In 2017, a definition of cryptocurrency was introduced by Legislative Decree No. 90/2017, dealing with the prevention of the use of the financial system for the purpose of laundering the proceeds of criminal activities and financing terrorism. Article 1, paragraph 2, letter qq) of the decree specifically described cryptocurrencies as “the digital representation of value, not issued by a central bank or a public authority, not necessarily linked to a legal tender currency, used as a means of exchange for the purchase of goods and services, and transferred, stored and negotiated electronically”. 

A definition of cryptoasset has also been recently introduced in the Italian legal system, with specific reference to the field of taxation law. Article 67, paragraph 1, letter c-sexies of the Consolidated Law on Income Taxes (TUIR), modified in 2022, now defines cryptoassets as a “digital representation of value or of rights which may be transferred or stored electronically, through the use of distributed ledger technology or similar technologies”. This definition follows the definition in the Markets in Crypto-Assets (MiCA) Regulation, which has recently been approved by the European Parliament. 

Initial coin offerings (ICOs), are not properly addressed by current legislation, but have been dealt with by the Italian Companies and Exchange Commission (Commissione Nazionale per le Società e la Borsa (CONSOB)), the public authority responsible for regulating the Italian financial markets, whose mission is the protection of investors. CONSOB addressed the matter in 2019 with a document titled “Initial Coin Offerings and Crypto-Assets Exchanges”, where it opted for a case-by-case solution, looking for financial features and distinguishing financial assets from non-financial assets in each single ICO. 

Italian case law has so far adopted a much stricter approach, finding financial features in most of the examined ICOs (Supreme Court, decision No. 44378/2022).

There is not comprehensive legislation unique to cryptoassets in Italy. However, along with the legislation mentioned above in Question 1, the recent modifications to the TUIR have classified incomes from cryptoassets in the category of “different incomes”, which are subject to taxation, though they have not been achieved in the exercise of a profession, by commercial enterprises, by corporate participation or due to the work as employee. 

Legislative Decree No. 90/2017, as mentioned above, addresses provisions designed to prevent money laundering. To achieve this purpose, the anti-money laundering and counter-financing of terrorism (AML/CFT) discipline, addressed by the Legislative Decree 231/2009 (modified in 2019), offers a definition of VASPs (Virtual Asset Service Providers), which includes both providers of services relating to the use of virtual currencies, such as exchange platforms, and digital wallet service providers. Since 18 May 2022 every provider of services related to the use of cryptocurrencies (“subjects”) must be listed in a special register (DLT Registry), under the supervision of the Italian financial regulator (Organismo Agenti e Mediatori (OAM)). 

Since 2019 this has included the providers of services related to the use of digital wallets. These subjects are described as those who professionally supply services to their clients to safeguard and store the clients’ private cryptographic keys to allow the transfer of virtual currencies. 

Finally, in May 2023, the FinTech Decree (Decree No. 25/2023) was adopted. Through this act, the Italian Government recognised the possibility of issuing financial products in a digital form, and regulated the transmission of shares, obligations and other securities in the form of tokens. These products can now circulate through the use of distributed ledger technology (DLT) platforms. 

The main concern within the Italian system is to distinguish assets which might be considered as types of securities from the others. Any attempt to identify different kinds of digital assets comes from an effort made by practitioners and competent authorities to delineate schemes capable of identifying the specific features of each token. 

Therefore, the only explicit regulation provided by law is that of security tokens, which fall within the applicatory area of Legislative Decree No. 58/1998 (the Consolidated Law on Finance (TUF)) and are subject to obligations and burdens where dealt with. 

Further, the approval of the FinTech Decree in 2023 has explicitly recognised the existence of security tokens, and has established the rules applicable to these kinds of assets, regulating their circulation and the rights connected to the ownership of a token. The DLT registry (which is under the supervision of CONSOB) now has specific obligations in regard to security tokens including maintaining a special public registry for operators and assets.

The activities of cryptoasset issuers are only partially regulated, in compliance with the obligation to endorse the EU law. 

Under the AML/CFT discipline, VASPs are required to fulfil certain obligations in order to adequately verify the identity of the client (the “Know Your Customer” procedure), to securely store data and information, and to report suspicious transactions to the Financial Intelligence Unit (UIF), constituted within Banca d’Italia. In some cases, the service provider is also required to abstain from contracting with the client, if it is not able to verify their identity or when it has its seat in a high-risk country. 

Moreover, since May 2022, for VASPs it is mandatory to register at the OAM money exchangers registry, in the section dedicated to “providers of services related to the use of virtual currency and digital wallet services”. 

