During the last several years we've witnessed the growing popularity of virtual or crypto currencies and today, we could even say that it is a trend as many individuals can buy virtual currencies through various platforms and applications by simply using their smartphones, while at the same time watching their favorite TV show. Procedure to create a profile through those platforms is usually simple and swift with very limited requirements. The use of virtual currencies, though, conceals the danger of anonymity or pseudo-anonymity that characterizes them1 . Criminals take advantage of this anonymity by using cryptos to transfer illicit funds to the financial system, achieving, in this way, their integration in the market and/or the financing of terrorist organizations. To paint the general picture of the scale of such misuse, the crypto currencies and blockchain report, requested by the European Parliament, states that "even though the full scale of misuse of virtual currencies is unknown, its market value has been reported to exceed EUR 7 billion worldwide".2

In a world where the competent authorities and the criminals are in a never ending cat-and-mouse game, where authorities are always multiple steps behind, the European Union has adopted the Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018 (the "5th AML Directive") amending the Directives (EU) 2015/849, 2009/138/EC and 2013/36/EU. The 5th AML Directive's aim is to enhance transparency of financial transactions not only in the existing framework but also to alternative finance and social entrepreneurship, 3 by including as obliged entities a) the "providers engaged in exchange services between virtual currencies4 and fiat currencies" and b) the "custodial wallet providers5 ".6 In other words, the 5th AML Directive applies to the service providers that fall under its definitions. As a result, they need to apply customer due diligence procedures in identifying and verifying the identity not only of all new customers but also of existing customers on a risk-sensitive basis. 7 In addition, they are obliged to report suspicious transactions to the competent authority of their Member State. In this way, the EU seeks to reduce the anonymity enjoyed by criminals so far, changing, therefore, the rules of the game.

Cyprus in the last few years became a hub for the forex industry, as commonly known, which is growing rapidly. Regulators having concerns over the crypto-assets activities were long awaiting for the amendment of the local anti-money laundering laws. In connection with the above, on 23 February 2021 the Law on the Prevention and Suppression of Money Laundering Activities of 2021 of the Republic of Cyprus (the "Law"), came into force which radically amends the Prevention and Suppression of Money Laundering Activities Laws of 2007- 2019 and implementsthe 5th AML Directive. The Law extends the definition of 'obliged entities' and catches within its ambit the crypto-assets service providers, who are now obliged to apply due diligence procedures every time they undertake a transaction amounting to or more than EUR 1,000, irrespective of the fact that this transaction occurs in a single transaction or in multiple that are interconnected.8 Given that the threshold provided by the Law is quite low, it is apparent that the competent authorities are determined to put under review and scrutiny the majority of the transactions undertaken by the service providers. The question is whether this will be sufficient.

Consequently, crypto-asset businesses need to implement adequate measures and procedures in identifying their customer and its ultimate beneficial owner(s), in accordance with the Law. Technology is again to be of assistance with this demanding exercise, and software can be used "that can automatically background check an organisation to see if its ownership structure has changed, how long it has been established and where the company is registered. Furthermore, robotic and digital process automation (RPA and DPA) can be used to trigger an action such as an email asking banks for financial information such as P&L statements to show source of income, check for originating payments and even discrepancies in costs and profit to check for employees secretly siphoning off funds".9

In addition, the 5th AML Directive stipulates that Member States shall ensure that the providers of exchange services between virtual currencies and fiat currencies and the custodian wallet providers are registered.10 Pursuant to the Law, such a register will be kept by Cyprus Securities and Exchange Commission (Cysec) and will include a) crypto-assets service providers11 that provide professional services or activities in the Republic of Cyprus, even if they are already registered in another Member State for the services or activities they provide and b) crypto-assets service providers that provide professional services or activities in the Republic of Cyprus, except the persons who provide or carry out services or activities in the Republic of Cyprus that are related to virtual currencies and who have been registered in another Member State for the services or activities they provide.12

It is important to note that individuals who are not registered can continue to provide or carry out crypto-assets services in the Republic of Cyprus only if they are registered in another Member State for the said services.13

The crypto-assets service providers need to submit an application to Cysec, which will review and decide whether it will be approved or declined.14 Upon acceptance of the application, crypto-assets service providers need to pay to Cysec registration and subscription fees, which will be determined by a circular to be issued by Cysec. Furthermore, the Law provides that the crypto-assets service providers need to:

  1. immediately inform Cysec regarding any material amendments on the information required for their registration;15
  2. apply the organizational and operational requirements, as will be specified in a circular of Cysec;16 and
  3. ensure that individuals with a managerial position17 18and the ultimate beneficial owner(s)19 20 of the crypto-assets service providers are always capable and honorable, in line with the circular to be issued by Cysec.

It needs to be pointed out that the crypto-assets service providers are obliged to comply with the circular of Cysec and failure to do so is considered as infringement of the relevant article of the Law. 21

Τherefore, it is of paramount importance for the crypto-assets service providers to review and comply with the circular as soon as it is issued by Cysec.

