Depositaries and capital management companies: Responsibilities in the Crypto Era

Background

In recent years, crypto assets have gained significant importance as an asset class. According to Article 3(1) No. 5 of EU Regulation 2023/1114 (MiCA), crypto assets are digital representations of values or rights that can be electronically transferred and stored using distributed ledger technology (DLT) or similar technologies. However, the innovative nature of these assets introduces new risks and regulatory challenges, particularly due to the control that comes with knowledge of the private cryptographic key, making them susceptible to threats such as hacking. 

The draft circular issued by BaFin specifies the supervisory requirements for depositaries and capital management companies involved in direct investments in crypto assets. Since the enactment of the Future Financing Act (Zukunftsfinanzierungsgesetz) in 2024, special alternative investment funds (AIFs) both with and without fixed investment conditions, other domestic public AIFs and closed public AIFs, are now permitted to invest directly in crypto assets. Investment funds are also permitted to directly acquire crypto assets, provided they meet the requirements of permissible assets of a collective investment undertaking (OGAW). 

Obligations of Depositaries 

Given the unique characteristics of crypto assets, depositaries have several critical responsibilities to ensure secure and compliant management of these investments. They must conduct a risk assessment before accepting mandates and establish appropriate supervisory processes. Additionally, depositaries are required to have sufficient resources and qualified personnel, including technical measures to secure private cryptographic keys. This includes the necessary qualifications for the managing directors (Geschäftsleiter) responsible for depositary functions. They must possess relevant theoretical and practical expertise regarding the assets intended for acquisition by an investment fund, as well as their custody both domestically and internationally. It should be noted that, as mentioned above, the investment opportunity in crypto assets through regulated investment funds is relatively new compared to other asset classes, so comprehensive experience at the management level may not always be available at this time. For this reason, BaFin acknowledges that it may suffice for managers to build the necessary practical experience within a period of six months after taking on the mandate, in addition to existing theoretical knowledge, which can be evidenced through completed training programs. 

Besides staffing levels, essential organisational precautions also encompass the availability of appropriate IT systems and processes. If the depositary has control over the crypto assets, it must implement a suitable crypto strategy or take specific measures to safeguard the crypto assets and/or the private cryptographic keys. 

Depositaries must also determine the eligibility of crypto assets for custody, with a particular focus on security tokens. Crypto assets referred to as "security tokens" may be transferable securities as defined in Annex I Section C of the MiFID II Directive, and thus qualify as financial instruments. Depending on the design, a security token may also be a crypto security. Crypto securities and shares in crypto funds are considered financial instruments under applicable regulations and are generally regarded as custodial financial assets.

Custody of crypto assets involves registering the depositary or a sub-depositary as the holder in the crypto (securities) register and ensuring that the private cryptographic key is assigned to them. Depositaries may delegate custody to sub-depositaries, provided they meet specific regulatory requirements. For assets that are not eligible for custody, depositaries must verify that the capital management company has acquired ownership or a similar legal position. Furthermore, depositaries must ensure that the public key is assigned to the crypto custodian or the investment fund, securing access to the crypto asset. 

Depositaries are also responsible for verifying that the acquisition of crypto assets complies with investment conditions and legal requirements, ensuring that transactions are conducted fairly and at market prices. 

Obligations of Capital Management Companies 

Capital management companies face their own technical and regulatory challenges when directly acquiring crypto assets. They must ensure that their licenses cover the direct acquisition of crypto assets; if not, an extension is required. Additionally, they need to have adequate personnel and resources, including training for existing staff and possibly hiring external experts. At least one managing director responsible for portfolio and risk management must possess sufficient theoretical and practical knowledge of crypto assets. 

Due to the technical and regulatory peculiarities associated with investing in crypto assets, the capital management company may need to adapt existing processes or even set up new ones. This means that the capital management company must successfully complete a new product process before the first investment in crypto assets. The following points, among others, must be taken into account: risk management process, increased risk of the assets being lost when investing directly in crypto assets, the selection and ongoing dialogue with the depositary and, if necessary, a crypto custodian, best execution policy, and unit value determination. 

When valuing crypto assets, as a rule, valuations must be based on prices from approved trading platforms, with procedures in place to address price discrepancies. 

Overall, this consultation paper provides a comprehensive framework for depositaries and capital management companies to effectively manage the unique risks and challenges associated with investing in crypto assets. By adhering to this circular, these entities can ensure regulatory compliance and protect the interests of their investors. Stakeholders are encouraged to submit their feedback by 31 March 2025. In a constantly evolving landscape of crypto assets, it is crucial for all involved parties to stay informed and actively participate in the regulatory process to help shape the final guidelines and ensure they are practical and effective. 

Authored by Dr. Sarah Wrage and Stefanie Franz.