Article 60 Provision of crypto-asset services by certain financial entities
1. A credit institution may provide crypto-asset services if it notifies the information referred to in paragraph 7 to the competent authority of its home Member State at least 40 working days before providing those services for the first time. 2. A central securities depository authorised under Regulation (EU) No 909/2014 of the European Parliament and of the Council ( 45 ) shall only provide custody and administration of crypto-assets on behalf of clients if it notifies the information referred to in paragraph 7 of this Article to the competent authority of the home Member State, at least 40 working days before providing that service for the first time. For the purposes of the first subparagraph of this paragraph, providing custody and administration of crypto-assets on behalf of clients is deemed equivalent to providing, maintaining or operating securities accounts in relation to the settlement service referred to in Section B, point (3), of the Annex to Regulation (EU) No 909/2014. 3. An investment firm may provide crypto-asset services in the Union equivalent to the investment services and activities for which it is specifically authorised under Directive 2014/65/EU if it notifies the competent authority of the home Member State of the information referred to in paragraph 7 of this Article at least 40 working days before providing those services for the first time. For the purposes of this paragraph: (a) providing custody and administration of crypto-assets on behalf of clients is deemed equivalent to the ancillary service referred to in Section B, point (1), of Annex I to Directive 2014/65/EU; (b) the operation of a trading platform for crypto-assets is deemed equivalent to the operation of a multilateral trading facility and operation of an organised trading facility referred to in Section A, points (8) and (9), respectively, of Annex I to Directive 2014/65/EU; (c) the exchange of crypto-assets for funds and other crypto-assets is deemed equivalent to dealing on own account referred to in Section A, point (3), of Annex I to Directive 2014/65/EU; (d) the execution of orders for crypto-assets on behalf of clients is deemed equivalent to the execution of orders on behalf of clients referred to in Section A, point (2), of Annex I to Directive 2014/65/EU; (e) the placing of crypto-assets is deemed equivalent to the underwriting or placing of financial instruments on a firm commitment basis and placing of financial instruments without a firm commitment basis referred to in Section A, points (6) and (7), respectively, of Annex I to Directive 2014/65/EU; (f) the reception and transmission of orders for crypto-assets on behalf of clients is deemed equivalent to the reception and transmission of orders in relation to one or more financial instruments referred to in Section A, point (1), of Annex I to Directive 2014/65/EU; (g) providing advice on crypto-assets is deemed equivalent to investment advice referred to in Section A, point (5), of Annex I to Directive 2014/65/EU; (h) providing portfolio management on crypto-assets is deemed equivalent to portfolio management referred to in Section A, point (4), of Annex I to Directive 2014/65/EU. 4. An electronic money institution authorised under Directive 2009/110/EC shall only provide custody and administration of crypto-assets on behalf of clients and transfer services for crypto-assets on behalf of clients with regard to the e-money tokens it issues if it notifies the competent authority of the home Member State of the information referred to in paragraph 7 of this Article at least 40 working days before providing those services for the first time. 5. A UCITS management company or an alternative investment fund manager may provide crypto-asset services equivalent to the management of portfolios of investment and non-core services for which it is authorised under Directive 2009/65/EC or Directive 2011/61/EU if it notifies the competent authority of the home Member State of the information referred to in paragraph 7 of this Article at least 40 working days before providing those services for the first time. For the purposes of this paragraph: (a) the reception and transmission of orders for crypto-assets on behalf of clients is deemed equivalent to the reception and transmission of orders in relation to financial instruments referred in Article 6(4), point (b)(iii), of Directive 2011/61/EU; (b) providing advice on crypto-assets is deemed equivalent to investment advice referred to in Article 6(4), point (b)(i), of Directive 2011/61/EU and in Article 6(3), point (b)(i), of Directive 2009/65/EC; (c) providing portfolio management on crypto-assets is deemed equivalent to the services referred to in Article 6(4), point (a), of Directive 2011/61/EU and in Article 6(3), point (a), of Directive 2009/65/EC. 6. A market operator authorised under Directive 2014/65/EU may operate a trading platform for crypto-assets if it notifies the competent authority of the home Member State of the information referred to in paragraph 7 of this Article at least 40 working days before providing those services for the first time. 7. For the purposes of paragraphs 1 to 6, the following information shall be notified: (a) a programme of operations setting out the types of crypto-asset services that the applicant crypto-asset service provider intends to provide, including where and how those services are to be marketed; (b) a description of: (i) the internal control mechanisms, policies and procedures to ensure compliance with the provisions of national law transposing Directive (EU) 2015/849; (ii) the risk assessment framework for the management of money laundering and terrorist financing risks; and (iii) the business continuity plan; (c) the technical documentation of the ICT systems and security arrangements, and a description thereof in non-technical language; (d) a description of the procedure for the segregation of clients’ crypto-assets and funds; (e) a description of the custody and administration policy, where it is intended to provide custody and administration of crypto-assets on behalf of clients; (f) a description of the operating rules of the trading platform and of the procedures and system to detect market abuse, where it is intended to operate a trading platform for crypto-assets; (g) a description of the non-discriminatory commercial policy governing the relationship with clients as well as a description of the methodology for determining the price of the crypto-assets they propose to exchange for funds or other crypto-assets, where it is intended to exchange crypto-assets for funds or other crypto-assets; (h) a description of the execution policy, where it is intended to execute orders for crypto-assets on behalf of clients; (i) evidence that the natural persons giving advice on behalf of the applicant crypto-asset service provider or managing portfolios on behalf of the applicant crypto-asset service provider have the necessary knowledge and expertise to fulfil their obligations, where it is intended to provide advice on crypto-assets or provide portfolio management on crypto-assets; (j) whether the crypto-asset service relates to asset-referenced tokens, e-money tokens or other crypto-assets; (k) information on the manner in which such transfer services will be provided, where it is intended to provide transfer services for crypto-assets on behalf of clients. 8. A competent authority receiving a notification as referred to in paragraphs 1 to 6 shall, within 20 working days of receipt of such notification, assess whether all required information has been provided. Where the competent authority concludes that a notification is not complete, it shall immediately inform the notifying entity thereof and set a deadline by which that entity is required to provide the missing information. The deadline for providing any missing information shall not exceed 20 working days from the date of the request. Until the expiry of that deadline, each period as set out in paragraphs 1 to 6 shall be suspended. Any further requests by the competent authority for completion or clarification of the information shall be at its discretion but shall not result in a suspension of any period set out in paragraphs 1 to 6. The crypto-asset service provider shall not begin providing the crypto-asset services as long as the notification is incomplete. 9. The entities referred to in paragraphs 1 to 6 shall not be required to submit any information referred to in paragraph 7 that was previously submitted by them to the competent authority where such information would be identical. When submitting the information referred to in paragraph 7, the entities referred to in paragraphs 1 to 6 shall expressly state that any information that was submitted previously is still up-to-date. 10. Where the entities referred to in paragraphs 1 to 6 of this Article provide crypto-asset services, they shall not be subject to Articles 62, 63, 64, 67, 83 and 84. 11. The right to provide crypto-asset services referred to in paragraphs 1 to 6 of this Article shall be revoked upon the withdrawal of the relevant authorisation that enabled the respective entity to provide the crypto-asset services without being required to obtain an authorisation pursuant to Article 59. 12. Competent authorities shall communicate to ESMA the information specified in Article 109(5), after verifying the completeness of the information referred to in paragraph 7. ESMA shall make such information available in the register referred to in Article 109 by the starting date of the intended provision of crypto-asset services. 13. ESMA, in close cooperation with EBA, shall develop draft regulatory technical standards to further specify the information referred to in paragraph 7. ESMA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by 30 June 2024. Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010. 14. ESMA, in close cooperation with EBA, shall develop draft implementing technical standards to establish standard forms, templates and procedures for the notification pursuant to paragraph 7. ESMA shall submit the draft implementing technical standards referred to in the first subparagraph to the Commission by 30 June 2024. Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph of this paragraph in accordance with Article 15 of Regulation (EU) No 1095/2010.
Article 61 Provision of crypto-asset services at the exclusive initiative of the client
1. Where a client established or situated in the Union initiates at its own exclusive initiative the provision of a crypto-asset service or activity by a third‐country firm, the requirement for authorisation under Article 59 shall not apply to the provision of that crypto-asset service or activity by the third‐country firm to that client, including a relationship specifically relating to the provision of that crypto-asset service or activity. Without prejudice to intragroup relationships, where a third‐country firm, including through an entity acting on its behalf or having close links with such third‐country firm or any other person acting on behalf of such entity, solicits clients or prospective clients in the Union, regardless of the means of communication used for the solicitation, promotion or advertising in the Union, it shall not be deemed to be a service provided on the client’s own exclusive initiative. The second subparagraph shall apply notwithstanding any contractual clause or disclaimer purporting to state otherwise, including any clause or disclaimer that the provision of services by a third-country firm is deemed to be a service provided on the client’s own exclusive initiative. 2. A client’s own exclusive initiative as referred to in paragraph 1 shall not entitle a third‐country firm to market new types of crypto-assets or crypto-asset services to that client. 3. ESMA shall by 30 December 2024 issue guidelines in accordance with Article 16 of Regulation (EU) No 1095/2010 to specify the situations in which a third-country firm is deemed to solicit clients established or situated in the Union. In order to foster convergence and promote consistent supervision in respect of the risk of abuse of this Article, ESMA shall also issue guidelines in accordance with Article 16 of Regulation (EU) No 1095/2010 on supervision practices to detect and prevent circumvention of this Regulation.
