FinTech Insights #7 –
Integration of EU’s MiCAR in Maltese law

Malta has been a forerunner in regulating digital assets with the introduction of the Virtual Financial Assets Act, Chapter 590 of the Laws of Malta (the “VFA Act”) back in 2018.  Following its approval in 2022 and publication in 2023, Regulation (EU) 2023/1114 of the European Parliament and Council on markets in crypto-assets (“MiCAR”) has an 18-month window to become fully enforceable by 30^th December 2024. However, MiCAR’s Title III and Title IV on issuing and regulating stablecoins will be applicable from 30^th June 2024 according to Article 149 MiCAR.  Rules on crypto-asset service providers in Title V of MiCAR will be enforced as from 30^th December 2024.

MiCAR is a directly applicable regulation, meaning it does not require transposition into local law. EU Member States without national laws on digital assets have a straightforward process for integrating MiCAR into their national law.  In Malta, the forward-looking 2018 VFA Act contained provisions that regulate digital assets more prudently than the EU’s 2023 MiCAR. Thus, the local regulator amended the VFA Act to remove certain obligations to match MiCAR.

The relevant legislative act which integrates MiCAR into Maltese law is Act XIV of 2024 of the Laws of Malta, dated the 16^th of April 2024 and titled ‘An Act to amend the Virtual Financial Assets Act, Cap. 590, and to provide for other matters ancillary or consequential thereto’.  Given the similarity between MiCAR and the VFA Act, Malta’s Act XIV of 2024 did not require an overhaul because both treat digital assets similarly to how MiFID regulates financial products.  In fact, the most noticeable change in Act XIV of 2024 is the removal of multiple references to the VFA Agent, which was required under the VFA regime but not by MiCAR.

Current Legislative Status of Issuing Digital Assets

The EU’s MiCAR provides rules for issuing three types of digital assets:

• Utility Token: This category of crypto-asset is designed solely to grant access to a product or service offered by the entity that issues it.
• Asset-referenced Token (“ART”): This variant of crypto-asset, distinct from electronic money tokens, strives to preserve a consistent value by linking to another value or entitlement, or a combination of these, including one or multiple recognised currencies, assets, or technologies.
• E-Money Token (“EMT”): A crypto-asset type that claims to sustain a stable value by mirroring the value of a single official central-bank-issued currency.

The two types of tokens that trigger enforcement provisions by 30th June 2024, namely ARTs and EMTs, have been introduced into Maltese law through Article 2(b) and Article 2(d) of Act XIV of 2024, which make specific reference to MiCAR and replicate the definition of MiCAR in the VFA Act. Article 1 of Act XIV of 2024 stipulates that these definitions will come into effect in Maltese law from 30th June 2024, coinciding with MiCAR’s first enforcement phase, ensuring a smooth regulatory transition for EMTs and ARTs.  The rationale for this amendment in the local VFA Act is explained by the MFSA’s circular of April 2024 which said that Act XIV of 2024 of the Laws of Malta “seeks to carve out EMTs and ARTs from falling within the definition of a Virtual Financial Asset or otherwise a DLT Asset in view of the fact that such assets will fall within scope of the MiCA Regulation as at 30 June 2024.”

The application process for ARTs has been delineated by the MFSA in a circular dated the 26^th of June 2024 titled ‘Publication of Applications for Issuers of Asset-Referenced Token’. In this circular, the MFSA outlines that it launched a new application form applicable to entities who wish to offer ARTs to the public or admit ARTs to trading from Malta and who are seeking authorisation in terms of Article 18 MiCAR. The application form can be found here and the MFSA’s ‘Process Authorisation Charter’ can be viewed here. The MFSA’s guideline for filling the application is accessible here. Other MFSA forms which would need to be filled in terms of the ARTs section on the MFSA’s authorisation portal are the: AX01 – Corporate Questionnaire; AX02 – Involvement Suitability Assessment; AX03 – Third Party Outsourcing Assessment; AX05 – Extended ICT Questionnaire.

MiCAR also introduces the concept of significant tokens for ARTs and EMTs, with the European Banking Authority (“EBA”) responsible for their categorisation as ‘significant’, thereby imposing stricter requirements on issuers of these crypto-assets that meet the ‘significant’ threshold. ARTs and EMTs, commonly known as stablecoins, are designed to maintain a stable value by referencing other assets or combinations of assets and underlying technologies. By establishing a harmonised regime for issuing and offering stablecoins publicly and creating a unified framework for intermediary activities related to crypto-assets across all EU Member States, MiCAR could be a catalyst for accelerating the digitalisation of EU capital markets.

