CMS Expert Guide to Crypto Regulation in Ireland

Ireland has chosen to follow EU developments relating to crypto assets rather than create a standalone domestic regulatory regime. Depending on the nature of the activities relating to crypto assets, such activities could fall within scope of: (a) Ireland’s anti-money laundering framework, the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 (the “CJA 2010”), (b) existing Irish financial services regulatory regimes (as set out in the column to the right), and (c) the EU’s Regulation on markets in crypto-assets (“MiCA”).

In terms of the four named activities, some or all could fall within the scope of the CJA 2010. The CJA 2010 transposes the EU’s Fifth Anti-Money Laundering Directive 2018/843 (5MLD) into Irish law, though the amendments, introduced under the Criminal Justice (Money Laundering and Terrorist Financing) (Amendment) Act 2021, go further than required by the MLD5.

The amendments apply broadly to “virtual asset service providers” (VASPs), a term which generally includes a person who by way of business carries out one or more of the following activities for, or on behalf of, another person:

1. exchange between virtual assets and fiat currencies;
2. exchange between one or more forms of virtual assets;
3. transfer of virtual assets, that is to say, conduct a transaction on behalf of another person that moves a virtual asset from one virtual asset address or account to another;
4. custodian wallet provider;
5. participation in, and provision of, financial services related to an issuer’s offer or sale of a virtual asset or both.

Cryptoasset activities such as exchange of assets, custody, borrowing/lending and yield/staking could all fall within the activities listed (a) to (e), above.

Significantly, under the ‘VASP’ regime, a person falling within the definition of a VASP must not only comply with anti-money laundering obligations but must also register with the Central Bank of Ireland (Central Bank). This registration is not merely a formality and the Central Bank may refuse a registration application. 

The registration procedure itself involves a number of steps, which are set out on the Central Bank’s website.

Article 143 of MiCA provides a transition period for crypto-asset service providers (“CASPs”) that are already providing in-scope services in accordance with national law, prior to MiCA’s applicability (on 29 December 2024).  In Ireland, this relates to VASPs registered with the Central Bank in accordance with AML legislation.  The transition period allows CASPs to continue to provide services for up to 18 months after MiCA’s date of application (ie until June 2026), or until they have been granted or refused authorisation under MiCA. However, the Department of Finance in Ireland undertook a public consultation on how Irish law should implement transitional arrangements for existing VASPs already providing services in accordance with Ireland’s domestic regulatory framework. Following the consultation, a feedback statement was published in December 2023, which states that “The Minister, and his Officials, have decided to exercise this discretion and reduce the transitional period to a maximum of 12 months in line with recent guidance issued by ESMA.”. 

In May 2024, the Central Bank stated that: “For clarity, any applicant firm that is not registered and operating as a VASP by 30 December 2024 cannot avail of the transitional arrangements under MiCAR and will not be permitted to operate as a CASP until authorisation has been granted via the CASP authorisation process.”

In addition, Article 143(6) of MiCA permits Member States to adopt a simplified procedure for authorisation applications, submitted between 30 December 2024 and 1 July 2026, by entities that on 30 December 2024 were already authorised under national law to provide crypto-asset services (e.g. VASPs in an Irish-law context).

However, following the above-mentioned public consultation, the Department of Finance stated in its feedback statement that: “The Minister, and his officials, having considered the contents of this opinion, has decided not to exercise this discretion provided for in Article 143(6). This position reflects the advice of ESMA, and recognises that Ireland’s existing VASP registration process under the CJA, as amended, is not comparable to the MiCAR CASP requirements.” In May 2024, the Central Bank stated that: “A CASP authorisation assessment is significantly broader and more substantial than a VASP registration. Therefore, CASP applicants should be aware that a VASP registration provides no indication of the outcome of a CASP assessment.

Furthermore, a VASP registration does not lead to a simplified CASP assessment.  All CASP applications will be deemed a new authorisation application and be assessed in line with the requirements of MiCAR. The Central Bank will take existing supervisory history and engagement with a firm into consideration as part of the authorisation assessment.”

