CTRL/SHIFT - 14 06 2026 PARTHENOPE STAGE - ADRIANA TORRES VERGARA - NAVIGATING EU'S DIGITAL FINANCE

All right. Um Thanks, Ionut, and hi everyone. Um I'm afraid that I will be speaking today about one of the less appealing topics of this conference. Um at least for you, for the industry, uh given that the EU has built one of the most um comprehensive regime uh regulating the digital assets um uh activity. Yet, some segments of the ecosystem remain um yet uncovered.

However, uh European regulators are starting to consider how to address them. And while they'll do it, uh the process of the revision of the markets in crypto assets regulation has also started. So, in my today's presentation, I will try to um to start reflecting on the first lessons of the implementation of the regime that we have in the EU, but also I would like to bring to bring you some intelligence on what is going on in Brussels, what is the European European Commission, the ESMA, and the EBA on how to move forward. And also, what could be um the approach for regulating these uh sections that still remain uncovered. I am Adriana Torres Vergara.

I am a lawyer, and I work for Digital Assets Association that is called the Dadan. We represent multiple players of the ecosystem before European and national institutions. You can see here um in the screen some of them from stablecoin issuers, exchanges, um but also players that are currently under the DLT pilot regime. One of our main annual activities is we we issue um a uh annual study on crypto assets adoption. It's an interesting one because it provides information on crypto assets acquisition, um profile investors in the EU, um using trends for crypto etc.

and and uh I think is is very useful. We try to bring this information as well to European regulators to demonstrate also comparing this year and previous year data with all the data that we have that the market is consolidating. As you can see in the screen by the percentage of current holders of crypto assets and acquirers, those are who have already acquired crypto assets. But let's jump into substance and before we discuss how the European regulatory regime is will move potentially, let's go into the different regulations that are currently applying. As you can see, we have a very large list here.

The digital assets markets are regulated by MiFID and by MiCA being MiFID the regulation that sorry directive that addresses financial instruments and some crypto assets could be considered as such and also operators offering services with it. Whereas MiCA regulated some specific crypto assets, it established three new categories and also it creates the category of crypto asset service provider on it. On the payment side of things, we have the payment services directive. I will say this is an efficiency of the European regulation that we have because MiCA establishes that the stable coins can be qualified as crypto assets and also as electronic money. This means that custody and transfers with stable coins will be considered as crypto asset services under MiCA but also a payment service which means that for those providers of those services will need two type of license for the purpose of contacting the same service.

This is very burdensome. So, I think I think this is something that needs to be fixed in the revision of Mika. From an AML perspective, we have the transfer funds regulation, which basically accommodates the travel rule requirements for crypto assets transfers, together with the holy AML package that basically also accommodates customer due diligence for the crypto assets activity. Um we also have the digital operational resilience, which basically establishes requirements not only for crypto asset services providers, but also for the infrastructure providers. So, those that are giving the IT infrastructure for crypto assets activity.

And then they will have to comply with ICT requirements, management, and and risk to report to the to the NCAs. Uh for the market infrastructure innovation, we have the DLT pilot regime. We will comment on the lessons from the application because it's really not being successful. Currently, we don't have that much players that are operating under this DLT pilot regime, but it basically establishes exemptions for those who want to do tokenization of financial instruments, and they want and they want to do settlement. Um on the tax side of things, we have DAC 8 basically establishing tax reporting for crypto asset services providers, but not only as we will see later.

Um we also have the data act and the GDPR. Those perhaps may be less considered, but are important as well. GDPR, I think I'm not sure if by the industry, but it establishes principles on data management, and therefore the question is how to accommodate those principles into the centralized infrastructure. Last year, we saw some clarifications from the European data protection Supervisor and still like some questions remain for the for for for the for for blockchains how to accommodate into them. We also see some contradiction between the European Data Protection Supervisor who is actually calling on players to make use of privacy preserving tools, whereas from an AML perspective the regulation prohibits that basically because the regulator is so risky averse and it feels that privacy preserving tools may be used to circumvent due diligence and to conduct criminal activity.

So see still something that needs to be fixed. The data act establishes a definition of what a smart contract is. The problem here at the time when the with the regulation was drafted. The definition of a smart contract does not necessarily meet the definition of what a smart contract means for us. However, the regulation requires that the smart contracts are designed to meet certain requirements and those requirements are not necessarily compatible with the smart contracts that we we what we refer as smart contract.

