Published on: 1 June 2018

Cryptocurrencies and ICOs...

BACKGROUND The emergence of cryptocurrencies and Initial Coin Offerings (ICO) has generated hypes and craze worldwide. Domestically, the Central Bank of Malaysia, also known as Bank Negara Malaysia (BNM) reported that the cryptocurrency transactions on four digital currencies exchanges is worth an average of MYR75 million each month in Malaysia.

CopyCash Foundation, a Singapore-based blockchain[1] startup has attempted to launch an ICO in January 2018. The launch had resulted in a heated discussion on the legitimacy of ICO when the Securities Commission Malaysia (SC) issued a Cease and Desist Order to the startup that put a halt to the launch. In light of the recent developments, one might be concerned about the legality of such instrument and arrangement in Malaysia.

CRYPTOCURRENCIES Cryptocurrencies, commonly referred to as digital currency, in which encryption techniques are used to regulate the generation of units of currency and verify the transfer of funds, operates independently of a central bank. In Malaysia, digital currency is legally defined as a digital representation of value that functions as a medium of exchange and is interchangeable with any money, including through the crediting or debiting of an account, but does not include electronic money issued by an approved issuer of electronic money under the Financial Services Act 2013 and the Islamic Financial Services Act 2013[2].

In 2014, BNM issued a statement declaring that cryptocurrencies are not recognised as legal tender in Malaysia. However, the trading of cryptocurrencies is not banned in Malaysia. In order to promote greater transparency in the use of cryptocurrencies and to prevent the use of cryptocurrencies for money laundering or terrorism financing, digital currency exchanges will be subject to obligations under the Anti-Money Laundering,Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA) as a reporting institution pursuant to the First Schedule of AMLA.

“Basically, we are going to make the promoter of the cryptocurrency, which include bitcoin, ethereum and ripple, to be more transparent, the methodology transparent and the people behind it transparent too. Hopefully, by doing this, the people can make their decision on whether to invest in cryptocurrency.” - Tan Sri Muhammad Ibrahim, former Governor of the Central Bank of Malaysia.

A reporting institution under AMLA[3] is defined as any person who provides any or a combination of the following services: (i) exchanging digital currency for money; (ii) exchanging money for digital currency; or (iii) exchanging one digital currency for another digital currency, regardless of whether in the course of carrying on a digital currency exchange business, or otherwise. It is irrelevant that the person is not domiciled in Malaysia when providing the aforesaid services[4].

The minimum requirements and standards to be observed by reporting institutions under AMLA have been set out in the policy document[5] (“the Document”), which came into effect on 27 February 2018. The stipulated obligations of a reporting institution under the Document, among others, is to take appropriate steps to assess their money laundering or terrorist financing risks (“Risks”), have policies to manage and mitigate the identified Risks, to conduct risk profiling on their customers, perform customer due diligence, identify and assess Risks that arise in the development of new digital currencies, products, services and business practices.

INITIAL COIN OFFERINGS According to BNM, ICO is “the offering of digital token in exchange for digital currency or any form of payment and incidental activities thereof”. ICO is also known as initial token offerings, token pre-sale, and token crowd-sale. SC observed that ICO may be structured in various forms, which include direct investments in projects which enable the investors to have a share of the returns from the projects, seeking funding through foundations where the investors are not entitled to any returns on their investment, and issuance of tokens which allow the investors to enjoy rights to a future product or service.

ICO has attracted the interest of venture capital companies. This is because ICO is a cost effective and faster option to raise funds, as it does not have to fulfill stringent regulatory processes. Similar to an Initial Public Offering (IPO), an ICO is a fundraising platform for companies, but using blockchain technology. In an ICO, a whitepaper, the equivalent of prospectus in an IPO which provides details on the purpose of the raised funds, will be issued. The difference between an IPO and an ICO is that companies issue cryptocurrencies in an ICO, instead of shares in an IPO, at a specified value to the investors. Further, investors in an ICO will not have an equity interest, unlike in an IPO. Thus, an ICO investor will not have any legal claim on the companies’ assets in the event of liquidation.

