This Q&A is part of the global guide to Fintech. For a full list of jurisdictional Q&As visit Portugal.
It will cover open banking, regulation of data, cryptocurrencies, blockchain, AI and insurtech.
This Q&A is part of the global guide to Fintech. For a full list of jurisdictional Q&As visit http://www.inhouselawyer.co.uk/index.php/practice-areas/fintech/
What are the sources of payments law in your jurisdiction?
Currently, Portuguese payments law is regulated under Decree-Law no. 317/2009, of 30 October (the Payment Services and E-Money Legal Framework, “PSELF”), which current version transposed both the Directive 2007/64/EC of the European Parliament and of the Council of 13 November 2007 (“PSD1) and Directive 2009/110/EC of the European Parliament and of the Council of 16 September 2009 (the e-Money Directive, “EMD”).
The transposition procedure of Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 (PSD2) is currently underway, and the national parliament has already granted the government due authorisation for the enactment of the new Decree-Law transposing the PSD2 and repealing the current PSELF.
Can payment services be provided by non-banks, and if so on what conditions?
Yes. Under the PSEFL, the provision of payment services may be performed by non-banking entities, notably payment institutions and e-money institutions. Both these entities are subject to regulatory requirements which must be met before beginning their activities.
The PSEMLF sets out the applicable rules and requirements for the incorporation and licensing of payment institutions and e-money issuers, both being subject to the Bank of Portugal supervision. For that effect, certain mandatory legal documentation must be filed with the Bank of Portugal, including, inter alia, draft bylaws, business plan, share capital commitment, corporate structure and beneficial ownership, the managers’ identification and fit and proper documentation, as well as corporate governance and internal compliance models and procedures. Current minimum statutory share capital requirements applicable to payment institutions ranges from € 20,000 to € 125,000 and a minimum of € 350,000 for e-money institutions.
The PSEMLF provides for an extensive list of products and services which may only be offered or rendered by either payment or e-money institutions.
What are the most popular payment methods and payment instruments in your jurisdiction?
Card-based payments, direct debits and bank transfers are the most popular and deeply-rooted payment methods in Portugal. Notwithstanding, we note that a recent surge in new payment apps has begun to gain traction (please refer to answer to question 19 below concerning the Mbway payment method introduced by SIBS consisting in real-time instant bank account transfers).
What is the status of open banking in your jurisdiction (i.e. access to banks’ transaction data and push-payment functionality by third party service providers)? Is it mandated by law, if so to which entities, and what is state of implementation in practice?
Due to the fact that the PSD2 has not yet been transposed to national law, no current third party providers are currently acting in the Portuguese market, rendering the open banking market status in Portugal technically inexistent.
How does the regulation of data in your jurisdiction impact on the provision of financial services to consumers and businesses?
There are no fintech specific data laws, but as fintech businesses regularly collect, control and process vast amounts of data (including personal data), they are subject to data protection rules (namely the General Data Protection Regulation – “GDPR”). The GDPR applies not only to Fintech companies established in the EU but also to companies established outside the EU, in case they have European customers.
In general, the processing of personal data requires customer’s express and prior consent, which must be met by data controllers, along with other onerous accountability obligations to evidence compliance.
These data protection rules are complemented by bank secrecy and AML rules, where Portuguese approach tends to be conservative and considers all personal data processed by a bank is subject to bank secrecy. In fact, disclosure of clients’ personal data protected by bank secrecy (including cross-border transfers) is permitted only with prior customer consent or, namely, if the processing is necessary to comply with a legal obligation to which the data controller is subject (as it is the case of anti-money laundering reports).
Notwithstanding the above, Portuguese legislation executing the GDPR is currently in preparation and may bring some additional adjustments or restrictions to the rules set out in the GDPR. Also, it is under discussion, within the EU Digital Single Market, a Regulation on the free flow of non-personal data, in order to remove all disproportionate restrictions to the movement of data across Member States and IT systems in the EU. Together with the GDPR, this Regulation intends to ensure a comprehensive and coherent approach to the free movement of all data in the EU.
What are regulators in your jurisdiction doing to encourage innovation in the financial sector? Are there any initiatives such as sandboxes, or special regulatory conditions for fintechs?
