QuickTake

In keeping with activity of both the EU-level financial regulatory and supervisory authorities as well as activity advanced at the national level by respective competent authorities, the German regulator has published a renewed and perhaps most comprehensive warning on investments in cryptocurrencies and crypto-assets. This warning contains a number of details ranging from definitions of core concepts (which go beyond definitions in law) as well as relevant risk factors. Financial services firms but also crypto-asset service providers will want to take note of the German regulator's focus and tone in this warning and update their client-facing documentation and general disclosures accordingly.

In light of both growing supervisory scrutiny in Germany but equally across the EU-27 on compliance with investor protection requirements such as investment advice as well as suitability and appropriateness requirements firms will want to ensure their marketing materials and client-facing documentation can pass muster. This is certainly the case given that both compliance obligations and supervisory scrutiny in this area will likely only increase in the transition to the EU's pan-European regime for the regulation of crypto-assets. Despite this renewed warning and equally irrespective of Germany's regulator and legislator advocating for comprehensive regulation of cryptocurrencies and crypto-assets, Germany remains one of the most supportive EU Member States for facilitating a safe, efficient and sustainable market for investors in cryptoassets as well as traditional products facilitating access to or tracking of cryptocurrencies and/or cryptoassets.

This Client Alert discusses the details of this new regulatory warning, the requirements that firms will want to consider and the outlook ahead given future rulemaking. This Client Alert should be read in conjunction with other standalone coverage from PwC Legal's RegCORE as it applies to developments relating to cryptoassets in German but also EU-wide regulation.

Overview

"Modern, digital and lucrative: this is the image that cryptocurrencies have among some private investors. Enthusiastic reports and investment tips on Bitcoin, Ether and Co. are circulating in the social media. In particular, apps for mobile trading make it easy to buy coins and tokens. However, investments in crypto assets are highly speculative - and just as risky." This is how the German Federal Financial Supervisory Authority (BaFin) on 4 February 2022 introduced the themes set out in its new and revised consumer protection warning for investors in crypto-assets. The rationale for such warning, which in its drafting can be interpreted as being token and technology agnostic and thus all-encompassing for fungible and non-fungible tokens and cryptocurrencies, reiterates the high speculative nature of the investments and the associated high risk.1

Importantly, due to BaFin's own legislative rulemaking, very much ahead of the finalisation of the EU's proposal for a Regulation on Markets in Crypto-Assets (MiCA), German law treats crypto-assets as "financial instruments" in the context of the German Banking Act (KWG). Thus, activity in relation to crypto-assets will, unless structural and/or statutory exemptions apply, require a KWG authorisation from the BaFin. This requirement has extraterritorial effect and thus BaFin's most recent update to its consumer protection warning should, even if at the time of writing it being only available in German, be of interest to all parties wishing to conduct activity with a nexus to Germany as well as investment recommendations published via social media – which the BaFin has also warned on.2

BaFin's focus in its most recent consumer protection warning provides a comprehensive consolidation (and revision) of its previous warnings. It also includes key concepts and approaches that have been previously covered at the EU-level notably by authorities such as the European Securities and Markets Authority. The overarching message is clear and simple, namely that when it comes to investments crypto-assets or traditional financial products with a crypto-asset exposure: the prospect of high returns always comes with high risks.

Accordingly, BaFin appeals to investors to exercise caution and conduct careful due diligence given that an investment in coins or tokens at the same time carries a high risk and possibly the entire invested sums being at risk of loss. BaFin's warning also sets out certain "risk factors" (discussed below) as well as definitions, both of which financial services providers but in particular crypto-asset investment service providers may wish to consider but also to include these in their client-facing materials or cross-reference to BaFin's warnings. BaFin also published in this consumer protection warning, details of its register of firms that it is or has been investigating for conducting unregulated activity. 3

There are also however some items that the BaFin warning is silent on and this is perhaps equally noteworthy in that the BaFin's warning does not extend to (at present) risks arising in the context of:

  • margin lending or otherwise borrowing of fiat currencies including to increase exposure in cryptoassets;
  • "atomic swaps" or lending crypto-assets against other crypto-assets;
  • cross-chain settlement of transactions in crypto-assets;
  • staking i.e., collecting rewards for holding particular crypto-assts
  • digital and operational risk to which crypto-asset trading venues as well as wallet providers (including those that are registered for crypto-custody services in Germany) might be exposed to, notably as a result of energy supply resilience challenges and/or cyber-crime (including fraud) causing trading outages or financial crime in fake platforms, fake coins, tokens, assets including non-fungible tokens (NFTs – NB the present warning does not single out any point on NFTs but might do so in a further revised form);
  • absence of depositor or investor compensation scheme protection outside of Germany (while it does warn on the absence of such protection in Germany); and
  • differing treatment on a cross-border basis in relation to regulation (including market abuse), tax and differing investor protection and disclosure obligations.

