Back to Index of Cryptoasset Regulations

The Maltese government enacted a series of laws in 2018 aimed at providing regulatory certainty over the use and development of cryptocurrencies within its jurisdiction.  The laws provide a framework through which virtual currencies themselves and the individuals or entities that work with these currencies are regulated.  Specifically, they provide a licensing system for providers of virtual financial asset services and regulate activities connected with virtual financial assets, including the initial offerings of these assets and the certification of platforms that these assets are offered on, and designate a regulatory body to oversee the application and enforcement of the framework. 

I. Introduction

The Maltese government has actively encouraged the development of cryptocurrency and has issued many consultation documents and other papers that discuss its regulation and development, with the aim of providing “the necessary legal certainty to allow this industry to flourish.”[1]  In 2018, Malta enacted the Virtual Financial Assets Act (VFA Act),[2] the Innovative Technology Arrangement and Services Act (ITAS Act),[3] and the Malta Digital Innovation Authority Act (MDIA Act).[4]  The intention behind these laws is to provide regulatory certainty, protect those who invest in virtual currencies, and encourage development in the innovative technology sector in Malta. [5] 

This report provides a high-level summary of these Acts, paying particular attention to the VFA Act and how it regulates virtual financial assets (VFAs).

Back to Top

II. Virtual Financial Assets Act

The VFA Act regulates a number of activities relating to VFAs when conducted in, or from within, Malta.  These activities encompass  

• the issuance of Initial VFA Offerings (commonly known as initial coin offerings, or ICOs);
• the application of a VFA issuer to trade the VFA on a distributed ledger technology (DLT) exchange;
• the activities of a VFA agent; and
• VFA service providers, such as eWallet providers, brokerages, and cryptocurrency exchanges. 

Individuals or entities that provide Virtual Financial Services (VFS) must be licensed.  Individuals engaged in these activities are all identified as “subject persons” and must comply with the anti-money laundering and counter-financing of terrorism laws of Malta.[6] 

The VFA Act designates the Malta Financial Services Authority (MFSA) as the competent authority responsible for overseeing and enforcing its provisions.[7]

A. Definitions

The VFA Act contains a vast array of definitions and includes cryptocurrency under the term “virtual financial asset,” which is defined as

any form of digital medium recordation that is used as a digital medium of exchange, unit of account, or store of value and that is not

(a) electronic money;[8]

(b) a financial instrument;[9] or

(c) a virtual token;

“virtual token” means a form of digital medium recordation whose utility, value or application is restricted solely to the acquisition of goods or services, either solely within the DLT platform on or in relation to which it was issued or within a limited network of DLT platforms[.][10]

The VFA Act provides that if a virtual token can be converted into another DLT asset type, it will be treated as the asset type to which it can be converted.[11]  Thus, a virtual token has no utility or value outside of the DLT platform on which it was issued, or within a limited group of DLT platforms,[12] and may only be redeemed on the platform by the issuer of the DLT asset. 

The VFA Act defines DLT as “a database system in which information is recorded, consensually shared, and synchronised across a network of multiple nodes.”[13]  Article 2 defines a “DLT asset” as “(a) a virtual token; (b) a virtual financial asset; (c) electronic money; or (d) a financial instrument, that is intrinsically dependent on, or utilises, Distributed Ledger Technology.”[14]

A DLT exchange is defined as “any trading and, or exchange platform or facility, whether in Malta or in another jurisdiction, on which any form of DLT asset may be transacted in accordance with the rules of the platform or facility.”[15]  The VFA Act distinguishes between DLT exchanges and DLT platforms, and specifically excludes DLT exchanges from the definition of DLT platforms.  The MFSA has advised that “this definition should not thus be interpreted as excluding fiat currencies from its scope. Therefore, the VFA exchange licence under the Act will encompass (i) VFA-to-VFA, (ii) fiat-to-VFA and (iii) VFA-to-fiat transactions.”[16]

A license must be obtained from the MFSA for individuals or entities that wish to offer a VFA or provide VFA services,[17] and such licenses can only be obtained by an application submitted to the MFSA through a VFA agent. [18]   The application must include “a programme of operations setting out the systems, security access protocols and any other matters as may be required to be set out by the competent authority from time to time.”[19]  An individual or entity that obtains a VFA license is able to facilitate the exchange of VFAs or provide services in the VFA sector.

