It's been a long time since the French ecosystem has been so upset, to say the least! For a few weeks now, some and others have been denouncing in the media and on social networks an "unprecedented" threat to the sector.

The object of this anger?

A bill that plans to accelerate the timetable on the licensing requirement for French companies operating in crypto, the famous "PSAN", that is to say "service providers on digital assets"!

Today, there are 60 PSANs in France, including Coinhouse, StackinSat, Forge (Société Générale's crypto subsidiary) or the biggest platform on the planet, Binance.

In Europe, there are more than 150, according to our calculations. Italy is in the lead with just over 70 PSANs, but the procedure for obtaining them is much more flexible. Germany has less than 10...

As a reminder, the PSAN status granted in France by the Autorité des marchés financiers (AMF) was created in 2019 by the Pact law. It provides a framework for players offering crypto services. This status provides for 2 levels:

• The registration

• The approval

Since 2019, all actors who want to operate in France - French or foreign - must register. Approval is only optional. To date, no one has yet obtained it.

Registration allows us to verify two things: the first is the reputability of the company's managers. "In particular, we check that they don't have a criminal record," says William O'Rorke, founding partner at ORWL Avocats, a firm that assists several crypto companies with their regulatory processes.

The second is the company's anti-money laundering policy and its ability to prevent the financing of terrorism. "This is the real important point of the registration," underlines William O'Rorke.

Registered actors must demonstrate that they have both a policy and a procedure to combat these illegal activities.

Registration vs. approval

The PSAN approval is much more restrictive, and it is precisely for this reason that it was decided from 2019 to make it optional, until the crypto startups can adapt to the future legislation. "The idea was to give the ecosystem time to prepare," explains a spokeswoman for the AMF.

In the meantime, the European Union has taken up the subject. After an intense battle in Brussels, which we followed week after week, it adopted a few months ago a regulatory framework for cryptos on the scale of the Old Continent: the MiCA (Markets in Crypto-Assets) regulation.

The text must be definitively voted by the Parliament next April, if there is no postponement, before coming into force in 2024 - and an 18-month adaptation period.

MiCA, which is directly inspired by the French Pact law, does not cover all crypto topics. DeFi (decentralized finance) and NFTs, for example, are not covered. Like the Pact law, and other laws in Europe, MiCA is almost essentially about crypto platforms - and also stablecoins (all the details are here).

Except that things have accelerated considerably in recent months with the FTX scandal. Faced with the scale of the fraud, regulators around the world have stepped up to the plate, explaining that the sector needs to be better supervised.

In Europe, several countries have indicated that they will tighten their regulation, even though the MiCA regulation is already supposed to do so.

"The fall of FTX has had a negative impact on the image of the sector and some people want to take advantage of it," explains Faustine Fleuret, president of the Association for the Development of Digital Assets (Adan).

It is in France that things have probably gone the fastest and the furthest with the amendment of Senator Hervé Maurey (UDI) which is due to arrive at the National Assembly on January 24 and which is generating as much criticism in the ecosystem.

This text provides that all crypto players who have not been registered before October 1, 2023 will have to go directly through the "approval" box without going through the registration. Oops! A little clarification though: all those already registered will be able to follow MiCA and comply by 2026.

"We are going to penalize the French ecosystem without providing real answers to the problem. This text would not have prevented a scandal like FTX," explains Faustine Fleuret.

A difficult step to take?

But beyond the issue of timing, it is the issue of approval itself that raises questions. For many crypto companies will not necessarily have the capacity to cross the hurdle. "It's a real challenge for many players," confirms Nicolas Louvet, the boss of Coinhouse (discover his exclusive interview).

What exactly does the agreement provide for?

There are of course the constraints related to registration: the good repute of the directors and the anti-money laundering policy.

But there are also other requirements:

• Provide financial information on the company: this concerns in particular the identity of the shareholders, direct or indirect, natural or legal persons, holding at least 10% of the capital or voting rights of the company seeking approval.

• The "contractual" documentation: each NSP must sign a detailed contract with the client explaining its commercial policy (its rates, its products, etc.). The contract must also include elements related to consumer protection and conflict management.

• A cybersecurity audit: in order to obtain (and keep!) the accreditation, the actors of the sector must proceed to an annual audit performed by a cybersecurity actor approved by the French National Agency for the Security of Information Systems (ANSSI).

• Capital requirements or insurance: PSANs must have a minimum of 150,000 euros of capital, as well as a percentage, to be determined, of capital proportional to the assets under management. If they do not have this equity, they can take out professional liability insurance.

If the first two conditions do not pose any problems, it is however much more complicated for the last two. Notably for financial reasons 💰

The cybersecurity audit alone represents several tens of thousands of euros per year. According to estimates, it is around 30,000 euros. And that's not counting the processes and skilled people that must be hired within the company. "Some are very far from it", explains an investor of the sector.

In terms of equity, the step is also quite high, and not only because a minimum of 150,000 euros of equity is required. Here too, "you need new skills in-house", explains William O'Rorke.

For those who would like to opt for professional liability insurance, the task is even more complicated since there is no such contract. "We are talking to insurers to unblock things, but it takes time," explains Faustine Fleuret.

According to our information, many insurers are still reluctant to insure crypto companies, especially due to the lack of a market. "It would take several companies in the sector," says one of them.

A few players such as Coinhouse, which has sufficient equity, have however managed to get insurance. But this remains an exception.

Added to this is a deteriorated market context with companies that have seen their activity slow down significantly. "The accreditation requirements represent a real financial effort," confirms Jonathan Herscovici, Co-Founder and CEO of StackinSat, registered as a PSAN, while also stating that he anticipated things. "We've been preparing for accreditation since the beginning."

An opinion shared by the boss of Bitstack, one of the other leading start-ups in the ecosystem, also registered. "This is clearly one of our big topics in 2023," explains its co-founder, Alexandre Roubaud.

All in all, obtaining approval should cost, between the various procedures (lawyers' fees, audits, etc.), several hundred thousand euros.

The risk of a market split in two

Other players not yet registered, such as PSAN, explain that they are afraid of not being able to take the step. "It's going to be very complicated," says one of them. "The risk for us, especially in this period, is not to put enough money on the product because of regulatory constraints," he adds.

Several players point to the risk of a fracturing of the market between the "small" and the "big". "Some will have absolutely no problem adapting and they will nibble away at the market while we will have to chase approval," criticizes the head of a French start-up.

Binance, Cryptocom and the other giants have indeed largely the means and the teams to get there without too much trouble. "We are working on it", confirms a manager of the most important platform of the planet, while specifying that "the step to cross between the registration and the approval is considerable for any crypto actor".

However, Binance's organization, and in particular its structural opacity, could pose some problems.

How will the subject evolve in the coming months? It's hard to know. The AMF explains that crypto-related activities require "strong regulatory requirements."

In the meantime, what is certain is that the approval could still be the subject of much discussion, especially if the French deputies decide to accelerate its timetable next week.