ITALY Law and Practice Contributed by: Francesco Paolo Patti and Marta Vittoria Colombo, Studio Patti
5. Decentralised Finance 5.1 Ability to Use DeFi
4.2 White Labelling Under the MiCAR framework as applied in Italy, the use of white-label solutions is not prohibited per se, but it is subject to strict regulatory constraints. The fundamental principle is that crypto-asset services may only be provided by an authorised CASP, which remains fully responsible for compliance with all regu- latory obligations vis-à-vis clients and supervisors. In practice, an external firm may leverage the infra- structure or licence of an authorised entity only where the arrangement is properly structured as outsourcing. In such cases, the authorised CASP must retain full control and responsibility over the service, including client onboarding, decision-making, compliance, and risk management. The third-party partner must oper- ate within a clearly defined contractual framework, under the supervision of the authorised entity. Conversely, if an external firm markets or provides services to clients in Italy under its own brand, even where it relies on the technical infrastructure or MiCAR authorisation of another entity, it may be deemed to be independently performing regulated activities. In such circumstances, a separate CASP authorisation would be required. From a supervisory perspective, Consob carefully assesses these arrangements both at the authorisa- tion stage and on an ongoing basis. Particular atten- tion is given to governance, allocation of responsi- bilities and client-facing functions, to ensure that the services provided by third parties do not dilute regula- tory accountability. Importantly, outsourcing requirements are increasingly stringent, especially where they involve ICT and tech- nology providers. This is largely due to the applica- tion of the Digital Operational Resilience Act (DORA), which imposes detailed obligations on regulated entities in relation to third-party risk management. CASPs must ensure robust oversight of outsourced functions, including due diligence, contractual safe- guards, monitoring and contingency planning. Where critical or important functions are outsourced, addi- tional requirements apply, including enhanced super- visory scrutiny.
DeFi is not prohibited in Italy. Rather, its regulatory treatment must be understood in light of MiCAR, which does not expressly regulate decentralised finance. Recital 22 MiCAR clarifies that services pro- vided in a fully decentralised manner, without interme- diaries, fall outside the scope of the Regulation. On this basis, purely decentralised protocols – where no identifiable entity exercises control or provides ser- vices on a professional basis – are, in principle, not subject to MiCAR authorisation requirements. That said, the practical boundary of what constitutes “fully decentralised” remains uncertain. Unlike some other European regulators, Consob has not yet tak- en a formal position or issued detailed guidance on the criteria to assess whether a protocol meets this threshold. It is nonetheless noteworthy that Consob’s enforcement activity – particularly its numerous warn- ings against non-compliant operators – has not, to date, been directed at DeFi protocols as such, but rather at identifiable entities providing services with- out proper authorisation. As regards centralised operators, CeFi firms (including CASPs) are not prohibited from interacting with DeFi protocols. In theory, they may utilise such protocols in connection with services offered to clients which are not covered by MiCAR, for example in areas such as lending and borrowing, staking or liquidity provision. However, this raises significant regulatory concerns. First, where a CASP integrates DeFi functionalities into its offering, it remains fully responsible vis-à-vis clients and regulators. Second, such activities are generally regarded as high-risk from a supervisory perspective. Key concerns include smart contract vulnerabilities, lack of governance transparency, counterparty risk, and potential difficulties in ensuring compliance with AML and investor protection standards. For this rea- son, Italian authorities are likely to subject such mod- els to heightened scrutiny. 5.2 DeFi Structures While DeFi is not prohibited in Italy, the jurisdiction is not generally regarded as particularly favourable
348 CHAMBERS.COM
Powered by FlippingBook