On April 23, 2021, the Bank of Portugal published Notice No. 3/2021, which regulates the procedures for filing, registration applications, and requests to amend the registration of companies that conduct or intend to conduct activities involving virtual assets. On January 24, 2023, the Bank of Portugal published Notice No. 1/2023, which sets forth the requirements necessary to ensure compliance with obligations regarding the prevention of money laundering and terrorist financing.

Registration of companies operating with virtual assets

Law No. 58/2020 of August 31, which transposed into national law Directive (EU) 2018/843 of the European Parliament and of the Council of May 30, 2018, into national law, amended for the second time the wording of Law No. 83/2017 of August 18 on combating money laundering and terrorist financing.

Under this amendment, certain activities related to virtual assets are now included in the list of activities subject to compliance with the provisions of the law on combating money laundering and terrorist financing.

Thus, under the current provisions of Law No. 83/2017, engaging in activities involving virtual assets requires prior registration with the Bank of Portugal; this law specifically provides for the possibility of establishing, by regulation, other elements that must be included in applications for registration—or for amendments to such registration—by entities that conduct activities involving virtual assets.

In light of the foregoing, on April 23, 2021, the Bank of Portugal issued Notice 3/2021, which sets forth the conditions for submitting to the Bank of Portugal applications for registration and amendments to the registration of entities that conduct, or intend to carry out, activities involving virtual assets in Portugal.

Given the operational realities of entities engaged in activities involving virtual assets, there has also been a need to specifically regulate prevention obligations regarding money laundering and terrorist financing; for this reason, the Bank of Portugal, in the exercise of its powers, issued Notice No. 1023 on January 24, 2023 (hereinafter «Notice 2023»).

Scope of Application 

The provisions of the 2021 notice apply to entities that intend to engage in or are engaged in, in Portugal, on a professional basis—either exclusively or in conjunction with other economic activities—at least one of the following activities:

• Services for exchanging virtual assets for fiat currencies; ;
• Exchange of services between one or more virtual assets; ;
• Services through which a virtual asset is moved from one address or wallet to another (virtual asset transfer).

Application for Registration

Applications should preferably be submitted through the Bank of Portugal’s website. Thus, just as with the electronic forms (which will be available online on the Bank of Portugal’s website), the documentation and supporting materials required for the registration application will also be submitted online through that website.

Alternatively, and only in cases of force majeure, applicant entities may complete the forms, attach the necessary information and documentation, and send them by mail to the Bank of Portugal. However, all such materials and documentation must also be submitted to the Bank of Portugal in digital form to ensure the accessibility, durability, reliability, integrity, and legibility of the information.

The Initial Request 

To file the initial application for registration, applicant entities must submit to the Bank of Portugal the forms set forth in Annexes I, I.A, and II of Notice 2021, duly completed.

Request for Change 

With regard to the processing of requests to amend a registration, the provisions of Notice 2021 set forth two procedures, depending on the type of amendments the requesting entity intends to make.

Thus, for most amendments, the provisions of Notice 2021 require that, within a maximum of 30 days from the date on which the respective events occurred (this deadline was already provided for in Article 112-A, paragraph 6, of Law 83/2017 of August 18), entities must submit the new form set forth in Annex I of the Notice, completed only in the sections applicable to the amendment.

The application must be accompanied by the information and documentation required in Annex I of Notice 2021, and only to the extent applicable to the proposed amendment.

If the change involves members of the applicant entity’s management or supervisory bodies, the relevant application must also be accompanied by the information and documentation required in Annex II of Notice 2021, and only in the section applicable to the proposed change.

However, in applications for amendments based on expanding the scope of activities to include virtual assets or on a change in the jurisdiction of the applicant entity—where that jurisdiction poses a potentially higher risk of money laundering or terrorist financing— it is necessary to submit an application in a format similar to the initial application for registration.

It should be noted that, in this type of request for a change in registration, when—in accordance with the provisions of the annexes to Notice 2021— information or documents are requested that were already provided in the initial registration application, the applicant may refer to those same items and documents, provided they are valid.

The Duty to Preserve 

All data and documents submitted by the applicant company to the Bank of Portugal as part of the initial registration application or an application to amend the registration must be retained by the Bank of Portugal for a period of 10 years and in such a way that they can be made available at any time. 

Communication to the Bank of Portugal 

Once registration has been granted to applicant companies, they must notify the Bank of Portugal of their effective start date for trading by email sent to ativosvirtuais@bancodeportugal.pt, within a maximum of 30 days.

Nonconformity 

Failure to comply with the provisions of Notice 2021 regarding the submission of the registration (specifically, everything mentioned above) will result in the Bank of Portugal will consider the requests as not having been submitted.

Furthermore, failure to register entities engaged in the trading of virtual assets also constitutes a particularly serious offense (pursuant to Article 169-A, paragraph ccc of Law 83/2017), punishable by fines ranging from €50,000 to €5,000,000 (for credit or financial institutions) or from €5,000 to €1,000,000 (for other entities).

The Duty to Inform and Cooperate

When the competence or suitability of beneficial owners, members of management or supervisory bodies, or other persons holding management positions in an entity that conducts business involving virtual assets is called into question, that entity must immediately notify the Bank of Portugal.

In addition, when renewing the term of office of a member of a management or supervisory body or of a person who holds a management position in an entity that conducts business involving virtual assets, the completion of the applicable fields in Appendix I and the collection of the declaration in Appendix II of Notice 2021 must be encouraged internally.

All measures taken to comply with this requirement must be documented and, as with the information and documents provided and submitted at the time of the initial registration application and the application for a change of registration, must be retained for a period of 10 years, so that they can be made available promptly to the Bank of Portugal at any time.

Opinion 2023 and the Strengthening of Prevention Responsibilities

With the publication of the 2023 notice, provisions regarding anti-money laundering and counterterrorism financing obligations have been incorporated into the legislation governing access to virtual asset-related activities in Portugal.

This measure introduces provisions that specifically address monitoring obligations, as well as identification and due diligence obligations, which must be complied with and implemented by entities operating with virtual assets in Portugal; although these obligations were already in place, they have now been expanded.

Among the other changes introduced by the 2023 Communication, with regard to oversight obligations, it is now mandatory for the companies in question to have, within their organizational structure, a member of the management body with executive responsibilities to oversee compliance with this obligation.

Conclusion

As was the case with the publication of Opinion 2023, legislation and regulations governing this activity are expected to expand. It should be noted that this phenomenon is relatively recent, and therefore, only as time passes and applicable legislation evolves will it become clear where legislation may or may not be necessary.

In any case, it should be emphasized that, in our view, the legislature should not make the process of contributing to the public domain overly complex, given that, as shown by the number of companies registered with the Bank of Portugal, this is, for the time being, a difficult business to enter in Portugal.

Another point to note concerns the format in which registration applications are submitted. Although the law clearly states that applications must be submitted using online forms, the fact is that, to date, no such forms have been made available, which demonstrates the legislature’s tendency to overcomplicate matters that may not need to be, a tendency that most likely extends to other provisions as well.

In short, we must not lose sight of the goal of simplifying these types of processes and reducing bureaucracy.