Crypto Custody as Regulated Financial Service with MiCAR and KWG License Requirement
Crypto custody is one of the most important services offered by service providers in the crypto market. From a technical point of view, crypto assets can in principle be held in custody by users themselves, so that the involvement of a service provider for crypto custody is not absolutely necessary. However, there are numerous constellations, particularly in the professional handling of crypto assets, in which third-party custody can make sense. For example, many crypto exchange platforms offer their customers custody of the crypto assets tradable on the platform in addition to crypto trading. In Germany, crypto custody has already been regulated as a financial service in the KWG since the implementation of the fifth Money Laundering Directive in January 2020. Crypto asset service providers that want to hold crypto assets in custody for German customers therefore need a BaFin license for the crypto custody business prior to commencing business. On a European level, the Markets in Crypto Assets Regulation (MiCAR) also provides for the regulation of crypto custody as a crypto asset service. As of the coming into effect of MiCAR, crypto custodians will therefore require a MiCAR license for their business operations throughout the EU.
License for Crypto Custody, Crypto Management and Safeguarding of Crypto Assets
In Germany, crypto custody requires a license in the case of the safekeeping, management or safeguarding of crypto assets or private keys that are used to hold, store or transfer crypto assets for others. According to the KWG, crypto custody thus includes three different variants, each of which requires a BaFin license to be obtained. According to BaFin’s administrative practice, crypto custody is deemed to be given if the crypto asset service provider holds in its custody the private keys associated with the customer’s crypto assets. In contrast, BaFin assumes crypto management if the crypto asset service provider continuously exercises rights from crypto assets for customers in the broadest sense. Finally, BaFin assumes that crypto assets are safeguarded if private keys are stored digitally or physically for customers. In all three cases, BaFin requires that the crypto asset service provider must actually have access to the customer’s private keys.
Content and Duration of the Licensing Procedures
In the licensing procedures for crypto custody, BaFin attaches great importance to the best possible IT security. BaFin’s focus is understandable, especially since crypto custody is usually a purely digitally offered financial service and if the private keys to the customers’ crypto assets are lost, they are irretrievably lost. In addition to flawless IT security, BaFin expects crypto custodians, like all supervised institutions, to have, among other things, a proper business organization, professionally fit and proper business directors, and sufficient capital resources to operate a functioning business model. As a general rule, diligent application preparation by a specialist lawyer can significantly shorten the duration of the licensing procedure. Licensing procedures for the acquisition of a BaFin license for crypto custody business should therefore be professionally planned and prepared under assistance of a law firm with sufficient experience in this field.
The competent lawyer for questions regarding Crypto Custody in our law firm is Attorney Lutz Auffenberg, LL.M (London).