Important definitions of BaFin concerning crypto-assets

In the context of BaFin's risk analysis and contents of its warning, it also sets out a "glossary of terms". These include definitions (in German but translated in English below) for the following concepts that go beyond what is set out at law (in Germany or at the EU-level).

Blockchain:

Blockchains are tamper-proof, distributed data structures in which transactions are logged in chronological order, traceable, immutable and without a central authority. Blockchain technology enables ownership relationships to be secured and regulated more directly and efficiently than before, as a complete and unalterable data record provides the basis for this. Crypto-assets are just one application, although the best known, of this. Blockchain technology itself is innovative and novel but not problematic from a supervisory perspective.

Contracts for Difference ("CFD"):

CFD are a category of so-called derivatives, i.e., financial instruments whose price depends on how the price of an underlying asset develops. With CFDs, two parties bet by contract on how the price of a certain underlying asset will develop. Due to significant investor protection concerns, BaFin issued a product intervention measure in its general ruling of July 23, 2019, restricting the marketing, distribution, and sale of CFD to retail investors in Germany. Due to the high volatility of crypto-assets, a stricter leverage limit applies to these CFD. Retail investors in Germany are now only allowed to trade CFD with such underlying with a leverage of up to two (initial margin protection).4

Distributed Ledger Technology ("DLT"):

DLT refers to the technological framework around the use of distributed ledgers. Blockchains are based on this technology - so they are a possible application of DLT, and Bitcoin is the most well-known use case for the use of blockchains. However, blockchains or distributed ledgers can be used for many other applications and records besides Bitcoin, such as digital identity management. It is not uncommon to find synonymous use of the terms blockchain technology and distributed ledger technology in academia and practice.

E-money:

E-money is any monetary value. However, this monetary value must represent a claim on the provider, be created in exchange for payment of a monetary amount and be stored electronically. For example, customers can purchase E-money in the form of payment or voucher cards at retail outlets or on the Internet and then use it to pay at various online retailers.5

Volatility

Volatility refers to the range of fluctuation in exchange rates or prices. It is a measure of the intensity of fluctuations in the value or price of a value. Thus, volatility is also a measure of the uncertainty of an investment and its price risk. The higher the volatility, the more the price fluctuates and the higher the risk of an investment.

Certificates:

Certificates are securities that can generally be traded. Legally, they are debt securities. The holder has a claim to payment or repayment of a cash amount or delivery of an underlying against the issuer of the certificate under the conditions specified in the certificate.

BaFin's risk factors specific to crypto-assets

BaFin has put forward a collection of risk factors (in German – summarised and translated below for convenience) that it expects both investors to take note of but (perhaps more implicitly than explicitly) relevant firms to consider including in their client-facing documentation:

  • The price jumps and volatility (as defined by BaFin (see above)) of many crypto-assets are extreme. The possible triggers are manifold and hard for private investors to keep track of.
  • Price increases (such as in the past with Bitcoin) often have a self-reinforcing effect. The rising prices move more investors to buy as well. The way they are marketed gives the misleading impression, especially to private investors, that you have to react quickly in order not to miss out on the promised profits ("fear of missing out" effect or FOMO").6 The resulting investments, in turn, cause prices to continue to rise for the time being, without there being any substantial reason for this.
  • Falling prices, as recently seen with Bitcoin and Ether, are not necessarily a good entry point for an investment. This is because the further price development is not foreseeable.
  • In addition, there is uncertainty regarding the sale of crypto-assets. Here, the question arises whether, in case of need, a buyer can be found who will immediately buy the crypto-assets at the presented price. An example in this case represents crypto-assets where the number or the total value of the coins or tokens on the market is rather small. Here, there may be very few buyers and no trading opportunity i.e. there is illiquidity risk.
  • Also, IT risks play a major role in cryptocurrencies. There are always hacker attacks that lead to the ultimate loss of access to crypto-assets.
  • If the custody of the crypto-assets is taken over by the investor itself, there is the risk of loss of access not only in case of cyber-attacks (including but not limited to hacks), but also if access is lost due to carelessness.
  • A lot of information on crypto-assets comes from sources that are difficult to verify in terms of data quality and completeness or are simply dubious.
  • Many unserious (BaFin implies 'dubious') actors operating in the crypto-asset space.

BaFin's recommendations for investors and thus also for firms

With the above risk factors in mind, BaFin reminds investors of the need for careful due diligence and caution prior to and following them carrying-out their investment activity in crypto-assets and/or traditional financial products that are linked to or otherwise exposed to crypto-assets. This includes the BaFin's recommendations for the following key points:

Investors should have a sufficiently detailed understanding of crypto-assets and their risks

According to BaFin, in order to be able to invest in crypto-assets in a risk-mitigating manner, it is essential that there is at least a basic understanding of the technology behind distributed ledger technology and how blockchain technology works. Knowledge of financial investments is not sufficient. Without this basic knowledge, it will not be possible to adequately assess the opportunities and risks of an investment in cryptoassets.

