This article was updated on December 13, 2019 with information about further BaFin guidance on the application procedure.

On November 29, 2019, the German legislator adopted new rules on crypto assets. The new rules have been adopted as part of the implementation of Directive (EU) 2018/843 of 30 May 2018 (5th AML Directive). Under the 5th AML Directive, the domestic law of EU member states has to provide that custodian wallet providers are subject to anti-money laundering requirements. In this context, “custodian wallet providers” are defined as entities that provide services to safeguard private cryptographic keys on behalf of their customers, to hold, store and transfer virtual currencies.¹ Rather than amending the German Anti-Money Laundering Act (Geldwäschegesetz (GWG)), the German legislator has decided to take a much broader approach. The new law contains, amongst others, changes to the German Banking Act (Kreditwesengesetz (KWG), which provide that:

1. crypto assets qualify as financial instruments;
2. trading with crypto assets and the custody of crypto assets as a service for others require a license from the German Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)) as a bank or as an investment firm;
3. entities that provide no other financial services than custody are exempted from certain rules that apply to other investment firms.

Crypto assets qualify as financial instruments

Whether or not crypto assets qualify as financial instruments has a significant impact on the applicable regulatory framework. If crypto assets qualify as financial instruments, entities trading with such assets or providing custody services with respect to them may require a license as a bank or an investment firm. Banks and investment firms must also comply with regulatory requirements such as capital requirements and anti-money laundering requirements.

The qualification of crypto assets as financial instruments was disputed in the past. The BaFin took the view that utility tokens did not qualify as financial instruments. However, according to the BaFin, investment tokens qualify as securities, which fall under the definition of financial instruments pursuant to the German Banking Act³. The BaFin also took the view that currency tokens qualify as “units of account” (Rechnungseinheiten), which also falls under the definition of financial instruments pursuant to the German Banking Act.² A decision by the district court (Kammergericht) of Berlin dated October 19, 2018, opposed this view and held that payment tokens did not qualify as financial instruments; however, this decision had no impact on BaFin’s administrative practice.
The new law defines crypto assets as “the digital representations of a value that has not been issued or guaranteed by any central bank or public authority and that does not have the legal status of currency or money, but which is accepted as a means of exchange or payment or for investment purposes by any person or entity on the basis of an agreement or according to market practice, and which can be transmitted, stored and traded electronically”.⁴

This definition is rather broad and can include utility tokens, investment tokens, payment tokens, as well as hybrids thereof. 

Licensing requirements for the custody of crypto assets

The new rules also include a licensing requirement for the safeguarding, the administration and the securing of crypto assets as a service for others. According to the legislative reasoning, “safeguarding” means that the service provider saves crypto assets of the customers in a collective account to which the customers have no key. The “administration” of crypto assets means the exercising of rights arising from the crypto assets (such as voting rights). The “securing” of crypto assets includes the securing of the private key of the customers as well as the securing of physical media on which such keys are recorded. This does not apply to the mere offering of storage capacity (such as webhosts or cloud storages), provided that such storage space is not explicitly offered for the securing of private keys. 

Thus, custodian wallet providers will be subject to license requirements if they offer their services in Germany. According to German banking law, the offering of services “in Germany” does not require a physical establishment in Germany. Any activity by which an entity incorporated or resident outside Germany solicits business from persons in Germany is regarded as the offering of services in Germany. Only if the German customer contacts the service provider without having been solicited to do so, the service provider will not be deemed to conduct the custody business in Germany (so-called “reverse solicitation”). If services are provided on the Internet, there is often only a thin line between soliciting customers in Germany and reverse solicitation.

Requirements for a license for the crypto asset business

Entities that require a license only for the crypto asset business, but not for any other type of banking business or financial service, will have to comply, inter alia, with the following requirements:

• an initial capital of €125,000;
• the management must have sufficient experience and be reliable;
• the firm must have a proper business organization (this includes the rules applicable to outsourcing and risk management as well as IT security which apply to banks and other investment firms);
• certain notification requirements (i.e. if the capital falls below certain thresholds or if managing directors resign or are appointed. 

