Cap. 647 Art. 27Provision of crypto-asset services by certain financial entities.

(1) The provisions of this article shall only apply where

Malta is the home Member State.

(2) A credit institution may provide crypto-asset services if it notifies the information referred to in sub-article (9) to the competent authority at least forty (40) working days before providing such services for the first time.

(3) A central securities depository authorised under Regulation

(EU) No. 909/2014 shall only provide the custody and administration of crypto-assets on behalf of clients if it notifies the information referred to in sub-article (9) to the competent authority at least forty

(40) working days before providing such service for the first time:

Provided that for the purposes of this sub-article, the provision of the custody and administration of crypto-assets on behalf of clients shall be deemed equivalent to providing, maintaining or operating securities accounts in relation to the settlement service referred to in point (3) of Section B of the Annex to Regulation (EU) No. 909/2014.

(4) An investment firm may provide crypto-asset services in the European Union equivalent to the investment services and activities for which it is specifically authorised under Directive 2014/ 65/EU if it notifies to the competent authority the information referred to in sub-article (9) at least forty (40) working days before providing such services for the first time:

Provided that for the purposes of this sub-article:

(a) the provision of the custody and administration of crypto-assets on behalf of clients shall be deemed equivalent to the ancillary service as referred to in point (1) of Section B of Annex I to Directive 2014/65/EU;

(b) the operation of a trading platform for crypto-assets shall be deemed equivalent to the operation of a multilateral trading facility and operation of an organised trading facility as referred to in points (8) and (9) respectively, of Section A of Annex I to Directive 2014/65/EU;

(c) the exchange of crypto-assets for funds and other crypto-assets shall be deemed equivalent to dealing on own account as referred to in point (3) of Section A of Annex I to Directive 2014/65/EU;

(d) the execution of orders for crypto-assets on behalf of clients shall be deemed equivalent to the execution of orders on behalf of clients as referred to in point (2) of Section A of Annex I to Directive 2014/65/EU;

(e) the placing of crypto-assets is deemed equivalent to the underwriting or placing of financial instruments on a firm commitment basis and placing of financial instruments without a firm commitment basis as referred to in points (6) and (7) respectively, of Section A of Annex I to Directive 2014/65/EU;

(f) the reception and transmission of orders for crypto- assets on behalf of clients shall be deemed equivalent to the reception and transmission of orders in relation to one or more financial instruments as referred to in point (1) of Section A of Annex I to Directive 2014/65/EU;

(g) providing advice on crypto-assets shall be deemed equivalent to investment advice as referred to in point

(5) of Section A of Annex I to Directive 2014/65/EU; and

(h) providing portfolio management on crypto-assets shall be deemed equivalent to management of investments as referred to in point (4) of Section A of Annex I to Directive 2014/65/EU.

(5) An electronic money institution authorised in accordance with Directive 2009/110/EC shall only provide the custody and administration of crypto-assets on behalf of clients and transfer services for crypto-assets on behalf of clients with regard to the e-money tokens it issues, if it notifies the competent authority w i t h the information referred to in sub-article (9) at least forty (40) working days before providing those services for the first time.

(6) A UCITS management company or an alternative investment fund manager may provide crypto-asset services equivalent to the management of portfolios of investment and non-core services for which it is authorised in accordance with Directive 2009/65/ EC or Directive 2011/61/EU if it notifies the competent authority with the information referred to in sub-article (9) at least forty (40) working days before providing those services for the first time:

Provided that for the purposes of this sub-article:

(a) the reception and transmission of orders for crypto- assets on behalf of clients shall be deemed equivalent to the reception and transmission of orders in relation to financial instruments as referred to in point (b)(iii) of Article 6(4) of Directive 2011/61/EU;

(b) providing advice on crypto-assets shall be deemed equivalent to investment advice as referred to in point (b)(i) of Article 6(4) of Directive 2011/61/EU and in point (b)(i) of Article 6(3) of Directive 2009/65/EC;

(c) providing portfolio management on crypto-assets shall be deemed equivalent to the services as referred to in point

(a) of Article 6(4) of Directive 2011/61/EU and in point (a) of Article 6(3) of Directive 2009/65/EC.

(7) A market operator authorised in accordance with Directive 2014/65/EU may operate a trading platform for crypto-assets if it notifies the competent authority with the information referred to in sub-article (9) at least forty (40) working days before providing such services for the first time.

(8) Notwithstanding the provisions of sub-articles (2) to (7), the entities referred to in the said sub-articles shall not be required to submit any information referred to in sub-article (9) that was previously submitted by them to the competent authority where such information would be identical:

Provided that when submitting the information referred to in sub-article (9), the entities referred to in sub-articles (2) to (7) shall expressly state that any information that was submitted previously is still up-to-date.

(9) Without prejudice to the provisions of Article 60(13) and

(14) of the MiCA Regulation, for the purposes of sub-articles (2) to

(7) the following information shall be notified to the competent authority:

(a) a programme of operations setting out the types of crypto-asset services that the applicant intends to provide, including where and how those services are to be marketed;

(b) a description of:

(i) the internal control mechanisms, policies and procedures to ensure compliance with the provisions of national law transposing Directive (EU) 2015/849;

(ii) the risk assessment framework for the management of money laundering and terrorist financing risks; and

(iii) the business continuity plan;

(c) the technical documentation of the ICT systems and security arrangements, and a description thereof in non-technical language;

(d) a description of the procedure for the segregation of clients’ crypto-assets and funds;

(e) a description of the custody and administration policy, where it is intended to provide custody and administration of crypto-assets on behalf of clients;

(f) a description of the operating rules of the trading platform and of the procedures and system to detect market abuse, where it is intended to operate a trading platform for crypto-assets;

(g) a description of the non-discriminatory commercial policy governing the relationship with clients as well as a description of the methodology for determining the price of the crypto-assets they propose to exchange for funds or other crypto-assets, where it is intended to exchange crypto-assets for funds or other crypto-assets;

(h) a description of the execution policy, where it is intended to execute orders for crypto-assets on behalf of clients;

(i) evidence that the natural persons giving advice on behalf of the applicant or managing portfolios on behalf of the applicant have the necessary knowledge and expertise to fulfil their obligations, where it is intended to provide advice on crypto-assets or provide portfolio management on crypto-assets;

(j) whether the crypto-asset service relates to asset-referenced tokens, e-money tokens or other crypto-assets; and

(k) information on the manner in which such transfer services shall be provided, where it is intended to provide transfer services for crypto-assets on behalf of clients.

(10) The competent authority shall, within twenty (20) working days of receipt of such notification as referred to in sub-articles (2) to (7), assess whether all required information has been provided.

(11) Where the competent authority concludes that a notification as referred to in sub-articles (2) to (7) is not complete, it shall immediately inform the notifying entity thereof and set a deadline by which that entity is required to provide the missing information:

Provided that the deadline for providing any missing information shall not exceed twenty (20) working days from the date of the request and, until the expiry of the said deadline, each period as set out in sub-articles (2) to (7) shall be suspended:

Provided further that the crypto-asset service provider shall not begin providing the crypto-asset services as long as the notification referred to in sub-articles (2) to (7) is incomplete.

(12) Without prejudice to sub-article (11), any further request by the competent authority for completion or clarification of the information provided in terms of this article, shall be at its discretion but shall not result in a suspension of the period set out in sub-articles

(2) to (7).