B. Role of the MFSA

The MFSA is the regulatory body charged as the competent authority under the VFA Act.  It may determine a person or entity is engaged in an activity that constitutes a VFA service, or that a DLT asset is a financial asset, virtual token, electronic money, or financial instrument.  The MFSA may also make a determination that a VFA service is provided from or within Malta or that an initial VFA offering has been made, or is being made, in or from within Malta.  When such a determination is made, the individual or entity has a right to appeal the MFSA’s decision.[20]

C. VFA Agents

The VFA Act provides for a system of VFA agents, who must be

• an accountant, auditor, or advocate;
• a firm that provides these services or corporate services;
• a legal organization held by an aforementioned person or firm; or
• a person the MFSA considers suitable to perform the duties of a VFA agent listed in the VFA Act.[21] 

The VFA agent is responsible for a variety of obligations under the VFA Act, including conducting a “fitness and properness” assessment before accepting a client; advising the issuer as to the obligations contained in the VFA Act; ensuring the issuer complies with the provisions of the VFA Act; cooperating with the MFSA; and ensuring the anti-money laundering laws of Malta are complied with.  The MFSA has issued a rulebook that sets out in detail the obligations and responsibilities of VFA agents.[22]

VFA agents are considered gatekeepers and are required to have a “know your client” system in place, which includes verifying the source of funds of those whose primary wealth originates from, or includes, DLT assets, such as bitcoins.[23]  The MFSA has specifically stated that it “will not be endorsing any specific know your client software solutions.”[24]  It expects the VFA agents to have “robust Know Your Client (‘KYC’) systems and controls in place in order to address and mitigate the money laundering/funding of terrorism risks pertaining to their specific business model. It is emphasised that there is no ‘one-size-fits-all’ approach in this respect.”[25] 

D. Initial Virtual Financial Asset Offering

An “initial VFA offering” (commonly known as an initial coin offering, or ICO) is defined as “a method of raising funds whereby an issuer is issuing virtual financial assets and is offering them in exchange for funds.”[26]  The issuer of a VFA offering must comply with the VFA Act and the Virtual Financial Assets Rulebook issued by the MFSA.[27]  The issuer of the initial VFA offering must be a legal person formed under any law in Malta that proposes to issue, or actually issues, VFAs in or from within Malta.[28]  The issuer must appoint a VFA agent, who must be registered with the MFSA.[29]   The issuer itself is not required to be registered with the MFSA, but the VFA Act requires that issuers of initial VFA offerings register a white paper with the MFSA, which must be done through the VFA agent of the issuer.  The white paper must be clearly written, easily understood, and set out information that, “according to the particular nature of the issuer and of the virtual financial assets offered to the public, is necessary to enable investors to make an informed assessment of the prospects of the issuer, the proposed project and of the features of the virtual financial asset. “[30]

The white paper must be approved by the MFSA[31] and is valid for six months after such approval.[32]  The VFA Act sets out extensive specifications concerning the information the white paper must include.  The white paper is intended to protect investors by providing transparency.  It must include a summary in non-technical language that provides key information about the VFAs.[33]  Unless the disclosure of such information would be contrary to the public interest or is seriously detrimental to the issuer, the white paper must also include a detailed description of various aspects of the VFA offering, including

• the reason behind the initial offering;
• a technical description of the platform and its benefits;
• the sustainability of the project;
• the challenges, risks, and mitigating measures of the offering;
• the characteristics of the financial assets offered;
• a description of the issuer;
• a description of the wallet(s) the issuers will use;
• security safeguards against cyber threats;
• the life cycle of the offering;
• the targeted investor base;
• the exchange rate of the VFAs;
• the underlying protocol’s interoperability with other protocols;
• how funds raised through the offering will be allocated;
• the amount and purpose of the issue;
• the total number of financial assets to be issued and the features of these assets;
• the distribution of financial assets;
• the incentive mechanism to secure any transactions;
• the methods of payment; 
• the estimated speed of transactions;
• the applicable taxes;
• the time during which the offer is open;
• any restrictions on the transferability of the virtual financial assets;
• any soft or hard cap for the offering, and how investors can retrieve their money if the cap is not met;
• the risks associated with the offering;
• details of the issuer, including the name, registered address and registered number, the issuer’s objectives, the group of undertakings the issuer belongs to, and if applicable, the members who directly or indirectly exercise, or could exercise, a role in the issuer’s administration;
• the issuer’s principal activities, and any legal proceedings against the issuer that would impact the issuer’s financial position;
• details of the issuer’s board of administration; and
• the financial track records of issuers that have been established for three or more years.[34]

