The crypto custody business is a novelty and a German singularity. In the course of the implementation of the 5th Money Laundering Directive into German law, legislation has defined the term cryptoasset and included the crypto custody business as a new financial service in the German Banking Act. Whoever engages in crypto custody business requires a licence in Germany pursuant to Section 32 KWG.
What is crypto custody business?
Custody, management, and protection of cryptoassets or private cryptographic keys which are used to keep, store or transfer cryptoassets for others constitute the provision of a crypto custody business. This means in detail:
A cryptoasset is the digital representation of a value that has not been issued or guaranteed by any central bank or public body. In addition, it must be used by natural or legal persons as a means of exchange or payment or for investment purposes and must be transferred, stored and traded electronically.
However, the definition excludes fiat money (i.e. money that is used as legal tender) and e-money, as well as monetary assets that would be deemed e-money but are not due to an exemption (e.g. limited network, limited product range).
A private cryptographic key is used to keep, store, or transfer cryptographic values. While the public key of a cryptowallet, as the name suggests, is also publicly known, it is usually not the case with private keys, as cryptoassets can only be transferred from one user to another with a private key.. Due to this extensive control over cryptoassets by means of a private key the custody, management or protection of private keys is equivalent to the custody, management, or protection of cryptoassets.
The custody, management or protection must be provided for others. The owner of cryptoassets is therefore not covered by the definition. According to BaFin, however, the issuer of cryptoassets can be.
Custody within the meaning of this provision means taking care of cryptoassets as a service for third parties. Typically, these are service providers which hold cryptoassets for their customers collectively. Management broadly means ongoing fulfilment of the rights resulting from the cryptoassets. Finally, protection means both the digital storage of third parties’ private cryptographic keys and safekeeping of physical data media (e.g. a piece of paper on which the private key is written).
Who needs a license?
Anyone who operates a crypto custody business in Germany on a commercial basis or to an extent that requires a commercially organized business requires the prior authorization of BaFin. The threshold to commercial status is already very low, because it is sufficient if the business has been established for a certain period of time (thus excluding one-time services) and if the operator is pursuing this business in order to generate a profit (the intention is sufficient, there is no need to actually make profit).
In addition, the business must be operated in Germany. This means that any legal entities or natural persons whose registered office or habitual residence is located within the Federal Republic of Germany needs to obtain a license, even if the service is only offered to customers outside of Germany. The same applies vice versa: legal entities or natural persons from abroad who do not have a physical presence in Germany, but whose services are offered on the German market that meet the definition of crypto custody business, require an authorization.
No passporting
And this is an issue: the crypto custody business is an invention of the German legislator and there is no equivalent in other EU countries. The authorization for a crypto custody business does not imply authorization for cross-border business (as is the case with payment services, for example). This means that a foreign crypto custodian addressing the German market necessarily has to set up a branch in Germany and has to obtain a license from BaFin.
The future – commendable or misguided?
It remains to be seen whether the crypto custody business will be a German aberration or a European model. Currently, it will is a bit confusing because the proposal for a Regulation on Markets in Cryptoassets (MiCa) does contain an authorization regime but the definition of cryptoassets of the MiCa is not consistent with the German Banking Act (KWG).
While there is no certainty in that matter, watch out not to inadvertently conduct a crypto custody business. Or for that matter any of the other financial services within the meaning of the KWG, that have been presented in the previous articles. Because the classification of cryptoassets as financial instruments within the meaning of Section 1 (11) KWG entails the need to examine whether, in addition to the crypto business, there is also for example an investment or acquisition brokerage service.
For more information: BaFiN Guidance notice on crypto custody business (https://www.bafin.de/SharedDocs/Veroeffentlichungen/EN/Merkblatt/mb_200302_
LINK TO THE HOMEPAGE OF THE FINTECH ONLINE COURSE
Cover picture: Copyright © Adobe/ sutthinon602
