VAITOS: A major milestone for our financial services industry
A few months ago, our jurisdiction crossed an important milestone in its journey. The Virtual Asset and Initial Token Offering Services Act 2021 (the “Act”) came into force on 7th February 2022. The Act was passed by the Mauritian National Assembly on 10 December 2021. This culminates a judicious attempt by the local authorities to set up a comprehensive framework for regulating virtual assets. The rapid enactment of the Act was also strongly motivated by the recommendation 15 of the Financial Action Task Force and the desire to have Mauritius removed from the FATF grey list.
Serving its purpose
Despite being motivated mainly by AML/CFT considerations, the Act serves its purpose and has laid down crucial directives and structures for the framework and brings clarity:
- It empowers the Financial Services Commission, Mauritius (the “FSC”) to regulate and supervise Virtual Asset Service Providers (“VASPS”) and issuers of ITOs within the non-bank financial services sector in Mauritius.
- It defines a Virtual Asset (“VA”) as a digital representation of value that may be digitally traded or transferred, and may be used for payment or investment purposes; but does not include a digital presentation of fiat currencies, securities and other financial assets that fall under the purview of the Securities Act.
- It defines a VASP as a business conducting one or more of the following activities or operations:
- Exchange between virtual assets and fiat currencies;
- Exchange between one or more forms of virtual assets;
- Transfer of virtual assets;
- Safekeeping of virtual assets or instruments enabling control over virtual assets;
- Administration of virtual assets or instruments enabling control over virtual assets;
- Participation in, and provision of, financial services related to:
- An issuer’s offer and sale of a virtual asset;
- An issuer’s offer or sale of a virtual asset;
- It defines assets that could be portrayed as VA but that do not fall under the ambit of the Act and service providers that could be portrayed as VASPS but that do not fall under the ambit of the Act.
- It defines the different classes of VASP licences. In that sense, it adequately captures the activities as laid out above.
- It sets up the necessary links to related regulations and laws namely: The Asset Recovery Act, The Courts Act, The Financial Intelligence and Anti-Money Laundering Act, The Financial Services Act, The Income Tax Act, The Insolvency Act, The Ombudsperson for Financial Services Act, The Securities Act, The UN Sanctions Act 2019 and The Securities (CIS)assets and its related businesses with the other laws and regulations in the country.
Focus on digital currencies
It is important to note that the Act adds on to an existing framework and focuses on digital currency except any eventual Central Bank Digital Currency. It does not directly oversee other types of virtual assets such as security tokens, utility tokens, non-fungible tokens nor WEB 3.0 projects. It also excludes closed-loop items like those that could be used on loyalty programs and private networks. It also appears that Security Tokens are still regulated under Fintech Series Guidance Notes 2 and 3 of the FSC.
Laudable journey under a progressive and forward-looking path
This culmination marks a laudable journey of nearly five years. The local authorities had been on a progressive and forward-looking path with several initiatives to first prevent the exclusion of the asset class from the financial services ecosystem, leveraging on the existing Securities Act and Financial Services Act. Gradually they defined the requirements for exchanges and custodians. In the transition process, they introduced the Fintech Sandbox license in a way not to penalize potential VASPS who wanted to set up base in Mauritius. Guidance was also given on Securities Token Offerings. The FSC further initiated consultation on the matter with industry players in July 2021 and completed its National Risk Assessment with respect to VA sector in November 2021. The relevant regulations, guidance notes and consultative papers include:
- FSC Fintech Series Guidance Note: Recognition of Digital Assets as an asset-class for investment by Sophisticated and Expert Investors (17 September 2018)
- Financial Services (Custodian services (digital asset)) Rules 2019 (28 February 2019)
- FSC Fintech Series Guidance Note 2: Security Token Offerings (STOs) (8 April 2019)
- Economic Development Board, Mauritius – Regulatory Sandbox Licence: Guidelines for fintech projects (December 2019)
- FSC Fintech Series Guidance Note 3: Security Token Offerings and Security Token Trading Systems (15 June 2020)
- Ministry of Financial Services and Good Governance, Mauritius – Industry Consultations on the proposed enactment of the “The Virtual Asset Business Bill” (July 2021)
- The Virtual Asset and Initial Token Offering Services Act 2021 (Passed 16 December 2021, enacted 7 February 2022)
- FSC Frequently Asked Questions – Virtual Asset and Initial Token Offering Services Act 2021 (9 February 2022)
- FSC AML/CFT Guidance Notes for Virtual Asset Service Providers and Issuers of Initial Token Offerings (28 February 2022)
The Act sets out five classes of VASP licence:
Class “M” – Virtual Asset Broker-Dealer
Class “O” – Virtual Asset Wallet Services
Class “R” – Virtual Asset Custodian
Class “I” – Virtual Assets Advisory Services
Class “S” – Virtual Asset Market Place
These licences provide sufficient framework to capture the VASP activities as described under the Act. It further defines ancillary services and products that do not fall under the ambit of the Act. The good thing is that the framework now sets out what a service provider can or cannot do without a licence or conversely when you should seek a licence and most importantly how to do so.
