CSSF's FAQ on virtual assets – Credit institutions


In brief

On 23 December 2021 (as updated on the 4 January 2022), the CSSF issued a second FAQ on virtual assets’ (VAs)* considerations dedicated to Credit Institutions (CIs). This FAQ provides further clarity on:

  1. Investment in VAs and the opening of current accounts denominated in VAs;

  2. Registration/notification requirements to provide VAs services in Luxembourg;

  3. CSSF expectations if specialised VAs players are used, specifically for VAs’ custody arrangements;

  4. Investors information requirements when providing VAs services;

  5. Operational requirements to comply with when transacting in VAs or offering VAs services;

  6. Investment funds depositary context.

*Virtual Assets are defined in article 1 (20b) of the law of 12 November 2004, on the fight against money laundering and terrorist financing, as amended.

In details

Long awaited by the banking industry, the FAQ clarifies that:

1. CIs can invest directly into VAs with careful consideration of accounting and capital requirements. As stated by the former FAQ,  IAS 38 (International Accounting Standard) – Intangible assets – has been retained unless the VAs qualify for cash or financial instrument accounting treatment. As updated on the new FAQ, particular attention shall be given to the 1250% risk weighting under CRR (Capital Requirements Regulation).

2. CIs are allowed to open accounts for customers to deposit their VAs (securities account like), this refers to safekeeping virtual assets on behalf of customers. However, as of today, CIs are neither allowed to open bank accounts denominated in VAs (current account like) nor can they facilitate or execute payment in VAs.

  • As a reminder, any CIs wishing to offer VAs services, such as safekeeping or others, are required to first get registered as a VASP (Virtual Assets Service Provider) in Luxembourg by submiting and presenting a comprehensive business case to the CSSF. All details are available here.

3. When using VAs specialised players (such as crypto-exchanges or specialised crypto-asset custody providers), CIs are reminded about the importance of proper due diligence, as well as the importance of managing concentration risk.

  • A key consideration in such a setup is whether or not the counterparty risk vis-à-vis the VAs specialised player is effectively and contractually transferred to CIs customers. This will directly impact the responsibility and compensation requirements of the CI towards its customers in case of damage (VAs loss or theft due to security breach for example), as well as its compliance duties in terms of exposure limits framework (CRR)."VAs loss or theft through"

  • CIs envisaging direct safekeeping setup (as opposed to the model described here above) must engage discussion with CSSF beforehand.

4. From the investor protection perspective, and despite the fact that VAs do not meet the definition of financial instruments (and therefore do not fall under MIFID investor protection rules), the CSSF expects the setup of an investment protection framework by any CIs facilitating investment in VAs. Such framework shall cover guarantee of best execution, investments’ suitability/appropriateness checks, investor information (educational materials on related risks) and VAs’ holding reporting.

5. As general operational requirements for CIs offering VAs services or transacting in VAs, corresponding knowledge/competence/expertise, infrastructure and human resources at operational, control and management levels are de facto required.

6. With regards to the investment funds industry - AIFs investing directly or indirectly in VAs - it shall be noted that for those VAs qualifying as “other assets”, the depositary function is limited to safekeeping duties regarding ownership verification and record keeping (i.e. does not cover the VAs’ custody as such). Depending on whether the depository provides in-house custody of VAs or appoints a VAs specialised player in that respect, a VASP registration will/will not be required.

  • More specifically, in-house VAs’ custody services will trigger VASP registration and the restitution obligation will apply for those VAs held off-balance on behalf of customers. Alternatively, in case the VAs’ custody is performed by a VAs specialised players, no VASP registration is foreseen for the depositary, the VAs are not recognised off-balance sheet of the depositary and no restitution obligation applies as the liability is born by the VAs specialised player. The latter requires direct contractual relationship between the IFM/AIF and the VAs specialised player.

Which entities are concerned

  • Credit institutions

  • Depositary

  • Virtual assets service providers

What's next?

These formal clarifications will undoubtedly be warmly welcomed by market participants and shall drive further developments for the Luxembourg banking and asset management industries. However, knowing what is possible versus what is not is only the starting point, and numerous preliminary steps shall be taken when envisaging virtual asset services, among others:

  • Acknowledge and understand the breadth of the virtual assets universe and the dynamics of the ecosystem;

  • Identify addressable markets and define your positioning and business model;

  • Evaluate technological considerations and impact on operating model;

  • Ensure compliance with current and upcoming regulatory environment;

  • Design fit for purpose internal policies and procedures taking the specifics of virtual assets into account to ensure sound and sustainable business;

  • Elaborate and design sound investment strategies taking the full potential of virtual assets into account (i.e. yield enhancement features);

  • Obtain an unbiased view on key players in the space and perform due diligence on potential stakeholders with an emphasis and custody arrangements.

These are only some of the key areas to consider before entering this fascinating, yet complex and fragmented new ecosystem.

How we can help you

The Blockchain & Crypto-Assets team of PwC Luxembourg has developed a comprehensive suite of services to support you every step of the way in your virtual assets venture.