Then we also have the cyber resilience act which basically requires due diligence let say from a perspective of an IC cyber resilience from a cyber resilience perspective and the product liability directive which basically allows to to request liability for any any any cyber failure basically of a product. So jumping into the early lessons from the implementation of these legislations. When it comes to Mika many of you, um, perhaps you have, uh, dealt with it. It is a very complex complex regulation, and we've seen, um, a lot of challenges for the industry to, um, to get an agreement. Um, I think that MiCA has brought a lot of legal certainty, but it has also set up the bar so high.

And it makes it very hard, especially for small players, to be able to meet such requirements. Only those who have the resources, the structure, and also they are partnered with the with the right, um, uh, partners, uh, will be able to make it. We have seen also some inconsistent interpretation of some of the requirements. Actually, we have also seen the asthma, um, publishing some peer reviews establishing that some NCAs have had a bit a lighter interpretation of of of MiCA requirements. Um, and, uh, supervisory practices as well.

But this may be fixed in the new MiCA 2, um, and also through the market integration and supervision package that we will address later, where basically the European Commission is proposing to centralize supervision. This means that ESMA could be the authority that not only will supervise CASP rather than NCAs, but will also, um, uh, provide the authorization, the MiCA authorization. Um, yet we see this iteration between MiCA and MiFID. Sometimes the regulatory perimeter about the two is not sufficiently clear, and here we see some different interpretations among, uh, NCAs. And, um, and finally, we also have this problem about payments, the PSD3 and PSR.

This means the need of having two different licenses for the purpose of operating with a stable coins. When it comes to the um TFR, um the biggest problem perhaps is the lack of interoperability among travel rule protocols. Basically, this means if someone is using Notabene and some and the other CASP is using uh TRUST, as they are um not interoperable, there's no way to share the information and therefore information needs to be sent manually. Some CASPs are making use are sharing this information via email, but something that perhaps perhaps has put a bit of spotlight is that depending on where the other counterparty it is located, we're talking about transmission of data protection that is off borders. It's going off um uh the EU, which may not necessarily be aligned from a GDPR perspective.

Um apart from high compliance cost, we also see some problems with self-hosted wallets because the TFR says that for transactions over 1,000 euro, the um crypto asset of the beneficiary and uh um and and of the originator have to uh verify whether their its customer is controlling um or is the owner of that self-hosted wallet. This means that in certain situations, the CASP may have to do some KYC on a person that is not even its client. So, that of course uh imposes challenge because why I should give you information about myself if you are not even my service provider. Um and we also have um the uh sunrise issue or a customer um sorry, the counterparty due diligence challenges. What happens, for example, if I have to do some counterparty due diligence with a CASP that is not even located in the EU?

Where um, their uh, AML requirements doesn't oblige him uh, oblige the institution to provide me all the necessary information that is necessary for the purpose of the anti-money laundering European anti-money laundering um, regime. When it comes to DORA, I think you will all agree that is very, very uh, resource intense. And when it comes to DAC 8 as well. However, here we are also navigating more legal uncertainty because the scope of DAC 8 is even broader than MiCA. This means that some players that are not even crypto asset services providers under MiCA will have to report information on the tax authorities.

For example, information around NFTs because NFTs are not captured by MiCA, but are are captured under the DAC 8. The DLT pilot regime, um, I think that uh, it's really not successful. Where it the European regulator wanted to create a specific regime, um, basically we don't have that many participants and this is because the the the regulation established a temporality of 6 year to the license. The the scope is so narrow. It establishes thresholds on the issuance per um, financial instruments that are allowed and on the total um, volumes.

Uh, so it's it's quite restrictive restrictive. In terms of financial instruments that are allowed, similar only by play money bonds, um, uh, shares and then and some few others are are allowed. So, that really discourages um players from the participating in that regime because why I should pour that many resources into something that it it will just last 6 years. And again, this kind of this scalability is is uh is so limited. Um so, yeah.

Let's start thinking what is next. What is ahead? What is going to happen? Um currently, the regulatory gap that we see is DeFi, crypto lending, borrowing, and also some staking models. And we also see some gray areas.

Uh for example, for crypto perpetuals, um recently, the um the ESMA published a statement saying that um the product intervention measures that applied for uh um C- uh CFDs, so to for for traditional uh future perpetuals, uh sorry, perpetual futures, also apply to crypto perpetuals. This means that caps on the leverage will be imposed. Um other gray areas are prediction markets. We see uh some uh different interpretations there. For example, recently, uh the Spanish authority said that um uh well, banned um uh some some players in the in the in the sector from continue offering um uh services in Spain saying that this is gambling, so they need an authorization.