At best, an investment in crypto-assets should be made as an addition to an existing portfolio that is broadly diversified into other asset classes. The reason for this is the highly speculative nature of crypto-assets as an asset class, as described above. It should also be refrained from investing only because the bank, broker or investment advisor offer access to crypto-assets or recommend them as an asset class for investment.

While the BaFin does not explicitly in the above cross-refer to existing German but EU rules on investment advice, suitability and appropriateness, the tone of the warnings and the recommendations imply, with distinct emphasis, that firms should consider their compliance obligations with these requirements and that they can evidence robust policies and procedures to reduce risks that investors might be exposed to.

Information about the nature of the different types of coins or tokens

The BaFin is clear in its warning that there are significant differences between the various types of cryptoassets. It is therefore in BaFin's view essential that investors understand the concept of the respective coin or token and the different attributes as well as what can (or cannot) be done with respect to such cryptoassets across different trading platforms as well as different blockchain protocols

BaFin recalls that one of the best-known crypto assets is still Bitcoin. This is based on the possibility of a nonstate substitute currency with a limited money supply. This is also an essential difference to money and book money, which can be acquired indefinitely. The creation of new units of value in Bitcoin is done through a predetermined mathematical process within a computer network, this process is called "mining". The idea behind Bitcoin is to use it to exchange for goods or services. However, the value of a Bitcoin is volatile as it is not guaranteed by any entity and is only equal to what the other party is willing to pay or exchange for it.

Compared to Bitcoins, the concept of so-called private stablecoins is very different. These are, as BaFin summarises it, digital assets linked to recognised legal tender such as the euro and the US dollar or to a basket of assets or physical goods via various stabilisation mechanisms. The theory behind stablecoins is to avoid extreme price fluctuations that are common with other cryptocurrencies.

However, the BaFin notes that acquiring stablecoins, such as Tether, Dai, or USD Coin, also exposes investors to significant risks. In particular, BaFin flags that the respective stablecoin issuer actually perform the promised hedging transactions and that these can actually bring about the desired value stabilisation. There is (at present) no supervisory monitoring of this.

Moreover, the BaFin concludes with its warning that 'other crypto-assets' are also structured quite differently. For this reason, the nature of the intended crypto-asset should be addressed before investing. This catch-all conclusion seeks to imply warnings for fungible and non-fungible crypto-assets.

Scope and limits of supervision

Role of BaFin in relation to cryptocurrencies

Supervisory requirements for the issuance of value units exist in only two cases. First, if cryptocurrencies and/or crypto-assets are structured in such a way that they are to be classified as securities, assets or investment assets (funds). And secondly, if private stablecoins are structured in such a way that they constitute so-called E-money (see BaFin's definition) or indeed a collective investment scheme.

In the case of cryptocurrencies such as Bitcoin, Ether, Litecoin, etc., neither the project initiators who created the program code ("protocol"), nor the "miners" who generate the respective new coins, nor the program code or the crypto value itself are subject to any supervisory review or monitoring. Even private stablecoins such as Tether are not (at present) subject to BaFin supervision. While this may change under MiCA, the BaFin warns investors that the absence of supervision by BaFin (and indeed other supervisory authorities) is a risk in its own right.

However, BaFin does supervise crypto-asset ervice providers operating in Germany that offer activities related to crypto-assets and cryptocurrencies, in accordance with statutory regulations. This applies, for example, to crypto trading platforms, providers of crypto ATMs and companies that offer the so-called cryptocustody business. However, BaFin is keen to state that the supervision of these companies does not represent a quality characteristic for the crypto-assets themselves that are acquired or held in custody

Equally, BaFin remindes investors that if a (regulated) service provider loses money or has to cease operations, there is no protection, from customer losses, such as deposit insurance or investor compensation schemes. Such schemes do not exist for crypto-assets and may not always capture failures of investment firms that would be covered by the EU's Investment Compensation Schemes Directive as implemented in German law. It should be noted that the latter has (regrettably at present) much lesser protection coverage levels than for example the EU's harmonised protection levels of EUR 100,000 under the Depositor Guarantee Scheme Directive.