For digital assets/tokens that do not meet the criteria for ARTs or EMTs (namely utility tokens as regulated by Title II of MICAR, whose enforcement will start from 30th December 2024), MiCAR imposes a notification obligation to the relevant authorities and focuses on the duties of offerors and firms aiming for trading admission, as outlined in Articles 4 to 15 in Title II of MiCAR. Any public offering or trading admission necessitates the creation, notification, and publication of a crypto-asset white paper (Article 4 MiCAR). MiCAR outlines specific requirements for the content and format of the white paper (Article 6). Moreover, MiCAR establishes liability for the accuracy of the information in the crypto-asset white paper in Article 15, and both the whitepaper and marketing communications must be reported to the competent authority in terms of Article 8 of MiCAR.

Current Legislative Status of Crypto-Asset Service Providers (“CASPs”)

Article 3(16) of MiCAR defines a licensable ‘crypto-asset service’ as any of the following services and activities relating to any crypto-asset:

• “(a)providing custody and administration of crypto-assets on behalf of clients;
• (b) operation of a trading platform for crypto-assets;
• (c) exchange of crypto-assets for funds;
• (d) exchange of crypto-assets for other crypto-assets;
• (e)execution of orders for crypto-assets on behalf of clients;
• (f) placing of crypto-assets;
• (g)reception and transmission of orders for crypto-assets on behalf of clients;
• (h) providing advice on crypto-assets;
• providing portfolio management on crypto-assets;
• (j) providing transfer services for crypto-assets on behalf of clients.”

The list largely tallies up with what is provided in Schedule 2 of Malta’s VFA Act which contains the list of services which require a VFA licence:

1. Reception and Transmission of Orders (tallies with MiCAR 3(16)(g))
2. Execution of orders on behalf of other persons (tallies with MiCAR 3(16)(e))
3. Dealing on own account (tallies with MiCAR 3(16)(b))
4. Portfolio Management (tallies with MiCAR 3(16)(i))
5. Custodian or Nominee Services (tallies with MiCAR 3(16)(a))
6. Investment Advice (tallies with MiCAR 3(16)(h))
7. Placing of virtual financial assets (tallies with MiCAR 3(16)(f))
8. The operation of a VFA exchange (tallies with MiCAR 3(16)(c, d))
9. Transfer of virtual financial assets (tallies with MiCAR 3(16)(j))

This means that although the relevant sections of MiCAR on crypto-asset services (Title V) will be enforced from December 2024 onwards, Malta is already applying/enforcing them as they are already part of its corpus iuris. Therefore, one does not expect the Maltese legislator to introduce any ground-breaking legislative amendments to further align with MiCAR since Malta is already in line with the EU regulation.

Both the VFA regime and the MiCAR regime require issuers of tokens to be a legal person. However, while MiCAR clearly indicates that any CASP applicant must be a legal person, Article 13 of the VFA Act still says “person” rather than “legal person”. R3-2.1.2.6 of the MFSA’s Chapter 3 of the VFA rulebooks clearly stipulates that “A person wishing to be licensed to provide a VFA service shall be a legal person established in Malta”, in sync with MiCAR. Thus, although the MFSA rulebook requires the applicant to be a legal person, adding the word “legal” to Article 13 of the VFA Act is a very minor amendment that will likely be carried out in subsequent revisions of the VFA Act without any repercussions to current practices.

As for Investment Firms providing crypto activities, the provision of investment services and ancillary services concerning securities tokens, which are classified as transferable securities under MiFID II, will not be under MiCAR’s regulatory umbrella. MiCAR’s provisions do not extend to crypto-assets considered financial instruments under MiFID II, nor to deposits, structured funds (unless categorised as e-money tokens), securitisation holdings, non-life or life insurance offerings, and pension schemes.  Article 60 of MiCAR sets out the notification requirements for investment firms, AIFMs, and UCITS management companies that intend to engage in a small number of activities involving crypto-assets (not all activities in Article 3(16) are covered by the notification). Article 60 of MiCAR will be enforced as of 30 December 2024. In Malta, Regulation 3 of the Virtual Financial Assets Regulations, Subsidiary Legislation 590.01 of the Laws of Malta (“SL590.01”) provides that investment firms and fund managers are exempt from VFA licensing for certain VFA services.

NFTs

Non-Fungible Tokens (“NFTs”) which are strictly non-fungible (i.e. “are unique and not fungible with other crypto-assets” in terms of Article 2(3) MiCAR) are not regulated by MiCAR. On the other hand, the inclusion of fractionalised and tradable NFTs within MiCAR’s framework is determined on an individual basis.

MiCAR’s position of excluding NFTs from its scope is congruent with the Maltese position because NFTs do not feature in the VFA Act and the MFSA said in paragraph 6 of a set of NFT Guidelines published in  2023 that “The exclusion of NFTs from the scope of financial services frameworks based on the criteria outlined in these guidelines is without prejudice to other legislation which may be applicable to NFT-related activities, including anti-money laundering and terrorism financing legislation.” The MFSA further confirms MiCAR’s position by saying in the same NFT guidelines that “these guidelines, […] are largely influenced by the treatment being adopted in terms of the Markets in Crypto-Assets.”