In Malaysia, SC and BNM in a joint statement issued in January 2018, has cautioned that the launching of ICOs, without proper authorisation, is an offence in Malaysia. This is because such an act involves regulated activities that fall within the purview of laws administered by SC and the Bank. Although a comprehensive and clear regulation framework for ICO in Malaysia is yet to be issued by SC and BNM, the SC and BNM established a Brokerage Industry Digitisation Group (BRIDGe) to accelerate and review digitisation of the stockbroking industry.

CONCLUSION The regulation of cryptocurrencies and ICO in Malaysia is in its infancy. As the regulation of ICO is lacking, investors are reminded to be prudent with the associated risks of ICOs, especially since some of the ICO structures might limit the legal recourse available to the investors. ICO operators are advised to seek legal consultation as no person is allowed to carry out regulated activities such as, fund raising, fund management, and other dealings in capital market products without first obtaining SC’s approval.

For further insight in this area of law, please contact our Partners:
Loh Mei Mei
Kung Suan Im
Ashela Ramaya
Chan Kwan Hoe
Celine Rangithan

[1] A system in which a record of transactions made in bitcoin or another cryptocurrency are maintained across several computers that are linked in a peer-to-peer network.

[2] Paragraph 6 of the Anti-Money Laundering and Counter Financing of Terrorism (AML/CFT) – Digital Currencies (Sector 6)

[3] Paragraph 25(1) of the First Schedule to Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001

[4] Paragraph 4.2 of Anti-Money Laundering and Counter Financing of Terrorism (AML/CFT) – Digital Currencies (Sector 6)

[5] Anti-Money Laundering and Counter Financing of Terrorism (AML/CFT) – Digital Currencies (Sector 6)

Personal Data Protection Notice

We at ZUL RAFIQUE & partners recognize the importance of privacy and the sensitivity of personal information. As required under the Personal Data Protection Act 2010, the purpose of this Personal Data Protection Notice (“Notice”) is to inform you how we collect and process your personal data when you appoint or engage us to provide services, when you access and use our website or interact with us including through meetings, seminars, conferences or events.

By appointing or engaging us to provide services to you, by accessing and using our website or by interacting with us, you consent to us using, collecting and processing your personal data in the manner contemplated in this Notice.

This Notice may be amended or updated from time to time. We would advise you to check this Notice on our website from time to time for amendments or updates. By continuing to use or engage our services, to use our website or to communicate with us subsequent to any amendments or updates to this Notice, it would confirm and indicate your acceptance to the amendments or updates to this Notice.

What Personal Data Do We Collect?

Personal data generally means any information that identifies you. Your personal data is collected and processed by us at the start of our services or interaction and, from time to time, in the course of our engagement or interaction.

The type of personal data collected and processed by us includes:

name, date of birth, nationality, gender, NRIC / passport number, residency status, correspondence address, contact details including mobile, office and residential telephone number and facsimile number, e-mail address, banking details, financial / creditworthiness information;
employment category (private sector, government sector, self-employed, non-working or others), name of employer and office address, details of relationship with the company (e.g. promoter, director, shareholder);
such other information relevant or required for:
- our legal engagement;
- provision of legal services for the purposes of the legal engagement or legal transaction; and
- compliance with legal and regulatory requirements; and
any additional information provided by you or third parties about you.

Source of Personal Data

Personal data collected will mainly be from you. However, some personal data may also be collected by us from other available sources including but not limited to credit reporting agencies, government department or agencies, public registries, websites, social media, publications, events, seminars, conferences.

How Do We Use Your Personal Data

Your personal data is collected and processed by us for our business activities including the following purposes:

to verify your identity;
to communicate with you including responding to your enquiries;
all purposes related to or in connection with our legal engagement;
to provide legal services for the purposes of the legal engagement or transaction;
to comply with legal and/or regulatory requirements including court orders;
for our day to day operations and administrative purposes including file management, billing and collection, audits, reporting, investigations etc.;
for the purposes of enforcing or defending our legal rights and/or obtaining legal advice;
to send you materials or publications including newsletter, articles or updates or information about events, conferences, seminars, talks which may be of interest to you;
to promote, offer or market our services to you;
to send as potential referees to (i) editors/researches in ranking legal publication and journals and/or (ii) clients/potential clients who request for referees of past work in relation to any proposal, submissions, tenders or bids;
to assist in the prevention, detection or investigation of crime or possible criminal activities or for the administration of justice;
for security and internal audit purposes;
for such other purposes as may be directed or consented to by you; and
for all other purposes in relation to or incidental to the above.