Entities that provide no licensable services other than the custody of crypto assets are exempted from a number of regulatory requirements that generally apply to investment firms.⁵ This mainly applies to certain requirements related to capital buffers⁶ and liquidity and regulatory capital requirements under the Banking Act⁷ and the CRR⁸.

Further licensing requirements

Since the legislator has now clarified that crypto assets qualify as financial instruments, any banking business or financial service relating to financial instruments will require a license if such a banking business or financial service is conducted or provided in relation to crypto assets. 

For example, the operation of a multilateral trading system (MTF) that brings together multiple third-party buying and selling interests in financial instruments according to non-discretionary rules, qualifies as a licensable investment service.⁹ Depending on their specific set-up, it is likely that some crypto asset trading platforms may qualify as MTFs. 

In addition, the purchase and sale of financial instruments as an agent for others qualifies as a licensable banking business or financial service. Thus, if such activity is conducted with respect to crypto assets, the service provider will have to obtain a license as a bank or investment firm.

Pure proprietary trading, which is not provided as a service for others, does not qualify as a licensable business. However, it should be noted that own account trading that is conducted with a view to purchasing and selling crypto assets to customers does not qualify as proprietary trading and may therefore be subject to licensing requirements.

Changes in comparison with the draft rules

A draft version of the new rules¹⁰provided that entities that hold a license for the custody of crypto assets may not provide any other licensable business. This would have meant that, for example, an entity that holds a license for the operation of an MTF would have been excluded from offering the custody of crypto assets. This was mainly based on IT security considerations. The legislator was concerned that custodians of crypto assets would often be a target of hackers and that in case of a successful hack, not only the custody business but also other businesses of the same entity may be affected.¹¹ However, this strict separation rule was abandoned in parliament.

Transition periods

The new law will enter into force on January 1, 2020, subject to certain transition periods. Entities which require a license for the custody of crypto assets, or which require a license due to the extension of the definition of “financial instruments”, may notify the BaFin on or before March 31, 2020, of their intention to obtain a license. In such case, the license will be deemed to be awarded on a preliminary basis, provided that they will submit a complete application for a license no later than November 30, 2020. 

On December 4, 2019, the BaFin published further guidance on the application procedure. The BaFin also asked firms that intend to rely on the transition period to notify BaFin of such intention before January 1, 2020 on an informal basis. However, this notification is voluntary and does not affect the aforementioned deadline for the formal notification.

Firms that provide custody services with respect to crypto assets or other services related to crypto assets are advised to consider the implications of the new rules, in particular whether they need to obtain a license. Please note the deadline of March 31, 2020, for indicating the intention to obtain such a license to the BaFin. Please also note the deadline of November 30, 2020, for the submission of a complete application for a license. Although about one year from now, it should be noted that the preparation of a complete application may require a considerable amount of time and effort. 

1. Art. 3 para. 19 of Directive 2015/849 as amended by the 5th AML Directive.↩
2. Furthermore, investment tokens may qualify as can be as “transferrable securities” and therefore also as financial instruments pursuant to Directive 2014/65/EU (MiFID II), depending on their features. ↩
3. Traditionally, “units of account” have been interpreted as payment instruments such as the special drawing rights under the International Monetary Fund regime.↩
4. The definition also explicitly excludes e-money and payment instruments that entitle its holder to the acquisition of a limited range of goods or services only or certain payment services that are offered by the provider of electronic communication services. ↩
5. Section 2 para. 7b of the Banking Act.↩
6. Sections 10c to 10i of the Banking Act↩
7. Section 11 of the Banking Act.↩
8. Articles 411 to 455 of the CRR.↩
9. Section 1 para. 1 sentence 1 no. 1b) of the Banking Act, which implements no. 8 of Annex I, Section A of Directive 2014/65/EU (MiFID II).↩
10. Section 32 para. 1g) of the Banking Act in the version of the government draft (Regierungsentwurf), BT-Drucks. 19/13827.↩
11. BR-Brucks. 352/19, p. 124.↩