Germany: What are crypto custodians allowed to do under the draft eWpG?

Since 1 January 2020, we have had the financial service of crypto custodian in the German Banking Act (KWG), the new financial service was introduced in the course of implementing the fifth Money Laundering Directive (AMLD5). The Federal Government has now presented a draft law on the introduction of electronic securities which was preceded by a draft bill. The facts of the crypto custody business are now to be adapted.

1. Previous scope of permission

   The scope of permission of crypto custodians currently consists of: the custody, management and safeguarding of crypto assets or private cryptographic keys used to hold, store or transfer crypto assets for others.

   Crypto assets (other than e-money or an e-money-like monetary assets) are digital representations of a value that is not issued or guaranteed by any central bank or public authority and does not have the legal status of currency or money but, is accepted by natural or legal persons as a means of exchange or payment or for investment purposes by virtue of an agreement or actual practice and can be transmitted, stored and traded electronically. Examples of crypto assets are Bitcoin, Ether, XRP, Bitcoin Cash, Tether and Litecoin.
   
   

2. Proposal of the future scope of permission

   The eWpG is intended to introduce electronic securities, these are to be entered in electronic securities registers, which may be kept as central registers or as crypto securities registers. An electronic security that is entered in a crypto securities register is a crypto security. The maintenance of a crypto securities register is to become a new financial service under the German Banking Act.

   Electronic securities (including crypto securities) are securities within the meaning of the German Custody Act (Depotgesetz).

   The scope of crypto custody business is to be reworded to include:

   "the custody, administration and safeguarding of crypto assets or private cryptographic keys used to hold, store or dispose of crypto assets for others as well as the safeguarding of private cryptographic keys used to hold, store or dispose of crypto securities for others pursuant to Section 4 (3) of the Electronic Securities Act (crypto custody business)".

   In addition to the previous activity in relation to crypto securities, the securing of private cryptographic keys (private key) for crypto securities is thus added.

   The scope of crypto custody will therefore be expanded in the future, previously the crypto custodian under the draft eWpG could hold and manage crypto assets and store the associated private keys, but with regard to crypto securities it may only store the private keys (i.e. it cannot keep safe or manage crypto securities). This is in keeping with the view that crypto securities are treated like (real) securities by their legal design and are also securities in the sense of the Custody Act (Depotgesetz). Only the permission of the custody business covers the custody of securities.

   However, this raises two follow-up questions:
   
   1. What is the difference between crypto securities and crypto assets
   
   2. What does it mean to "keep safe" a crypto security?
   
   

3. Difference crypto securities and crypto assets
   
   From the various terms used by the legislator, it is clear that there must be a difference between crypto securities and crypto assets.
   
   However, until now, the distinction between crypto assets and securities (in the custodial sense - not to be confused with the concept of securities in the sense of prospectus law) was simple: The concept of securities under custodial law previously required securitisation. Any financial instrument that was not securitised could not be a security (under custody law). The security tokens on the market (tokenised bonds, which BaFin classifies as securities sui generis under prospectus law) could therefore only fall under the concept of crypto asset.
   
   Therefore, it is now important to look at how the explanatory memorandum deals with these security tokens. Security tokens issued before the eWpG will come into force but are not automatically recorded as crypto securities -rather, they must first be entered in a crypto securities register in order to become electronic securities. However, there is no obligation to do so. Therefore, the draft eWpG does not provide for a separate transitional regulation for security tokens. However, it also follows from this justification that future security tokens that correspond to only the concept of securities under prospectus law can be issued, but not under deposit law, because they are not entered in a crypto securities register. These can then be held in custody by crypto custodians.
   
   Since the provisions of the draft eWpG (in particular the rules on bona fide acquisition) will not apply to these security tokens, the issuer and investment intermediaries should be particularly concerned about investor education and prospectus liability.
   
   If they give the impression that it is a crypto security (within the meaning of the draft eWpG), although it is a security token that is not registered in any crypto securities register, a prospectus error is likely.
   
   It can be assumed that the (civil) legal differences between simple security tokens and crypto securities are so serious that in the case of such a prospectus error, the investor can demand the takeover of the securities against reimbursement of the purchase price and the usual costs associated with the purchase.
   
   

4. Custody of crypto securities
   
   There are very few to no precise statements on the custody of a crypto security - here it helps to look at the classic custody of securities under the Custody Act. This has its origins in the fact that a (paper) certificate is issued for each security. This certificate proves the ownership of the securitised right. Originally, the certificate was presented when the claims arising from it were fulfilled. This has changed, the infrastructure of the capital market has been expanded and now offers collective custody of the securities as a rule. Today, the security is no longer physically presented, but a book-entry transfer takes place. After a transfer, the respective custodian holds the security in safe custody for the buyer, not the seller. In Germany, securities are usually held by Clearstream as the central securities depository.
   
   The custody of an electronic security cannot be physical as the deed is missing. According to the draft eWpG, the keeping of the securities register also does not constitute custody within the meaning of the Custody Act (Depotgesetz). Custody must therefore mean that someone mediates the "possession" or ownership of the (electronic) security for another person. It follows that the person who registers in the crypto securities register holds the crypto security in custody, but only assumes this position as holder for someone else, i.e. "holds it in custody" for them.
   
   If the investor has entered in the crypto securities register as the holder (individual entry), the crypto custodian may store the private key for this purpose. The storage of the key is subject to the same technical risks as the previously regulated crypto custody, which is why the legislator considers this selective expansion of the scope to be necessary. However, the crypto custodian may not register itself in the crypto securities register on behalf of the investor (unless it also has a permit for the custody business).
   
   

5. Outlook
   
   The legislative process is currently underway. It is expected that the law will be passed before the end of this legislative period.