Disclosure of Your Personal Data

Under certain circumstances, we may be required to disclose your personal data to third parties. Third parties to whom your personal data may be disclosed by us are as follows:

any persons directed by or consented to by you;
any persons required for the purposes of the legal engagements and/or legal transactions including but not limited to counter parties, other advisors, financial institutions, regulatory bodies etc;
any person for the purposes of compliance with legal and regulatory requirements;
our data processors i.e. third party who we engage to process personal data on our behalf including but not limited to archival storage, data entry service providers, computer backup services, disaster recovery services, banks and financial institutions etc.; and
our professional advisors including but not limited to legal advisors, tax advisors, financial advisors, auditors, insurance brokers etc.

Further, we may also be required to transfer your personal data outside of Malaysia for the purposes and to such third parties stated in this Notice. The transfer of your personal data outside Malaysia would also be required if you are travelling, residing or based outside Malaysia.

Obligation to Provide Personal Data

We acknowledge that you have the right in deciding the information you wish to provide to us. The provision of the information listed above is voluntary in nature. However, please note that if you do not provide the information above or limit the way such information is to be processed, it may result in us not being able to:

communicate or correspond with you;
undertake the legal engagement or transaction and/or to provide our services to you; and/or
grant you access to our website.

Data Access and Data Correction

If you wish to request:

for access to your personal information;
for your personal data to be corrected or updated; or
to withdraw your consent or limit the use of your personal data;

please submit your written request to:

Assistant Manager Human Resources and Administration Department

Zul Rafique & Partners
D3-3-8 Solaris Dutamas
No.1 Jalan Dutamas 1
50480 Kuala Lumpur, Malaysia

Telephone : 03-6209 8228
Facsimile : 03-6209 8331

An administrative charge may be imposed for any request under paragraph (a) and (b) above.

Further, we reserve the right to refuse your requests for any reasons permitted under law.

Disclaimer

The accuracy and completeness of your personal data depends on the information you provide. We assume that the information you have provided is accurate, up to date and complete unless you inform us otherwise.

Where you provide any third party information to us including but not limited to employer, colleagues, family information, it is our assumption that such information is accurate, up to date and complete and that you have obtained the necessary consent to disclose the same.

Conflict

In the event that there is any conflict between the English and national language version of this Notice, the English language version shall prevail.

Notis Perlindungan Data Peribadi

Kami di ZUL RAFIQUE & partners menghormati kepentingan privasi dan sensitiviti data peribadi anda. Sebagaimana yang dikehendaki di bawah Akta Perlindungan Data Peribadi 2010, Notis Perlindungan Data Peribadi ini (“Notis”) bertujuan untuk memaklumkan kepada anda bagaimana kami mengumpul dan memproses data peribadi anda apabila anda melantik pihak kami untuk memberikan perkhidmatan. Bukan itu sahaja, Notis ini turut bertujuan untuk memaklumkan kepada anda bagaimana kami memproses data peribadi anda apabila anda mengakses dan menggunakan laman sesawang kami atau berhubung dengan kami melalui mesyuarat, seminar, ataupun persidangan.

Dengan melantik kami untuk memberikan perkhidmatan kami kepada anda dan juga dengan mengakses dan menggunakan laman sesawang atau berinteraksi dengan kami, anda dengan ini telah bersetuju dengan penggunaan, pengumpulan dan pemprosesan data peribadi anda oleh pihak kami mengikut cara yang dinyatakan dalam Notis ini.