Certificates and CFDs with crypto values as underlying asset

BaFin notes that there are more and more offers of certificates and financial contracts for difference (CFDs, see BaFin's definitions) with crypto-asset/currency values as the so-called underlying. According to BaFin, the risks of the crypto-asset/currency values are here passed on to the certificate or CFD. In addition, certain certificate product features can further amplify these risks. For example, if the price development of the cryptoasset/currency asset is disproportionately mapped in the financial instrument leverage in the CFD

In addition, certificates and CFDs are usually also associated with higher costs. The reason for this are the additional costs incurred by the product, for example, for hedging transactions (hedging conducted by the offeror of the CFD of its own market risk in the crypto-asset/currency), as well as the priced-in profit margin for certificates. In addition, the terms and conditions of a CFD may also be disadvantageous for (notably retail) investors if, for example, investment certificates provide for a short-term termination option by the CFD offeror. This is an area that the BaFin has already put under sufficient scrutiny in various MiFIR/MiFID II product intervention powers in respect of CFDs (most recently updated in 2019) and in respect of futures with "additional payment obligations" (see standalone coverage from PwC Legal's EU RegCORE on these developments).

Consequently, according to BaFin, certificates and CFDs involve additional risks, some of which are considerable and sometimes difficult for (notably retail) investors to understand. In addition, there is the risk that the issuer of the certificates or CFDs may go bankrupt or even become insolvent. This is called counterparty risk or issuer default risk.

Finally, it is almost impossible to enforce claims if the companies issuing the certificates or CFDs are based in countries outside the European Union or operate without the required license.

Information and investment tips on social media

BaFin recently warned (see standalone coverage on this development and analysis from PwC Legal's EU RegCORE) in respect of the dissemination of information and investment tips on social media platforms and messenger services.

BaFin's concerns are due to various actors, such as developers and providers of crypto-assets, but also financial influencers and other self-proclaimed experts, who often spread false promises. In addition, BaFin warns against the often-aggressive marketing of coins and tokens. Equally, BaFin expresses its worries that important information for potential investors is often withheld in posts, videos, etc. For this reason, BaFin has compiled recommendations on what to look out for in investment tips in social media. Investors are thus encouraged to:

  • check which social media channels/influencers are being "advised" by and who or what is behind it. If the identity of the author is not clear from a post and it is also not apparent what background the person has, the information should not be relied upon;
  • conduct a careful review of the investment advice so that the opportunities and risks can be fully surveyed and understood;
  • consider the financial motives of the tipster. As a rule, tipsters receive a commission from the company whose investment products they report on;
  • adopt caution in that very high profit promises mean that applying scepticism is advisable;
  • when switching to private messenger services for investment tips, caution is important. This will expose private contact information; and
  • in advance of relying on any investment advice those providing it should be due diligenced for indications of potential scams using social media.

Outlook

The BaFin's warning course comprehensive and prescriptive and thus set some important (perhaps welcome) goal posts on supervisory expectations. Some firms may need to consider whether and how they should revisit their risk warnings and other disclosures throughout the product design and governance considerations but equally the marketing, distribution and sales processes in their engagement with clients, in particular with respect to retail clients' customer journey along with client-facing documentation, risk representations along with post-trade reporting and disclosures. Despite the BaFin's updated rules, which are likely to be subject to on-going reviews in line with further supervisory action, BaFin and indeed the German government remains one of the most supportive EU jurisdictions in for facilitating a safe, efficient and sustainable market for investors in crypto-assets as well as traditional products facilitating access to or tracking of cryptocurrencies and/or crypto-assets.

Financial services and in particular crypto-asset service provider firms operating into or from Germany may want to consider stepping up their preparatory measures including their horizon risk management affecting what they can offer to clients and how. This might help firms in forward-planning the impact but also differences between the BaFin's rules as well as those supervisory expectations set by the EU-level authorities across the EEA, in particular on MiFIR/MiFID II suitability and appropriateness.7

While some of these rules and expectations may be overlapping, and some may stem from common EU principles or rulemaking, there are still a number of jurisdiction-specific requirements but also unintended conceptual divergences that firms are nevertheless expected to comply with, irrespective of EU-level aims of improving supervisory convergence of both the body of rulemaking, including in its Single Rulebook for financial services across the EU's Single Market but also the supervisory culture across relevant authorities.

Footnotes

1 Available (only in German) here.

2 See separate coverage on this development from PwC Legal's EU RegCORE.

3 Available (only in German) here.

4 See standalone coverage from PwC Legal's EU RegCORE on Germany's bans to retail clients in Germany in relation to CFD trading and futures with additional payment obligations.

5 It should be noted that at an EU level, EU rulemaking and supervisory interpretation thereof is clear that digital assets – whether crypto-assets or cryptocurrencies are not considered E-money

6 This is perhaps the first time globally that a regulator has used the popular term FOMO to refer to investment behaviour and related risks

7 For further details of PwC Legal's dedicated client-centric online services to help with horizon scanning, risk mapping (including with data lakes) and compliance framework documentation please contact PwC Legal's EU RegCORE.

Originally Published March 2022

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.