Virtual Assets
The terms “Virtual asset” and “Virtual asset service provider” originate from the Financial Action Task Force (the “FATF”) “Recommendation 15 – New Technologies” (the “FATF Recommendation 15”) annexed to the FATF Guidance on Virtual assets and VASP (the “FATF Guidance”). These documents were published for the first time back in 2015 and were subsequently modified in 2019 and 2021.
Who can become a VASP ?
The VASP definition is a functional definition, meant to be applied based on an assessment of whether a person undertakes functions of a VASP and provides a qualifying service.
A person may be a VASP if it carries out one or more of the five categories of activity or operation described in the VASP service definition.
However, the VASP definition is subsidiary to others, in order to avoid repetition or overlap. In other words, the definition of VASP only applies to persons that are not covered elsewhere by other applicable legal or regulatory provisions .
It excludes, for example, financial institutions and designated non-financial businesses and professions providing their traditional services with no relation to Virtual assets.
That being said, FATF definitions are a “guidance” which implies that the VASP definition must be interpreted broadly and may vary according to jurisdictions.
What services are provided by a VASP ?
According to FATF guidance a VASP is any person providing, on behalf of or for its customer, one or more of the following services:
- exchange between virtual assets and fiat currencies, including the exchange between virtual currencies and fiat currencies;
- exchange between one or more forms of virtual assets;
- transfer of virtual assets;
- safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets, including custodian wallet services;
- participation in and provision of financial services related to an issuer’s offer and/or sale of virtual assets.
VASP registration requirements
VASPs must apply for a license or registration in the jurisdiction(s) in which they are formed.
When a VASP is a natural person, that person must apply for a license or registration in the jurisdiction where its business is located. As a result, VASPs that are established or provide services in Luxembourg must be registered in the financial sector regulator’s (the “CSSF”) register of virtual asset service providers.
An EU member State does not have to impose a separate licensing or registration requirement on natural or legal persons who are already licensed or registered as financial institutions in that State and are permitted to engage in VASP activities under such license or registration. However, in Luxembourg, any entity offering or intending to offer any VASP services, including those already licensed/registered by a competent authority and, in particular, licensed financial institutions, must first register as a VASP.
VASPs that offer products and/or services to customers in their own jurisdiction or conduct operations from that jurisdiction may need to be licensed or registered in that other jurisdiction. According to the regulator (CSSF) the registration required in Luxembourg for persons providing relevant Virtual assets activities or operations listed in the VASP definition is “without prejudice to any other license/registration or other status required either in Luxembourg or by other European or third countries for any other activities performed by the applicant”
Therefore, VASPs must comply with the requirements of the different jurisdictions where they intend to provide their services and seek a license or registration therein.
How to register as a Luxembourg VASP
In most cases, the VASP registration process begins with a meeting at the CSSF headquarters. If the applicant submits a formal registration file to the CSSF, all required documents and information must be included.
In the case of an AIF, the CSSF may also expect each AIF initiator intending to invest in Virtual Assets to present its project to the CSSF ahead of time.
Documents and information must be submitted to the CSSF in advance, exclusively electronically via a specific system. Obviously, submission does not imply automatic registration.
Following submission, the CSSF will review the registration file. It may communicate with the applicant and arrange meetings with it. The CSSF verifies the legal requirement for the applicant’s professional standing (“fit & proper”) of the persons performing management functions within the VASP as well as the VASP beneficial owners. During the registration process, the CSSF may request additional information/documents.
The registration will take place once the CSSF has completed its analysis and made a formal registration decision. The entity information is then published in a public register created, kept, and maintained by the CSSF. If the VASP’s activities change significantly after registration, the registered VASP must notify the CSSF in writing, right away.
Required information to register as a Luxembourg VASP
Depending on whether the applicant is a natural or a legal person, it must provide the following information with its registration request:
Natural person
- Name and the first name(s);
- Precise private or professional address ;
- The service(s) provided falling under one or more of the VASP services referred in the VASP definition;
- A description of the money laundering and terrorist financing risks to it will be exposed and the internal control mechanisms it established in order to mitigate these risks and to comply with the professional obligations defined in the AML/CFT Law and in Regulation (EU) 2015/847.
Legal person
- Name (dénomination sociale);
- Precise address of the central administration;
- A description of the activities performed, in particular, a list of the types of virtual asset services and their relevant qualification;
- A description of the money laundering and terrorist financing risks to which it will be exposed and the internal control mechanisms it established in order to mitigate these risks and to comply with the professional obligations defined in the AML/CTF Law and in Regulation (EU) 2015/847.
The CSSF may request complementary documents and information. Regarding an AIF that is investing in virtual assets, the CSSF may namely request the following:
- A description of the project and of the activities performed;
- A description of the different services providers/delegates involved;
- Information on whether or not the investments in virtual assets will be made directly or indirectly (by the means of derivatives for example);
- An updated risk management policy including in particular how the risks in relation to the virtual assets are managed;
- An updated valuation policy including the rules as to how the value of the virtual assets will be determined;
- A description regarding the experience of the portfolio manager (and other involved entities in the investment management process) in virtual assets;
- A description of how the custody of the assets will be organised by the depositary;
- Information regarding the targeted investors, as well as any information on the distribution channels of the AIF;
- The AML/CFT analysis performed by the AIFM on the assets side (CSSF, FAQ Virtual Assets – Undertakings for collective investment, Q.3, p. 4).
The VASP applicant must also notify to the CSSF the persons (at last two persons) responsible for the VASP management and entitled to effectively determine the policy of the business. In this regard, the VASP must justify the professional standing (“fit & proper”) of these persons as well as of its beneficial owners, which will be assessed by the CSSF on the basis of criminal records and of any evidence demonstrating that these persons are of good repute and offer every guarantee of irreproachable business conduct.