Current Status of ESMA and EBA RTSs on MiCAR

The European Commission is vested with the authority to adopt delegated acts in specified areas to supplement MiCAR, with the aim of further detailing the following elements:

• Technical specifications of the definitions and their adaptation to market and technological developments;
• Criteria and factors to be considered by national competent authorities (“NCAs”) when adopting product intervention measures;
• Criteria and factors to be considered by ESMA/EBA when exercising temporary intervention powers;
• Criteria for determining when an asset-referenced token is deemed significant.

MiCAR comprises a significant array of Level 2 measures (i.e., Regulatory Technical Standards “RTSs” and/or Implementing Technical Standards “ITS”) and Level 3 measures (i.e., EBA and ESMA Guidelines) that need to be formulated and approved by the EU before they can be implemented in the MFSA’s VFA rulebook.

ESMA is tasked by MiCAR to introduce most of the RTSs, although some of these will also be supplemented by a number of RTSs and guidelines from the EBA. To date, ESMA has published a consultation or draft of all RTSs which where envisaged by ESMA’s workplan when MiCAR was initially promulgated, however, these RTSs are yet to be finalised and/or published in final version.

ESMA’s first draft package of MiCAR RTS has been published as a draft and contains requirements delegated by the following MiCAR Articles:

• Article 60(13): RTS on content of notification from selected entities to NCAs.
• Article 60(14): ITS on forms and templates for notification from entities to NCAs.
• Article 62(5): RTS on the content of the application for authorisation for CASPs.
• Article 62(6): ITS on forms and templates for CASP authorisation application.
• Article 71(5): RTS on complaints handling procedure.
• Article 72(5): RTS on management and prevention, disclosure of conflict of interest.
• Article 84(4): RTS on intended acquisition information requirements.

ESMA’s second  MiCAR consultation package’s consultation covers:

• RTS on the content, methodologies, and presentation of sustainability indicators concerning negative impacts on climate and the environment.
• RTS outlining the measures that crypto-asset service providers must implement to ensure consistent and reliable service performance.
• RTS related to trade transparency.
• RTS on the content and format of order book records.
• RTS on record-keeping requirements for crypto-asset service providers.
• RTS specifying the data required for the classification of white papers.
• ITS on standard forms and templates for the crypto-asset white paper.
• ITS on the technical means for the appropriate public disclosure of inside information.

ESMA’s third MiCAR consultation package covers:

• RTS for detecting and reporting suspected market abuse in crypto-assets.
• Guidelines on policies and procedures, including client rights, for crypto-asset transfer services.
• Guidelines on suitability requirements for specific crypto-asset services and the format of periodic statements for portfolio management.
• Guidelines on ICT operational resilience for certain entities under MiCAR.

ESMA also had two other consultations on reverse solicitation as well as on the conditions and criteria for the qualification of crypto-assets as financial instruments.  Moreover, on 8^th  November 2023, the European Commission issued four draft delegated regulations which have been updated through Commission Delegated Regulations 2024/1503, 2024/1504, 2024/1506, and 2024/1507 which were approved in February 2024, published in May 2024 and came into effect on 19^th June 2024. These Commission Delegated Regulations address: fees imposed by the EBA on issuers of significant ARTs and EMTs; criteria for determining the significance of these tokens; factors and criteria for ESMA, EBA, and other authorities to use in their intervention powers; and procedural rules for the EBA to levy fines or periodic penalties on issuers of significant ARTs and EMTs.

ESMA together with the EBA have jointly issued Draft Management Body Selection Guidelines for evaluating the suitability of members of the management body of CASPs  and issuers of ARTs to outline standard criteria. These criteria include assessing the necessary knowledge, skills, and experience, as well as the reputation, honesty, and integrity of the members. Additionally, the guidelines consider whether the members can devote adequate time to their roles. Once these guidelines are approved and published, they will also need to be taken into consideration when the MFSA’s AX02 Forms are being filled in relation to MFSA Personal Questionnaires.

EBA and ESMA also jointly issued Draft Shareholder Guidelines for the suitability assessment of shareholders or members, whether directly or indirectly involved, with significant holdings in CASPs and issuers of ARTs where competent authorities are provided with a common methodology. This methodology is used to evaluate the suitability of shareholders and members with substantial direct or indirect holdings for the purposes of granting authorisation as issuers of ARTs or CASPs, as well as for conducting the prudential assessment of proposed acquisitions.