It will be extremely interesting to see how Cysec will clarify the following uncertainties in the keenly awaited circular:

  1. the requirements for the registration of the crypto-assets service providers;
  2. the reasons for removal from the register and its implications;
  3. the definition of material amendments on required information;
  4. the organizational and operational requirements that need to be in place;
  5. the amount of the subscription fee;
  6. how the capability and honorability of the individuals with a managerial position and the ultimate beneficial owner(s) can be assessed;
  7. the obligations of individuals holding managerial positions; and
  8. the obligations of the ultimate beneficial owner(s).

The 5th AML Directive has undoubtedly filled an extremely important gap in the legislation by shedding a bit of light in the anonymity enjoyed by criminals using virtual currencies for their illicit activities. Nevertheless, only time will show whether the measures taken by the competent authorities are sufficient or whether additional actions need to be adopted. To quote the words of Oliver Wendell Holmes Jr., "the life of the law has not been logic; it has been experience".

Footnotes

1 As defined in a recent International Monetary Fund staff discussion note (January 2016) "most cryptocurrencies are pseudo-anonymous: while cryptocurrency transactions are publicly recorded, users are known only by their VC addresses, which cannot be traced back to users' real-world identity. As such, cryptocurrency transactions are more transparent than cash but more anonymous than other forms of online payment". https://www.imf.org/external/pubs/ft/sdn/2016/sdn1603.pdf

2 Cryptocurrencies and blockchain, June 2018- requested by the European Parliament's Special Committee on Financial Crimes, Tax Evasion and Tax Avoidance

3 Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018, Recitals 2 and 8

4 Virtual currencies are defined in the Directive as: "a digital representation of value that is not issued or guaranteed by a central bank or a public authority, is not necessarily attached to a legally established currency and does not possess a legal status of currency or money, but is accepted by natural or legal persons as a means of exchange and which can be transferred, stored and traded electronically"

5 Custodian wallet provider is defined in the Directive as: "an entity that provides services to safeguard private cryptographic keys on behalf of its customers, to hold, store and transfer virtual currencies"

6 Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018, Article 1 (1)(c)

7 Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018, Article 1 (9)(b)

8 Law on the Prevention and Suppression of Money Laundering Activities of 2021 of the Republic of Cyprus, Article 19 (β)

9 Steve Morgan, EU's Fifth Anti-Money Laundering Directive: what the crypto-asset sector needs to know, 07 January 2020 https://www.finextra.com/blogposting/18301/eus-fifth-anti-money-laundering-directive-what-the-crypto-asset-sector-needs-to-know

10 Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018, Article 1(29)

11 It is defined in article 2 of the Law as: the person who provides or carries out one or more of the following services to another person or on behalf of another person: a) trade between virtual currencies and fiat currencies, b)trade between virtual currencies, c) management, transmission, transfer, retain, safeguard, including depository, of virtual currencies or virtual keys or means which allow the control of virtual currencies, d) offer and or sale of virtual currencies and e) provision of financial services in connection with the delivery, offer and/or sale of virtual currencies

12 Law on the Prevention and Suppression of Money Laundering Activities of 2021 of the Republic of Cyprus, Article 61(E)(2)

13 Law on the Prevention and Suppression of Money Laundering Activities of 2021 of the Republic of Cyprus, Article 61(E) (4)

14 Law on the Prevention and Suppression of Money Laundering Activities of 2021 of the Republic of Cyprus, Article 61(E)(4)and (5)

15 Law on the Prevention and Suppression of Money Laundering Activities of 2021 of the Republic of Cyprus, Article 61(E)(6)(a)

16 Law on the Prevention and Suppression of Money Laundering Activities of 2021 of the Republic of Cyprus, Article 61(E)(7)(a)

17 Law on the Prevention and Suppression of Money Laundering Activities of 2021 of the Republic of Cyprus, Article 61(E)(9)(a)

18 It is defined in article 2 of the Law as: the individuals who are part of the board of directors of an obliged entity and/or perform executive functions and they are responsible to the board of directors for the everyday management of the obliged entity

19 Law on the Prevention and Suppression of Money Laundering Activities of 2021 of the Republic of Cyprus, Article 61(E)(10)(a)

20 It is defined in article 2 of the Law as: the physical or legal person who jointly or severally owns directly or indirectly: a) special participation (represents at least 10% of the share capital or rights of the virtual currencies service provider or exercises significant influence on the board of directors), b) a percentage of the voting rights or share capital that is equal or more than the minimum of 20%, 30% or 50%, or c) such a percentage in the virtual currencies service provider which is considered as a subsidiary

21 Law on the Prevention and Suppression of Money Laundering Activities of 2021 of the Republic of Cyprus, Article 61(E)(11)(b)

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.