Bitonic, the oldest Bitcoin exchange in the Netherlands, recently had its day in court at the Dutch Central Bank (DCB). It was about the legality of DCB’s mandate that Bitonic (and other Bitcoin exchanges and custodians operating in the Netherlands) implement very strict “address verification procedures” in order to obtain the legally required registration with DCB.
The judge’s opinion on the case was generally positive for Bitonic’s complaints, and on April 7, she gave the DCB six weeks to review its policies. On Wednesday evening, the DNB officially recognized the legality of Bitonic’s complaints and revoked its mandate for strict address verification requirements under the registration regime.
The win is crucial to the continued vibrancy and profitability of the Dutch Bitcoin industry.
Background to the legal process
Preparations for the legal proceedings began in May 2018 when the European Union passed the fifth money laundering directive (AMLD5). According to this directive, the member states of the European Union had to implement certain regulations for the exchange and custody of cryptocurrencies in their laws.
By and large, AMLD5 requires that cryptocurrency exchanges and custodians (1) conduct background checks on their customers, (2) monitor and report unusual transactions, (3) and register with a competent regulator.
The implementation of the AMLD5 directive into Dutch law has been a bit chaotic and controversial to say the least. The main discussion point focused on the AMLD5’s mandate for a registration system (Requirement 3 above).
Initially, the government’s implementation of the AMLD5 concept at the end of 2018 envisaged a licensing system instead of a registration system. The former is a much more onerous requirement than the latter.
This caused a significant backlash in the Dutch bitcoin industry and various other players, including the Dutch Raad van State. an important institution for legal review in the Netherlands. Replacing the requirements of AMLD5 with the introduction of a licensing system proved unjustifiable and the government was forced to return to the drawing board.
That should have been the end of the discussion. But it wasn’t like that.
While the government had indeed changed part of the wording of the proposed law, specifically now referring to a “registration regime”, many believed that the law still de facto imposed a licensing regime.
So there was renewed pressure on the government. After more than a year of debating what a straightforward implementation of a registration regime based on AMLD5 should have been, the Dutch Bitcoin sector could finally breathe a sigh of relief in April 2020 when the government clearly stated that the industry should go under a registration regime, no licensing regime, and explained what such a regime entailed.
In the words of Wopke Hoekstra, Minister of Finance at the time of these discussions, “Registration is something you do, you are given a license. [A license] is really something else. The bar is on another level. “
This seemed to leave little room for ambiguity to the DCB, which was appointed as the “relevant regulatory authority” to oversee the registration regime.
Because of this, the Dutch bitcoin industry was quite confused on September 21 last year. On that day, a few months after processing the registration applications and shortly before the deadline, the Dutch central bank casually transmitted in a webinar that every withdrawal of bitcoins by a customer from an exchange or custodian into his own wallet would require strict address verification procedures.
Failure to follow these procedures before November 21st (the registration deadline) so that Bitcoin exchanges and custodians were notified would result in a refusal to grant registration. Again, such a rejection of a company would essentially require that it cease operations at that point.
What exactly did the DCB commission with these address verification measures?
In essence, when a customer withdraws bitcoins from a custodian or exchange, the DCB required the service provider to take radical measures to verify that the withdrawal address actually belongs to the customer. They advocated several methods on their website including the following (the website has since closed):
- So that customers can take screenshots of their wallets with the destination address.
- For the customer and the company for video conferencing during the transaction.
- So that customers can digitally sign the destination address with the associated private key.
- So that customers can return part of the bitcoins they received to the stock exchange or the custodian bank.
- So that the company provides the customer with an address (presumably through the possession of an extended public key of the customer).
Of course, this type of measure would likely be ineffective in combating sanction evasion (or other financial crimes on the matter), would place a heavy bureaucratic burden on the Dutch Bitcoin industry, penetrate deep into customer privacy and pose an increased security risk for customers. It is also difficult to see how such measures under a registration system could possibly be justified.
Of course, the Dutch Bitcoin community protested again. But the whole protest fell on deaf ears at the DCB. So Bitonic decided to take action. In protest, they would meet the address verification requirements to keep their registration. At the same time, they would take the DCB to court over these demands.
Bitonic’s complaint against the DCB was threefold.
First, Dutch politicians have clearly stated what constitutes a registration system and that the law implementing AMLD5 should be interpreted that way. The requirements for address verification imposed by the DCB are content-related requirements that do not comply with the law. .
Second, address verification requirements are not mandated by the Sanctions Act of 1977, which formed the legal basis for the DCB’s requirements. Bitonic, like most other Bitcoin companies operating in the Netherlands, already complies with this law by screening customers or final beneficiaries of accounts against lists of politically exposed persons (or PEPs). This is how banks comply with the law.
Thirdly, the policy is in contradiction to the “General Data Protection Regulation” (GDPR) of the EU. This regulation requires that all data collection activities have a solid legal basis. Since the DCB address verification policy has no such basis, Bitonic (and other compliant Bitcoin companies) are violating the GDPR.
Bitonic filed these three complaints in court on March 23, 2021. The judge was reluctant to criticize the DCB too sharply, given the complex technical nature of the case. However, her opinion was largely based on Bitonic’s complaints, although she no longer found that the address verification procedures were unlawful. It then gave the DCB six weeks to review and revise its guidelines on address verification rules as part of the registration regime.
