An extract from The Virtual Currency Regulation Review, 3rd Edition

Introduction to the legal and regulatory framework

Malta remains at the forefront of the major developments taking place within the blockchain and cryptocurrency scene, both within the European Union and globally. In 2016, the Maltese government set up a Blockchain Taskforce to help create and implement a national blockchain strategy aimed at materialising the opportunities of distributed ledger technology (DLT) and of setting the necessary safeguards. This strategy eventually resulted in three new laws relevant to the sector being published in 2018: the Virtual Financial Assets Act, Chapter 590 of the Laws of Malta (the VFA Act), the Innovative Technology Arrangements and Services Act, Cap 592 of the Laws of Malta (ITASA), and the Malta Digital Innovation Authority Act, Cap 591 of the Laws of Malta (the MDIA Act).

Considering the size of Malta's gaming sector, it is natural to link this thriving sector to the future of DLT; Malta was a trailblazer in the gaming sector and in its regulation of gaming law, creating a robust framework wherein licensees can operate in a well-regulated and flexible atmosphere.

Malta has not only enacted three full pieces of legislation, but various stakeholders and authorities continue to release guidelines to assist in the application and implementation of these laws. For instance, the Malta Gaming Authority issued a position on virtual currencies and their adoption within the Maltese gaming context and has created a sandbox for the use of certain cryptocurrencies by MGA licensees. The Malta Financial Services Authority (MFSA) also issued three Rulebooks covering the role of virtual financial asset (VFA) agents, issuers of initial coin offerings (ICOs) and providers of crypto services, which it updates on a regular basis to reflect developments in this field. Following the coming into force of the VFA Act and the finalisation of the aforementioned Rulebooks, the MFSA approved the first batch of VFA agents and launched the application forms for prospective crypto services (VFA service providers) and issuers to respectively initiate the licensing process and white paper registration. In addition, the Financial Intelligence Analysis Unit (FIAU) recently issued Part II of the Implementing Procedures on the Application of Anti-Money Laundering and Countering the Funding of Terrorism Obligations to the Virtual Financial Assets Sector.

Securities and investment laws

Investment services rendered in relation to securities and financial instruments, whether traditional or dependent upon DLT, are regulated by the Maltese Investment Services Act, Chapter 370 of the Laws of Malta and the Markets in Financial Instruments Directive (MiFID). On the other hand, the VFA Act aims to regulate DLT assets, which are to be distinguished from financial instruments, electronic money and virtual tokens.

The VFA Act defines virtual tokens as a form of digital medium recordation whose utility, value or application is restricted solely to the acquisition of goods or services, either solely within a DLT platform on or in relation to which it was issued or within a limited network of DLT platforms. If a virtual token is or can be converted into another DLT asset type, it is treated as the DLT asset type into which it is or may be converted, unless its technical set-up prohibits the virtual token's conversion.

Electronic money is regulated in accordance with the Financial Institutions Act (Chapter 376 Laws of Malta) and specifically Directive 2009/110/EC of the European Parliament and of the Council of 16 September 2009 on the taking up, pursuit and prudential supervision of the business of electronic money institutions.

The term VFA is defined as any form of digital medium recordation that is used as a digital medium of exchange, unit of account or store of value, and that is not electronic money, a financial instrument or a virtual token. Thus, primarily, the VFA Act aims to regulate assets that do not fall within the parameters of traditional security legislation.

To offer legal clarity regarding this distinction, the MFSA created the Financial Instrument Test. The Test must be applied to each DLT asset (i.e., financial instruments, electronic money or virtual tokens dependant on DLT) to determine its nature and the respective applicable legal framework based on the token's features.

Once the type of DLT asset is determined, the following legal regime will be applicable:

  1. virtual tokens are not regulated by any specific body of law in Malta;
  2. financial instruments are defined as set out in the MiFID and thus regulated by financial services legislation;
  3. electronic money is regulated in Malta by the Financial Institutions Act; and
  4. VFAs are regulated by the VFA Act.

The Test is expected to be carried out compulsorily within the context of an ICO for VFAs, referred to as an initial VFA offering (IVFAO) by the issuer and his or her VFA agent. It must also be carried out by persons providing any service or performing any activity within the context of the VFA Act or traditional financial services legislation in relation to DLT assets whose classification has not been determined. Given that the type of DLT asset may change during its lifetime, the MFSA may at any time order the conduct of the Test again to obtain an update on the determination of a DLT asset. If the DLT asset is not issued in or from Malta, the Test must be conducted before any service involving the asset is provided in Malta.

If a DLT asset, such as a securitised token, is considered to be a financial instrument by the Financial Instrument Test, then it is to be regulated by financial services legislation. In this case, rather than conducting an IVFAO or ICO, the issuer would need to assess whether the security token offering qualifies as an offer to the public or not. If it is deemed to constitute an offer to the public, then a prospectus must be drafted and registered with the authority in line with the Prospectus Regulation. The MFSA has also issued feedback on a recent consultation process on the offering of tokens that classify as financial instruments. In the coming months, the MFSA will be collaborating with the Malta Business Registry to explore whether any provisions of the Companies Act require any amendments to clarify whether the registers of members and debenture holders can be kept in dematerialised form using DLT.

Banking and money transmission

When addressing the holding of cryptocurrencies between issuer and investor during the undertaking of a VFA service, the VFA Act makes reference to wallets.

The VFA Act addresses custodian and nominee services and defines them as a VFA service licensable under the Act. Under the VFA Act, acting as a custodian or nominee holder of VFAs or private cryptographic keys, or both, or if in conducting such activities the nominee is holding such assets or keys on behalf of another person, these are considered to be VFA services.

According to the VFA Act, an issuer must provide a detailed description of the issuer's wallet or wallets used in the white paper along with a description of the 'security safeguards against cyber threats to the underlying protocol, to any off-chain activities and to any wallets used by the issuer'. The Act thus addresses security measures that are paramount to the existence and reliability of a wallet. The Act does not impose any requirements in terms of the actual technology to be used when hosting such wallets, thus ensuring the intended neutrality of the law.

If a DLT asset is classified as electronic money, it continues to be regulated by the Financial Institutions Act, and ancillary rules and regulations.

The provision of banking services in relation to cryptocurrencies, and more specifically VFAs, continues to be regulated by financial services legislation through the Banking Act, and ancillary rules and regulations.