VASPs and WSPs who must enrol in the OAM register

Much has been said and written, and in many places, about the obligation for VASPs and WSPs to enrol in the register kept by the OAM and the MEF decree that finally implemented it.

As has been written before, the decree leaves the interpreter with the awkward task of resolving several issues: that of correctly identifying the subjects actually required to enrol, given that the provision is not sufficiently clear and does not merely identify the exchange and digital wallet platforms; that of the effects on VASPs and WSPs operating from non-EU countries, given that the decree expressly mentions as subjects required to enrol in the register only Italian operators and those based in other EU member states, and so on.

But there is one issue on which special reflection and focus is required: that of the sanctioning aspect and of possible mechanisms and powers to inhibit the conduct of business by those entities that operate without being entered in the register.

How is the OAM organized and what types of VASPs and WSPs are obliged to register?

To frame the question, we need to take a step back and understand what the actual function of the register kept by the OAM is and what are the roles, functions and powers of the actors that revolve around it: from the OAM itself, to the Nuclei di Polizia Valutaria, to the FIU, and so on.

Now, this register is not comparable, in terms of purpose and function, to the many qualifying registers provided for in the national system and also regulated at a European level, to be eligible for admission to which it is necessary to demonstrate special suitability requirements, whether in terms of professional skills, in terms of honourableness, or in terms of asset reliability. 

The obligation to belong to this type of register is provided for when the intention is to regulate access to activities or professions of particular social impact and delicacy: medical professions, other professions in which important client interests are handled (lawyers, accountants, etc.), banking and financial activities, in which savings (constitutionally protected) or other protected interests, such as consumer protection, etc., are affected.

Admission to these types of registers generally has an authorizing and qualifying function and is subject to supervision by bodies (professional orders, Bank of Italy, Consob, Ivass, etc., depending on the type of activity).

These bodies, first and foremost, are called upon to ascertain and assess the possession of the eligibility requirements provided for by the sector’s regulations (also through competitive procedures), and then have penetrating powers of control, sanctioning and inhibiting the performance of the activity in an irregular or abusive manner.

The case of the OAM register for VASPs and WSPs is quite different.

First of all, it is clear that entry in the register is only for the purpose of monitoring the performance of the activity, for anti-money laundering purposes (but also, implicitly, for tax control purposes), and not for the purpose of verifying the possession of particular eligibility requirements.

In fact, in order to enrol in the register, the legislation does not provide for any other requirement than having a registered office or residence in Italy. Moreover, pursuant to Article 17 bis co. 8 ter of Legislative Decree 141/2010, in order to obtain registration there is no need for any kind of assessment procedure, but a simple notification by persons operating or intending to operate in Italy.

Despite this, registration in the register, pursuant to paragraph 1 of the same Article 17 bis, is a conditio sine qua non for the professional exercise of the activity. Thus, this type of registration has an enabling and authorizing function.

That is the general picture.

What happens if an operator carries out this type of activity without being registered?

It is worth remembering that, as far as we are aware, there are many platforms, widely used in Italy, that have chosen not to register with the OAM register and to disregard, de facto, the Italian market.

In spite of this, there will be Italian users who will continue to use the services of these platforms.

So, what could happen?

One of the most widespread convictions is that in this case, the site through which the services are provided could be shut down.

Is this really the case? The matter is not so simple.

Let’s see what the rules say.

Paragraph 5 of Article 17 bis of Legislative Decree 141/2010 qualifies the exercise of this activity as abusive and provides for an administrative fine of between €2,065 and €10,329. 

If this were the only consequence at risk for those who operate without registration in the register, there would be much to be said for the deterrent effect of this sanction, if one considers that for legal persons the one-off contribution for registration in the register amounts to the considerable sum of 8,300 euros.

Paragraph 8b of Article 17a also states that:

“With the decree referred to in this paragraph, forms of cooperation are established between the Ministry of Economy and Finance and the police forces, suitable to interdict the provision of services related to the use of virtual currency by providers who do not comply with the reporting obligation”.