Article 62 Application for authorisation as a crypto-asset service provider
1. Legal persons or other undertakings that intend to provide crypto-asset services shall submit their application for an authorisation as a crypto-asset service provider to the competent authority of their home Member State. 2. The application referred to in paragraph 1 shall contain all of the following information: (a) the name, including the legal name and any other commercial name used, the legal entity identifier of the applicant crypto-asset service provider, the website operated by that provider, a contact email address, a contact telephone number and its physical address; (b) the legal form of the applicant crypto-asset service provider; (c) the articles of association of the applicant crypto-asset service provider, where applicable; (d) a programme of operations, setting out the types of crypto-asset services that the applicant crypto-asset service provider intends to provide, including where and how those services are to be marketed; (e) proof that the applicant crypto-asset service provider meets the requirements for prudential safeguards set out in Article 67; (f) a description of the applicant crypto-asset service provider’s governance arrangements; (g) proof that members of the management body of the applicant crypto-asset service provider are of sufficiently good repute and possess the appropriate knowledge, skills and experience to manage that provider; (h) the identity of any shareholders and members, whether direct or indirect, that have qualifying holdings in the applicant crypto-asset service provider and the amounts of those holdings, as well as proof that those persons are of sufficiently good repute; (i) a description of the applicant crypto-asset service provider’s internal control mechanisms, policies and procedures to identify, assess and manage risks, including money laundering and terrorist financing risks, and business continuity plan; (j) the technical documentation of the ICT systems and security arrangements, and a description thereof in non-technical language; (k) a description of the procedure for the segregation of clients’ crypto-assets and funds; (l) a description of the applicant crypto-asset service provider’s complaints-handling procedures; (m) where the applicant crypto-asset service provider intends to provide custody and administration of crypto-assets on behalf of clients, a description of the custody and administration policy; (n) where the applicant crypto-asset service provider intends to operate a trading platform for crypto-assets, a description of the operating rules of the trading platform and of the procedure and system to detect market abuse; (o) where the applicant crypto-asset service provider intends to exchange crypto-assets for funds or other crypto-assets, a description of the commercial policy, which shall be non-discriminatory, governing the relationship with clients as well as a description of the methodology for determining the price of the crypto-assets that the applicant crypto-asset service provider proposes to exchange for funds or other crypto-assets; (p) where the applicant crypto-asset service provider intends to execute orders for crypto-assets on behalf of clients, a description of the execution policy; (q) where the applicant crypto-asset service provider intends to provide advice on crypto-assets or portfolio management of crypto-assets, proof that the natural persons giving advice on behalf of the applicant crypto-asset service provider or managing portfolios on behalf of the applicant crypto-asset service provider have the necessary knowledge and expertise to fulfil their obligations; (r) where the applicant crypto-asset service provider intends to provide transfer services for crypto-assets on behalf of clients, information on the manner in which such transfer services will be provided; (s) the type of crypto-asset to which the crypto-asset service relates. 3. For the purposes of paragraph 2, points (g) and (h), an applicant crypto-asset service provider shall provide proof of all of the following: (a) for all members of the management body of the applicant crypto-asset service provider, the absence of a criminal record in respect of convictions and the absence of penalties imposed under the applicable commercial law, insolvency law and financial services law, or in relation to anti-money laundering, and counter-terrorist financing, to fraud or to professional liability; (b) that the members of the management body of the applicant crypto-asset service provider collectively possess the appropriate knowledge, skills and experience to manage the crypto-asset service provider and that those persons are required to commit sufficient time to perform their duties; (c) for all shareholders and members, whether direct or indirect, that have qualifying holdings in the applicant crypto-asset service provider, the absence of a criminal record in respect of convictions or the absence of penalties imposed under the applicable commercial law, insolvency law and financial services law, or in relation to anti-money laundering and counter-terrorist financing, to fraud or to professional liability. 4. Competent authorities shall not require an applicant crypto-asset service provider to provide any information referred to in paragraphs 2 and 3 of this Article that they have already received under the respective authorisation procedures in accordance with Directive 2009/110/EC, 2014/65/EU or (EU) 2015/2366, or pursuant to national law applicable to crypto-asset services prior to 29 June 2023, provided that such previously submitted information or documents are still up-to-date. 5. ESMA, in close cooperation with EBA, shall develop draft regulatory technical standards to further specify the information referred to in paragraphs 2 and 3. ESMA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by 30 June 2024. Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010. 6. ESMA, in close cooperation with EBA, shall develop draft implementing technical standards to establish standard forms, templates and procedures for the information to be included in the application for authorisation as a crypto-asset service provider. ESMA shall submit the draft implementing technical standards referred to in the first subparagraph to the Commission by 30 June 2024. Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph of this paragraph in accordance with Article 15 of Regulation (EU) No 1095/2010.
Article 63 Assessment of the application for authorisation and grant or refusal of authorisation
1. Competent authorities shall promptly, and in any event within five working days of receipt of an application under Article 62(1), acknowledge receipt thereof in writing to the applicant crypto-asset service provider. 2. Competent authorities shall, within 25 working days of receipt of an application under Article 62(1), assess whether that application is complete by checking that the information listed in Article 62(2) has been submitted. Where the application is not complete, competent authorities shall set a deadline by which the applicant crypto-asset service provider is to provide any missing information. 3. Competent authorities may refuse to review applications where such applications remain incomplete after the expiry of the deadline set by them in accordance with paragraph 2, second subparagraph. 4. Once an application is complete, competent authorities shall promptly notify the applicant crypto-asset service provider thereof. 5. Before granting or refusing authorisation as a crypto-asset service provider, competent authorities shall consult the competent authorities of another Member State where the applicant crypto-asset service provider is in one of the following positions in relation to a credit institution, a central securities depository, an investment firm, a market operator, a UCITS management company, an alternative investment fund manager, a payment institution, an insurance undertaking, an electronic money institution or an institution for occupational retirement provision, authorised in that other Member State: (a) it is its subsidiary; (b) it is a subsidiary of the parent undertaking of that entity; or (c) it is controlled by the same natural or legal persons who control that entity. 6. Before granting or refusing an authorisation as a crypto-asset service provider, competent authorities: (a) may consult the competent authorities for anti-money laundering and counter-terrorist financing, and financial intelligence units, in order to verify that the applicant crypto-asset service provider has not been the subject of an investigation into conduct relating to money laundering or terrorist financing; (b) shall ensure that the applicant crypto-asset service provider that operates establishments or relies on third parties established in high-risk third countries identified pursuant to Article 9 of Directive (EU) 2015/849 complies with the provisions of national law transposing Articles 26(2), 45(3) and 45(5) of that Directive; (c) shall, where appropriate, ensure that the applicant crypto-asset service provider has put in place appropriate procedures to comply with the provisions of national law transposing Article 18a(1) and (3) of Directive (EU) 2015/849. 7. Where close links exist between the applicant crypto-asset service provider and other natural or legal persons, competent authorities shall grant authorisation only if those links do not prevent the effective exercise of their supervisory functions. 8. Competent authorities shall refuse authorisation if the laws, regulations or administrative provisions of a third country governing one or more natural or legal persons with which the applicant crypto-asset service provider has close links, or difficulties involved in their enforcement, prevent the effective exercise of their supervisory functions. 9. Competent authorities shall, within 40 working days from the date of receipt of a complete application, assess whether the applicant crypto-asset service provider complies with this Title and shall adopt a fully reasoned decision granting or refusing an authorisation as a crypto-asset service provider. Competent authorities shall notify the applicant of their decision within five working days of the date of that decision. That assessment shall take into account the nature, scale and complexity of the crypto-asset services that the applicant crypto-asset service provider intends to provide. 10. Competent authorities shall refuse authorisation as a crypto-asset service provider where there are objective and demonstrable grounds that: (a) the management body of the applicant crypto-asset service provider poses a threat to its effective, sound and prudent management and business continuity, and to the adequate consideration of the interest of its clients and the integrity of the market, or exposes the applicant crypto-asset service provider to a serious risk of money laundering or terrorist financing; (b) the members of the management body of the applicant crypto-asset service provider do not meet the criteria set out in Article 68(1); (c) the shareholders or members, whether direct or indirect, that have qualifying holdings in the applicant crypto-asset service provider do not meet the criteria of sufficiently good repute set out in Article 68(2); (d) the applicant crypto-asset service provider fails to meet or is likely to fail to meet any of the requirements of this Title. 11. ESMA and EBA shall jointly issue guidelines in accordance with Article 16 of Regulation (EU) No 1095/2010 and Article 16 of Regulation (EU) No 1093/2010, respectively, on the assessment of the suitability of the members of the management body of the applicant crypto-asset service provider and of the shareholders or members, whether direct or indirect, that have qualifying holdings in the applicant crypto-asset service provider. ESMA and EBA shall issue the guidelines referred to in the first subparagraph by 30 June 2024. 12. Competent authorities may, during the assessment period provided for in paragraph 9, and no later than on the 20th working day of that period, request any further information that is necessary to complete the assessment. Such request shall be made in writing to the applicant crypto-asset service provider and shall specify the additional information needed. The assessment period under paragraph 9 shall be suspended for the period between the date of request for missing information by the competent authorities and the receipt by them of a response thereto from the applicant crypto-asset service provider. The suspension shall not exceed 20 working days. Any further requests by the competent authorities for completion or clarification of the information shall be at their discretion but shall not result in a suspension of the assessment period under paragraph 9. 13. Competent authorities shall, within two working days of granting authorisation, communicate to ESMA the information specified in Article 109(5). Competent authorities shall also inform ESMA of any refusals of authorisations. ESMA shall make the information referred to in Article 109(5) available in the register referred to in that Article by the starting date of the provision of crypto-asset services.
Article 64 Withdrawal of authorisation of a crypto-asset service provider
1. Competent authorities shall withdraw the authorisation of a crypto-asset service provider if the crypto-asset service provider does any of the following: (a) has not used its authorisation within 12 months of the date of the authorisation; (b) has expressly renounced its authorisation; (c) has not provided crypto-asset services for nine consecutive months; (d) has obtained its authorisation by irregular means, such as by making false statements in its application for authorisation; (e) no longer meets the conditions under which the authorisation was granted and has not taken the remedial action requested by the competent authority within the specified timeframe; (f) fails to have in place effective systems, procedures and arrangements to detect and prevent money laundering and terrorist financing in accordance with Directive (EU) 2015/849; (g) has seriously infringed this Regulation, including the provisions relating to the protection of holders of crypto-assets or of clients of crypto-asset service providers, or market integrity. 2. Competent authorities may withdraw authorisation as a crypto-asset service provider in any of the following situations: (a) the crypto-asset service provider has infringed the provisions of national law transposing Directive (EU) 2015/849; (b) the crypto-asset service provider has lost its authorisation as a payment institution or its authorisation as an electronic money institution, and that crypto-asset service provider has failed to remedy the situation within 40 calendar days. 3. Where a competent authority withdraws an authorisation as a crypto-asset service provider, it shall notify ESMA and the single points of contact of the host Member States without undue delay. ESMA shall make such information available in the register referred to in Article 109. 4. Competent authorities may limit the withdrawal of authorisation to a particular crypto-asset service. 5. Before withdrawing an authorisation as a crypto-asset service provider, competent authorities shall consult the competent authority of another Member State where the crypto-asset service provider concerned is: (a) a subsidiary of a crypto-asset service provider authorised in that other Member State; (b) a subsidiary of the parent undertaking of a crypto-asset service provider authorised in that other Member State; (c) controlled by the same natural or legal persons who control a crypto-asset service provider authorised in that other Member State. 6. Before withdrawing an authorisation as a crypto-asset service provider, competent authorities may consult the authority competent for supervising compliance of the crypto-asset service provider with the rules on anti-money laundering and counter-terrorist financing. 7. EBA, ESMA and any competent authority of a host Member State may at any time request that the competent authority of the home Member State examine whether the crypto-asset service provider still complies with the conditions under which the authorisation was granted, when there are grounds to suspect it may no longer be the case. 8. Crypto-asset service providers shall establish, implement and maintain adequate procedures ensuring the timely and orderly transfer of their clients’ crypto-assets and funds to another crypto-asset service provider when an authorisation is withdrawn.