We are currently not aware of any such initiatives on the regulators’ behalf. However, we note that the CMVM (the Portuguese Market Securities Commission or CMVM) is actively engaging market players and stakeholders in a recent effort to improve and understand businesses’ concerns and regulatory obstacles currently hindering innovation and new technologies to enter the market.
At the same time, Portugal Fintech has launched an initiative named “Portugal FinLab” which is meant to be a communication channel between innovators and the Portuguese Financial Regulators. Through this channel, the regulators give guidelines to the projects submitted to them. The purpose of the Portugal FinLab is to support the development of projects that are genuinely innovative.
It is the result of a partnership between the regulators Banco de Portugal, CMVM - Portuguese Securities Market Commission, and ASF - Insurance and Pension Funds Supervisory Authority, along with Portugal Fintech.
Do you foresee any imminent risks to the growth of the fintech market in your jurisdiction?
The most evident risk we foresee as to the growth of the fintech ecosystem in Portugal pertains to the regulatory and supervisory authorities treatment and understanding of the different subject. The actual interpretation of some of the provisions included in the PSD2 (notably in what concerns the exemptions provided thereunder) may prove controversial and hinder some business models which would otherwise based on the assumption that the PSD2 transposed framework would not apply to it.
More troublesome seems to be the matters related to cryptocurrencies and blockchain technology initiatives, due to the apparent inertia of both the Bank of Portugal and the CMVM (as well as the legislator’s) will to regulate and give context to such potential disruptive technologies.
What tax incentives exist in your jurisdiction to encourage fintech investment?
Even though we are not aware of any current tax incentive specifically aimed at encouraging fintech investment, there are tax incentives generally available to start-up investment which may be of importance considering that most of fintech investment is made through start-ups.
As an example, “Programa Semente” establishes that individual taxable persons who make eligible investments up to € 100,000 in start-ups can deduct 25% of the investment made up to a limit of 40% of the IRS collection.
Which areas of fintech are attracting investment in your jurisdiction, and at what level (Series A, Series B etc)?
The current market status of investment in fintech in Portugal is rather slow, which we envisage is due to the delay in transposing the PSD2 into national law. As such, the legal act transposing the directive shall approve a new and reformed legal framework for the majority of fintech companies currently operating in the Portuguese market, while simultaneously paving the way for new market players and new types of companies to enter the market and offer their products and services to both consumers and other businesses. It shall also mark the legal recognition of third party providers, furthering the open banking ecosystem with the surging of new companies – such as payment initiation and account information services.
Notwithstanding, we note that there have been some specific foreign fintech businesses entering the Portuguese market, although opening up branches or subsidiaries and not providing direct investment in new Portuguese-based projects. Exception to this is the new crowdfunding platforms which have been accompanied by the correspondent surge in new players managing such platforms.
If a fintech entrepreneur was looking for a jurisdiction in which to begin operations, why would it choose yours?
It should choose ours because Portugal is becoming more innovation driven and events such as Web Summit have attracted numerous investors and start-ups to the Portuguese market. We currently see such trend evolving and many start ups taking advantage of an attractive work life balance kind of approach, while simultaneously benefiting from increasing initiatives aiming to increase investment in innovative areas such as fintech (please see, for example, the example of Portugal FinLab above.
Access to talent is often cited as a key issue for fintechs – are there any immigration rules in your jurisdiction which would help or hinder that access, whether in force now or imminently? For instance, are quotas systems/immigration caps in place in your jurisdiction and how are they determined?
Yes, there are immigration rules in Portugal which intend to facilitate the access of tech business developers to our country.
In fact, the new Regulatory Decree regarding the entry, permanence, exit and removal of foreigners into and out of the Portuguese national territory, published this month and which will be in force on October 1st this year, enables the optimization and flexibility of the residence visa and permit proceedings, notably for the foreign entrepreneurs and highly qualified workers in order to encourage the establishment in Portugal of new tech and innovative businesses.
These new provisions foresee the possibility of issuing a residence visa specifically for entrepreneur foreigners who wish to invest in Portugal notably in the tech and innovative areas.