Most recently, the Central Bank in its ‘MiCAR – frequently asked questions’ (updated 10 September 2024) stated: “Where a VASP is registered and operating as a VASP by 30 December 2024, they may avail of the transitional arrangements under MiCAR, but as per the current regime, they will not have any passporting rights under the Irish VASP regime to provide their services in other jurisdictions.

Any VASP not intending to apply for a MiCAR authorisation should establish clear wind-down plans and make arrangements to cease providing services by the end of the transitional period adopted by the Department of Finance.”

As a further enhancement to the AML framework for crypto assets, the EU has enacted a Regulation (EU 2023/1113) on information accompanying transfer of funds and certain crypto assets which is directly applicable in Ireland from 30 December 2024. This Regulation replaces the existing Wire Transfer Regulation (EU 2015/847) and will increase the traceability of crypto asset transfers. The Regulation requires crypto asset service providers to ensure that transfers of crypto assets are accompanied by certain information on the originator and beneficiary of the transfer, e.g. the originator’s name and address.

General

As mentioned, Ireland has chosen to follow EU developments relating to crypto assets rather than create a standalone domestic regulatory regime.  In all cases, it is necessary to look to the underlying service provided, in order to determine whether it falls under an existing Irish financial services regulatory regime. Depending on the nature of the activity relating to crypto assets, and also the type of crypto-asset, the activity could also fall within scope of MiCA (discussed separately below). 

Exchange activities

Irish Payment Services Regulations

It is possible that the operator of a cryptocurrency exchange who settles payments of fiat currency between the buyers and sellers of cryptocurrency could be regarded as being engaged in the activity of money transmission/remittance, triggering the application of the European Union (Payment Services) Regulations 2018 (Irish Payment Services Regulations).

Irish MiFID Regulations

Depending on how an exchange is structured, and the nature of the tokens being made available on the exchange, a cryptocurrency exchange may fall within the scope of existing financial regulation, such as the European Union (Markets in Financial Instruments) Regulations 2017 (Irish MiFID Regulations). Other cryptocurrency exchanges, by contrast, may be structured and operate in a way that falls outside of the regulated space in the EU.

Borrowing/lending activities

Retail Credit Firm/Credit Servicing Firm/High Cost Credit Provider Authorisation

Under the Central Bank Act 1997 a person who meets the definition of a retail credit firm, or who performs the regulated activity of ‘credit servicing’, may be required to obtain authorisation from the Central Bank. Similarly, under the Consumer Credit Act 1995 a person who meets the definition of a high cost credit provider, may be required to obtain authorisation from the Central Bank.

However, there may be strong arguments as to why these particular regimes would not apply in the context of the proposed activity of borrowing/lending.

Credit Reporting

The Credit Reporting Act 2013 establishes a Central Credit Register and imposes obligations, primarily related to credit reporting and credit checking, on certain providers of credit.

Again, there may be strong arguments as to why this particular regime would not apply in the context of the proposed activity of borrowing/lending.

MiCA

Following approval by the Council of the EU and the European Parliament, MiCA was published in the Official Journal on 9 June 2023 and entered into force on 29 June 2023. As an EU Regulation, no transposition is required by Ireland and MiCA has direct effect as part of Irish national law.

MiCA provides for three types of crypto-asset:

• asset-referenced tokens (“ARTs”),  1 An ART is defined in MiCA as “a type of crypto-asset that is not an electronic money token and that purports to maintain a stable value by referencing another value or right or a combination thereof, including one or more official currencies”.
• electronic money tokens (“e-money tokens” or “EMTs”)  2 An EMT is defined as a “crypto-asset that purports to maintain a stable value by referencing the value of one official currency”.  and
• other crypto-assets – neither ARTs nor e-money tokens and includes utility tokens.  3 A utility token is defined as ”a type of crypto-asset which is intended to provide digital access to a good or service, available on DLT, and is only accepted by the issuer of that token”.

