OAM — the Italian agent and crypto register

The OAM register is the Italian regulatory feature most often misread by foreign-licensed firms — usually in the direction of doing too much. The Organismo degli Agenti e dei Mediatori keeps the mandatory registers of financial agents and credit brokers, holds the special section for payment-services agents, and until this year kept Italy’s pre-MiCA register of virtual-currency operators. Getting the perimeter right matters twice over: a passporting institution that registers agents it does not need to register loses months, and one that skips the half-yearly communication it does owe is exposed to an anti-money-laundering sanction. This piece sets out who registers, who only communicates, what the central contact point is for, and what happened to the VASP register.

1. Who runs the OAM, and which lists it keeps

The OAM is an Italian-law body created under Article 128-undecies of the Testo Unico Bancario, operating under Banca d’Italia’s supervisory umbrella. It is not a licensing authority: it keeps registers, vets entry requirements, and channels data to the supervisors. Four lists matter for a payments audience.

2. The special section: payment-services agents of Italian institutions

An agent that promotes and concludes payment-service contracts on direct mandate of an intermediary under Title V of the TUB, a payment institution, an e-money institution, a bank or Poste Italiane is carrying on financial agency in payment services. Where that activity is performed exclusively in payment services, entry goes to the special section of the Elenco degli Agenti in Attività Finanziaria under Article 128-quater TUB — registration under comma 2, with the communication duties in comma 7 — implemented by D.M. 28 dicembre 2012, n. 256, against the payment-services definitions in D.Lgs. 11/2010.

Registration is per person. Each natural person or legal entity acting as an agent is entered in its own right, holding its own entry requirements, alongside — not instead of — the principal’s authorisation. The principal retains supervisory responsibility for the agent’s conduct, including anti-money-laundering performance, and Banca d’Italia inspects that on both sides of the relationship.

3. The rule foreign-licensed firms get wrong

An agent that acts only for payment institutions or e-money institutions authorised in another EU Member State is not required to enter the Italian special section. That agent belongs in the public register kept by the authority that authorised the principal — the home-state register — and the Italian obligation is discharged through communication to the OAM rather than through registration.

There is one hard edge, and it is the thing to test before designing a distribution network. If the agent acts for even one Italian-authorised institution alongside its EU principals, the Italian registration becomes mandatory for that agent. Mixed networks convert a communication obligation into a registration obligation, per agent, silently.

Worked example. A Luxembourg-authorised e-money institution passports into Italy and appoints twelve retail agents, four of which already distribute for an Italian payment institution. Facts to rule: the eight pure-EU agents sit outside the special section and belong in the Luxembourg register; the four mixed agents fall inside it and must be entered in Italy. What the compliance officer does: run the mixed-mandate test at onboarding as a screening question rather than a periodic review, and separate the two populations in the agent master data. Outcome: eight agents live on the home-state notification timetable, four on the Italian one. The failure mode is treating the network as homogeneous — either twelve unnecessary Italian registrations, or four missing ones discovered in an inspection.

4. The central contact point and the half-yearly communication

Escaping the special section does not remove the Italian obligation, it changes its shape. Payment service providers and e-money institutions — Italian and EU alike — must communicate their agents and convenzionati to the OAM on a half-yearly basis, so that the supervisory authorities can run their controls. EU institutions do this through their punto di contatto centrale, the central contact point that Italian anti-money-laundering law requires of institutions distributing in Italy through agents or convenzionati.

The central contact point is itself a registered object: it enters a dedicated section of the OAM register and maintains its identification details, the date activity began in Italy, and any subsequent variations. Institutions must accredit with the OAM before they can transmit, which is a lead-time item rather than a formality — the accreditation has to exist before the first reporting date, not on it.

A convenzionato is a different animal from an agent and is easy to under-declare: an operator providing auxiliary or support activity in the provision of payment services without entering a negotiating relationship with the end customer. Retail networks assembled through commercial partners frequently contain convenzionati that nobody has classified.

Worked example. A passporting institution’s first half-yearly communication lists its 40 agents and omits 60 retail points that top up balances but never sign a customer up. Facts to rule: those points are performing auxiliary activity in the provision of payment services with no negotiation with the end customer — convenzionati, and inside the communication. What the operations lead does: build the population from the commercial contract inventory rather than from the agent register, and classify every counterparty as agent, convenzionato or neither before the cut-off. Outcome: one complete file. The failure mode is a systematically incomplete return, which is what supervisory data-matching is designed to find.

The consequence of not doing it is not administrative. Failure in this regime is pursued as a sanction under Article 61, comma 2, of D.Lgs. 231/2007 — the anti-money-laundering decree — not as a registry housekeeping point.

5. The VASP register, and the transition that has now closed

Until MiCA, Italy required operators in virtual currencies and digital wallets to enter a register kept by the OAM. That regime has ended, and the dates have all now passed — which makes any guidance still describing OAM-VASP registration as a live route out of date.

Two points survive the expiry and still matter. OAM-VASP registration was never equivalent to a MiCA authorisation — it was a registration regime with anti-money-laundering purposes, not a prudential licence — so a firm cannot rely on a historic entry as evidence of authorised status. And an application filed inside the window bought continuity only until it was decided, and in no case beyond 30 June 2026.

6. What replaced it

Crypto-asset service providers now hold an authorisation under Article 59 of Regulation (EU) 2023/1114. Italy splits the authorising role between Banca d’Italia and CONSOB, with CONSOB acting as the single point of contact with ESMA for cross-border notifications under Article 65 MiCAR. Authorised firms appear in the competent authority’s register; the OAM list no longer performs that function. The mechanics of the file are covered in our CASP authorisation in Italy piece.

Note what does not transfer. A CASP that intends to distribute through agents or convenzionati in Italy re-enters the questions in sections 2 to 4 on their own terms; the crypto authorisation says nothing about the agent perimeter, and the two regimes are assessed separately.

7. Ongoing obligations, and where they decay

• Entry requirements are continuing requirements. Fitness and properness is tested at registration and has to hold afterwards; the practical control is a periodic re-collection of criminal-record and conflicts declarations, not a file assembled once.
• Variations are notifiable. Change of address, change of principal, change of the central contact point, cessation of activity in Italy — each is a data-maintenance event with its own filing.
• The half-yearly communication is a fixed cycle. It runs whether or not the network changed, and it is built from a population, so the reconciliation has to happen upstream of the cut-off.
• Deregistration is operationally sharp. An agent removed from the list can no longer perform the activity. The principal has to terminate the mandate and preserve continuity of the customer relationship, and any sanction against the agent runs separately.
• Annual contributions apply to registered persons and to institutions managing networks; treat them as a diarised item, because non-payment is a status problem rather than a billing one.

8. Questions that come up

9. What to do, today

• Run the mixed-mandate test on every Italian agent: does it act for any Italian-authorised institution? That single question decides register-or-communicate.
• If you are an EU principal, confirm your central contact point is registered in the OAM’s dedicated section and that its data — including the date activity began in Italy — is current.
• Complete the OAM accreditation before the first half-yearly reporting date, not on it.
• Build the half-yearly population from the commercial contract inventory, so convenzionati are classified rather than assumed absent.
• Re-collect agent fitness-and-properness evidence on a cycle; entry requirements are continuing requirements.
• Remove any residual reliance on an OAM-VASP entry. It ceased to authorise anything on 30 June 2026.

Related: CASP authorisation in Italy · EMI licence in Italy · Agent versus distributor · PSD2 agents and the Article 14 register · Agent and distributor reporting obligations · Registro dei titolari effettivi — Italy