Article 65 Cross-border provision of crypto-asset services
1. A crypto-asset service provider that intends to provide crypto-asset services in more than one Member State shall submit the following information to the competent authority of the home Member State: (a) a list of the Member States in which the crypto-asset service provider intends to provide crypto-asset services; (b) the crypto-asset services that the crypto-asset service provider intends to provide on a cross-border basis; (c) the starting date of the intended provision of the crypto-asset services; (d) a list of all other activities provided by the crypto-asset service provider not covered by this Regulation. 2. The competent authority of the home Member State shall, within 10 working days of receipt of the information referred to in paragraph 1, communicate that information to the single points of contact of the host Member States, to ESMA and to EBA. 3. The competent authority of the Member State that granted authorisation shall inform the crypto-asset service provider concerned of the communication referred to in paragraph 2 without delay. 4. The crypto-asset service provider may begin to provide crypto-asset services in a Member State other than its home Member State from the date of receipt of the communication referred to in paragraph 3 or at the latest from the 15th calendar day after having submitted the information referred to in paragraph 1.
Article 66 Obligation to act honestly, fairly and professionally in the best interests of clients
1. Crypto-asset service providers shall act honestly, fairly and professionally in accordance with the best interests of their clients and prospective clients. 2. Crypto-asset service providers shall provide their clients with information that is fair, clear and not misleading, including in marketing communications, which shall be identified as such. Crypto-asset service providers shall not, deliberately or negligently, mislead a client in relation to the real or perceived advantages of any crypto-assets. 3. Crypto-asset service providers shall warn clients of the risks associated with transactions in crypto-assets. When operating a trading platform for crypto-assets, exchanging crypto-assets for funds or other crypto-assets, providing advice on crypto-assets or providing portfolio management on crypto-assets, crypto-asset service providers shall provide their clients with hyperlinks to any crypto-asset white papers for the crypto-assets in relation to which they are providing those services. 4. Crypto-asset service providers shall make their policies on pricing, costs and fees publicly available, in a prominent place on their website. 5. Crypto-asset service providers shall make publicly available, in a prominent place on their website, information related to the principal adverse impacts on the climate and other environment-related adverse impacts of the consensus mechanism used to issue each crypto-asset in relation to which they provide services. That information may be obtained from the crypto-asset white papers. 6. ESMA, in cooperation with EBA, shall develop draft regulatory technical standards on the content, methodologies and presentation of information referred to in paragraph 5 in respect of the sustainability indicators in relation to adverse impacts on the climate and other environment‐related adverse impacts. When developing the draft regulatory technical standards referred to in the first subparagraph, ESMA shall consider the various types of consensus mechanisms used to validate crypto-asset transactions, their incentive structures and the use of energy, renewable energy and natural resources, the production of waste and greenhouse gas emissions. ESMA shall update the regulatory technical standards in the light of regulatory and technological developments. ESMA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by 30 June 2024. Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.
Article 67 Prudential requirements
1. Crypto-asset service providers shall, at all times, have in place prudential safeguards equal to an amount of at least the higher of the following: (a) the amount of permanent minimum capital requirements indicated in Annex IV, depending on the type of the crypto-asset services provided; (b) one quarter of the fixed overheads of the preceding year, reviewed annually. 2. Crypto-asset service providers that have not been in business for one year from the date on which they began providing services shall use, for the calculation referred to in paragraph 1, point (b), the projected fixed overheads included in their projections for the first 12 months of service provision, as submitted with their application for authorisation. 3. For the purposes of paragraph 1, point (b), crypto-asset service providers shall calculate their fixed overheads for the preceding year, using figures resulting from the applicable accounting framework, by subtracting the following items from the total expenses after distribution of profits to shareholders or members in their most recently audited annual financial statements or, where audited statements are not available, in annual financial statements validated by national supervisors: (a) staff bonuses and other remuneration, to the extent that those bonuses and that remuneration depend on a net profit of the crypto-asset service providers in the relevant year; (b) employees’, directors’ and partners’ shares in profits; (c) other appropriations of profits and other variable remuneration, to the extent that they are fully discretionary; (d) non-recurring expenses from non-ordinary activities. 4. The prudential safeguards referred to in paragraph 1 shall take any of the following forms or a combination thereof: (a) own funds, consisting of Common Equity Tier 1 items and instruments referred to in Articles 26 to 30 of Regulation (EU) No 575/2013 after the deductions in full, pursuant to Article 36 of that Regulation, without the application of threshold exemptions pursuant to Articles 46 and 48 of that Regulation; (b) an insurance policy covering the territories of the Union where crypto-asset services are provided or a comparable guarantee. 5. The insurance policy referred to in paragraph 4, point (b), shall be disclosed to the public on the crypto-asset service provider’s website and shall have at least the following characteristics: (a) it has an initial term of not less than one year; (b) the notice period for its cancellation is at least 90 days; (c) it is taken out from an undertaking authorised to provide insurance, in accordance with Union or national law; (d) it is provided by a third-party entity. 6. The insurance policy referred to in paragraph 4, point (b), shall include coverage against the risk of all of the following: (a) loss of documents; (b) misrepresentations or misleading statements made; (c) acts, errors or omissions resulting in a breach of: (i) legal and regulatory obligations; (ii) the obligation to act honestly, fairly and professionally towards clients; (iii) obligations of confidentiality; (d) failure to establish, implement and maintain appropriate procedures to prevent conflicts of interest; (e) losses arising from business disruption or system failures; (f) where applicable to the business model, gross negligence in the safeguarding of clients’ crypto-assets and funds; (g) liability of the crypto-asset service providers towards clients pursuant to Article 75(8).
Article 68 Governance arrangements
1. Members of the management body of crypto-asset service providers shall be of sufficiently good repute and possess the appropriate knowledge, skills and experience, both individually and collectively, to perform their duties. In particular, members of the management body of crypto-asset service providers shall not have been convicted of offences relating to money laundering or terrorist financing or of any other offences that would affect their good repute. They shall also demonstrate that they are capable of committing sufficient time to effectively perform their duties. 2. Shareholders and members, whether direct or indirect, that have qualifying holdings in crypto-asset service providers shall be of sufficiently good repute and, in particular, shall not have been convicted of offences relating to money laundering or terrorist financing or of any other offences that would affect their good repute. 3. Where the influence exercised by the shareholders or members, whether direct or indirect, that have qualifying holdings in a crypto-asset service provider is likely to be prejudicial to the sound and prudent management of that crypto-asset service provider, competent authorities shall take appropriate measures to address those risks. Such measures may include applications for judicial orders or the imposition of penalties against directors and those responsible for management, or the suspension of the exercise of the voting rights attaching to the shares held by the shareholders or members, whether direct or indirect, that have the qualifying holdings. 4. Crypto-asset service providers shall adopt policies and procedures that are sufficiently effective to ensure compliance with this Regulation. 5. Crypto-asset service providers shall employ personnel with the knowledge, skills and expertise necessary for the discharge of the responsibilities allocated to them, taking into account the scale, nature and range of crypto-asset services provided. 6. The management body of crypto-asset service providers shall assess and periodically review the effectiveness of the policy arrangements and procedures put in place to comply with Chapters 2 and 3 of this Title and take appropriate measures to address any deficiencies in that respect. 7. Crypto-asset service providers shall take all reasonable steps to ensure continuity and regularity in the performance of their crypto-asset services. To that end, crypto-asset service providers shall employ appropriate and proportionate resources and procedures, including resilient and secure ICT systems as required by Regulation (EU) 2022/2554. Crypto-asset service providers shall establish a business continuity policy, which shall include ICT business continuity plans as well as ICT response and recovery plans set up pursuant to Articles 11 and 12 of Regulation (EU) 2022/2554 that aim to ensure, in the case of an interruption to their ICT systems and procedures, the preservation of essential data and functions and the maintenance of crypto-asset services or, where that is not possible, the timely recovery of such data and functions and the timely resumption of crypto-asset services. 8. Crypto-asset service providers shall have in place mechanisms, systems and procedures as required by Regulation (EU) 2022/2554, as well as effective procedures and arrangements for risk assessment, to comply with the provisions of national law transposing Directive (EU) 2015/849. They shall monitor and, on a regular basis, evaluate the adequacy and effectiveness of those mechanisms, systems and procedures, taking into account the scale, the nature and range of crypto-asset services provided, and shall take appropriate measures to address any deficiencies in that respect. Crypto-asset service providers shall have systems and procedures to safeguard the availability, authenticity, integrity and confidentiality of data pursuant to Regulation (EU) 2022/2554. 9. Crypto-asset service providers shall arrange for records to be kept of all crypto-asset services, activities, orders, and transactions undertaken by them. Those records shall be sufficient to enable competent authorities to fulfil their supervisory tasks and to take enforcement measures, and in particular to ascertain whether crypto-asset service providers have complied with all obligations including those with respect to clients or prospective clients and to the integrity of the market. The records kept pursuant to the first subparagraph shall be provided to clients upon request and shall be kept for a period of five years and, where requested by the competent authority before five years have elapsed, for a period of up to seven years. 10. ESMA shall develop draft regulatory technical standards to further specify: (a) the measures ensuring continuity and regularity in the performance of the crypto-asset services referred to in paragraph 7; (b) the records to be kept of all crypto-asset services, activities, orders and transactions undertaken referred to in paragraph 9. ESMA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by 30 June 2024. Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.
Article 69 Information to competent authorities
Crypto-asset service providers shall notify their competent authority without delay of any changes to their management body, prior to the exercise of activities by any new members, and shall provide their competent authority with all of the necessary information to assess compliance with Article 68.
Article 70 Safekeeping of clients’ crypto-assets and funds
1. Crypto-asset service providers that hold crypto-assets belonging to clients or the means of access to such crypto-assets shall make adequate arrangements to safeguard the ownership rights of clients, especially in the event of the crypto-asset service provider’s insolvency, and to prevent the use of clients’ crypto-assets for their own account. 2. Where their business models or the crypto-asset services require holding clients’ funds other than e-money tokens, crypto-asset service providers shall have adequate arrangements in place to safeguard the ownership rights of clients and prevent the use of clients’ funds for their own account. 3. Crypto-asset service providers shall, by the end of the business day following the day on which clients’ funds other than e-money tokens were received, place those funds with a credit institution or a central bank. Crypto-asset service providers shall take all necessary steps to ensure that clients’ funds other than e-money tokens held with a credit institution or a central bank are held in an account separately identifiable from any accounts used to hold funds belonging to the crypto-asset service providers. 4. Crypto-asset service providers may themselves, or through a third party, provide payment services related to the crypto-asset service they offer provided that the crypto-asset service provider itself, or the third party, is authorised to provide those services under Directive (EU) 2015/2366. Where payment services are provided, crypto-asset service providers shall inform their clients of all of the following: (a) the nature and terms and conditions of those services, including references to the applicable national law and to the rights of clients; (b) whether those services are provided by them directly or by a third party. 5. Paragraphs 2 and 3 of this Article shall not apply to crypto-asset service providers that are electronic money institutions, payment institutions or credit institutions.