MiCA prescribes uniform requirements for the offering and admitting to trading of the above types of crypto-assets and prescribes requirements for crypto-asset service providers (“CASPs”).

MiCA ‘crypto-asset service’ is defined in Article 3(1)(16) as any of the following services and activities relating to any crypto-asset:

1. providing custody and administration of crypto-assets on behalf of clients;
2. operation of a trading platform for crypto-assets;
3. exchange of crypto-assets for funds;
4. exchange of crypto-assets for other crypto-assets;
5. execution of orders for crypto-assets on behalf of clients;
6. placing of crypto-assets;
7. reception and transmission of orders for crypto-assets on behalf of clients;
8. providing advice on crypto-assets;
9. providing portfolio management on crypto-assets;
10. providing transfer services for crypto-assets on behalf of clients.

Under MiCA, CASPs must be authorised by a national competent authority (“NCA”) in order to operate in the EU. In Ireland, this is the Central Bank.  Importantly, certain financial services providers that are authorised under existing legislation can also provide crypto-asset services without separately obtaining authorisation as a CASP under MiCA, provided they fulfil certain requirements.

MiCA will mostly apply from 30 December 2024 but the requirements relating to ARTs and EMTs became applicable on 30 June 2024.

As mentioned in Question 1 above, a VASP registration does not lead to a simplified CASP assessment, but the Central Bank will take existing supervisory history and engagement with a firm into consideration as part of the CASP authorisation assessment.

As mentioned in Question 1 above, as an EU Regulation, no transposition is required by Ireland and MiCA has direct effect as part of Irish national law.

The Central Bank is the national competent authority for the authorisation and supervision of entities that are subject to MiCA in Ireland. Firms seeking to establish themselves in Ireland to offer any CASP services will firstly need to be authorised by the Central Bank.

The Central Bank has established a cross-sectoral team to integrate MiCA into its supervisory and authorisation processes and methodologies.

The Central Bank has stated that it is working with EU colleagues through supervisory coordination networks to build convergence around authorisation and supervisory expectations and processes.

The CASP authorisation process in Ireland consists of two phases: (1) a pre-application engagement phase and (2) the formal application phase. The Central Bank has opened the pre-application engagement phase and firms are encouraged to contact the CBI to begin the authorisation process.

The Central Bank has stated that in general, based on its experience, the best-prepared firms, willing to engage transparently in the authorisation process, proceed through the process more efficiently.

More generally, the Central Bank has repeatedly emphasised its commitment to being open and engaged with respect to fintech entities, and this is demonstrated through engagement with industry, enhancements to its Innovation Hub, and the set-up of an Innovation Sandbox Programme.

See Question 1 above in relation to:

• Exchange (buy/sell);
• Custody (hold);
• Borrowing/lending; and
• Yield/staking services.

Direct sales of tokens by issuers

Direct sales of tokens by issuers is likely to involve participation in, and provision of, financial services related to an issuer’s offer or sale of a virtual asset or both. Therefore, it will be regulated as a VASP activity and registration as a VASP will be required, see above for detail.

Staking on proof of stake consensus mechanisms

Cryptoasset activities such as yield/staking services (including on proof-of-stake consensus mechanisms) could all fall within the VASP activities listed at (1) to (5) in Question 1, above.

NFTs

Ireland does not have any domestic legislative regulatory regime specific to NFTs, or activities relating to NFTs. However, it should be assessed whether a particular NFT (or activities relating to the NFT) could fall within an existing regulatory regime. In particular, depending on the type of NFT, it could be characterised under Irish law as a virtual asset for the purposes of CJA 2010. Section 24(1) of CJA 2010 refers to a “virtual asset”, which it defines as: “a digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes but does not include digital representations of fiat currencies, securities or other financial assets.” The above definition does not exclude NFTs from being virtual assets. On balance, however, we think that such categorisation would be unlikely in respect of NFTs that are in practice used as collectibles.

