With this date fast approaching, and recent news of CASP applications needing more time to be processed, entities which were licensed under the current virtual asset service provider (VASP) regime are now turning to assessing the possibilities offered by the grandfathering provisions under MiCAR.
-
The main difference between VASP and CASP : passporting
The VASP regime, which originated by the FATF recommendation 15, and included by amendment of the law of 12 November 2004 on the fight against money-laundering and terrorism financing (the AML Law), was intended to give an initial regulatory framework to entities looking to offer such services, albeit limited to AML/CTF matters. This regime however does not stem from a EU legal framework, and is a purely national in scope.
A VASP licence, offering evidence of the entity's supervision by the CSSF, allows greater comfort to customers, especially for products targeting retail customers or consumers, as could often be the case with the larger names in the industry. Given the lack of any EU-wide legal framework, the VASP licence could not benefit from the advantages of EU law, including the principle of mutual recognition and the freedom of movement.
These principles – and the cooperation mechanisms between supervisory authorities - however underpin the passporting mechanism sought by non-EU firms to enter the EU market, where a licence in a member State authorises the entity to provide the same services in all other member States. The CSSF further confirmed in a Q&A on VASPs in August 2023 that no passporting is available, thus drawing VASPs and VASP candidates' attention to "the registration as a VASP with the CSSF [being] without prejudice to any requirements applicable in the other countries where a VASP provides its services or intends to provide its services", before concluding that a VASP must, therefore, assess the possibility to offer their services in each single member State they target.
In comparison, the CASP regime stemming from MiCAR builds upon the definition of the VASP with similar services but most importantly stems from EU law and allows, under article 59(7) MiCAR, for the passporting of the resulting license within the EU. A CASP licensed in Luxembourg may therefore provide such services freely for instance to Ireland without the need to meet any additional conditions, either through "right of establishment, including through a branch, or through the freedom to provide services."
With the end of the VASP regime, supervisory authorities in the EU have redirected first time VASP applicants to seek a CASP license directly earlier this year, with the CSSF making such announcement end of February 2024.
-
The transitional regime under MiCAR
Article 143(3) of MiCAR provides that CASPs which "provided their services in accordance with applicable law before 30 December 2024, may continue to do so until 1 July 2026", i.e., an 18-month period. Member States may however "decide not to apply the transitional regime for crypto-asset service providers provided for in the first subparagraph or to reduce its duration where they consider that their national regulatory framework applicable before 30 December 2024 is less strict than this Regulation."
Recital 114 of MiCAR however nuances this reduction or waiver should be used member States which "do not, at present, have in place strong prudential requirements for [CASP] currently operating under their regulatory frameworks."
In a draft bill of law (n°8387), amending the AML Law to implement MiCAR, the Luxembourg legislator confirmed its intention to keep the MiCAR grandfathering clause in relation to the VASPs. The bill aims at removing the VASP regime, whilst providing for a transitional regime in order to ensure that existing VASPs still comply with their obligations under the AML Law should they not obtain a CASP licence on 30 December 2024.
This transitional period, referred to as the "grandfathering clause", recognises the rights granted to certain entities in the past (i.e., the VASPs) for a period well after the programmed end of such rights.
-
The lack of passporting of the grandfathering?
It follows from the above that existing VASPs will be allowed to keep providing their services authorised under their VASP license until 1 July 2026. Two consequences should however be drawn.
First, services not covered by the existing VASP licence cannot be provided during this period, irrespective of whether the entity is currently seeking a CASP licence for such out-of-scope services.
Second, the VASP licence still does not benefit from any passporting. However, with MiCAR entering into application on 30 December 2024, so does the CASP licence requirement to provide the relevant services across the EU member State. A VASP in Luxembourg looking to provide services in the Netherlands will be met with the requirement of a CASP licence, and thus precluded from the provision of services.
Thus, unlike the CASP license, the grandfathered VASP licence under MiCAR does not benefit from any passporting.
One may wonder if it would not have been useful to extend the grandfathering provisions not only to a member State's own existing actors, but also the actors found in other member States. In such circumstance, a VASP in Luxembourg could in theory benefit from a 'soft'-passport of its grandfathered license across the EU. This will however require a common approach in each EU member State ; the Luxembourg legislator as a reference only provides the grandfathering for VASP licence holders with the CSSF.
In the absence of such concerted action from the legislators, and given the overload of case files with the CSSF, which now has to coordinate with other European supervisors, existing VASPs are now being stuck between a rock and a hard place: waiting for a CASP licence and continuing providing their services but only in Luxembourg.
-
Download the pdf
This article was published in the December 2024 edition of Agefi Luxembourg.