Separately, in June 2024, the EBA released the final EBA package of technical standards and guidelines under MiCAR on prudential matters including, governance, conflicts of interest and remuneration. This package includes final draft RTSs detailing adjustments to own funds requirements, liquidity management policies, and stress-testing programs. Additionally, guidelines on recovery plans outline the necessary format and content, aiming to ensure harmonisation across EU Member States. These standards were developed in cooperation with ESMA and the European Central Bank.

The RTS packages from ESMA and EBA, most of which are still in draft or consultations, essentially outline the changes ahead for the MFSA VFA rulebook. Once the RTSs are published, the MFSA will adopt them in the VFA rulebook.

Integration of MiCAR RTSs in the MFSA Rulebook

As with regards to the MFSA’s integration of these ESMA and EBA rules into Malta’s rulebook, the MFSA would need to wait until ESMA issues the final RTSs listed in the previous section to be able to amend the VFA rulebook to fully match ESMA’s RTS. Nonetheless, amendments are already being carried out.

Before MiCAR, the MFSA had three distinct chapters (i.e. separate documents) in its rulebook for crypto-related licences:

• Chapter 1 titled “Virtual Financial Assets Rules for VFA Agents” – This chapter will be eventually phased out due to the fact that MiCAR does not require an agent to assist in the application. In April 2024, the VFA Act was amended to remove the VFA Agent requirement. Subsequently, the MFSA issued a user guide note about the removal of the VFA Agent following Legal Notice 134 of 2024 which was published in June 2024 in relation to the fees of the VFA Agent in  01.
• Chapter 2 titled “Virtual Financial Assets Rules for Issuers of VFAs” – This chapter applies to those who will issue VFAs/coins/or other digital assets. This chapter was amended in April 2024 following consultation on Chapter 2 of the VFA rulebook and the publication of Act XIV of 2024 to remove references to the VFA Agent and the systems auditor. The provisos in this chapter of the rulebook correspond to Titles II, III and IV of MICAR.  In addition to the RTSs that were published in relation to Titles III and IV on ARTs and EMTs by the EBA in June 2024, ESMA’s second package of RTS contains criteria on whitepapers  relating to utility tokens. MiCAR clearly states that whitepapers do not require approval, but merely needs to be notified to the NCAs. Consequently, this will reduce the compliance requirements in Malta which had previously required registration of whitepapers. Given that the VFA Act carves out ARTs and EMTs to solely have the definition of MiCAR, any future amendments to the second chapter of the MFSA’s VFA rulebook on issuers of VFAs will replicate the guidelines coming from the EU. In light of the fact that digital assets falling under the definition of EMTs and ARTs in the VFA are supervised directly by MiCAR, any further amendments in this chapter of the MFSA rulebook for integrating MiCAR in Malta would principally consist of replicating the EBA guidelines on tokens issued in June 2024 and other ESMA guidelines in the pipeline.
• Chapter 3 titled “Virtual Financial Assets Rules For VFA Service Providers” – The latest version of this chapter is ‘v1.07’ and it relates to the licensing and conduct of all CASPs other than the issuing of digital assets. Back in December 2023, the MFSA had issued a circular detailing the updates to Chapter 3 of the VFA rulebook to align with MiCAR and introduced a two-stage applicability schedule for new requirements starting from 1 January 2024 and the other from 1st July 2024. Chapter 3 was further amended in April 2024 following MFSA-led consultation and the publication of Act XIV of 2024 of the Laws of Malta. The rulebook still retains the four types of CASP classes, but the capital requirement amount tallies with what is provided in Paragraph 4 of Article 67 of MiCAR. Although this rulebook is currently largely in line with MiCAR, the RTSs published by ESMA will need to feature in the rulebook. Thus, more changes to this third chapter of Malta’s VFA rulebook are expected once new RTSs and delegated regulations from the EU are made official.

1st August 2024 is slated to be the date when the MFSA stops accepting applications under the local VFA regime as per the circular issued in April 2024 which said: “Any person wishing to submit an application for the provision of a VFA service in terms of the Virtual Financial Asset Act shall do so by no later than 1st August 2024, provided that such person shall be considered an applicant upon submission of an application as specified in Article 14 of the Virtual Financial Assets Act.”

Whilst the integration of MiCAR in Maltese law through the VFA Act and its subsidiary legislation can be considered to be complete for the time being, the MFSA rulebook will be amended again in the coming months to reflect the numerous RTSs from ESMA which are yet to be published. Moreover, some transitory provisions will still be in place, the most notable one in Malta being the transitory provision which was introduced by Act XIV of 2024 which removed the VFA Agent requirement but provided transitory provision through the addition of Article 63 and Article 64 of the VFA Act. There are also transitory provisions provided by MiCAR in relation to pre-MICAR entities who converted their licence to MiCAR as outlined in the grandfathering clause which, depending on the decision of each EU Member State, can run up to 1st July 2026, as per Article 143 of MiCAR.