Currently, (as of March 2024) 140 VASPs are listed and therefore authorised to offer their services to the public (www.organismo-am.it/elenchi-registri/operatori_valute_virtuali/index.html).

The only law which specifically addresses the promotion of cryptoassets in Italy is the FinTech Decree, (“Decree”) but it is limited to tokens defined as securities. In most of the cases scrutinised by the courts, the financial elements defining securities has been found to exist in issued tokens. According to the latest jurisprudential statements, as it happens in the United States with the Dewey test, a product presents financial features when it displays the following characteristics: 

• the use of capital; 
• the expectation to make a profit; 
• the presence of risks related to the activity.

According to the Decree, the rules provided by the TUF should apply to these assets. Every issuer of an ICO concerning security tokens must therefore, pursuant to the TUF, obtain an authorisation from the competent authorities (CONSOB and Banca d’Italia).

As stated above, however, the main problem concerning cryptoassets in the Italian legal system is related to the definition of securities, even when they are not qualified as such by the issuer.

Even the adoption of the Decree, given the state of the art in the Italian jurisprudence, is unlikely to change the above-mentioned attitude of the courts toward newly issued tokens. 

The Anti Money Laundering Decree, Legislative Decree No. 231/2007, establishes that VASPs shall respect the AML/CFT rules. 

VASPs are obliged to implement an efficient “Know Your Customer” procedure, through which they verify the trustworthiness of the client, when a continuative relationship is established, when an occasional operation implies the movement of goods for an amount equal or superior to EUR 15,000, and in any case, in which there is a suspicion of money laundering or doubts on the identity of the customer. VASPs must refuse to establish a relationship if they are not able to accomplish the adequate customer verification and if the customer is based in a high-risk country. 

VASPs are also compelled to keep documents, data and information relating to “Know Your Customer” and obtained during the adequate customer verification. In doing so, VASPs are also required to observe the data protection laws and the privacy rules, avoiding the leak of personal data. 

VASPs, like all the subjects considered in the Decree, shall also report to the competent authority (the UIF) any suspect operation, any suspicion of money laundering or terrorism financing activities. In this case, the client cannot be tipped off or made aware of the report. Following a suspicious activity report the UIF evaluate whether to investigate the case and collaborate with a special unit in the financial police, as well as with the Anti-mafia Investigative Directorate, to verify the existence of criminal activities.

The ownership of cryptoassets is not expressly defined. The only rules regarding the ownership of cryptoassets are those concerning taxation in the TUIR. The new Article 67, paragraph 1, letter c-sexies, establishes that, among the incomes subject to taxation, consideration should be given to capital gains and income realised through reimbursement, transfer, barter or holding of cryptoassets, when their value exceeds EUR 2,000. 

The list of the taxable incomes, substantially identical to those considered for any other traditional assets, suggests that the ownership of cryptoassets is to be regulated by the ordinary rules governing the ownership of goods and transactions, as provided in the Italian Civil Code. 

In Italy there is no law or regulation which specifically addresses the regime applicable to DAOs. 

In Italy there are no special rules which apply in case of crypto bankruptcy or insolvency. 

The first definition of smart contract in the Italian system was offered by Article 8 ter of the Legislative Decree No. 135/2018, which proposed a description of this phenomenon as “a computer program that operates on distributed ledger technologies and whose execution automatically binds two or more parties on the basis of effects predefined by them”. 

As in the Italian legal system many kinds of contract require the written form for their validity, Article 8 ter states an equivalence principle, under which the smart contract is considered to match the requirements of the written form, though fully digital, when the parties are properly identified. The requirements to meet this condition shall be identified by the competent authority, which is the Agency for Digital Italy (AgID), empowered for the drafting of guidelines to describe the technical procedure for the identity verification (not yet adopted).

If a person becomes a victim of a crypto fraud the remedies they can pursue are those provided by the national criminal and civil law. 

In particular, it is possible to denounce the crime as an ordinary fraud (Article 640 of the Criminal Code), as a cyber fraud (Article 640 ter of the Criminal Code), or as an abusive access to an IT or telematic system (Article 615 ter of the Criminal Code). 

If the perpetrator of the fraud is known, the Civil Code also offers some possible solutions, such as the reinstatement action and the claim action; in these cases, the judge will have the option to order interim measures, with the aim of guaranteeing the possession of the asset to the applicant. If the perpetrator of the fraud has already disposed of the asset, however, the only possible remedy may be to bring a damages action. 

Currently there are no ongoing consultations or draft law concerning cryptoassets in Italy. The situation might change, however, because of the MiCA Regulation, which may lead to the introduction of proper distinctions made between different categories of cryptoassets.