See Question 1 above in relation to:

• Exchange (buy/sell);
• Custody (hold);
• Borrowing/lending; and
• Yield/staking services.

Direct sales of tokens by issuers

MiCA provides that ARTs can only be offered to the public by entities authorised by the competent authority or a credit institution that meets certain requirements. ART issuers must have strong governance procedures and lines of responsibility.  They must prepare a recovery plan outlining measures to be taken to restore compliance with reserve of assets requirements.  ART issuers must have a registered office in the EU. Significant ART issuers will also be subject to higher capital requirements and oversight by the European Banking Authority.

Issuers of ARTs must draw up a white paper and the white paper must contain certain specified information about: the issuer, the ART, the rights and obligations attached to the ART, the underlying technology, the risks, the reserve of assets and the principle adverse impacts on the climate and other environment-related adverse impacts of the consensus mechanism used to issue the ART.  The white paper must be approved by the Central Bank and published on the ART‘s website. 

In relation to an offer to the public of EMTs, Article 48 MiCA states that “A person shall not make an offer to the public or seek the admission to trading of an e-money token...unless that person is the issuer of such e-money token and: 

1. is authorised as a credit institution or as an electronic money institution; and 
2. has notified a crypto-asset white paper to the competent authority and has published that crypto-asset white paper in accordance with Article 51. ”

Issuers must issue EMTs at par value and grant holders redemption rights at par value and cannot grant interest on EMTs.  It will be necessary for a white paper to be published and notified to the Central Bank when offering the crypto-assets to the public or seeking their admission to trading. However, unlike for an ART, the EMT white paper will not be subject to approval by the Central Bank. Significant EMTs will be subject to higher capital requirements and oversight by the European Banking Authority.

MiCA also provides for the regulation of crypto-assets other than ARTs and EMTs, including utility tokens. These other crypto-assets have less onerous requirements. Crucially, an issuer of this type of crypto-asset, such as a utility token, is not required to hold a regulatory authorisation. However, it will be necessary for a white paper to be published and notified to the NCA when offering the crypto-assets to the public or seeking their admission to trading.  As with an EMT, the white paper does not need to be approved by the NCA.

MiCA has also introduced regulatory requirements for CASPs to issue consumer warnings where the consumer has not satisfied the conditions of the required appropriateness test. MiCA also introduces minimum standards for advertising and marketing and obligations regarding the disclosure of conflicts of interest.

Staking on proof of stake consensus mechanisms

MiCA does not specifically regulate staking on proof of  consensus mechanisms.

In accordance with Article 4(3)(b) MiCA, Title II of MiCA (which regulates crypto-assets other than ARTs and EMTs) does not apply to the crypto-assets that are automatically created as a reward for the maintenance of the distributed ledger technology (“DLT”) or the validation of transactions (which likely includes staking and mining activities). In addition, crypto-asset services that are provided in a fully decentralised manner without any intermediary do not fall within scope of MiCA. It should therefore be assessed whether the relevant staking services would fall within these exemptions from MiCA.

NFTs

MiCA does not apply to crypto-assets that “are unique and not fungible with other crypto-assets, including digital art and collectibles”, amongst other exceptions. Notably, non-fungible tokens (“NFTs”) are not covered by MiCA rules.

However, it should be assessed whether a particular NFT (or activities relating to the NFT) could fall within an existing regulatory regime. Depending on the type of NFT, it could be characterised under Irish law as:

1. a financial instrument for the purposes of the revised Markets in Financial Instruments Directive 2014/65 (MiFID) and related Irish MiFID Regulations;
2. an “investment instrument” for the purposes of the Investment Intermediaries Act, 1995;
3. electronic-money, or
4. a virtual asset for the purposes of CJA 2010.