Article 71 Complaints-handling procedures
1. Crypto-asset service providers shall establish and maintain effective and transparent procedures for the prompt, fair and consistent handling of complaints received from clients and shall publish descriptions of those procedures. 2. Clients shall be able to file complaints free of charge with crypto-asset service providers. 3. Crypto-asset service providers shall inform clients of the possibility of filing a complaint. Crypto-asset service providers shall make available to clients a template for filing complaints and shall keep a record of all complaints received and any measures taken in response thereto. 4. Crypto-asset service providers shall investigate all complaints in a timely and fair manner and communicate the outcome of such investigations to their clients within a reasonable period. 5. ESMA, in close cooperation with EBA, shall develop draft regulatory technical standards to further specify the requirements, templates and procedures for handling complaints. ESMA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by 30 June 2024. Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.
Article 72 Identification, prevention, management and disclosure of conflicts of interest
1. Crypto-asset service providers shall implement and maintain effective policies and procedures, taking into account the scale, the nature and range of crypto-asset services provided, to identify, prevent, manage and disclose conflicts of interest between: (a) themselves and: (i) their shareholders or members; (ii) any person directly or indirectly linked to the crypto-asset service providers or their shareholders or members by control; (iii) members of their management body; (iv) their employees; or (v) their clients; or (b) two or more clients whose mutual interests conflict. 2. Crypto-asset service providers shall, in a prominent place on their website, disclose to their clients and prospective clients the general nature and sources of conflicts of interest referred to in paragraph 1 and the steps taken to mitigate them. 3. The disclosure referred to in paragraph 2 shall be made in an electronic format and shall include sufficient detail, taking into account the nature of each client, in order to enable each client to take an informed decision about the crypto-asset service in the context of which the conflicts of interest arise. 4. Crypto-asset service providers shall assess and, at least annually, review their policy on conflicts of interest and take all appropriate measures to address any deficiencies in that respect. 5. ESMA, in close cooperation with EBA, shall develop draft regulatory technical standards to further specify: (a) the requirements for the policies and procedures referred to in paragraph 1, taking into account the scale, the nature and the range of crypto-asset services provided; (b) the details and methodology for the content of the disclosure referred to in paragraph 2. ESMA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by 30 June 2024. Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.
Article 73 Outsourcing
1. Crypto-asset service providers that outsource services or activities to third parties for the performance of operational functions shall take all reasonable steps to avoid additional operational risk. They shall remain fully responsible for discharging all of their obligations pursuant to this Title and shall ensure at all times that the following conditions are met: (a) outsourcing does not result in the delegation of the responsibility of the crypto-asset service providers; (b) outsourcing does not alter the relationship between the crypto-asset service providers and their clients, nor the obligations of the crypto-asset service providers towards their clients; (c) outsourcing does not alter the conditions for the authorisation of the crypto-asset service providers; (d) third parties involved in the outsourcing cooperate with the competent authority of the crypto-asset service providers’ home Member State and the outsourcing does not prevent the exercise of the supervisory functions of competent authorities, including on-site access to acquire any relevant information needed to fulfil those functions; (e) crypto-asset service providers retain the expertise and resources necessary for evaluating the quality of the services provided, for supervising the outsourced services effectively and for managing the risks associated with the outsourcing on an ongoing basis; (f) crypto-asset service providers have direct access to the relevant information of the outsourced services; (g) crypto-asset service providers ensure that third parties involved in the outsourcing meet the data protection standards of the Union. For the purposes of point (g) of the first subparagraph, crypto-asset service providers are responsible for ensuring that the data protection standards are set out in the written agreements referred to in paragraph 3. 2. Crypto-asset service providers shall have a policy on their outsourcing, including on contingency plans and exit strategies, taking into account the scale, the nature and the range of crypto-asset services provided. 3. Crypto-asset service providers shall define in a written agreement their rights and obligations and those of the third parties to which they are outsourcing services or activities. Outsourcing agreements shall give crypto-asset service providers the right to terminate those agreements. 4. Crypto-asset service providers and third parties shall, upon request, make available to the competent authorities and other relevant authorities all information necessary to enable those authorities to assess compliance of the outsourced activities with the requirements of this Title.
Article 74 Orderly wind-down of crypto-asset service providers
Crypto-asset service providers that provide the services referred to in Articles 75 to 79 shall have in place a plan that is appropriate to support an orderly wind-down of their activities under applicable national law, including the continuity or recovery of any critical activities performed by those service providers. That plan shall demonstrate the ability of crypto-asset service providers to carry out an orderly wind-down without causing undue economic harm to their clients.
Article 75 Providing custody and administration of crypto-assets on behalf of clients
1. Crypto-asset service providers providing custody and administration of crypto-assets on behalf of clients shall conclude an agreement with their clients to specify their duties and their responsibilities. Such an agreement shall include at least the following: (a) the identity of the parties to the agreement; (b) the nature of the crypto-asset service provided and a description of that service; (c) the custody policy; (d) the means of communication between the crypto-asset service provider and the client, including the client’s authentication system; (e) a description of the security systems used by the crypto-asset service provider; (f) the fees, costs and charges applied by the crypto-asset service provider; (g) the applicable law. 2. Crypto-asset service providers providing custody and administration of crypto-assets on behalf of clients shall keep a register of positions, opened in the name of each client, corresponding to each client’s rights to the crypto-assets. Where relevant, crypto-asset service providers shall record as soon as possible in that register any movements following instructions from their clients. In such cases, their internal procedures shall ensure that any movement affecting the registration of the crypto-assets is evidenced by a transaction regularly registered in the client’s register of positions. 3. Crypto-asset service providers providing custody and administration of crypto-assets on behalf of clients shall establish a custody policy with internal rules and procedures to ensure the safekeeping or the control of such crypto-assets, or the means of access to the crypto-assets. The custody policy referred to in the first subparagraph shall minimise the risk of a loss of clients’ crypto-assets or the rights related to those crypto-assets or the means of access to the crypto-assets due to fraud, cyber threats or negligence. A summary of the custody policy shall be made available to clients at their request in an electronic format. 4. Where applicable, crypto-asset service providers providing custody and administration of crypto-assets on behalf of clients shall facilitate the exercise of the rights attached to the crypto-assets. Any event likely to create or modify the rights of a client shall immediately be recorded in the client’s register of positions. Where there are changes to the underlying distributed ledger technology or any other event likely to create or modify a client’s rights, the client shall be entitled to any crypto-assets or any rights newly created on the basis and to the extent of the client’s positions at the time of the occurrence of that change or event, except when a valid agreement signed with the crypto-asset service provider providing custody and administration of crypto-assets on behalf of clients pursuant to paragraph 1 prior to that change or event expressly provides otherwise. 5. Crypto-asset service providers providing custody and administration of crypto-assets on behalf of clients shall provide their clients, at least once every three months and at the request of the client concerned, with a statement of position of the crypto-assets recorded in the name of those clients. That statement of position shall be made in an electronic format. The statement of position shall identify the crypto-assets concerned, their balance, their value and the transfer of crypto-assets made during the period concerned. Crypto-asset service providers providing custody and administration of crypto-assets on behalf of clients shall provide their clients as soon as possible with any information about operations on crypto-assets that require a response from those clients. 6. Crypto-asset service providers providing custody and administration of crypto-assets on behalf of clients shall ensure that necessary procedures are in place to return crypto-assets held on behalf of their clients, or the means of access, as soon as possible to those clients. 7. Crypto-asset service providers providing custody and administration of crypto-assets on behalf of clients shall segregate holdings of crypto-assets on behalf of their clients from their own holdings and ensure that the means of access to crypto-assets of their clients is clearly identified as such. They shall ensure that, on the distributed ledger, their clients’ crypto-assets are held separately from their own crypto-assets. The crypto-assets held in custody shall be legally segregated from the crypto-asset service provider’s estate in the interest of the clients of the crypto-asset service provider in accordance with applicable law, so that creditors of the crypto-asset service provider have no recourse to crypto-assets held in custody by the crypto-asset service provider, in particular in the event of insolvency. Crypto-asset service provider shall ensure that the crypto-assets held in custody are operationally segregated from the crypto-asset service provider’s estate. 8. Crypto-asset service providers providing custody and administration of crypto-assets on behalf of clients shall be liable to their clients for the loss of any crypto-assets or of the means of access to the crypto-assets as a result of an incident that is attributable to them. The liability of the crypto-asset service provider shall be capped at the market value of the crypto-asset that was lost, at the time the loss occurred. Incidents not attributable to the crypto-asset service provider include any event in respect of which the crypto-asset service provider demonstrates that it occurred independently of the provision of the relevant service, or independently of the operations of the crypto-asset service provider, such as a problem inherent in the operation of the distributed ledger that the crypto-asset service provider does not control. 9. If crypto-asset service providers providing custody and administration of crypto-assets on behalf of clients make use of other crypto-asset service providers of that service, they shall only make use of crypto-asset service providers authorised in accordance with Article 59. Crypto-asset service providers providing custody and administration of crypto-assets on behalf of clients and that make use of other crypto-asset service providers of that service shall inform their clients thereof.