Notis ini akan tertakluk kepada pindaan dan pengemaskinian dari masa ke semasa. Oleh itu, adalah disarankan supaya pihak anda menyemak Notis ini di laman sesawang kami dari masa ke semasa untuk memastikan sebarang pindaan atau pengemaskinian yang dilakukan adalah dalam pengetahuan anda. Dengan meneruskan perlantikan dan penggunaan khidmat kami selepas apa-apa pindaan atau pengemaskinian yang dilakukan terhadap Notis ini, ia secara langsung menandakan penerimaan anda terhadap pindaan atau pengemaskinian yang dilakukan terhadap Notis ini.

Apakah Data Peribadi Yang Kami Kumpul?

Data peribadi secara amnya bermaksud apa-apa maklumat yang berkaitan dengan pengenalan diri anda. Tanggungjawab kami terhadap anda memerlukan kami mengumpul dan memproses data peribadi anda. Pemprosesan dan pengumpulan data peribadi anda bermula dari awal perkhidmatan kami bersama anda termasuklah sebarang interaksi diantara pihak kami dan anda, selepas itu, dari semasa ke semasa sepanjang tempoh pengambilan atau penggunaan khidmat kami.

Jenis data peribadi yang dikumpul dan diproses oleh kami adalah:

nama, tarikh lahir, kewarganegaraan, jantina, nombor kad pengenalan/passport, status kependudukan, alamat surat-menyurat, butiran perhubungan termasuk nombor telefon bimbit, pejabat dan kediaman dan faksimili, alamat email, butiran perbankan, maklumat kewangan / kepercayaan kredit;
kategori pekerjaan (sektor awam, kerajaan, bekerja sendiri, tidak bekerja atau lain-lain), nama majikan dan alamat pejabat, butiran hubungan dengan syarikat (sebagai contoh promoter, pengarah, pemegang saham);
maklumat-maklumat lain yang relevan dan perlu untuk:
- melantik kami untuk memberi khidmat guaman
- memberi khidmat guaman; dan
- menepati keperluan undang-undang dan pengawalseliaan.
apa-apa maklumat tambahan yang diberikan oleh anda atau pihak-pihak ketiga berkenaan dengan anda.

Sumber Data Peribadi

Kebanyakan data peribadi yang dikumpul oleh kami adalah data peribadi yang dikemukakan kepada kami oleh anda. Walaubagaimanapun, data peribadi anda juga boleh dikumpul oleh kami dari sumber-sumber yang lain termasuk tetapi tidak terhad kepada agensi pelaporan kredit, agensi atau jabatan kerajaan, pendaftaran awam, laman sesawang, media sosial, penerbitan, seminar, dan persidangan.

Bagaimana Kami Menggunakan Maklumat Peribadi Anda

Sebagai sebuah firma guaman, kami mengumpul dan memproses data peribadi anda untuk tujuan berikut:

pengesahan identiti anda;
berkomunikasi dengan anda termasuk memberikan maklum balas terhadap pertanyaan anda;
semua tujuan berkaitan dengan perlantikan kami;
untuk memberikan khidmat guaman;
untuk mematuhi keperluan undang-undang dan pengawalseliaan termasuklah perintah mahkamah;
bagi operasi harian kami dan tujuan pentadbiran termasuklah pengurusan fail, bil dan kutipan, audit, laporan, penyiasatan dsb.;
bagi tujuan menguatkuasakan dan mempertahankan hak-hak perundangan kami dan/atau mendapatkan nasihat perundangan;
menghantar bahan-bahan atau penerbitan termasuklah surat berita, artikel- artikel atau maklumat berkenaan majlis-majlis, persidangan-persidangan, seminar-seminar dan ceramah-ceramah yang mungkin menarik minat anda;
untuk mempromosi, menawar atau mengiklan perkhidmatan kami kepada anda;
untuk dihantar sebagai sumber rujukan berpotensi kepada (i) editor-editor / penyelidik-penyelidik di dalam penerbitan dan jurnal-jurnal dan/atau (ii) klien-klien / klien-klien berpotensi yang memohon rujukan kerja-kerja terdahulu berkaitan apa-apa cadangan, penghujahan, tawaran atau bidaan;
untuk membantu pencegahan, pengesanan atau penyiasatan jenayah atau kemungkinan aktiviti-aktiviti jenayah atau bagi pentadbiran keadilan;
tujuan audit dalaman dan keselamatan;
bagi tujuan lain sebagaimana yang diarahkan atau yang telah diberikan persetujuan oleh anda; dan
bagi segala tujuan lain berkaitan atau bersampingan dengan perkara-perkara di atas.