The MFSA states that financial track records are needed

in order to ensure that investors are adequately safeguarded. Investor protection is achieved predominantly through transparency. This means that investors need to have all the necessary information in order to be able to make an informed assessment of the prospects of the Issuer, the proposed project and of the features of the VFA.[35]

An individual or entity that includes false statements in a white paper, or publishes them to a website or advertisement, and thus causes any person to lose money is liable to pay damages whether the statements were made intentionally or through gross negligence.[36]

The VFA Act requires individuals that wish to submit VFAs to be traded on a DLT exchange to submit an application for admission, and include almost the same information required by issuers of VFAs in a white paper.[37]

E. Determinations of DLT Assets

The MFSA has developed a financial instrument test, along with guidelines,[38] designed to aid individuals and entities within the financial sector in determining whether a product or service falls under traditional financial services legislation or within the new VFA legislative framework.[39]  The test aims to provide clarity over whether a DLT asset is a virtual token, a VFA, electronic money, or a financial asset.[40]   The test is aimed at issuers that offer DLT assets to the public, or on a DLT exchange from within Malta, or those providing VFA services or activities with a DLT asset that has not yet been classified under the VFA Act or under the traditional financial services framework.[41] The test operates as follows:         

• If the DLT asset is a virtual token, then any activities in relation to the token are not regulated.[42]
• If deemed a financial instrument or electronic money, then the traditional financial services framework applies.[43]
• If determined to be neither a virtual token, financial instrument, nor electronic money, then the asset is considered to be a VFA and will be regulated by the VFA framework.[44]

Thus, a DLT asset may not be listed as both a VFA and a financial instrument.  It either qualifies as a VFA regulated by the VFA framework, as a financial instrument regulated by the traditional financial services framework, or as a virtual token that is not subject to any regulations.[45]

The result of the test must be signed by either a VFA agent for issuers of initial VFA offerings, the compliance officer for license holders under the traditional financial services framework or VFA framework, or the VFA agent or legal advisor of any person or entity without a license.[46]

The MFSA has stated that it intends to create a public register of DLT assets that have been determined in accordance with the test.  

F. VFA Services

Schedule 2 of the VFA Act sets out what VFA services are, and covers activities provided in connection with a DLT asset that has been determined to be a VFA, including

• receiving or transmitting orders;
• executing orders on behalf of another person;
• managing a portfolio of assets containing or including more than one VFA;
• acting as a custodian or nominee holder of a VFA or cryptographic key;
• providing investment advice;
• marketing newly issued VFAs; or
• operating a VFA exchange.[47]

Individuals or entities that provide VFA services in, or from within, Malta must comply with the provisions of the VFA Act and the Rulebook issued by the MFSA.[48]  In order to provide a VFA service in, or from within, Malta a license must be obtained from the MFSA, which must be applied for through a VFA agent.[49]  The Central Bank of Malta and other members of the European System of Central Banks and national bodies along with liquidators, individuals managing their own accounts, and individuals providing VFA services for their parent company or subsidiaries are exempted from the requirement to have a license to provide VFA services.[50]   

VFA service licenses are divided into four different classes:

• Class 1: Authorized to receive and hold orders and provide investment advice to VFAs, but not authorized to hold or control clients’ assets or money.
• Class 2: Authorized to provide any VFA service and hold or control clients’ assets or money in the course of providing VFA services, but not authorized to operate a VFA exchange or deal with their own account.
• Class 3: May provide any VFA service other than a VFA exchange and hold or control clients’ assets or money in the course of providing VFA services.
• Class 4: May provide any VFA service, or hold or control clients’ assets or money in the course of providing a VFA service.[51]

The MFSA has stated that the VFA services license is limited to the purposes of acting as a VFA services license holder and that traditional financial services license holders would be conducting activities that are not compatible with the VFA Act, as “a purpose or object referring to any activity that requires any kind of authorisation whatsoever by the MFSA under any Maltese law, other than the Act, shall be deemed to be incompatible with the services of a VFA Service Provider.”[52]

