by Andria PapageorgiouCySEC Circular on EBA Guidelines: Enhancing Anti-Money Laundering Measures for Crypto-Asset Service Providers
We would like to draw your attention to Circular C640 (the “Circular”), issued by the Cyprus Securities and Exchange Commission (the “CySEC”) on the 26th of April 2024, for the purposes of informing Regulated Entities, as these defined therein, about European Banking Authority’s Guidelines amending Guidelines EBA/2021/02 on customer due diligence and the factors credit and financial institutions
should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions under Articles 17 and 18(4) of Directive (EU) 2015/849 – Guidance to crypto-asset service providers to effectively manage their exposure to ML/TF risks
On January 16, 2024, the European Banking Authority (EBA) extended its Guidelines on ML/TF risk factors to CASPs, signifying a significant stride in the EU’s efforts to combat financial crime. The new Guidelines (EBA/GL/2024/01) underscore ML/TF risk factors and mitigating measures that CASPs need to adopt, recognizing the potential abuse of CASPs for illicit financial activities.
The risks associated with CASPs are manifold, ranging from the rapidity of crypto-asset transfers to the anonymity features embedded in certain products, heightening the susceptibility to ML/TF activities. Hence, CASPS must grasp these risks comprehensively and implement effective measures to mitigate them.
The amended Guidelines serve to equip CASPs with a framework for identifying these risks, offering a non-exhaustive list of factors indicating exposure to varying levels of ML/TF risk. By leveraging these risk factors, CASPs can gain insights into their customer base and pinpoint areas of vulnerability, thereby fine-tuning their mitigating measures, including the use of blockchain analytics tools.
Recognizing the interconnectedness of the financial sector, the Guidelines extend guidance to credit and financial institutions with CASPs as clients or exposure to crypto assets. This risk is exacerbated when institutions engage with unregulated crypto-asset service providers.
In essence, these Guidelines foster a unified understanding of ML/TF risks associated with CASPs and outline the requisite steps for CASPs and other financial institutions to manage these risks effectively. The amended Guidelines will come into effect on December 30, 2024.
In line with its overarching supervisory approach, CySEC urges all Regulated Entities to adhere to the Guidelines and demonstrate the appropriateness of their AML/CFT policies, controls, and procedures in light of identified ML/TF risks, thus ensuring robust measures to combat financial crime.
Should you have any further questions, please do not hesitate to contact us at [email protected].
Disclaimer: The information contained in this article is provided for informational purposes only, and should not be construed as financial or investment or legal advice on any matter. Andria Papageorgiou Law Firm is not responsible for any actions (or lack thereof) taken as a result of relying on or in any way using information contained in this article and in no event shall be liable for any damages resulting from reliance on or use of this information.
by Andria PapageorgiouHow to Register with CySEC as a Crypto Asset Service Provider (CASP)?
The Cyprus Securities and Exchange Commission (CySEC) functions as the autonomous regulatory body overseeing the investment services market, collective investment, asset management sectors, as well as crypto-asset activities within and beyond the Republic of Cyprus. CySEC’s mission is to position the Cyprus securities market as a premier destination for investment, renowned for its security, reliability, and attractiveness.
Acting as the national authority responsible for Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT), CySEC governs Crypto-Asset Services Providers (CASP) offering services within or from Cyprus.
On September 13th, 2021, the CySECreleased a Policy Statement concerning the Registration and Operations of CASP. This statement details the registration criteria and offers further guidance on the process for becoming a registered CASP.
Submission of an application for registration in the Register of CASP:
For a complete application, the below information will be needed:
- The name, trade name, legal form and legal entity identifier of the CASP;
- the physical address of the CASP;
- the services provided and/or the activities that the CASP may carry out as defined below.
- the website of the CASP.
- the crypto-assets’ addresses of the CASP;
- the crypto-assets in relation to which the CASP provides services or exercises activities;
- the types of clients the CASP services;
- information as to whether the CASP offers payment services in crypto-assets;
- information as to whether the CASP operates crypto-assets ATMs, the number and the exact location thereof;
- the geographic jurisdictions in which the CASP operates; and
- information as to whether the CASP is registered or supervised in any other jurisdiction.
The documents and data are submitted in the official language of the Republic or in English and are originals or, where this is not possible, they are true copies of the originals. In case that the documents and data are produced in a language other than the official language of the Republic or in English, their true translation is also submitted.