An example of Portugal’s commitment to facilitate bringing these projects into our country is the “StartUp Visa” which is a program destined to bring to Portugal foreign business developers who wish to establish their projects in Portugal. This program had a previous certification process for the incubator companies to apply in order to host entrepreneur foreigners who wish to create and develop tech companies in the national territory.
The applications for the startup companies are already available online at https://webapps.iapmei.pt/StartupVisa/VisaEmp/Account/Login.aspx and there is still no deadline foreseen for the submission of the applications. When an application is approved, a residence visa may be requested by the entrepreneur(s) of the project (up to five for each project) at the consular post, which will be valid for four months and may be renewed. After arriving in Portugal, the entrepreneurs must schedule a meeting with the Immigration Authority (“Serviço de Estrangeiros e Fronteiras”) in order to request for the residence permit.
If there are gaps in access to talent, are regulators looking to fill these and if so how? How much impact does the fintech industry have on influencing immigration policy in your jurisdiction?
The Fintech industry plays a highly important role in Portuguese immigration policy as explained above.
The proof of the importance of this area of business to our country is clearly defined by these new rules that have recently been created in order to encourage this type of investment to come to Portugal, debureaucratising and speeding up the request and issuance of residence visas and permits for this purpose.
What protections can a fintech use in your jurisdiction to protect its intellectual property?
Protection of fintech technology can take place by various means. The protection of software seems to be the most relevant, as fintech technology usually translates into computer systems and applications. Software is protected in Portugal under the same legal rules that apply to copyright protection (according to Decree-Law no. 252/94, of 20 October, as amended). Copyright does not require a registry to exist, but this can be done in the General-Inspection for Cultural Activities (IGAC). Software per se cannot be protected by a patent, unless it meets the criteria to be considered a computer implemented invention, which is an invention whose implementation involves the use of a computer, computer network or other programmable apparatus. In addition, computer-implemented business models can also be patented, to the extent that they are claimed as a technical solution for a technical problem (for instance, automating a response considering the data collected) and involving technical considerations (e. g., the reading of the database). Otherwise, business models are not patentable. All in all, a case-by-case analysis is necessary to determine if protection by patent is feasible.
Technology developed in the context of a fintech business can also be protected as a trade secret. Trade secrecy protects against any act of a competitor that discloses, uses or acquires, without consent, information that is secret, which has a commercial value due to that fact and which has been subject to considerable steps to keep it secret (for instance, the execution of non-disclosure agreements). Note that current national legal provisions on trade secrecy, which are included in in the Industrial Property Code (approved by Decree-Law No. 36/2003, as amended), are now under revision, which is mostly related to the transposition of Directive (EU) 2016/943 of the European Parliament and of the Council, of 8 June 2016, on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure. The Directive brings substantial changes to the trade secrecy regime, notably on the protection criteria and the enforcement regime, which is expected to become clearer and more effective with the mentioned legislative change.
How are cryptocurrencies treated under the regulatory framework in your jurisdiction?
The current regulatory approach in Portugal has been to exclude cryptocurrencies from the qualification of “legal currency” and not issuing specific regulation dealing with them. Both the Bank of Portugal and the CMVM share this understanding.
The Bank of Portugal has, as far back as 2013, issued a clarification under which it considered that bitcoin (and thus, all remaining cryptocurrencies) cannot be considered secure currency, given that its issuing is done by non-regulated and non-supervised entities. In addition, the users bear all the risks, as there is no fund for the protection of depositors/investors. This approach closely follows the position of the European Banking Authority (EBA). Note that specific regulation on cryptocurrencies is not expected soon: both the Government and the Bank of Portugal have stated that they will not regulate cryptocurrencies and that the first step shall be taken by the European Commission. Despite the lack of regulation and supervision, the Bank of Portugal has indicated that the use of cryptocurrencies is not forbidden or an illegal act. Hence, this entity is so far more focused on a preventive and educational approach, by means of alerting to the risks of cryptocurrencies.
