AUSTRIA Trends and Developments Contributed by: Oliver Völkel, Jara Erhard and Bryan Hollmann, CERHA HEMPEL
Operational phase: training, monitoring and culture Once authorised, CASPs move into a phase where the sustainability of their frameworks is tested. Initial policy roll-outs are not sufficient; regulators expect a living compliance architecture. This includes: • continuous staff training on MiCA requirements, AML/CFT developments, ICT risk and market practice; • targeted client education, particularly for retail cli- ents, on product features, risks and safeguards; • ongoing monitoring of regulatory developments and supervisory expectations, followed by timely policy and process updates; • regular internal audits, thematic reviews and struc- tured incident management; and • transparent and proactive communication with supervisors. In this environment, “compliance culture” becomes a tangible operational factor: staff must be able to recognise regulatory risks and escalate them appro- priately, rather than treating compliance as a purely formal obligation. EMTs and “Dual Licensing”: When One Licence Is Not Enough A particularly practical question concerns whether, and under what circumstances, EMT-related services provided by a CASP may also give rise to a separate licensing requirement under PSD2. In its opinion on the PSD2/MiCA interplay, the EBA expressly noted that certain activities involving EMTs may qualify as payment services under PSD2. As a result, an addi- tional authorisation as a payment institution or elec- tronic money institution may be required. This applies in particular to (i) the transfer of EMTs on behalf of customers and (ii) the custody or adminis- tration of EMTs, in so far as such activities are to be classified as payment services. Moreover, depending on the specific business model, custodial wallets may also fall within the PSD2 framework where they qualify as “payment accounts”.
early in the process for the licensing procedure and for designing the business model, governance and policies – at a time when the entity is not yet generat- ing revenue, while personnel quality is already a deci- sive factor for the FMA’s licensing decision. Although the deputy MLRO role can, in principle, be combined with a managing director position, this presupposes that the individual has the requisite qualifications and sufficient time capacity. In practice, “applicant hunt- ing” has therefore become a critical path item in many authorisation projects. Reliance on group infrastructure and outsourcing standards Many CASPs rely on existing group or parent-com- pany infrastructure, for example for trading systems, custody, risk management or compliance tools. This is legitimate and often efficient, but it triggers strict requirements for outsourcing arrangements. The deci- sive question for supervisors is less whether outsourc- ing is permissible, and more whether it complies in full with the applicable European outsourcing framework. In practice, this entails: • formal, written outsourcing agreements with clearly defined scope and responsibilities; • detailed service level agreements for each out- sourced function, including performance metrics and escalation processes; • governance structures that ensure the CASP retains oversight, control and the ability to chal- lenge the provider; • evidence that the provider meets relevant EU requirements, including ICT and resilience rules (such as those under DORA); and • credible business-continuity planning to demon- strate that the CASP can maintain at least safe, reduced operations if a key service provider fails. Supervisory experience to date indicates that out- sourcing can accelerate time-to-market only if regu- latory requirements are incorporated into the design from the beginning. Attempts to retrofit compliant out- sourcing documentation late in the process tend to result in delays and follow-up questions.
56 CHAMBERS.COM
Powered by FlippingBook