Italy
General financial regulatory regime
In relation to the performance of banking, financial or payment services, the main Italian supervisory authorities are:
- the Bank of Italy, which is the central bank of Italy and is entrusted with the overall regulatory supervision of banks and other financial intermediaries, including payment services providers and e-money issuers; and
- the CONSOB, which is the Italian government authority responsible for regulating the Italian securities market as well as the provision and marketing of investment services.
CONSOB is entrusted with supervision on transparency and correctness of regulated entities, including banks and financial intermediaries providing investment services and monitoring compliance with the rules of conduct generally imposed on such intermediaries.
Additional authorities also operate, in relation to specific sectors (eg insurance) or in connection with specific issues (eg competition and data protection).
General
The provision of banking, financial and payment services in Italy is reserved to authorized intermediaries. A person must not carry on a regulated activity in Italy unless authorized or exempt.
Consequently, where FinTech products and applications involve financial activities falling within the scope of the required regulatory authorizations, the firms providing such products and applications, if not otherwise exempt, must be authorized/passported, as the case may be.
Following a public debate involving market operators and based on a document for discussion CONSOB recently published a report on the initial offers and exchanges of crypto-activities. Pending the establishment of a shared European regulatory framework on crypto-assets and, in particular, on their possible qualification as securities, CONSOB’s intention was to start a debate at national level on initial coin offerings (ICOs) and crypto-assets exchanges, in connection with the recent spread of ICOs and therefore, of crypto-assets invested in by Italian investors.
Electronic payments platforms and regulation of peer-to-peer lenders
Electronic money (e-money)
Reference shall be made to the provisions of the e-money directive No. 2009/110/EC (EMD) and to its national implementing measures, which include the Consolidated Banking Act and Legislative Decree No. 45, 16 April 2012, containing the EMD's implementing decree, both as amended from time to time. Moreover, for a complete understanding of the applicable legal and regulatory framework, also the rules regulating the provision of payment services shall be considered, as well as the Bank of Italy secondary level provisions.
E-money is defined as the electronically (including magnetically) stored monetary value, represented by a claim on the issuer, which is issued on receipt of funds for the purpose of making payment transactions. E-money must be accepted by a person other than the e-money issuer and include pre-paid cards and electronic pre-paid accounts for use online.
All providers performing payment services or e-money related activities must be authorized by, or passported with, the Bank of Italy, although, based on the specific functioning mechanism, the management of electronic payment platforms could qualify as a reserved activity, subject to regulations governing payment service providers and e-money issuers, or fall within one of the possible exemptions (eg if the firm qualifies as a mere technical service provider supporting the provision of the relevant services without any involvement in their offering or performance).
Peer-to-peer lending
Peer-to-peer lending activities (also 'social lending' or 'lending based crowdfunding') are defined, under the Italian regulatory framework, as 'the mechanism through which a plurality of borrowers could demand to a plurality of potential lenders, by means of online platforms, refundable funds for personal use or to fund a project'.
Based on the similarity of such activities with those relating to the public savings collection and considering that the latter, in accordance with the Consolidated Banking Act, are exclusively reserved to duly authorized credit institutions, since November 2016, the Bank of Italy has regulated social lending by a regulation governing the performance of collection activities carried out by subjects other than banks. The relevant provisions mainly clarify the conditions to be complied with in order to avoid a qualification of social lending services as reserved savings collection activities.
Bank of Italy's regulation refers both to the managers of social lending platforms and to the subjects who collect or lend funds through such platforms and is generally aimed at preventing non-banking entities from raising significant amounts of funds vis-à-vis an indefinite number of borrowers. In this sense, managers and collectors are, in any case, precluded from collecting demand deposits and from carrying out other forms of collection whatsoever involving the issuance or management of payment instruments having generalized usability. No limits are imposed on banks in carrying out social lending activities through online portals.
The Bank of Italy does not have investigation or sanctioning powers on non-banks entities providing collection activities. Any infringement of the aforesaid provisions is governed by criminal law.
A special regime for the collection of risk capital via online portals (equity crowdfunding) is regulated by the Italian securities law (in particular by the Crowdfunding Regulation ( as amended by CONSOB resolution No. 21110 dated 10 October 2019), adopted by CONSOB pursuant to articles 50- quinquies and 100- ter of the Consolidated Financial Act). In equity crowdfunding, the securities respectively sold are issued by Italian innovative startups and small-to-medium-size companies or by certain undertakings for collective investments investing in those kind of companies. The managers of such portals shall comply with a set of requirements, and in order to be entitled to operate are then enrolled in a specific register kept by CONSOB.
Following recent amendments to the Consolidated Financial Act and the Crowdfunding Regulation, the Italian regulation also introduced the possibility, within certain limits, for the aforesaid entities to collect of bonds and other debt financial instruments through such online portals (debt crowdfunding).