Under this pressure, it was impossible for the DCB not to move. It was therefore not surprising that Bitonic was informed on May 19 that “after a new check” the requirements for address verification “do not adequately meet the discretion that an institution has to implement this standard in a risk-oriented manner. DNB has therefore wrongly stipulated the registration requirement as a condition for the registration of Bitonic. “
In essence, the DCB admitted that its submitted requirements were unlawful and should never have been made. It has also stopped admitting its illegality.
The legal process is of great importance to the Dutch bitcoin industry.
While the DCB has not completely abolished address verification requirements, its statement leaves much more room for appropriate procedures. This can save administrative costs and red tape for clients, provide better privacy and security for clients and ensure that Dutch stock exchanges and custodians can stay competitive with their foreign counterparts, including those in other EU member states (as far as I know). The Netherlands is the only EU member state that has tried to impose strict address verification requirements.
Bitonic immediately removes the most stringent address verification requirements, including requesting a customer screenshot or signature over the receiving address.
We’ll have to wait and see how other Bitcoin companies react to this statement from the DCB. In view of the fact that many potential customers have apparently switched to foreign service providers in recent months out of concerns about security, data protection and bureaucracy, it would be wise to follow this example.
While the court ruling and the subsequent statement by the DCB are certainly a welcome development, the overall implementation of AMLD5 in the Netherlands leaves something to be desired:
- Getting AMLD5 into law should have been pretty straightforward. Instead, the government unnecessarily burdened the public, and in particular the Bitcoin sector, with more than a year of discussion about the details of the implementation of the registration system.
- The implementation of the registration regime of the law by the DCB should also have been quite simple. Instead, an attempt was made to set requirements that go far beyond the legal framework. Not interested in further discussion of the matter, a court ruling was required for the DCB to “reconsider” these requirements.
- While some friction can be expected (and perhaps welcomed) in regulating a new industry, all of this has left the Dutch bitcoin industry and user community far more burdensome than necessary. Companies have lost revenue and some have ceased operations or moved to another location. The opportunities for innovation lost were likely greater: rather than having lengthy discussions with government officials, regulators, lawyers and judges, time would have been better spent creating innovative new services and improving existing ones.
For a country that prides itself on its open and innovative character, all of this is certainly unacceptable.
 Directive 2018/843, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32018L0843.
 Raad van State, No. W06.19.0080 / III, June 2 (2019), available at https://www.rijksoverheid.nl/documenten/kamerstukken/2019/07/02/advies-van-raad-van-state – wijziging-vierde-anti-witwasrichtlijn.
 For a criticism of the legislative proposal in this direction, see Frank ‘t Hart and Els Deerenberg, “Implementatie vijfde anti-witwasrichtlijn”, November 4th (2019), available at https://bitcoin.nl/img/posts/408/ Notes% 20’t% 20Hart% 20advocaten% 20-% 2004112019-% 20implementatiewet% 20witwassen% 20-% 20niet% 20beleidsarm.pdf.
 My own translation. The quote can be found in Eerste kamer der Staten-Generaal, “Verslag van de plenaire vergadering van dinsdag 21 April 2020”, April 21 (2020), available at https://www.eerstekamer.nl/verslag/20200421/verslag.
 I had a more in-depth discussion of the issues with these requirements in response to FinCEN’s proposal for similar types of regulations for the US market late last year in “Comment on FinCEN’s Proposed Requirements,” January 4th (2020) at https: // bitcoinmagazine.com/business/a-commentary-on-fincens-proposed-kyc-requirements.
 See for example Eva Smal, “Cryptobedrijven vinden toetsing van DNB veel te streng”, November 2nd (2020), available at https://www.nrc.nl/nieuws/2020/11/02/cryptobedrijven-vinden-toetsing – van-dnb-te-streng-a4018327
 Bitonic, “Bitonic Filing An Injunction To Be Exempted From The Wallet Verification Requirement,” January 26 (2021), https://bitonic.nl/news/220/bitonic-files-preliminary-injunction- to-be-relieved-of-wallet verification requirement.
 Regulation 2016/679, https://eur-lex.europa.eu/eli/reg/2016/679/oj.
 See De Rechtspraak, “Verzoek Bitonic is ontvankelijk maar geen schorsing registratievereiste”, April 7th (20201, available at https://www.rechtspraak.nl/Organisatie-en-contact/Organisatie/Rechtbanken/Rechtbank-Rotterdam/Nieuws/ Verzoek -Bitonic-is-ontvankelijk-maar-geen-schorsing-registratievereiste-.aspx.
 Bitonic, “DNB officially recognizes Bitonic’s complaints and revokes the wallet review requirement”, May 20 (2021), https://bitonic.nl/news/231/dnb-formally-acknowledges-complaints-bitonic-and -revokes-wallet- verification request.
 In particular, this includes the world’s largest trading platform for Bitcoin derivatives. See Deribit, “Deribit moves to Panama + KYC February 2020”, January 9th (2020), available at https://blog.deribit.com/uncategorized/deribit-moving-to-panama-kyc-february-2020/.