The MFSA notes that traditional financial services license holders that wish to be a VFA service provider can do so, but must establish a separate entity.[53]

The VFA Act contains a variety of offenses relating to activities regulated under the VFA Act, and issuers or license holders can, upon conviction, be fined up to €10 million (approx. US$11.3 million) or three times the profits made or losses avoided due to the offense and/or imprisonment for up to six years.[54]  Upon conviction of an offense under the VFA  Act, VFA agents can be fined up to €500,000 (approx. US$565,000) and/or be sentenced to up to six months’ imprisonment.[55]

Back to Top

III. Innovative Technology Arrangement and Services Act

The ITAS Act regulates innovative technology arrangements and designated innovative technology service providers, which are overseen by the MDIA.  The MDIA Act defines innovative technology arrangements as “the intrinsic elements including software, codes, computer protocols and other architectures which are used in the context of DLT, smart contracts and related applications.”[56]  The ITAS Act lists what it considers to be an innovative technology arrangement to include

1. software and architectures which are used in designing and delivering DLT which ordinarily, but not necessarily:

(a) uses a distributed, decentralized, shared and, or replicated ledger;
(b) may be public or private or hybrids thereof;
(c) is permissioned or permissionless or hybrids thereof;
(d) is secure to a high level against retrospective tampering, such that the history of transactions cannot be replaced;
(e) is protected with cryptography; and
(f) is auditable;

2. smart contracts and related applications, including decentralised autonomous organisations, as well as other similar arrangements;

3. any other innovative technology arrangement which may be designated by the Minister, on the recommendation of the Authority, by notice from time to time.[57]

Information technology services are defined in the ITAS Act as

1. the review or audit services referred to in this Act with reference to innovative technology arrangements provided by system auditors;

2. the technical administration services referred to in this Act with reference to innovative technology arrangements provided by technical administrators.[58]

The ITAS Act provides for the certification of innovative technology arrangements if they contain certain qualities, features, attributes, behaviors, or aspects, as determined by the MDIA.[59]  The ITAS Act provides for the registration of innovative technology services, which is handled by the MDIA.  The MDIA maintains an electronic register of the details of all providers registered, which is publicly available.[60]  This certification and registration process provides formal recognition of these arrangements and services and “will be undertaken in full respect of the importance of not hindering innovation,” while ensuring that investors, consumers, and market integrity are protected, according to one commentary.[61]

Back to Top

IV. Malta Digital Innovation Authority Act

The MDIA Act established the Malta Digital Innovation Authority to develop the innovative technology sector in Malta.  The MDIA has a variety of roles connected to this purpose, including to

• promote government policies for the deployment of innovative technology arrangements within the government;
• promote and facilitate the advancement and use of innovative technology arrangements;
• promote education about ethical standards on the use and advancement of innovative technology arrangements;
• ensure Malta’s reputation with regard to innovative technology arrangements is maintained and protected;
• protect users of innovative technology arrangements;
• harmonize both practices and standards use in innovative technology arrangements; and
• promote legal certainty in the law applying to innovative technology arrangements.[62] 

The MDIA is also responsible for authorizing innovative technology arrangements and innovative technology services providers, as discussed above.

Practitioners have noted that the most important roles held by the MDIA are harmonizing practice and facilitating the adoption of standards on innovative technology arrangements and promoting ease of access to publicly available innovative technology arrangements, as

[t]he pursuit of these objectives will secure the integrity of the Maltese DLT market and will ensure that any measures adopted in Malta will not be disconnected from DLT international policies and rules. This will afford both providers and consumers with more legal certainty especially when the operations and transactions, even though arising in or from Malta, include cross-border elements.[63]

Back to Top

V. Conclusion

The Maltese government is continuing to work on the regulatory structure to ensure that Malta is a world leader in the development of cryptocurrencies.  The VFA Act, the MDIA Act, and the ITAS Act are the first of their kind in the world to regulate virtual assets.  Together they create a regulatory regime that aims to provide legal certainty for individuals and entities wishing to develop these assets from in, or within, Malta; maintain market integrity and transparency; and provide clarity for those wishing to invest in them.[64]

Back to Top

Prepared by Clare Feikert-Ahalt
Senior Foreign Law Specialist
April 2019

---

Back to Top

Last Updated: 12/30/2020