Article 6 paragraph 2 of the MEF decree of 13.1. 2022, therefore, following up on this provision, establishes that the special currency police unit, the departments of the Guardia di Finanza and the police forces may detect “the unauthorized exercise on the territory of the Italian Republic of services relating to the use of virtual currency and/or digital wallet services” and in this case they proceed to the ascertainment and contestation of the violation in the manner and within the time limits provided for by Law 689/1981 (the so-called decriminalization law, which regulates the contestation and imposition of administrative sanctions).

Scrolling through all the legislation, from the legal provision by which the OAM was established (i.e., Article 128 undecies of Legislative Decree 386/1993) to the one indicating the sanctions that the OAM may impose (the subsequent Article 128 duodecies), to those of implementing rank, it does not appear that the OAM has an autonomous power to order the obscuration of the website.

The OAM can remove from the register registered operators who commit certain types of violation. This would automatically make them “abusive” if they continue to operate after their removal from the register.

However, it would not appear that the OAM has any direct power over unregistered operators.

As it turns out though, the legislation repeatedly states that carrying out activities if one is not registered constitutes an abusive practice.

Which leads to reckoning with a provision that should be of great concern to operators who are considering the possibility of carrying out VASP or WSP activities on Italian territory, without bothering to register, perhaps operating from abroad: this is Article 348 of the penal code, which sanctions the abusive exercise of a profession.

The provisions of the regulation

The provision specifically states in the first paragraph that:

“Anyone who unlawfully exercises a profession for which a special State qualification is required shall be punished by imprisonment from six months to three years and a fine ranging from €10,000 to €50,000”.

The second paragraph also states that if a conviction is reached, this entails, among other things, “the confiscation of the things that were used or intended to commit the offence”.

Now, in cases where confiscation is envisaged for a certain offence, precautionary seizure may also take place. This is provided for, among other things, by Article 13(2) of Law 689/1981, i.e., precisely that law to which Article 6 of the MEF decree refers for the assessment of abusive exercise, as we have seen above.

This raises two questions. The first: can carrying out VASP or WSP activities in Italy without being registered with the OAM register integrate the crime envisaged by Article 348 of the Criminal Code? Second question: if so, would it be possible, in theory, to seize and then confiscate the website?

A reading of Article 348 suggests that yes, the absence of registration in the OAM register could integrate the violation.

It would seem that all the ingredients are there, firstly because Article 17 bis of Legislative Decree 141/2010 qualifies as abusive the exercise of the activity without registration. Secondly, because the same provision states that in order to exercise the activity one needs “a special qualification by the State” and, as we have seen, it may well be said that registration in the register in essence constitutes a special qualification by the State.

As to the second question (i.e. whether a website can be confiscated and possibly seized), the idea may sound strange: seizure and confiscation usually involve tangible assets whose availability (with seizure) and then ownership (with confiscation) are deprived.

In concrete terms, the law has admitted both the possibility of preventive seizure of a website “by means of obfuscation” by requiring the connectivity provider or the person who owns the electronic resource to carry out the technical operations necessary to make the site or page non-consumable to the outside world”, and the possibility of its confiscation.

This on the basis of the consideration that:

“It must be deemed to be definitively accepted that computer data in itself, insofar as it is normatively equated with a ‘thing’, can be subject to seizure”. 

In this sense, a ruling by the United Sections of the Criminal Court of Cassation (no. 31022 of 17.7.2015) is of central importance.

For this reason, the possibility appears anything but remote that, where it is found that exchange or virtual wallet services, usable from Italy, are provided by subjects, including foreign ones, who are not registered in the OAM register, the competent authorities may proceed with the charging of abusive exercise of a profession, and, if necessary, proceed both to the precautionary seizure of the website, and to its subsequent confiscation.

Admittedly, all these legal arguments lend themselves to many interpretative nuances and, certainly, the regulatory framework, as a whole very approximate, does not help to derive certainties.

All that remains is to wait and see what will happen in terms of application, when the system reaches its full potential.