Depending on the structure of the offshore business and the manner in which the services to Irish customers are provided, it may be the case that the offshore business would not be considered to be a “designated person” for the purposes of CJA 2010 (and therefore out of scope of the VASP authorisation requirement), on the basis that is not acting in Ireland in the course of business carried on in Ireland. For the purposes of this assessment, the number of connecting factors to Ireland is relevant; active marketing of products to Irish customers would be a strong indication that the offshore business is carrying on business in Ireland.  

MiCA contains provisions in respect of reverse solicitation by offshore businesses. Article 75 states: “This Regulation should not affect the possibility for persons established in the Union to receive crypto-asset services by a third-country firm on their own initiative. Where a third-country firm provides crypto-asset services on the own initiative of a person established in the Union, the crypto-asset services should not be deemed to be provided in the Union. Where a third-country firm solicits clients or prospective clients in the Union or promotes or advertises crypto-asset services or activities in the Union, its services should not be deemed to be crypto-asset services provided on the own initiative of the client. In such a case, the third-country firm should be authorised as a crypto-asset service provider.”

Therefore, the provision of services by offshore businesses to Irish customers on a reverse solicitation basis is generally permitted. Active solicitation is not permitted.

As noted in Question 1 above, the Central Bank has stated that: “Any VASP not intending to apply for a MiCAR authorisation should establish clear wind-down plans and make arrangements to cease providing services by the end of the transitional period adopted by the Department of Finance.”

It is currently envisaged by industry that, once MiCA becomes effective, a legislative amendment will be adopted to repeal the VASP regime.

The Central Bank states on its website“The Central Bank’s experience of assessing applications for VASPs, since commencement of the regime in April 2021, highlights that a period of at least ten months is required to conclude the assessment of a VASP application. Therefore, firms that are considering providing CASP services should focus their efforts on preparing for a CASP application rather than seeking a VASP registration at this time. Individual potential VASP applicants who have engaged with the Central Bank on a pre-registration basis have been advised of this in recent months.”

The Central Bank has stated that a CASP authorisation assessment is significantly broader and more substantial than a VASP registration, and that it will issue further communications regarding the authorisation and notification processes in due course. 

The Central Bank has also stated that firms who have not previously engaged with the Central Bank and who are seeking to establish themselves in Ireland to offer any CASP services, should engage with its Innovation Hub in the first instance. Timelines specific to the Applicant may be discussed as part of that process.

During Q3 2024, the Central Bank commenced liaising with entities seeking to become authorised as a CASP in Ireland in an early engagement capacity. This first pre-application engagement phase, involves an introduction meeting during which the entity will present on their business model and the Central Bank presents on the authorisation and supervisory expectations. Following on from this, it will be necessary for applicant entities to submit a ‘Key Facts Document’ to support an initial assessment of how any draft application might align with the Central Bank’s authorisation and supervisory expectations. The second, formal application phase, will consist of the submission by the entity of the full application for CASP authorisation, which will be assessed by the Central Bank. The Central Bank may require additional information following receipt of the submission, pursuant to which a final decision will be made by the Central Bank relating to authorisation. The Central Bank has indicated that it will begin to take formal applications for CASP authorisation in Q4 2024.

According to Article 62 MiCA, the application will need to cover the name (legal and commercial), legal entity identifier, website and contact details; legal form of the entity; articles of association; programme of operations; prudential safeguards; governance arrangements; good repute, knowledge, skills and experience of the management body; identity of shareholders with qualifying holdings and the amounts of those holdings; internal control mechanisms, policies and procedures to identify, assess and manage risks; technical documentation of ICT systems and security arrangements; procedure for segregation of clients’ crypto-assets and funds; complaints handling procedures; the type of crypto-asset involved, among other information.

The Central Bank has articulated its authorisation and supervisory expectations for entities under MiCA, emphasising a firm-by-firm risk appetite and a high authorisation threshold based on four principles: utility and customer base, firm failure, transparency, and no predetermined authorisation assessments. Additionally, the Central Bank expects adherence to four engagement principles during the application process: transparency, supervisability, preparedness, and consumer focus. Nine high-level expectations are also set for CASP authorisation applicants, including governance and accountability, conflict of interest management, client asset protection, transparent ownership, viable business models, anti-money laundering and counter-terrorism financing (AML/CTF) compliance, operational resilience, crisis management, and conduct and transparency.