List of Forms and Questionnaires for registration:
- Form 188-01: Application for CASP Registration and for Amendment of Registration;
- Form 188-02: Personal Questionnaire for CASP Beneficiaries – Natural Persons;
- Form 188-03: Personal Questionnaire for CASP Beneficiaries who are Legal Persons;
- Form 188-04: Personal Questionnaire for CASP Beneficiaries who are Trusts;
- Form 188-05: Personal Questionnaire for Persons Holding a Management Position;
- Form 188-06: List of Persons Holding a Management Position;
- Form 188-07: NotificationForm for EEA CASPs.
Crypto Asset Services:
Crypto Asset Service Providers are able to operate through varying business models due to the different combinations of crypto-asset activities and services that can be generated, based on the company’s business plan and vision. CASP are categorised into three classes according to the crypto-asset services offered:
| CASP Class | Crypto Asset Services |
|---|---|
|
Class 1
|
• Provision of investment advice
|
| Class 2 | • Provision of investment advice
And/or any of the below: • Reception and transmission of client orders
|
| Class 3 | • Provision of investment advice
And/or any of the below: • Reception and transmission of client orders Plus any of the below: • Administration, transfer of ownership, transfer of site, holding, and/or safekeeping, including custody, of crypto assets or cryptographic keys or means enabling control over crypto assets |
Initial Capital Requirements:
The initial capital requirements differ depending on the various classes of CASPs, as outlined in the table provided below.
| CASP Class | Initial Capital Requirements |
|---|---|
| Class 1 | 50,000 EUR |
| Class 2 | 125,000 EUR |
| Class 3 | 150,000 EUR |
Board of Directors:
In the case of the Board of Directors, the Board of Directors of the applicant is comprised of at least 4 persons who meet certain requirements (i.e. good reputation, experience, skills, etc.), 2 of which must direct the business activities of the CASP and 2 must be independent members.
Required Policies:
- Business Plan;
- Anti-Money Laundering Manual;
- Internal Operations Manual (IOM);
- Travel Rule Book;
- Remuneration Policy;
- Corporate Governance (if not included in the IOM);
- Business Continuity Plan and Disaster Recovery Policy;
- Outsourcing Policy (if not included in the IOM);
- Accounting Procedures (if not included in the IOM);
- Risk Management Policy;
- IT and Security Policies;
- Complaints’ Handling Policy;
- Legal Documents which will be accessible and available at all times on the website of the CASP licensed entity (i.e. Terms and Conditions).
Applications Fees:
Fees payable to the Cyprus Securities and Exchange Commission for the examination of the registration application are standard and independent of the services intended to be offered. The fee is 10,000 EUR. Where the application for the CASP registration is approved the CASP is not required to pay any additional fees to CySEC for the first year of its registration.
Annual Fees:
Annual fees payable to the Cyprus Securities and Exchange Commission for the renewal of the CASP registration for one year, are standard and independent of the services offered by the CASP. The applicable fee is 5,000 EUR from year 2 onwards.
Licensing Timeframe:
Although the relevant regulatory framework specified that CySEC shall inform the applicable within 6 months from the submission of a fully completed application, in our experience, the CASP registration procedure can be concluded in 12 months, in anticipation of CySEC’s varying workload and the applicant’s preparedness on reverting back with the information and documents requested.
Andria Papageorgiou Law Firm:
Our Firm comprises top-tier professionals dedicated to assisting both new and established CASPs offering crypto asset services in or from Cyprus with their registration process. Our team handles everything from gathering the necessary information to preparing and submitting a complete application package to CySEC, ensuring a smooth and efficient registration process on your behalf.
Once your registration is completed, our Firm stands ready to collaborate closely with you to ensure compliance with all regulatory obligations. We offer a wide array of post-registration services tailored to your specific needs.
Furthermore, for EEA-established CASPs already registered with their national competent authority, we assist in submitting the requisite notification form to CySEC, along with the necessary evidence regarding crypto asset services conducted or intended to be conducted in Cyprus.
It’s worth noting that our Law Firm has extensive experience in CASP registration, having successfully achieved the registration of a CASP-licensed entity, placing among the first 10 entities with a CASP license.
Should you have any further questions, please do not hesitate to contact us at [email protected].
Disclaimer: The information contained in this article is provided for informational purposes only, and should not be construed as financial or investment or legal advice on any matter. Andria Papageorgiou Law Firm is not responsible for any actions (or lack thereof) taken as a result of relying on or in any way using information contained in this article and in no event shall be liable for any damages resulting from reliance on or use of this information.