Accompanying guidance notes
Ancillary to the Act, we have the AML/CFT Guidance Notes that set out the main areas of concern on AML/CFT considerations when it comes to VA. Any VASP that supports peer-to-peer transactions needs to develop its system for red flag indicators. Anonymity is another area of concern. This feature must not be used to route money laundering and terrorist financing. Transaction monitoring must also be taken care of given the flexibility and speed to transactions in the space. Besides these areas, any VASP is expected to conduct traditional KYC/AML checks on both parties to any transaction and also perform due diligence on the business model of the project. KYC/AML considerations will not affect all VASPs in the same way. VASPs promoting marketplaces will face higher risks. Others will have greater ability to do client screening and exert more control on the parties to each transaction. VASPS will also have the possibility to use AML/CFT Risk-Based Approach (“RBA”). This will provide reasonable flexibility to VASPS to accommodate for high-risk clients which would have been otherwise excluded. Unfortunately for the sector, the current structure of risk scores classifies most activities supported by VA as high risk by nature of the design of the business model. Actually most digital and online business models are classified as high risk, not only those of VA. The most important is not to exclude high risk activities and clients and to understand how to manage the risks and report them. Afterall, the aim is to develop business processes that allow our businesses to grow and position ourselves as promoters rather than trying to win excellence awards in the field of KYC/AML, position ourselves only as administrators and back-office operators and stifle our front office sector.
Readiness of our regulators
Having a regulatory framework in place is a first step. The second step is to put it into practice. Despite all good deeds, the jurisdiction has shown very poor performance in terms of attracting VASPS to domicile their activities. Many challenges exist in the readiness of the regulator to assess the fitness and properness of applicants. Such assessment is not always prescriptive, and the regulator needs to use judgment. First obstacle is to understand the business model of the applicant. The business model will evolve around a proof of concept where the function of the token and its tokenomics will be tested. Then there is need to assess the soundness of the technology and platforms being used to host the token and its ecosystem. In many cases, there is no prescribed or historical standards. Many projects are based on innovative business models and newly developed technology. Other area of challenge would be the assessment of the cybersecurity infrastructure supporting the project. This would require a minimum understanding of IT systems, cryptography and cybersecurity practice and standards. Last but not least is the due diligence on the intermediaries and service providers to the project or VASP. Many VASPS will rely on other VASPS to run their business model and most of these VASPS will not be regulated in Mauritius.
A simple example is a Crypto Fund that needs to use numerous crypto exchanges and a few sub-custodians. What would the regulator consider as credible crypto exchange? How would they rate decentralized exchanges? Blockchain technology has introduced new business models that challenge existing standards. Fitting decentralized business models into existing traditional mindset is not an easy task. And it should not be the case that because a new business model cannot be categorized as per existing standards that it should be considered unsound or too risky and hence classified as not credible and ineligible. This would result of crowding out of good projects from our jurisdiction.
