Approval: the big challenge facing crypto start-ups

As a reminder, the PSAN status granted in France by the Autorité des marchés financiers (AMF) was created in 2019 by the Pacte Act. It provides a framework for players offering crypto services. This status provides for 2 levels:

• Registration

• Authorisation

Since 2019, all players who want to operate in France - French or foreign - must register. Accreditation, on the other hand, is only optional. To date, no one has yet obtained it.

Registration makes it possible to check two things: the first is the good repute of the company's directors. "In particular, we check that they have no criminal record," says William O'Rorke, founding partner at ORWL Avocats, a firm that assists several crypto companies with their regulatory procedures.

The second frames the company's anti-money laundering policy and its ability to prevent the financing of terrorism. "This is the real important point of registration," stresses William O'Rorke.

Registered players must demonstrate that they have both a policy and a procedure aimed at combating these illicit activities.

Registration vs approval

PSAN approval, on the other hand, is much more restrictive, and it is precisely for this reason that it has been decided from 2019 to make it optional, until crypto start-ups can adapt to the future legislation. "The idea was to give the ecosystem time to prepare," explains an AMF spokeswoman.

In the meantime, the European Union has taken up the subject. After an intense battle in Brussels, which we have followed week after week, a few months ago it adopted an Old Continent-wide regulatory framework for cryptos: the MiCA (Markets in Crypto-Assets) regulation.

The text must be definitively voted by Parliament next April, if there is no postponement yet, before coming into force in 2024 - and an 18-month adaptation period.

MiCA, which is directly inspired by the French Pacte law, does not cover all crypto topics. DeFi (decentralised finance) and NFTs, for example, are not covered. Like the Pacte law, and other laws in Europe, MiCA almost essentially concerns crypto platforms - and also stablecoins (all the details are here).

Except that things have accelerated sharply in recent months with the FTX scandal. Faced with the scale of the fraud, regulators around the world have stepped up to the plate, explaining that the sector needs to be more closely supervised.

In Europe, several countries have indicated that they will tighten their regulation, even though the MiCA regulation is already supposed to do so.

"The fall of FTX has had a negative impact on the sector's image and some people want to take advantage of this," explains Faustine Fleuret, president of the Association for the Development of Digital Assets (Adan).

It is in France that things have undoubtedly moved the fastest and furthest with the amendment by Senator Hervé Maurey (UDI) which is due to arrive at the National Assembly on 24 January and is attracting just as much criticism in the ecosystem.

This text provides that all crypto players who have not been registered before 1 October 2023 will have to go straight through the "authorisation" box without going through registration. Oops! A word of clarification though: all those already registered will be able to follow MiCA and comply by 2026.

"We're going to penalise the French ecosystem without providing any real answers to the problem. This text would not have prevented a scandal like FTX," explains Faustine Fleuret.

A difficult step to take?

But beyond the timetable issue, it is the approval itself that raises questions. For many crypto companies will not necessarily have the capacity to clear the hurdle. "It's a real challenge for a lot of players", confirms Nicolas Louvet, the boss of Coinhouse (find out more in his exclusive interview).

What exactly does the authorisation provide for?

There are obviously the constraints relating to registration: reputability of directors and anti-money laundering policy.

But there are also other requirements:

• Providing financial information about the company: this relates in particular to the identity of shareholders, whether direct or indirect, natural or legal persons, holding at least 10% of the capital or voting rights of the company seeking authorisation.

• "Contractual" documentation: each NSP must sign a detailed contract with the customer setting out its commercial policy (rates, products, etc.). The contract must also include information on consumer protection and dispute management.

• Cybersecurity audit: to obtain approval (and keep it!), industry players must undergo an annual audit by a cybersecurity expert approved by the French national agency for information systems security (ANSSI).

• Equity requirements or insurance: NSPs must have a minimum of €150,000 in equity, as well as a percentage, to be determined, of equity in proportion to assets under management. If they do not have this equity, they can take out professional indemnity insurance.

While the first two conditions do not pose any problems, the last two are much more complicated. Not least for financial reasons 💰

The cybersecurity audit alone costs several tens of thousands of euros a year. Estimates put it at around €30,000. And that's not counting the processes and the qualified people who need to be hired within the company. "

On the equity side, the staircase is also quite high, and not just because a minimum of €150,000 of equity is required. Here too, "you need new skills in-house", explains William O'Rorke.

For those who would like to opt for professional indemnity insurance, the task looks even more complicated as there is no contract of this type. "We're talking to insurers to unblock things, but it's taking time," explains Faustine Fleuret.

According to our information, many insurers are still reluctant to insure crypto companies, not least because of the lack of a market. "It would take several companies in the sector," explains one of them.

Some players such as Coinhouse, which has sufficient equity capital, have nevertheless managed to get insurance. But this remains an exception.

Add to this a deteriorated market context with companies seeing a sharp slowdown in activity. "The accreditation requirements represent a real financial effort," confirms Jonathan Herscovici, Co-Founder and CEO of StackinSat, which is registered as a PSAN, while making it clear that he had anticipated things. "We've been preparing for accreditation from the start."

An opinion shared by the boss of Bitstack, one of the ecosystem's other flagship start-ups, which is also registered. "This is clearly one of our big issues in 2023", explains its co-founder, Alexandre Roubaud.

All in all, obtaining registration is expected to cost, between the various procedures (legal fees, audits, etc.), several hundred thousand euros.

The risk of a market split in two

Other players not yet registered, such as PSAN, say they fear they will not be able to take the plunge. "It's going to be very complicated", explains one of them. "The risk for us, especially at this time of year, is that we won't be able to put enough money into the product because of regulatory constraints", he adds.

Several players also point to the risk of a fracturing of the market between the "small" and the "big". "Some of them will have absolutely no problem adapting and they'll nibble away at the market while we'll have to chase approval", criticises the boss of a French start-up.

Binance, Cryptocom and the other giants in fact largely have the means and teams to achieve this without too much trouble. "We're working on it," confirms a manager from the largest platform on the planet, while pointing out that "the step to take between registration and authorisation is considerable for any crypto player".

Binance's organisation, and in particular its structural opacity, could pose a few problems for it, however.

How will the subject evolve over the coming months? It's hard to say. The AMF explains that crypto-related activities require "strong regulatory requirements".

In the meantime, what is certain is that the authorisation could still be much talked about, especially if French MPs decide to speed up its timetable as early as next week.