Article 76 Operation of a trading platform for crypto-assets
1. Crypto-asset service providers operating a trading platform for crypto-assets shall lay down, maintain and implement clear and transparent operating rules for the trading platform. Those operating rules shall at least: (a) set the approval processes, including customer due diligence requirements commensurate to the money laundering or terrorist financing risk presented by the applicant in accordance with Directive (EU) 2015/849, that are applied before admitting crypto-assets to the trading platform; (b) define exclusion categories, if any, of the types of crypto-assets that are not admitted to trading; (c) set out the policies, procedures and the level of fees, if any, for the admission to trading; (d) set objective, non-discriminatory rules and proportionate criteria for participation in the trading activities, which promote fair and open access to the trading platform for clients willing to trade; (e) set non-discretionary rules and procedures to ensure fair and orderly trading and objective criteria for the efficient execution of orders; (f) set conditions for crypto-assets to remain accessible for trading, including liquidity thresholds and periodic disclosure requirements; (g) set conditions under which trading of crypto-assets can be suspended; (h) set procedures to ensure efficient settlement of both crypto-assets and funds. For the purposes of point (a) of the first subparagraph, the operating rules shall clearly state that a crypto-asset is not to be admitted to trading where no corresponding crypto-asset white paper has been published in the cases required by this Regulation. 2. Before admitting a crypto-asset to trading, crypto-asset service providers operating a trading platform for crypto-assets shall ensure that the crypto-asset complies with the operating rules of the trading platform and shall assess the suitability of the crypto-asset concerned. When assessing the suitability of a crypto-asset, the crypto-asset service providers operating a trading platform shall evaluate, in particular, the reliability of the technical solutions used and the potential association to illicit or fraudulent activities, taking into account the experience, track record and reputation of the issuer of those crypto-assets and its development team. The crypto-asset service providers operating a trading platform shall also assess the suitability of the crypto-assets other than asset-referenced tokens or e-money tokens referred to in Article 4(3), first subparagraph, points (a) to (d). 3. The operating rules of the trading platform for crypto-assets shall prevent the admission to trading of crypto-assets that have an inbuilt anonymisation function unless the holders of those crypto-assets and their transaction history can be identified by the crypto-asset service providers operating a trading platform for crypto-assets. 4. The operating rules referred to in paragraph 1 shall be drawn up in an official language of the home Member State, or in a language customary in the sphere of international finance. If the operation of a trading platform for crypto-assets is provided in another Member State, the operating rules referred to in paragraph 1 shall be drawn up in an official language of the host Member State, or in a language customary in the sphere of international finance. 5. Crypto-asset service providers operating a trading platform for crypto-assets shall not deal on own account on the trading platform for crypto-assets they operate, including where they provide the exchange of crypto-assets for funds or other crypto-assets. 6. Crypto-asset service providers operating a trading platform for crypto-assets shall only be allowed to engage in matched principal trading where the client has consented to that process. Crypto-asset service providers shall provide the competent authority with information explaining their use of matched principal trading. The competent authority shall monitor the engagement of crypto-asset service providers in matched principal trading, and ensure that their engagement in matched principal trading continues to fall within the definition of such trading and does not give rise to conflicts of interest between the crypto-asset service providers and their clients. 7. Crypto-asset service providers operating a trading platform for crypto-assets shall have in place effective systems, procedures and arrangements to ensure that their trading systems: (a) are resilient; (b) have sufficient capacity to deal with peak order and message volumes; (c) are able to ensure orderly trading under conditions of severe market stress; (d) are able to reject orders that exceed pre-determined volume and price thresholds or are clearly erroneous; (e) are fully tested to ensure that the conditions under points (a) to (d) are met; (f) are subject to effective business continuity arrangements to ensure the continuity of their services if there is any failure of the trading system; (g) are able to prevent or detect market abuse; (h) are sufficiently robust to prevent their abuse for the purposes of money laundering or terrorist financing. 8. Crypto-asset service providers operating a trading platform for crypto-assets shall inform their competent authority when they identify cases of market abuse or attempted market abuse occurring on or through their trading systems. 9. Crypto-asset service providers operating a trading platform for crypto-assets shall make public any bid and ask prices and the depth of trading interests at those prices which are advertised for crypto-assets through their trading platforms. The crypto-asset service providers concerned shall make that information available to the public on a continuous basis during trading hours. 10. Crypto-asset service providers operating a trading platform for crypto-assets shall make public the price, volume and time of the transactions executed in respect of crypto-assets traded on their trading platforms. They shall make those details for all such transactions public as close to real-time as is technically possible. 11. Crypto-asset service providers operating a trading platform for crypto-assets shall make the information published in accordance with paragraphs 9 and 10 available to the public on a reasonable commercial basis and ensure non-discriminatory access to that information. That information shall be made available free of charge 15 minutes after publication in a machine-readable format and it shall remain published for at least two years. 12. Crypto-asset service providers operating a trading platform for crypto-assets shall initiate the final settlement of a crypto-asset transaction on the distributed ledger within 24 hours of the transaction being executed on the trading platform or, in the case of transactions settled outside the distributed ledger, by the closing of the day at the latest. 13. Crypto-asset service providers operating a trading platform for crypto-assets shall ensure that their fee structures are transparent, fair and non-discriminatory and that they do not create incentives to place, modify or cancel orders or to execute transactions in a way that contributes to disorderly trading conditions or market abuse as referred to in Title VI. 14. Crypto-asset service providers operating a trading platform for crypto-assets shall maintain resources and have back-up facilities in place to enable them to report to their competent authority at all times. 15. Crypto-asset service providers operating a trading platform shall keep at the disposal of the competent authority, for at least five years, the relevant data relating to all orders in crypto-assets that are advertised through their systems, or give the competent authority access to the order book so that the competent authority is able to monitor the trading activity. That relevant data shall contain the characteristics of the order, including those that link an order with the executed transactions that stem from that order. 16. ESMA shall develop draft regulatory technical standards to further specify: (a) the manner in which transparency data, including the level of disaggregation of the data to be made available to the public as referred to in paragraphs 1, 9 and 10, is to be presented; (b) the content and format of order book records to be maintained as specified in paragraph 15. ESMA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by 30 June 2024. Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.
Article 77 Exchange of crypto-assets for funds or other crypto-assets
1. Crypto-asset service providers exchanging crypto-assets for funds or other crypto-assets shall establish a non-discriminatory commercial policy that indicates, in particular, the type of clients they agree to transact with and the conditions that shall be met by such clients. 2. Crypto-asset service providers exchanging crypto-assets for funds or other crypto-assets shall publish a firm price of the crypto-assets or a method for determining the price of the crypto-assets that they propose to exchange for funds or other crypto-assets, and any applicable limit determined by that crypto-asset service provider on the amount to be exchanged. 3. Crypto-asset service providers exchanging crypto-assets for funds or other crypto-assets shall execute client orders at the prices displayed at the time when the order for exchange is final. Crypto-asset service providers shall inform their clients of the conditions for their order to be deemed final. 4. Crypto-asset service providers exchanging crypto-assets for funds or other crypto-assets shall publish information about the transactions concluded by them, such as transaction volumes and prices.
Article 78 Execution of orders for crypto-assets on behalf of clients
1. Crypto-asset service providers executing orders for crypto-assets on behalf of clients shall take all necessary steps to obtain, while executing orders, the best possible result for their clients taking into account factors of price, costs, speed, likelihood of execution and settlement, size, nature, conditions of custody of the crypto-assets or any other consideration relevant to the execution of the order. Notwithstanding the first subparagraph, crypto-asset service providers executing orders for crypto-assets on behalf of clients shall not be required to take the necessary steps as referred to in the first subparagraph in cases where they execute orders for crypto-assets following specific instructions given by its clients. 2. To ensure compliance with paragraph 1, crypto-asset service providers executing orders for crypto-assets on behalf of clients shall establish and implement effective execution arrangements. In particular, they shall establish and implement an order execution policy to allow them to comply with paragraph 1. The order execution policy shall, amongst others, provide for the prompt, fair and expeditious execution of client orders and prevent the misuse by the crypto-asset service providers’ employees of any information relating to client orders. 3. Crypto-asset service providers executing orders for crypto-assets on behalf of clients shall provide appropriate and clear information to their clients on their order execution policy referred to in paragraph 2 and any significant change thereto. That information shall explain clearly, in sufficient detail and in a way that can be easily understood by clients, how client orders are to be executed by crypto-asset service providers. Crypto-asset service providers shall obtain prior consent from each client regarding the order execution policy. 4. Crypto-asset service providers executing orders for crypto-assets on behalf of clients shall be able to demonstrate to their clients, at their request, that they have executed their orders in accordance with their order execution policy and shall be able to demonstrate to the competent authority, at the latter’s request, their compliance with this Article. 5. Where the order execution policy provides for the possibility that client orders might be executed outside a trading platform, crypto-asset service providers executing orders for crypto-assets on behalf of clients shall inform their clients about that possibility and shall obtain the prior express consent of their clients before proceeding to execute their orders outside a trading platform, either in the form of a general agreement or with respect to individual transactions. 6. Crypto-asset service providers executing orders for crypto-assets on behalf of clients shall monitor the effectiveness of their order execution arrangements and order execution policy in order to identify and, where appropriate, correct any deficiencies in that respect. In particular, they shall assess, on a regular basis, whether the execution venues included in the order execution policy provide for the best possible result for clients or whether they need to make changes to their order execution arrangements. Crypto-asset service providers executing orders for crypto-assets on behalf of clients shall notify clients with whom they have an ongoing client relationship of any material changes to their order execution arrangements or order execution policy.
Article 79 Placing of crypto-assets
1. Crypto-asset service providers placing crypto-assets shall communicate the following information to the offeror, to the person seeking admission to trading, or to any third party acting on their behalf, before entering into an agreement with them: (a) the type of placement under consideration, including whether a minimum amount of purchase is guaranteed or not; (b) an indication of the amount of transaction fees associated with the proposed placing; (c) the likely timing, process and price for the proposed operation; (d) information about the targeted purchasers. Crypto-asset service providers placing crypto-assets shall, before placing those crypto-assets, obtain the agreement of the issuers of those crypto-assets or any third party acting on their behalf as regards the information listed in the first subparagraph. 2. Crypto-asset service providers’ rules on conflicts of interest referred to in Article 72(1) shall have specific and adequate procedures in place to identify, prevent, manage and disclose any conflicts of interest arising from the following situations: (a) crypto-asset service providers place the crypto-assets with their own clients; (b) the proposed price for placing of crypto-assets has been overestimated or underestimated; (c) incentives, including non-monetary incentives, are paid or granted by the offeror to crypto-asset service providers.
Article 80 Reception and transmission of orders for crypto-assets on behalf of clients
1. Crypto-asset service providers receiving and transmitting orders for crypto-assets on behalf of clients shall establish and implement procedures and arrangements that provide for the prompt and proper transmission of client orders for execution on a trading platform for crypto-assets or to another crypto-asset service provider. 2. Crypto-asset service providers receiving and transmitting orders for crypto-assets on behalf of clients shall not receive any remuneration, discount or non-monetary benefit in return for routing orders received from clients to a particular trading platform for crypto-assets or to another crypto-asset service provider. 3. Crypto-asset service providers receiving and transmitting orders for crypto-assets on behalf of clients shall not misuse information relating to pending client orders, and shall take all reasonable steps to prevent the misuse of such information by any of their employees.