Another domain that poses challenge is KYC/AML practices. Not all foreign VASPS use traditional KYC/AML practices. This does not mean that their practices are not adequate. Many sees anonymity as a potential source of risk, but this does not mean that all users who use platforms providing anonymity are laundering money or financing terrorists. Many users like anonymity for privacy and convenience considerations. The point is that you could have the most comprehensive regulatory framework but if licensing authority is overtly stringent because of the above challenges, development of the sector will be stifled. The industry should draw parallels from other digital and online business models. The technological implications should not be too far away from online and digital banking models.
Gaps in the framework and shortcomings
As with any new framework, there are still areas where there are gaps. The framework still does not provide guidance on how to treat other virtual assets such as security tokens, utility tokens, NFTs and Web 3.0 projects. The last two asset sub-classes are seeing rapidly increasing global adoption through the sports, gaming and entertainment industries and are major contributors to bringing to the word the benefits of the blockchain technology. And they themselves depend on and are closely linked to other mainstream VA that fall under the purview of the Act. Second shortcoming is that the framework is focused more the “jurisdiction” rather than the local consumers and investors. It is important for the regulatory authorities to note that their actions have significant influence on the wide adoption of the technology in the country. They set the scene and if they paint a bleak picture, they might discourage local consumers and investors to adopt and the country will miss out on opportunities. Adoption in the sector is driven by the mass of retail consumers and investors and not necessarily expert investors and sophisticated investors. Lawmakers in the US and EU are professing on the benefits while warning players not to neglect investment risks and AML/CFT risks. Blockchain technology is expected to bring significant benefits in the fields of (1) financial inclusion, (2) efficient gains in terms of time, costs and new functionalities and (3) cross-border transactions.
It is also important for our regulators to appreciate that through online channels, retail investors already have legal access to platforms that provide access to the VA asset class. These retail investors need guidance and should be encouraged to seek appropriate financial advice. Singapore and Canada have devoted efforts to empower this segment and not leave them out of the system. Focus is put on customer/investor profiling and risk appetite followed by needs matching.
In that sense, the FSC should consider the review of their FSC Fintech Series Guidance Note 1. The note presumes that only expert funds and sophisticated investors have interest and access to the sector. This is incorrect and ignores the fact that the majority of consumers/investors in the space are of the retail category and already have access through online platforms like eToro, Binance, Coinbase, Robinhood and Paypal. And most of these platforms are supported by payment systems like Visa and Mastercard who facilitate payments to them. The FSC should treat investment in VA as with any investment in global securities markets. There are treated as specialized investments that require investors to have a sound understanding of the investments and risk involved. Point to note, investors can have access to the asset class with as little as USD 50 or even USD 10 if they use ETFs. Focus should be placed more on the understanding of the investment products rather than the size of the investment. Size is no longer a good proxy for level of sophistication. Countries like El Salvador and Central African Republic have understood these implications and are focusing more on turning all their citizens into netizens and sophisticated investors.
Developing a sound understanding of the Blockchain technology and encourage adoption and development of a safe ecosystem
It is critical that the regulators develop a sound understanding of the space and the trends and developments within. There will be increasingly blurring of lines between the different categories of virtual assets as each category leverages on each other for their operations and as platforms become more interoperable. It will also become easier to monetise the utility tokens and transfer them. Global adoption will also be supported by the mass of retail consumers and investors and not necessarily through institutional and sophisticated investors. New applications in sports, entertainment, gaming and the metaverse will pave to the way to unprecedented adoption.
The one thing that is certain is that we are moving towards an era of digital economies supported by digital ecosystems and subscription-based business models. Blockchain, digital ledger technology and VA provide the best suited tools to operate these ecosystems. We will need a currency to facilitate transactions, a currency to enable store of value, a currency or digital “oil” to operate digital applications and digital assets that will empower the transfer of physical and intangible assets. VA are here to stay, and their involvement will increase over time. It is important that we encourage the development of a robust and safe ecosystem. This will not only encourage local adoption but also attract global players to come and do business here. If you want VASPS to come, you first need to show them that you have conviction in their business models. A first step in that direction would be to encourage our local banks to provide more support to consumers and investors who wish to enter the industry. They should show more willingness to support transfers into foreign VASPS and should strongly consider offering crypto custody services.
AUTHOR – KRISHNA PATHER