The Central Bank must follow the timelines outlined in Article 63 of MiCA for processing CASP authorisation applications, which include prompt acknowledgment of receipt (in any event within 5 days), a 25-working-day assessment period for application completeness, prompt notification of a complete application, a 40-working-day assessment period post-completeness, and a 5-working-day period to notify the applicant of the decision from the date of the decision, with the possibility of requesting additional information within the first 20 working days of the assessment period.

The Central Bank does not charge an application fee, however, registered VASPs will be subject to a supervisory levy which will be driven by the level of resources applied to their supervision.

Legal and other advisory costs will depend on the level of input required. In addition, we envisage that there would be set-up costs given that the Central Bank will expect to see a physical presence located (discussed below).

In relation to CASP applications, the Central Bank does not charge an application fee, however, CASPs will likely be subject to a supervisory levy which will be driven by the level of resources applied to their supervision. Legal and other advisory costs will depend on the level of input required. In addition, we envisage that there would be set-up costs given that the Central Bank will expect to see a physical presence located in Ireland. The Central Bank will issue further communications regarding the authorisation and notification processes in due course.

For information available to date on the CASP authorisation process and related timelines in Ireland, please refer to our response in Questions 2 and 5 above.

As noted in Question 1 above, the Central Bank has stated that: “Any VASP not intending to apply for a MiCAR authorisation should establish clear wind-down plans and make arrangements to cease providing services by the end of the transitional period adopted by the Department of Finance.”

It is currently envisaged by industry that, once MiCA becomes effective, a legislative amendment will be adopted to repeal the VASP regime.

The number of VASPs registered with the Central Bank of Ireland more than doubled between 2022 and 2023, which reflects the Irish regulator’s recent experience processing these applications and interest in virtual assets in Ireland.

As of 17 July 2024 (the latest update of the register by the Central Bank), there are fifteen entities registered as a VASP in Ireland. 

In relation to CASP applications, it is currently too early to say, as the Central Bank is due to formally accept applications to become authorised as a CASP next year.

For information available to date on the CASP authorisation process and related timelines in Ireland, please refer to the answer to Question 5 above.

The Central Bank expects to see a physical presence located in Ireland and for there to be at least one employee in a senior management role located physically in Ireland, to act as the contact person for engagement with the Central Bank.

The Central Bank’s Instruction Manual and Guidance Note states as follows: “An Applicant Firm seeking registration as a VASP must be acting in the State. In general, the Central Bank interprets “acting in the State” to mean a corporate body constituted under Irish law, or a branch, or agent, or a sole trader, which is operating its virtual asset services from an establishment, or via a physical presence, in Ireland.”

On 11 July 2022, the Central Bank published a bulletin in relation to VASPs. It identified, in the vast majority of applications, a lack of understanding and compliance with key AML/CFT obligations, in addition to significant and widespread weaknesses in proposed risk and control frameworks. These weaknesses resulted in a significant number of the applicant firms not being able to demonstrate to the Central Bank that they could meet their AML/CFT obligations. 

In relation to CASP applications, as noted above, we envisage that there would be set-up costs given that the Central Bank will expect to see a physical presence located in Ireland.

One of the benefits of MiCA’s harmonised rules is that authorised CASPs can provide crypto-asset services throughout the EU by passporting, either through the right of establishment (including through a branch) or through the freedom to provide services. CASPs that provide crypto-asset services on a cross-border basis will not be required to have a physical presence in the territory of a host Member State.

CASPs have numerous ongoing regulatory requirements under MiCA, including governance arrangements, obligations regarding the disclosure of conflicts of interest, marketing requirements and prudential safeguarding requirements.