Article 81 Providing advice on crypto-assets and providing portfolio management of crypto-assets
1. Crypto-asset service providers providing advice on crypto-assets or providing portfolio management of crypto-assets shall assess whether the crypto-asset services or crypto-assets are suitable for their clients or prospective clients, taking into consideration their knowledge and experience in investing in crypto-assets, their investment objectives, including risk tolerance, and their financial situation including their ability to bear losses. 2. Crypto-asset service providers providing advice on crypto-assets shall, in good time before providing advice on crypto-assets, inform prospective clients whether the advice is: (a) provided on an independent basis; (b) based on a broad or on a more restricted analysis of different crypto-assets, including whether the advice is limited to crypto-assets issued or offered by entities having close links with the crypto-asset service provider or any other legal or economic relationships, such as contractual relationships, that risk impairing the independence of the advice provided. 3. Where a crypto-asset service provider providing advice on crypto-assets informs the prospective client that advice is provided on an independent basis, it shall: (a) assess a sufficient range of crypto-assets available on the market which must be sufficiently diverse to ensure that the client’s investment objectives can be suitably met and which must not be limited to crypto-assets issued or provided by: (i) that same crypto-asset service provider; (ii) entities having close links with that same crypto-asset service provider; or (iii) other entities with which that same crypto-asset service provider has such close legal or economic relationships, such as contractual relationships, as to pose a risk of impairing the independent basis of the advice provided; (b) not accept and retain fees, commissions or any monetary or non-monetary benefits paid or provided by any third party or a person acting on behalf of a third party in relation to the provision of the service to clients. Notwithstanding point (b) of the first subparagraph, minor non-monetary benefits that are capable of enhancing the quality of crypto-asset services provided to a client and that are of such a scale and nature that they do not impair compliance with a crypto-asset service provider’s obligation to act in the best interests of its client shall be permitted in cases where they are clearly disclosed to the client. 4. Crypto-asset service providers providing advice on crypto-assets shall also provide prospective clients with information on all costs and related charges, including the cost of advice, where applicable, the cost of crypto-assets recommended or marketed to the client and how the client is permitted to pay for the crypto-assets, also encompassing any third-party payments. 5. Crypto-asset service providers providing portfolio management of crypto-assets shall not accept and retain fees, commissions or any monetary or non-monetary benefits paid or provided by an issuer, offeror, person seeking admission to trading, or any third party, or a person acting on behalf of a third party, in relation to the provision of portfolio management of crypto-assets to their clients. 6. Where a crypto-asset service provider informs a prospective client that its advice is provided on a non-independent basis, that provider may receive inducements subject to the conditions that the payment or benefit: (a) is designed to enhance the quality of the relevant service to the client; and (b) does not impair compliance with the crypto-asset service provider’s obligation to act honestly, fairly and professionally in accordance with the best interests of its clients. The existence, nature and amount of the payment or benefit referred to in paragraph 4, or, where the amount cannot be ascertained, the method of calculating that amount, shall be clearly disclosed to the client, in a manner that is comprehensive, accurate and understandable, prior to the provision of the relevant crypto-asset service. 7. Crypto-asset service providers providing advice on crypto-assets shall ensure that natural persons giving advice or information about crypto-assets, or a crypto-asset service, on their behalf possess the necessary knowledge and competence to fulfil their obligations. Member States shall publish the criteria to be used for assessing such knowledge and competence. 8. For the purposes of the suitability assessment referred to in paragraph 1, crypto-asset service providers providing advice on crypto-assets or providing portfolio management of crypto-assets shall obtain from their clients or prospective clients the necessary information regarding their knowledge of, and experience in, investing, including in crypto-assets, their investment objectives, including risk tolerance, their financial situation including their ability to bear losses, and their basic understanding of the risks involved in purchasing crypto-assets, so as to enable crypto-asset service providers to recommend to clients or prospective clients whether or not the crypto-assets are suitable for them and, in particular, are in accordance with their risk tolerance and ability to bear losses. 9. Crypto-asset service providers providing advice on crypto-assets or portfolio management of crypto-assets shall warn clients or prospective clients that: (a) the value of crypto-assets might fluctuate; (b) the crypto-assets might be subject to full or partial losses; (c) the crypto-assets might not be liquid; (d) where applicable, the crypto-assets are not covered by the investor compensation schemes under Directive 97/9/EC; (e) the crypto-assets are not covered by the deposit guarantee schemes under Directive 2014/49/EU. 10. Crypto-asset service providers providing advice on crypto-assets or portfolio management of crypto-assets shall establish, maintain and implement policies and procedures to enable them to collect and assess all information necessary to conduct the assessment referred to in paragraph 1 for each client. They shall take all reasonable steps to ensure that the information collected about their clients or prospective clients is reliable. 11. Where clients do not provide the information required pursuant to paragraph 8, or where crypto-asset service providers providing advice on crypto-assets or portfolio management of crypto-assets consider that the crypto-asset services or crypto-assets are not suitable for their clients, they shall not recommend such crypto-asset services or crypto-assets, nor begin the provision of portfolio management of such crypto-assets. 12. Crypto-asset service providers providing advice on crypto-assets or portfolio management of crypto-assets shall regularly review for each client the suitability assessment referred to in paragraph 1 at least every two years after the initial assessment made in accordance with that paragraph. 13. Once the suitability assessment referred to in paragraph 1 or its review under paragraph 12 has been performed, crypto-asset service providers providing advice on crypto-assets shall provide clients with a report on suitability specifying the advice given and how that advice meets the preferences, objectives and other characteristics of clients. That report shall be made and communicated to clients in an electronic format. That report shall, as a minimum: (a) include an updated information on the assessment referred to in paragraph 1; and (b) provide an outline of the advice given. The report on suitability referred to in the first subparagraph shall make clear that the advice is based on the client’s knowledge and experience in investing in crypto-assets, the client’s investment objectives, risk tolerance, financial situation and ability to bear losses. 14. Crypto-asset service providers providing portfolio management of crypto-assets shall provide periodic statements to their clients, in an electronic format, of the portfolio management activities carried out on their behalf. Those periodic statements shall contain a fair and balanced review of the activities undertaken and of the performance of the portfolio during the reporting period, an updated statement of how the activities undertaken meet the preferences, objectives and other characteristics of the client, as well as an updated information on the suitability assessment referred to in paragraph 1 or its review under paragraph 12. The periodic statement referred to in the first subparagraph of this paragraph shall be provided every three months, except in cases where a client has access to an online system where up-to-date valuations of the client’s portfolio and updated information on the suitability assessment referred to in paragraph 1 can be accessed, and the crypto-asset service provider has evidence that the client has accessed a valuation at least once during the relevant quarter. Such online system shall be deemed an electronic format. 15. ESMA shall, by 30 December 2024, issue guidelines in accordance with Article 16 of Regulation (EU) No 1095/2010 specifying: (a) the criteria for the assessment of client’s knowledge and competence in accordance with paragraph 2; (b) the information referred to in paragraph 8; and (c) the format of the periodic statement referred to in paragraph 14.
Article 82 Providing transfer services for crypto-assets on behalf of clients
1. Crypto-asset service providers providing transfer services for crypto-assets on behalf of clients shall conclude an agreement with their clients to specify their duties and their responsibilities. Such agreement shall include at least the following: (a) the identity of the parties to the agreement; (b) a description of the modalities of the transfer service provided; (c) a description of the security systems used by the crypto-asset service provider; (d) fees applied by the crypto-asset service provider; (e) the applicable law. 2. ESMA, in close cooperation with EBA, shall issue guidelines in accordance with Article 16 of Regulation (EU) No 1095/2010 for crypto-asset service providers providing transfer services for crypto-assets on behalf of clients as regards procedures and policies, including the rights of clients, in the context of transfer services for crypto-assets.
Article 83 Assessment of proposed acquisitions of crypto-asset service providers
1. Any natural or legal person or such persons acting in concert who have taken a decision either to acquire, directly or indirectly, (the ‘ proposed acquirer’) a qualifying holding in a crypto-asset service provider or to increase, directly or indirectly, such a qualifying holding so that the proportion of the voting rights or of the capital held would reach or exceed 20 %, 30 % or 50 % or so that the crypto-asset service provider would become its subsidiary, shall notify the competent authority of that crypto-asset service provider thereof in writing indicating the size of the intended holding and the information required pursuant to the regulatory technical standards adopted by the Commission in accordance with Article 84(4). 2. Any natural or legal person who has taken a decision to dispose, directly or indirectly, of a qualifying holding in a crypto-asset service provider shall, prior to disposing of that holding, notify in writing the competent authority of its decision and indicate the size of such holding. That person shall also notify the competent authority where it has taken a decision to reduce a qualifying holding so that the proportion of the voting rights or of the capital held would fall below 10 %, 20 %, 30 % or 50 % or so that the crypto-asset service provider would cease to be that person’s subsidiary. 3. The competent authority shall, promptly and in any event within two working days following receipt of a notification pursuant to paragraph 1, acknowledge receipt thereof in writing. 4. The competent authority shall assess the proposed acquisition referred to in paragraph 1 of this Article and the information required pursuant to the regulatory technical standards adopted by the Commission in accordance with Article 84(4) within 60 working days of the date of the written acknowledgement of receipt referred to in paragraph 3 of this Article. When acknowledging receipt of the notification, the competent authority shall inform the proposed acquirer of the date of expiry of the assessment period. 5. For the purposes of the assessment referred to in paragraph 4, the competent authority may consult the competent authorities for anti-money laundering and counter-terrorist financing and financial intelligence units and shall duly consider their views. 6. When performing the assessment referred to in paragraph 4, the competent authority may request from the proposed acquirer any additional information that is necessary to complete that assessment. Such request shall be made before the assessment is finalised, and in any case no later than on the 50th working day from the date of the written acknowledgement of receipt referred to in paragraph 3. Such requests shall be made in writing and shall specify the additional information needed. The competent authority shall suspend the assessment period referred to in paragraph 4, until they have received the additional information referred to in the first subparagraph of this paragraph. The suspension shall not exceed 20 working days. Any further requests by the competent authority for additional information or for clarification of the information received shall not result in an additional suspension of the assessment period. The competent authority may extend the suspension referred to in the second subparagraph of this paragraph by up to 30 working days if the proposed acquirer is situated outside the Union or regulated under the law of a third country. 7. A competent authority that, upon completion of the assessment referred to in paragraph 4 decides to oppose the proposed acquisition referred to in paragraph 1, shall notify the proposed acquirer thereof within two working days and in any event before the date referred to in paragraph 4 extended, where applicable, in accordance with paragraph 6, second and third subparagraphs. The notification shall provide the reasons for such a decision. 8. Where the competent authority does not oppose the proposed acquisition referred to in paragraph 1 before the date referred to in paragraph 4 extended, where applicable, in accordance with paragraph 6, second and third subparagraphs, the proposed acquisition shall be deemed to be approved. 9. The competent authority may set a maximum period for concluding the proposed acquisition referred to in paragraph 1, and extend that maximum period where appropriate.
Article 84 Content of the assessment of proposed acquisitions of crypto-asset service providers
1. When performing the assessment referred to in Article 83(4), the competent authority shall appraise the suitability of the proposed acquirer and the financial soundness of the proposed acquisition referred to in Article 83(1) against all of the following criteria: (a) the reputation of the proposed acquirer; (b) the reputation, knowledge, skills and experience of any person who will direct the business of the crypto-asset service provider as a result of the proposed acquisition; (c) the financial soundness of the proposed acquirer, in particular in relation to the type of business envisaged and pursued in respect of the crypto-asset service provider in which the acquisition is proposed; (d) whether the crypto-asset service provider will be able to comply and continue to comply with the provisions of this Title; (e) whether there are reasonable grounds to suspect that, in connection with the proposed acquisition, money laundering or terrorist financing within the meaning of, respectively, Article 1(3) and (5) of Directive (EU) 2015/849 is being or has been committed or attempted, or that the proposed acquisition could increase the risk thereof. 2. The competent authority may oppose the proposed acquisition only where there are reasonable grounds for doing so on the basis of the criteria set out in paragraph 1 of this Article or where the information provided in accordance with Article 83(4) is incomplete or false. 3. Member States shall not impose any prior conditions in respect of the level of qualifying holding that is required to be acquired under this Regulation nor allow their competent authorities to examine the proposed acquisition in terms of the economic needs of the market. 4. ESMA, in close cooperation with EBA, shall develop draft regulatory technical standards specifying the detailed content of the information that is necessary to carry out the assessment referred to in Article 83(4), first subparagraph. The information required shall be relevant for a prudential assessment, proportionate and adapted to the nature of the proposed acquirer and the proposed acquisition referred to in Article 83(1). ESMA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by 30 June 2024. Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.
