Crypto custodianship offences – changes after just one year?
With his law firm Fin Law, specialist lawyer Lutz Auffenberg has specialised in the field of fintech and innovative technologies. In particular, blockchain technology and its regulation is the focus of his work. In his guest article, he looks at the facts of crypto custody and this year’s changes to it.
Crypto custody business is currently the newest financial service in the German Banking Act. It is only since 1 January 2020 that the custody, management and safeguarding of crypto-assets or private cryptographic keys of others used to hold, store or Bitcoin Loophole transfer crypto-assets is regulated as a financial service requiring a licence. Less than a year later, however, German lawmakers are taking another look at the just-created facts and are planning changes to the wording of the legal definition. In the course of the introduction of electronic securities and the associated special form of crypto-securities, the legislator wants to expand the crypto-custody business in future to include the securing of private cryptographic keys that are used to hold, store or dispose of crypto-securities for others.
Only the securing of private keys to crypto-securities is to be regulated
The current government draft proposes to formulate the offence of crypto custody business in two variants in the future. While the first variant will continue to refer to the safekeeping, administration and securing of crypto-securities and associated private keys, the legislator would like to regulate the securing of private keys to crypto-securities in the future with the second variant.
The safekeeping and administration of crypto-securities, on the other hand, should not constitute a case of crypto-custody business. According to the Federal Government’s draft explanatory memorandum, these two activities should continue to fall under custody business and thus be regulated as banking business. This approach is consistent insofar as crypto-securities are to represent a special form of electronic securities and will thus be securities within the meaning of the Custody Act. According to BaFin’s constant administrative practice, the safekeeping of securities within the meaning of the Custody Act falls under the custody business.
How does the safeguarding of private keys differ from the safekeeping of crypto securities?
BaFin understands a custodial service within the meaning of crypto custody to be the custody of third-party crypto-securities. This includes, in particular, providers who transfer crypto-securities into their own wallets for which they themselves, and not the customer, hold private keys. The safeguarding of private keys within the meaning of the definition of crypto custody, on the other hand, refers to the storage of private keys for third parties, for example by digitally storing the keys or also by keeping data carriers such as USB sticks, hard drives or a plain sheet of paper on which private keys are stored.