The other possible forms of crowdfunding are not formally regulated and may be included – depending on the specific features and structures adopted – in other forms of financial activity, such as those relating to the granting of loans (whose performance is reserved to duly authorized financial intermediaries).
Regulation of payment services
Reference shall be made to the provisions of the PSD)2 and to its national implementing measures, which include the Consolidated Banking Act, and Legislative Decree No. 11, 27 January 2010, containing the PSD2's implementing decree (PS Decree), both as amended from time to time, as well as Bank of Italy secondary level provisions.
All providers performing payments services related activities shall be authorized by (or passported with) by the Bank of Italy.
In providing and marketing their services, payment services providers must also comply with the transparency and disclosure requirements set forth in the Transparency Provisions.
Application of data protection and consumer laws
The Italian Data Protection Code (Legislative Decree No. 193/2003) applies to the processing of personal data, including data held abroad, if the processing is performed by:
- an Italian or European Union company with a branch/stable organization in Italy;
- an entity established in the territory of a country outside the European Union, where said entity makes use in connection with the processing of equipment, whether electronic or otherwise, situated in the Italian territory, unless such equipment is used only for purposes of transit through the territory of the European Union; and
- a non-European Union controller processing data through a branch/stable organization in Italy.
Data processing under the Italian legislation may imply certain notification and compliance obligations and can give rise to privacy issues such as:
- whether the data is used appropriately;
- whether the collection of data is carried out in an appropriate manner;
- whether the data is disclosed only where disclosure is appropriate;
- whether the data is stored and transmitted safely;
- how long the data will be retained for;
- the circumstances under which the data subject can access and correct the data; and
- whether the data subject is sufficiently and appropriately informed about these matters.
The European General Data Protection Regulation (GDPR) will officially replace some of the provisions of the Italian Data Protection Code from 25 May 2018, but its principles are already being enacted in the Measures issued by the Italian Data Protection Authority. The GDPR is more prescriptive and restrictive and includes mandatory notifications where a breach occurs and provide for severe monetary sanctions in case of breach.
The Italian Consumer Code (Legislative Decree No. 206/2005) applies to any service offered to natural persons acting for purposes outside their trade, craft, business or profession. It includes rules relating to matters such as unfair commercial practices and unfair terms. In order to ensure compliance with the Italian Consumer Code, Fintech companies may consider the implementation of solutions aimed at monitoring and analyzing customer services, mitigating fraud and abuse, and implementing fair lending systems.
Money laundering regulations
The Italian rules governing the prevention of the use of the financial system for money laundering (AML) and/or terrorist financing (CTF) purposes are mainly contained in Legislative Decrees No. 231 of 21 November 2007 (AML Decree), and No. 109 of 22 June 2007, which implement the Fourth AML Directive) and Fifth AML Directives. Additional secondary level provisions which complete the new regulatory framework introduced by the Fourth and Fifth AML Directives have been issued by the Bank of Italy.
In general terms, the Central Information Unit (Unità di Informazione Finanziaria), established within the Bank of Italy, is empowered with supervision and monitoring powers on AML and CTF issues. The overall prevention system:
- is based on the collaboration and coordination between each of the operators and the administrative and investigation authorities;
- is regulated according to the risks involved; and
- requires the operators to comply with a series informative and record-keeping obligations.
FinTech services and activities, where relevant in light of the above, are subject to AML and CTF provisions, especially when involving activities considered as high money-laundering risks. Furthermore, with the implementation of the Fourth and Fifth AML Directives, the Italian legislator has expressly included “crypto currency operators” and “custodian wallet providers” within the category of the “other non-financial operators” subject to the provisions of the AML Decree. Crypto currency operators are defined as “any natural or legal person which provides third parties, in a professional capacity, with services that are functional to the use, the exchange, the custody and storage of virtual currencies and their conversion from, or into, currency of legal tender”, or in digital representations of value, including those convertible in other virtual currencies as well as issuing, offering, transfer and clearing any other service instrumental to the acquisition, negotiation or intermediation in the exchange of the virtual currencies”. Custodian wallet providers are, in turn, defined as “any natural person or entity that provides services to safeguard private cryptographic keys on behalf of its customers, to hold, store and transfer virtual currencies”.
It should be noted that, according to the aforesaid AML regulations, crypto-currencies operators and custodian wallet providers are, as of today, subject to the AML obligations to the extent that their operations include the performance of the activity of cryptographic storage or of conversion of virtual currencies from, or into, currency of legal tender.
In addition to the above, FinTech providers qualifying as banking or financial institutions or payment services providers shall also comply with the customer due diligence and on organisational requirements set forth in the secondary level regulations of the Bank of Italy.
Luciano Morello
Partner
DLA Piper LLP
[email protected]
T +39 338 690 73 96
View bio