My provider says it now falls under the European rules, what do I notice in practice?

What do you notice in practice from the European rules?

You notice the European rules in the number of questions you receive and in the information you are given unasked, and Paucitas sees that difference reflected in the files of recent years. At registration more is asked and substantiated. At a withdrawal a request for documents comes more often. And with the product itself comes information about costs, risks and the nature of what you are buying.

The AFM supervises providers of crypto asset services and handles the licence applications; without a licence or a notification from the AFM or another European supervisor those services may not be offered within the European Union (AFM on crypto service providers). The application of the European regulation on markets in crypto assets is described by ESMA (ESMA on MiCA).

That explains straight away why you receive more questions than a few years ago. The extra questions are not distrust towards you personally; they belong to the framework within which the provider works.

The wider context is set out on the pillar page crypto fraud investigation.

What a licence under the European rules does and does not say

A licence says something about supervision of the provider, not about the safety of your deposit, and Paucitas makes that distinction in every file in which the question comes up. Being under supervision means that a party has to meet requirements and that a supervisor can enforce them. It does not mean that a price behaves, that a counterparty delivers, or that an individual case ends well.

There is a second misunderstanding that comes past often. A party that says it falls under the European rules is not the same as a party that appears in a register. The statement costs nothing; the listing can be checked. That is precisely the difference you can test against.

There is also something you do notice as soon as things go wrong. With a party that appears in a register it is clear who the supervisor is and where a complaint belongs. With a party that does not, that address is missing, and then the route of your payments determines what can still be established. That is why the register check is useful not only beforehand but also afterwards: the outcome determines which kind of file you have.

What the underlying obligations around identification and client due diligence involve is explained briefly in the glossary under kyc and aml.

The register check under the European rules, and what you record from it

The register check is an action of a few minutes that is hard to reconstruct afterwards, and Paucitas therefore advises recording the outcome at the moment itself instead of later. Look the provider up under the exact statutory name, not under the trade name that appears in the app. Note the date and the time. Take a screenshot of the search result, including when nothing is found. And keep the link on which you searched.

Preferably do that check at the supervisor of the country where the provider is established, and not solely at the Dutch supervisor. A licence from another member state can carry through within the Union under the European rules, so that a party may be active here without appearing in a Dutch list. Whoever searches only in their own country therefore sometimes draws a conclusion that is too firm.

Those four details together form a record you have something to gain from later. If a dispute arises, the question is often what was known at the moment of the first deposit. A screenshot with a date answers that question; a memory does not.

Who assesses whether a platform is sound and on what basis is set out on the question page about who establishes whether a crypto platform is fraudulent.

Case, a provider that invoked the European rules

Case. A private individual was told by a provider that it had recently come under the European rules. The app showed a trade name, the terms and conditions a different name, and the confirmation email a third. He deposited, and at the first withdrawal a request for an extra payment came.

In the investigation the name from the terms and conditions could not be found in any European register. What could be traced were the addresses to which he had paid and the route the holdings followed afterwards, up to the point where the chain ended at a service provider.

The outcome was an overview with, per payment, the date, the amount, the hash and the destination, plus a passage about the three different names. Those three names turned out to be the most usable detail, because they showed which party had factually been dealt with.

The limit. Paucitas holds no funds itself and carries out no transactions on behalf of clients; the investigation records what happened and where the route ends.

For anyone going through this as a private individual, the working method is described on the page for private individuals.

What this means for anyone now considering an investigation

Anyone now considering an investigation is best advised to record the register status of the provider involved straight away, because that status is hard to demonstrate retrospectively in a file. Registers change under the European rules: a party can be added, a licence can be withdrawn, a name can change. What you see today is a detail of today.

Paucitas uses no automated analysis software, in any role. The investigation is carried out by hand on the basis of publicly accessible block explorers. Every transaction and every transaction hash is verified one by one before it is included in a report.

A Paucitas investigation takes between one working day and two weeks, depending on the size of the file and the urgency. An urgent report can be delivered within one working day and in exceptional cases the same day. A regular investigation is usually ready within three working days. For files with many transactions, several wallets or missing history, the lead time rises to around two weeks. A surcharge applies to urgent assignments.

Data is supplied digitally or at the office. Per case a delivery list is provided which states what data is needed. Where necessary Paucitas guides the collection and delivery of that data.

The order stays the same throughout: first the investigation, then you can file a criminal complaint using the report.

How you assess a platform before you step in can be read in the related blog recognising a fake crypto platform. If you are in doubt about the party you are dealing with, Paucitas will look with you at what can factually be established: see blockchain research or contact Paucitas.