Law 58/2020 of 31 August implements into Portuguese law Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing. It enshrines in the Portuguese legal framework a first approach to the regulation of entities that engage in activities with virtual assets.

Under this Decree-Law, Banco de Portugal now assumes supervisory powers over entities providing exchange services (between virtual assets and fiat currencies, or between one or more virtual assets), transfer or custodian wallet providers of virtual assets ("activities with virtual assets"), with regard to compliance with money laundering prevention rules. Not only does it bring these entities within the scope of entities subject to compliance with legal obligations to prevent money laundering, but it also provides for a true limited prudential supervision of them by Banco de Portugal.

"According to the new law, Banco de Portugal
assumes supervisory powers over
entities providing exchange, transfer or
custodian wallet providers services for virtual assets."

Particular emphasis should be placed on the fact that the new law introduces a first definition of the concept of virtual assets in the Portuguese legal system. It defines these assets as "a digital representation of value that is not necessarily linked to a legally established currency and that does not have the legal status of a fiat currency, but is accepted by natural or legal persons as a means of exchange or investment and can be transferred, stored and traded electronically".

In its communication of 8 September, Banco de Portugal stated, in relation to such entities, that the power of Banco de Portugal is "limited to the prevention of money laundering and terrorist financing. It does not extend to other areas of a prudential, conduct of business or other nature". However, Law 58/2020 in fact introduces a system of prudential evaluation of these entities as a precondition to engage in activities with virtual assets.

In fact, the new law establishes a system to monitor the competence and suitability of persons with managerial roles and of beneficial owners of entities carrying out activities with virtual assets. However, the criteria for assessing suitability essentially focus on the risks of money laundering and terrorist financing.

"Banco de Portugal can refuse registration if it
identifies the existence of a risk of serious breach
of laws and regulations aimed at preventing
money laundering and terrorist financing."

It is now compulsory for entities intending to engage in activities with virtual assets to register with Banco de Portugal. The registration process requires (among others) the identification of the shareholders, beneficial owners and members of the management and supervisory bodies, and other persons occupying senior management positions. It also requires an analysis of the sufficiency of the entity's internal control mechanisms to prevent money laundering and terrorist financing. This analysis includes an assessment of the risks associated with its projected customer base, products and services, distribution channels to be used, and the geographical areas of operation envisaged.

Banco de Portugal will give notice of the decision on the initial application for registration within three months of the date of the application for registration or of sending any additional information that has been requested, and the procedure may not exceed six months. Among other reasons, Banco de Portugal may refuse the registration if it identifies the existence of a risk of serious non-compliance with laws and regulations aimed at preventing money laundering and terrorist financing.

It is therefore essential for entities that apply to Banco de Portugal for registration to engage in activities with virtual assets to provide sufficient information to (i) demonstrate the suitability and competence of persons occupying managerial positions, (ii) enable the full identification of the respective beneficiaries, and (iii) demonstrate that they are equipped with the technical and human resources, and the internal procedures, to mitigate the risks of money laundering.