CSSF's FAQ on virtual assets – Credit institutions

Long awaited by the banking industry, the FAQ clarifies that:

1. CIs can invest directly into VAs with careful consideration of accounting and capital requirements. As stated by the former FAQ,  IAS 38 (International Accounting Standard) – Intangible assets – has been retained unless the VAs qualify for cash or financial instrument accounting treatment. As updated on the new FAQ, particular attention shall be given to the 1250% risk weighting under CRR (Capital Requirements Regulation).

2. CIs are allowed to open accounts for customers to deposit their VAs (securities account like), this refers to safekeeping virtual assets on behalf of customers. However, as of today, CIs are neither allowed to open bank accounts denominated in VAs (current account like) nor can they facilitate or execute payment in VAs.

• As a reminder, any CIs wishing to offer VAs services, such as safekeeping or others, are required to first get registered as a VASP (Virtual Assets Service Provider) in Luxembourg by submiting and presenting a comprehensive business case to the CSSF. All details are available here.

3. When using VAs specialised players (such as crypto-exchanges or specialised crypto-asset custody providers), CIs are reminded about the importance of proper due diligence, as well as the importance of managing concentration risk.

• A key consideration in such a setup is whether or not the counterparty risk vis-à-vis the VAs specialised player is effectively and contractually transferred to CIs customers. This will directly impact the responsibility and compensation requirements of the CI towards its customers in case of damage (VAs loss or theft due to security breach for example), as well as its compliance duties in terms of exposure limits framework (CRR)."VAs loss or theft through"

• CIs envisaging direct safekeeping setup (as opposed to the model described here above) must engage discussion with CSSF beforehand.

4. From the investor protection perspective, and despite the fact that VAs do not meet the definition of financial instruments (and therefore do not fall under MIFID investor protection rules), the CSSF expects the setup of an investment protection framework by any CIs facilitating investment in VAs. Such framework shall cover guarantee of best execution, investments’ suitability/appropriateness checks, investor information (educational materials on related risks) and VAs’ holding reporting.

5. As general operational requirements for CIs offering VAs services or transacting in VAs, corresponding knowledge/competence/expertise, infrastructure and human resources at operational, control and management levels are de facto required.

6. With regards to the investment funds industry - AIFs investing directly or indirectly in VAs - it shall be noted that for those VAs qualifying as “other assets”, the depositary function is limited to safekeeping duties regarding ownership verification and record keeping (i.e. does not cover the VAs’ custody as such). Depending on whether the depository provides in-house custody of VAs or appoints a VAs specialised player in that respect, a VASP registration will/will not be required.

• More specifically, in-house VAs’ custody services will trigger VASP registration and the restitution obligation will apply for those VAs held off-balance on behalf of customers. Alternatively, in case the VAs’ custody is performed by a VAs specialised players, no VASP registration is foreseen for the depositary, the VAs are not recognised off-balance sheet of the depositary and no restitution obligation applies as the liability is born by the VAs specialised player. The latter requires direct contractual relationship between the IFM/AIF and the VAs specialised player.

• Credit institutions

• Depositary

• Virtual assets service providers