FINLAND Law and Practice Contributed by: Jon Hautamäki, Max Atallah and Mikael Huhtala, Nordic Law
service is provided exclusively at the client’s own ini- tiative. However, MiCA’s reverse solicitation exemp- tion is interpreted narrowly, and firms may not rely on it as a basis for general marketing or active outreach to Finnish clients. 4.2 White Labelling White-label arrangements, under which an unlicensed firm uses the licence of an authorised CASP to pro- vide services to end clients, are not explicitly regulated under MiCA or Finnish law. Unlike MiFID II, which pro- vides a formal tied agent and appointed representa- tive regime for investment services, MiCA does not include an equivalent framework for crypto-asset ser- vices, meaning third-party distribution arrangements must be constructed within the general CASP authori- sation and outsourcing requirements under MiCA and DORA. The authorised CASP retains full regulatory responsi- bility for services provided under its licence, and the FIN-FSA will look through arrangements that appear designed to circumvent authorisation requirements. Outsourced functions must remain subject to the authorised CASP’s oversight and control. White-label arrangements are therefore permissible in principle but require careful legal structuring to ensure the authorised entity maintains genuine control over the regulated activities conducted and that the arrange- ment does not amount to unauthorised service provi- sion by the white-label partner. DeFi is not prohibited in Finland, but its regulatory treatment depends critically on the degree of decen- tralisation of the protocol or application in question. MiCA does not regulate genuinely and completely decentralised applications where no identifiable cen- tral operator exists. However, where a DeFi applica- tion or protocol is only nominally decentralised and an identifiable centralised entity operates or controls it, that entity is very likely to be classified as a CASP under MiCA and subject to the full authorisation and compliance framework. The boundary between genu- ine and nominal decentralisation remains an evolving 5. Decentralised Finance 5.1 Ability to Use DeFi
area without definitive regulatory guidance in Finland or at EU level. Firms authorised as CASPs in Finland may in prin- ciple utilise DeFi protocols in connection with their services, but must do so consistently with their regula- tory obligations under MiCA and DORA. Key concerns include ensuring that the use of DeFi protocols does not undermine client asset segregation and custody requirements, that ICT and operational resilience standards are maintained, and that AML and travel rule obligations are satisfied in respect of transactions conducted through DeFi infrastructure. The interaction between DeFi’s permissionless and pseudonymous characteristics and AML-compliance requirements presents particular challenges that require careful There is no specific corporate or legal structure in Finland designated for DeFi operations. Operators of DeFi protocols that fall within the scope of MiCA, by reason of having an identifiable central operator, would typically establish a Finnish limited liability company and seek CASP authorisation from the FIN- FSA. At least one member of the board of directors must reside within the EEA under the Finnish Limited Liability Companies Act. DAOs do not have a recog- nised legal form under Finnish law and therefore can- not themselves be authorised or hold licences. Where a DAO operates a DeFi protocol with Finnish nexus, legal liability and regulatory obligations would typically attach to the identifiable individuals or entities behind the protocol rather than the DAO itself. Genuinely decentralised protocols without an iden- tifiable operator fall outside the current regulatory framework entirely, though this position is expected to evolve as DeFi attracts increasing regulatory atten- tion at EU level in the coming period. 5.3 Liability Finnish courts and regulators have not yet issued significant guidance or enforcement decisions spe- cifically addressing liability and accountability in DeFi contexts. The general principle under Finnish law is that regulatory obligations and civil liability attach to identifiable legal or natural persons, meaning that case-by-case analysis. 5.2 DeFi Structures
234 CHAMBERS.COM
Powered by FlippingBook