CMVM has also issued an alert to investors in November 2017 on ICO’s indicating that most ICO’s are not regulated – in which case investors are unprotected due to the high volatility/lack of funds, potential of fraud/money laundering, inadequate documentation (most ICO’s have no prospectus but only a White Paper) and risk of loss of the invested capital. Still, CMVM opened the door for them to be subject to regulation according to their specific circumstances. This approach closely follows ESMA alert issued on ICO’s on the same month and a statement of November 2017 which indicated that where coins or tokens qualify as financial instruments, then it is likely that the firms therein involved pursue regulated investment activities, such as placing, dealing in or advising on financial instruments or managing marketing collective investment schemes. Note that CMVM also advised investors interested in financial products related with virtual currency to ask for complete information on the products and specifically on the risks to the financial brokers.
Considering the above, the usual distinction between the different types of tokens (or rather the rights and obligations which their issuance and possession entail) underlying the transactions may prove useful. Should tokens be used mainly as a means of payment, the approach taken by the Bank of Portugal/EBA is the one to look at. Conversely, where tokens have more similarities to securities, and hence the approach of CMVM/ESMA is the one to take note of.
Despite some lack of regulatory clarity there are two main areas where there seems to be legal guidance.
The first one relates with money laundering, given that the recent proposal for amending the AML Directive (Directive 2015/849) extends its scope of application to virtual currencies, i.e., to exchange services between virtual currencies and fiat currencies, and to wallet providers offering custodial services of credentials necessary to access virtual currencies.
Notwithstanding the proposed amendment to the European AML framework, note that the Bank of Portugal clarified that financial institutions are under the obligation to control transfers of funds coming from and going to platforms of negotiation of cryptocurrencies under AML provisions. In this respect, it has been widely reported that one of the major banks in Portugal has recently blocked any transfers having these types of entities as beneficiaries.
The second one relates with tax: the Court of Justice of the European Union (“CJEU”) already addressed the question on whether transactions, such as the exchange of bitcoin or other cryptocurrency for traditional currency, and vice versa, in return for payment of a sum equal to the difference between, on the one hand, the price paid by the operator to purchase bitcoins and, on the other hand, the price at which he sells those same bitcoins to his clients, qualified as a supply of services for consideration for VAT purposes and, if so, whether such supply would be considered exempt from VAT.
The CJEU decided that the exchange of bitcoins for traditional currency qualifies as a supply of services for VAT purposes. As to the question on whether these transactions should be regarded as exempt supplies, the CJEU pointed out that bitcoin, being a contractual means of payment, cannot be regarded as a current account or a deposit account, a payment or a transfer. Moreover, unlike a debt, cheques and other negotiable instruments referred to in Article 135(1)(d) of the VAT Directive, bitcoin is a direct means of payment between the operators that accept it. Therefore, the CJEU ruled that transactions, such as exchange of cryptocurrency for traditional currency, and vice versa, should be exempt from VAT under the provision of article 135(1)(e) of the VAT Directive. As the question submitted to the Court concerned only the exchange of cryptocurrency for legal tender currency, the CJEU did not expressly addressed the subject of whether the exchange of, e.g., bitcoins for a different cryptocurrency should also be regarded for VAT purposes as an exempt supply of services under article 135(1)(e) of the VAT Directive. However, in our view, the same reasoning applies and the answer should therefore be the same.
CJEU’s judgements are directly effective in all Member-States and, therefore, the Tax Authorities in all Member-States must abide by them. With this judgement, bitcoin exchangers, start-ups and users finally know where they stand from a VAT perspective. Buying, selling, sending, receiving, accepting and spending bitcoin will not be taxed, which allows economic agents to deal with bitcoin as they would with legal tender currency or other types of money.
More recently, the Portuguese Tax Authority (“PTA") issued binding rulings under which it stated that any gains derived from bitcoin trading should not be considered income for Personal Income Tax (“PIT”) purposes to the extent such activity does not constitute a business or professional activity. Indeed, the PTA concluded that gains derived from the sale of bitcoin would not fall under the concept of capital gains or investment income as defined by the Portuguese PIT Code and, consequently, those gains are not covered by the taxable base of the Portuguese PIT.
How are initial coin offerings treated in your jurisdiction? Do you foresee any change in this over the next 12-24 months?