Article 85 Identification of significant crypto-asset service providers
1. A crypto-asset service provider shall be deemed significant if it has in the Union at least 15 million active users, on average, in one calendar year, where the average is calculated as the average of the daily number of active users throughout the previous calendar year. 2. Crypto-asset service providers shall notify their competent authorities within two months of reaching the number of active users as set out in paragraph 1. Where the competent authority agrees that the threshold set out in paragraph 1 is met, it shall notify ESMA thereof. 3. Without prejudice to the responsibilities of competent authorities under this Regulation, the competent authorities of the home Member States shall provide ESMA’s Board of Supervisors with annual updates on the following supervisory developments in relation to significant crypto-asset service providers: (a) ongoing or concluded authorisations as referred to in Article 59; (b) ongoing or concluded processes of withdrawal of authorisations as referred to in Article 64; (c) the exercise of supervisory powers set out in Article 94(1), first subparagraph, points (b), (c), (e), (f), (g), (y) and (aa). The competent authority of the home Member State may provide ESMA’s Board of Supervisors with more frequent updates, or notify it prior to any decision taken by the competent authority of the home Member State with regard to the first subparagraph, point (a), (b) or (c). 4. The update referred to in paragraph 3, second subparagraph, may be followed by an exchange of views at ESMA’s Board of Supervisors. 5. Where appropriate, ESMA may make use of its powers under Articles 29, 30, 31 and 31b of Regulation (EU) No 1095/2010.
Article 86 Scope of the rules on market abuse
1. This Title shall apply to acts carried out by any person concerning crypto-assets that are admitted to trading or in respect of which a request for admission to trading has been made. 2. This Title shall also apply to any transaction, order or behaviour concerning crypto-assets as referred to in paragraph 1, irrespective of whether such transaction, order or behaviour takes place on a trading platform. 3. This Title shall apply to actions and omissions, in the Union and in third countries, concerning crypto-assets as referred to in paragraph 1.
Article 87 Inside information
1. For the purposes of this Regulation, inside information shall comprise the following types of information: (a) information of a precise nature, which has not been made public, relating, directly or indirectly, to one or more issuers, offerors or persons seeking admission to trading, or to one or more crypto-assets, and which, if it were made public, would likely have a significant effect on the prices of those crypto-assets or on the price of a related crypto-asset; (b) for persons charged with the execution of orders for crypto-assets on behalf of clients, it also means information of a precise nature conveyed by a client and relating to the client’s pending orders in crypto-assets, relating, directly or indirectly, to one or more issuers, offerors or persons seeking admission to trading or to one or more crypto-assets, and which, if it were made public, would likely have a significant effect on the prices of those crypto-assets or on the price of a related crypto-asset. 2. For the purposes of paragraph 1, information shall be deemed to be of a precise nature if it indicates a set of circumstances which exists or which may reasonably be expected to come into existence, or an event which has occurred or which may reasonably be expected to occur, where it is specific enough to enable a conclusion to be drawn as to the possible effect of that set of circumstances or event on the prices of crypto-assets. In that respect, in the case of a protracted process that is intended to bring about, or that results in, particular circumstances or a particular event, those future circumstances or that future event, and also the intermediate steps of that process which are connected with bringing about or resulting in those future circumstances or that future event, may be deemed to be precise information. 3. An intermediate step in a protracted process shall be deemed to be inside information if, in and of itself, it satisfies the criteria of inside information referred to in paragraph 2. 4. For the purposes of paragraph 1, information which, if it were made public, would likely have a significant effect on the prices of crypto-assets shall mean information that a reasonable holder of crypto-assets would likely use as part of the basis of the holder’s investment decisions.
Article 88 Public disclosure of inside information
1. Issuers, offerors and persons seeking admission to trading shall inform the public as soon as possible of inside information referred to in Article 87 that directly concerns them, in a manner that enables fast access as well as complete, correct and timely assessment of the information by the public. Issuers, offerors and persons seeking admission to trading shall not combine the disclosure of inside information to the public with the marketing of their activities. Issuers, offerors and persons seeking admission to trading shall post and maintain on their website, for a period of at least five years, all inside information that they are required to disclose publicly. 2. Issuers, offerors and persons seeking admission to trading may, on their own responsibility, delay disclosure to the public of inside information referred to in Article 87 provided that all of the following conditions are met: (a) immediate disclosure is likely to prejudice the legitimate interests of the issuers, offerors or persons seeking admission to trading; (b) delay of disclosure is not likely to mislead the public; (c) issuers, offerors or persons seeking admission to trading are able to ensure the confidentiality of that information. 3. Where an issuer, offeror or a person seeking admission to trading has delayed the disclosure of inside information in accordance with paragraph 2, it shall inform the competent authority that disclosure of the information was delayed and shall provide a written explanation of how the conditions set out in paragraph 2 were met, immediately after the information is disclosed to the public. Alternatively, Member States may provide that a record of such an explanation is to be provided only upon the request of the competent authority. 4. In order to ensure uniform conditions of application of this Article, ESMA shall develop draft implementing technical standards to determine the technical means for: (a) appropriate public disclosure of inside information as referred to in paragraph 1; and (b) delaying the public disclosure of inside information as referred to in paragraphs 2 and 3. ESMA shall submit the draft implementing technical standards referred to in the first subparagraph to the Commission by 30 June 2024. Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph of this paragraph in accordance with Article 15 of Regulation (EU) No 1095/2010.
Article 89 Prohibition of insider dealing
1. For the purposes of this Regulation, insider dealing shall be deemed to arise where a person possesses inside information and uses that information by acquiring or disposing of, for its own account or for the account of a third party, directly or indirectly, crypto-assets to which that information relates. The use of inside information by cancelling or amending an order concerning a crypto-asset to which the information relates where the order was placed before the person concerned possessed the inside information, shall also be considered to be insider dealing. The use of inside information shall also comprise submitting, modifying or withdrawing a bid by a person for its own account or for the account of a third party. 2. No person shall engage or attempt to engage in insider dealing or use inside information about crypto-assets to acquire, or dispose of, those crypto-assets, directly or indirectly, whether for that person’s own account or for the account of a third party. No person shall recommend that another person engage in insider dealing or induce another person to engage in insider dealing. 3. No person in the possession of inside information about crypto-assets shall, based on that inside information, recommend or induce another person: (a) to acquire or dispose of those crypto-assets; or (b) to cancel or amend an order concerning those crypto-assets. 4. The use of a recommendation or inducement as referred to in paragraph 3 amounts to insider dealing within the meaning of this Article where the person using that recommendation or inducement knows or ought to know that it is based on inside information. 5. This Article applies to any person who possesses inside information as a result of: (a) being a member of the administrative, management or supervisory bodies of the issuer, the offeror, or the person seeking admission to trading; (b) having a holding in the capital of the issuer, the offeror, or the person seeking admission to trading; (c) having access to the information through the exercise of an employment, profession or duties or in relation to its role in the distributed ledger technology or similar technology; or (d) being involved in criminal activities. This Article also applies to any person who possesses inside information under circumstances other than those referred to in the first subparagraph where that person knows or ought to know that it is inside information. 6. Where person as referred to in paragraph 1 is a legal person, this Article shall apply, in accordance with national law, to the natural persons who participate in the decision to carry out the acquisition, disposal, cancellation or amendment of an order for the account of the legal person concerned.
Article 90 Prohibition of unlawful disclosure of inside information
1. No person in possession of inside information shall unlawfully disclose inside information to any other person, except where such disclosure is made in the normal exercise of an employment, a profession or duties. 2. The onward disclosure of recommendations or inducements referred to in Article 89(4) amounts to unlawful disclosure of inside information where the person disclosing the recommendation or inducement knows or ought to know that it was based on inside information.
Article 91 Prohibition of market manipulation
1. No person shall engage in or attempt to engage in market manipulation. 2. For the purposes of this Regulation, market manipulation shall comprise any of the following activities: (a) unless carried out for legitimate reasons, entering into a transaction, placing an order to trade or engaging in any other behaviour which: (i) gives, or is likely to give, false or misleading signals as to the supply of, demand for, or price of, a crypto-asset; (ii) secures, or is likely to secure, the price of one or several crypto-assets at an abnormal or artificial level; (b) entering into a transaction, placing an order to trade or any other activity or behaviour which affects or is likely to affect the price of one or several crypto-assets, while employing a fictitious device or any other form of deception or contrivance; (c) disseminating information through the media, including the internet, or by any other means, which gives, or is likely to give, false or misleading signals as to the supply of, demand for, or price of one or several crypto-assets, or secures or is likely to secure, the price of one or several crypto-assets, at an abnormal or artificial level, including the dissemination of rumours, where the person who engaged in the dissemination knew, or ought to have known, that the information was false or misleading. 3. The following behaviour shall, inter alia, be considered market manipulation: (a) securing a dominant position over the supply of, or demand for, a crypto-asset, which has, or is likely to have, the effect of fixing, directly or indirectly, purchase or sale prices or creates, or is likely to create, other unfair trading conditions; (b) the placing of orders to a trading platform for crypto-assets, including any cancellation or modification thereof, by any available means of trading, and which has one of the effects referred to in paragraph 2, point (a), by: (i) disrupting or delaying the functioning of the trading platform for crypto-assets or engaging into any activities that are likely to have that effect; (ii) making it more difficult for other persons to identify genuine orders on the trading platform for crypto-assets or engaging into any activities that are likely to have that effect, including by entering orders which result in the destabilisation of the normal functioning of the trading platform for crypto-assets; (iii) creating a false or misleading signal about the supply of, or demand for, or price of, a crypto-asset, in particular by entering orders to initiate or exacerbate a trend, or engaging into any activities that are likely to have that effect; (c) taking advantage of occasional or regular access to the traditional or electronic media by voicing an opinion about a crypto-asset, while having previously taken positions on that crypto-asset, and profiting subsequently from the impact of the opinions voiced on the price of that crypto-asset, without having simultaneously disclosed that conflict of interest to the public in a proper and effective way.