However, the European Commission is asking feedback from the industry in order to see whether prediction markets needs to be covered by the current MiCA regime. And we also have double issuance models uh um of EMTs. So, what is to come next? Well, recently, the European Commission has launched the public consultation requesting the sector across different areas. Some of them are covered by the current Mika regime, but some of them not.

And I think this also give us some information on what is the commission thinking, asthma thinking, European regulators thinking on what this Mika 2.0 should cover. When it comes to ARTs and EMTs, I think that in general it requests information about the appropriateness of prudential and liquidity requirements that are applying to them. As specifically interesting is the part on EMTs where it also ask, for example, if it makes sense to allow the reserve of of assets to be deposited directly into central bank accounts. And then what there's one specific issue around double issuance models.

I'm not sure if you know what double issuance means. Basically, entities, for example, such as Circle who is located in the US and who is issuing a token in the US, um has also a Mika compliant stable coin here. And so, because of the fungibility, this means that in the EU we may we may see tokens that are not issued by the by the the entity, the European entity, but the entity in the US. That has been flagged by the European Central Bank and the European Risk Board. And actually, it's been a fight between the European Commission and and the European Central Bank because the ECB has asked to ban that.

So, to give you some some intelligence, the European Commission was expected to publish the Q&A to clarify that currently Mika accommodates for double issuance models, Uh, that was banned because politically, um, some other institutions were not in agreement with the approach uh, by the European Commission. So, what the Commission has done, basically used this public consultation to say that double issuance, indeed, it is allowed by MiCA, and actually it asked whether it should be continued to be allowed or not. Um, it asked across different the consultation also asked about other other issues, for example, the interaction between MiCA and MiFID, whereas the consultation is requesting feedback from the industry to know if, um, um, crypt all crypto assets, uh, regardless they qualified as financial instruments or not, should be brought entirely into into MiCA. And then, we also see other parts that, as I mentioned before, are not covered by MiCA. This is, for example, in the case of DeFi, decentralized finance.

At the time when I was working in the Parliament, there was a big discussion, and it was decided that it wasn't, um, uh, we needed like, uh, informed informed, um, uh, yeah, negotiations to decide how or whether we wanted to or or the European regulator wanted to, um, to regulate DeFi. It was a very, um, nascent ecosystem, so the decision was to leave it out. The problem is how you carve out something from the regulation if you don't define it sufficiently. So, I think there is a problem of interpretation of what DeFi is. I think that for MiCA 2, we may see some elements that will further clarify, um, how to consider where a service is sufficiently centralized or decentralized.

But I But I think that the European Commission will go a little bit farther, and we may see some clarifications around the DeFi gatekeeper model. Um basically, this will consist on um those that are um connecting their clients with DeFi applications. Um and uh and yeah, and so the idea is um to indeed those that are offering a gate into DeFi to to to establish a new crypto asset service under MiCA. Uh another option that has been considered is the certification of a smart contract. This um is not the very first time that we are in this debate.

Uh it is something that uh the AMF um so the French regulator has thought about it. Um because some of the risk that the regulators are seeing when it comes to DeFi is the exposure of um uh of uh of a smart contracts. Um we may also see further clarifications on uh prediction markets and crypto perps uh where the commission is actually asking whether they should be regulated by MiFID or by um or by MiCA. Yield as well, we may see some clarifications to allow yield, but we I think we will see like a big battle there because we know that uh banks may uh oppose to that. And also um NFTs as well.

Um commission is requesting feedback on whether it makes sense to regulate uh NFT services similar to state uh staking, crypto lending, and borrowing. For staking, I think that currently those staking models that um uh purport custody of crypto assets are already uh covered by the regulation, but I think there is legal uncertainty about liquid staking tokens, whether they not sufficiently meet the uh crypto assets uh categories that are in Mika. And yeah, I think crypto lending and crypto borrowing, those will be two two two two services that will be further clarified in in in in Mika as well. And finally, tokenized deposits versus deposit tokens will probably be clarified as well. So yeah, I think that if Mika is is changed that will also mean the update of other pieces of legislations, especially when it comes to D5, how to accommodate the AML obligations in this regard.

And I think that's something that worries a lot the European Commission. And finally, the 28th regime. I'm not sure if you've heard about this initiative, but it basically allows entities to create well it basically allows you to create an entity, European entity from a fully digital manner in two days with yeah, cost of two 200 euros maximum. So this may be leveraged in the context of financial regulation included that for the tokenization of financial markets and for crypto as well. And I think that the 28th regime will be embedded in other European financial sectorial legislations in order to avoid cross-border fragmentation among member states.

So yeah, that's it. Thank you everyone. And if you have any questions, feel free to reach out. Thank you.