Considering Portuguese securities law, security tokens do seem to be under the legal framework for securities provided the legal requirements are met. Although not specifically developing or advancing any criteria for certain ICO’s to be subject to market offering rules, the CMVM laid down a general understanding of a case by case basis approach, meaning that tokens that present features similar to those of securities (or for that matter, ICO’s that present features similar or analogous to public market offerings) may fall under securities laws and regulations, and thus comply with its respective obligations regarding public offerings, market information, regulatory submissions, among others. Notwithstanding, we have no knowledge of any ICO-related transaction or crypto assets offering that either fell under the securities law provisions, or that voluntarily submitted itself to the CMVM’s procedure for public offerings.
We do not envisage that Portuguese regulators will take the first step in reviewing the legal and regulatory treatment for ICOs, and we should probably expect a wait and see approach regarding the European institutions (notably ECB and ESMA) in this respect before any paradigm shifts take place at a national level.
Are you aware of any live blockchain projects (beyond proof of concept) in your jurisdiction and if so in what areas?
No, not that we are aware of. However please note that due to the early-stages and lack of a defined regulatory framework resulting from the PSD2 not being transposed, many initiatives and businesses are currently in seed phase and subject to confidentiality terms and thus we envisage that once the legal and regulatory framework is defined, new projects will be disclosed to the market.
To what extent are you aware of artificial intelligence already being used in the financial sector in your jurisdiction, and do you think regulation will impede or encourage its further use?
AI is a central technology for all sectors and industries, and as a result its testing and use is growing worldwide, including in Portugal. Indeed, AI (together with Big Data) is already being used in Portugal by banks and fintech companies, e.g., in customer service, in the analysis and granting of credit and even in regulatory compliance. AI brings several legal and regulatory challenges, from warranty, liability, transparency, among others. Regulation of AI is being thoroughly discussed at the international level, including in the EU, and such discussions also cover the strategic approach to adopt in this field. It is important to make sure that AI regulation does not impede or hinder the development and use of AI, and an approach of regulating without a full understanding of the evolution of this technology shall be avoided. However, some principles or recommendations shall naturally be approved to create legal certainty, which is also a factor that encourages the development of new technologies. Because of the global nature of this technology, any such guidelines should however be as aligned or coherent as possible to avoid market distortions.
Insurtech is generally thought to be developing but some way behind other areas of fintech such as payments. Is there much insurtech business in your jurisdiction and if so what form does it generally take?
We are not aware of any current projects in the insurtech area in the Portuguese market. However, we note that recently the insurance market has been subject to some instability, with a series of M&A transactions involving the biggest Portuguese insurers, and so it may be expected that once such companies are running smoothly after the recent market turmoil, new solutions arise eyeing the insurtech segment.
Are there any areas of fintech that are particularly strong in your jurisdiction?
The somewhat recent entering into force of the crowdfunding legal framework has seen a surge in new players and stakeholders on the market, introducing new crowdfunding (mostly debt crowdfunding) platforms, which in turn have opened up new funding alternatives to either individuals and corporations.
Payments is also a business which has seen an increased relevance, with the introduction of new solutions and platforms, notably, the so-called Mbway, a service by SIBS allowing for instant transfers between bank accounts (SIBS is the incumbent entity responsible for managing the intra-bank transfer and payments systems known as Multibanco)
What is the status of collaboration vs disruption in your jurisdiction as between fintechs and incumbent financial institutions?
We are not aware of any current collaboration between incumbent financial institutions in Portugal and other fintech companies. The most common approach to fintech by Portuguese banks seems to be carried out either by internal development and R&D or by integrating outsourced services or solutions to tech firms.
To what extent are the banks and other incumbent financial institutions in your jurisdiction carrying out their own fintech development / innovation programmes?
The current status of fintech development by banks and other institutions in Portugal can be described as being in a very early stage. There are some banks, mostly those whose business model is based on remote/web-based services with a more younger and tech-savvy target that are currently developing some fintech-related projects.
Are there any strong examples of disruption through fintech in your jurisdiction?
Despite fintech-related businesses and initiatives being currently in a very early stage in Portugal, the recent surge in crowdfunding platforms has begun to make some impact in what concerns the market perception regarding the different financing sources, with more and more individuals and small businesses resorting to this new financing alternatives instead of more traditional bank-based lending solutions.