Penzahiran Maklumat Peribadi Anda

Di bawah keadaan-keadaan tertentu, kami boleh menzahirkan data peribadi anda kepada pihak ketiga seperti berikut:

mana-mana orang yang diarahkan oleh atau yang telah dipersetujui oleh anda;
mana-mana orang yang berkenaan bagi tujuan-tujuan perlantikan khidmat undang-undang dan/atau transaksi undang-undang termasuk tetapi tidak terhad kepada pihak lawan, perunding-perunding lain, institusi-institusi kewangan, badan-badan pengawalseliaan dsb;
mana-mana orang bagi tujuan pematuhan undang-undang dan pengawalseliaan;
Pihak pemproses data iaitu pihak ketiga yang akan berkhidmat bagi memproses data peribadi bagi pihak kami termasuk tetapi tidak terhad kepada storan arkib, pemberi khidmat kemasukan data, perkhidmatan-perkhidmatan sokongan komputer, perkhidmatan-perkhidmatan pemulihan bencana, bank-bank dan institusi-institusi kewangan dsb; dan
penasihat-penasihat profesional kami, termasuk tetapi tidak terhad kepada penasihat undang-undang, penasihat-penasihat cukai, penasihat-penasihat kewangan, juruaudit-juruaudit, broker-broker insurans dsb.

Kami juga boleh memindah data peribadi anda keluar dari Malaysia bagi tujuan-tujuan dan kepada pihak ketiga yang dinyatakan dalam Notis ini. Data peribadi anda juga akan dipindah keluar dari Malaysia jika anda berada di luar Malaysia.

Kewajipan untuk Memberi Data Peribadi

Kami mengakui bahawa anda mempunyai hak untuk menentukan maklumat yang diberikan kepada kami. Maklumat yang disenaraikan di atas adalah secara sukarela. Jika anda tidak memberi maklumat di atas atau mengehadkan cara bagaimana maklumat tersebut diproses, kami tidak dapat:

berkomunikasi atau berhubung dengan anda;
bertindak di dalam perlantikan atau transaksi undang-undang dan/atau memberi perkhidmatan kami kepada anda; dan atau
memberikan anda akses kepada laman sesawang kami.

Akses dan Pembetulan Data

Jika anda ingin:

mengakses maklumat peribadi anda;
memperbetulkan atau mengemaskini data peribadi anda; atau
menarikbalik persetujuan anda atau mengehadkan penggunaan data peribadi anda,

sila hantar permintaan bertulis anda kepada:

Penolong Pengurus Jabatan Sumber Manusia dan Pentadbiran

Zul Rafique & Partners
D3-3-8 Solaris Dutamas
No.1 Jalan Dutamas 1
50480 Kuala Lumpur, Malaysia

Telefon : 03-6209 8228
Faksimile : 03-6209 8331

Caj pentadbiran akan dikenakan bagi permintaan di bawah perenggan (a), (b) dan (c) di atas.

Kami berhak untuk menolak permintaan anda jika dibenarkan di bawah undang-undang.

Penafian

Ketepatan dan kelengkapan data peribadi anda bergantung kepada maklumat yang anda berikan. Kami menganggap bahawa maklumat yang anda berikan adalah tepat, terkini dan lengkap melainkan jika anda memaklumkan sebaliknya kepada kami.

Kami menganggap bahawa maklumat pihak ketiga yang anda berikan kepada kami termasuk tetapi tidak terhad kepada maklumat majikan, maklumat rakan-rakan sekerja atau maklumat keluarga adalah tepat, terkini dan lengkap dan anda telah mendapatkan persetujuan yang sewajarnya untuk menzahirkan maklumat tersebut.

Percanggahan

Jika terdapat percanggahan diantara versi Bahasa Inggeris dan Bahasa Kebangsaan pada Notis ini, versi Bahasa Inggeris akan diguna pakai.

Cryptocurrencies and ICOs…