Article 92 Prevention and detection of market abuse
1. Any person professionally arranging or executing transactions in crypto-assets shall have in place effective arrangements, systems and procedures to prevent and detect market abuse. That person shall be subject to the rules of notification of the Member State where it is registered or has its head office or, in the case of a branch, the Member State where the branch is situated, and shall without delay report to the competent authority of that Member State any reasonable suspicion regarding an order or transaction, including any cancellation or modification thereof, and other aspects of the functioning of the distributed ledger technology such as the consensus mechanism, where there might exist circumstances indicating that market abuse has been committed, is being committed or is likely to be committed. The competent authorities receiving a report of suspicious orders or transactions shall transmit such information immediately to the competent authorities of the trading platforms concerned. 2. ESMA shall develop draft regulatory technical standards to further specify: (a) appropriate arrangements, systems and procedures for persons to comply with paragraph 1; (b) the template to be used by persons to comply with paragraph 1; (c) for cross-border market abuse situations, coordination procedures between the relevant competent authorities for the detection and sanctioning of market abuse. ESMA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by 30 December 2024. 3. In order to ensure consistency of supervisory practices under this Article, ESMA shall by 30 June 2025 issue guidelines in accordance with Article 16 of Regulation (EU) No 1095/2010 on supervisory practices among the competent authorities to prevent and detect market abuse, if not already covered by the regulatory technical standards referred to in paragraph 2.
Article 93 Competent authorities
1. Member States shall designate the competent authorities responsible for carrying out the functions and duties provided for in this Regulation. Member States shall notify those competent authorities to EBA and ESMA. 2. Where Member States designate more than one competent authority pursuant to paragraph 1, they shall determine their respective tasks and designate one competent authority as the single point of contact for cross-border administrative cooperation between competent authorities as well as with EBA and ESMA. Member States may designate a different single point of contact for each of those types of administrative cooperation. 3. ESMA shall publish on its website a list of the competent authorities designated in accordance with paragraphs 1 and 2.
Article 94 Powers of competent authorities
1. In order to perform their duties under Titles II to VI of this Regulation, competent authorities shall have, in accordance with national law, at least the following supervisory and investigative powers: (a) to require any person to provide information and documents which the competent authorities consider could be relevant for the performance of their duties; (b) to suspend, or to require a crypto-asset service provider to suspend, the provision of crypto-asset services for a maximum of 30 consecutive working days on any single occasion where there are reasonable grounds for suspecting that this Regulation has been infringed; (c) to prohibit the provision of crypto-asset services where they find that this Regulation has been infringed; (d) to disclose, or to require a crypto-asset servicer provider to disclose, all material information which might have an effect on the provision of the crypto-asset services concerned, in order to ensure the protection of the interests of clients, in particular retail holders, or the smooth operation of the market; (e) to make public the fact that a crypto-asset service provider fails to fulfil its obligations; (f) to suspend, or to require a crypto-asset service provider to suspend, the provision of crypto-asset services where the competent authorities consider that the crypto-asset service provider’s situation is such that the provision of the crypto-asset service would be detrimental to the interests of clients, in particular retail holders; (g) to require the transfer of existing contracts to another crypto-asset service provider in cases where a crypto-asset service provider’s authorisation is withdrawn in accordance with Article 64, subject to the agreement of the clients and the crypto-asset service provider to which the contracts are to be transferred; (h) where there is a reason to assume that a person is providing crypto-asset services without authorisation, to order the immediate cessation of the activity without prior warning or imposition of a deadline; (i) to require offerors, persons seeking admission to trading of crypto-assets, or issuers of asset-referenced tokens or e-money tokens to amend their crypto-asset white paper or further amend their modified crypto-asset white paper, where they find that the crypto-asset white paper or the modified crypto-asset white paper does not contain the information required by Article 6, 19 or 51; (j) to require offerors, persons seeking admission to trading of crypto-assets, or issuers of asset-referenced tokens or e-money tokens, to amend their marketing communications, where they find that the marketing communications do not comply with the requirements set out in Article 7, 29 or 53 of this Regulation; (k) to require offerors, persons seeking admission to trading of crypto-assets, or issuers of asset-referenced tokens or e-money tokens, to include additional information in their crypto-asset white papers, where necessary for financial stability or the protection of the interests of the holders of crypto-assets, in particular retail holders; (l) to suspend an offer to the public or an admission to trading of crypto-assets for a maximum of 30 consecutive working days on any single occasion where there are reasonable grounds for suspecting that this Regulation has been infringed; (m) to prohibit an offer to the public or an admission to trading of crypto-assets where they find that this Regulation has been infringed or where there are reasonable grounds for suspecting that it will be infringed; (n) to suspend, or require a crypto-asset service provider operating a trading platform for crypto-assets to suspend, trading of the crypto-assets for a maximum of 30 consecutive working days on any single occasion where there are reasonable grounds for suspecting that this Regulation has been infringed; (o) to prohibit trading of crypto-assets on a trading platform for crypto-assets where they find that this Regulation has been infringed or where there are reasonable grounds for suspecting that it will be infringed; (p) to suspend or prohibit marketing communications where there are reasonable grounds for suspecting that this Regulation has been infringed; (q) to require offerors, persons seeking admission to trading of crypto-assets, issuers of asset-referenced tokens or e-money tokens or relevant crypto-asset service providers to cease or suspend marketing communications for a maximum of 30 consecutive working days on any single occasion where there are reasonable grounds for suspecting that this Regulation has been infringed; (r) to make public the fact that an offeror, a person seeking admission to trading of a crypto-asset or an issuer of an asset-referenced token or e-money token, fails to fulfil its obligations under this Regulation; (s) to disclose, or to require the offeror, the person seeking admission to trading of a crypto-asset or the issuer of the asset-referenced token or e-money token, to disclose all material information which may have an effect on the assessment of the crypto-asset offered to the public or admitted to trading in order to ensure the protection of the interests of holders of crypto-assets, in particular retail holders, or the smooth operation of the market; (t) to suspend, or require the relevant crypto-asset service provider operating the trading platform for crypto-assets to suspend, the crypto-assets from trading where they consider that the situation of the offeror, the person seeking admission to trading of a crypto-asset or the issuer of an asset-referenced token or an e-money token is such that trading would be detrimental to the interests of the holders of crypto-assets, in particular retail holders; (u) where there is a reason to assume that a person is issuing asset-referenced tokens or e-money tokens without authorisation or a person is offering or seeking admission to trading of crypto-assets other than asset-referenced tokens or e-money tokens without a crypto-asset white paper notified in accordance with Article 8, to order the immediate cessation of the activity without prior warning or imposition of a deadline; (v) to take any type of measure to ensure that an offeror or a person seeking admission to trading of crypto-assets, an issuer of an asset-referenced token or an e-money token or a crypto-asset service provider comply with this Regulation including to require the cessation of any practice or conduct that the competent authorities consider contrary to this Regulation; (w) to carry out on-site inspections or investigations at sites other than the private residences of natural persons, and for that purpose to enter premises in order to access documents and other data in any form; (x) to outsource verifications or investigations to auditors or experts; (y) to require the removal of a natural person from the management body of an issuer of an asset-referenced token or of a crypto-asset service provider; (z) to request any person to take steps to reduce the size of its position or exposure to crypto-assets; (aa) where no other effective means are available to bring about the cessation of the infringement of this Regulation and in order to avoid the risk of serious harm to the interests of clients or holders of crypto-assets to take all necessary measures, including by requesting a third party or a public authority to implement such measures, to: (i) remove content or restrict access to an online interface or to order the explicit display of a warning to clients and holders of crypto-assets when they access an online interface; (ii) order a hosting service provider to remove, disable or restrict access to an online interface; or (iii) order domain registries or registrars to delete a fully qualified domain name and allow the competent authority concerned to register it; (ab) to require an issuer of an asset-referenced token or e-money token, in accordance with Article 23(4), 24(3) or 58(3), to introduce a minimum denomination amount or to limit the amount issued. 2. Supervisory and investigative powers exercised in relation to offerors, persons seeking admission to trading, issuers and crypto-asset service providers, are without prejudice to powers granted to the same or other supervisory authorities regarding those entities, including powers granted to relevant competent authorities under the provisions of national law transposing Directive 2009/110/EC and prudential supervisory powers granted to the ECB under Regulation (EU) No 1024/2013. 3. In order to fulfil their duties under Title VI, competent authorities shall have, in accordance with national law, at least the following supervisory and investigatory powers in addition to the powers referred to in paragraph 1: (a) to access any document and data in any form, and to receive or take a copy thereof; (b) to require or demand information from any person, including those who are successively involved in the transmission of orders or conduct of the operations concerned, as well as their principals, and if necessary, to summon and question any such person with a view to obtain information; (c) to enter the premises of natural and legal persons in order to seize documents and data in any form where a reasonable suspicion exists that documents or data relating to the subject matter of the inspection or investigation might be relevant to prove a case of insider dealing or market manipulation; (d) to refer matters for criminal prosecution; (e) to require, insofar as permitted by national law, existing data traffic records held by a telecommunications operator, where there is a reasonable suspicion of an infringement and where such records may be relevant to the investigation of an infringement of Articles 88 to 91; (f) to request the freezing or sequestration of assets, or both; (g) to impose a temporary prohibition on the exercise of professional activity; (h) to take all necessary measures to ensure that the public is correctly informed, inter alia, by correcting false or misleading disclosed information, including by requiring an offeror, person seeking admission to trading or issuer or other person who has published or disseminated false or misleading information to publish a corrective statement. 4. Where necessary under national law, the competent authority may ask the relevant court to decide on the use of the powers referred to in paragraphs 1 and 2. 5. Competent authorities shall exercise the powers referred to in paragraphs 1 and 2 in any of the following ways: (a) directly; (b) in collaboration with other authorities, including authorities competent for the prevention and fight against money laundering and terrorist financing; (c) under their responsibility, by delegation to the authorities referred to in point (b); (d) by application to the competent courts. 6. Member States shall ensure that appropriate measures are in place so that competent authorities can exercise the supervisory and investigatory powers that are necessary to perform their duties. 7. A person making information available to the competent authority in accordance with this Regulation shall not be considered to infringe any restriction on disclosure of information imposed by contract or by any legislative, regulatory or administrative provision, and shall not be subject to liability of any kind related to such notification.
Article 95 Cooperation between competent authorities
1. Competent authorities shall cooperate with each other for the purposes of this Regulation. Competent authorities shall render assistance to competent authorities of other Member States, and to EBA and ESMA. They shall exchange information without undue delay and cooperate in investigation, supervision and enforcement activities. Where Member States have, in accordance with Article 111(1), second subparagraph, laid down criminal penalties for the infringements of this Regulation referred to in Article 111(1), first subparagraph, they shall ensure that appropriate measures are in place so that competent authorities have all the necessary powers to liaise with judicial, prosecuting or criminal justice authorities within their jurisdiction to receive specific information related to criminal investigations or proceedings commenced for infringements of this Regulation and to provide the same information to other competent authorities as well as to EBA and ESMA, in order to fulfil their obligation to cooperate for the purposes of this Regulation. 2. A competent authority may refuse to act on a request for information or a request to cooperate with an investigation only in the following cases: (a) communication of relevant information could adversely affect the security of the Member State addressed, in particular with regard to the fight against terrorism and other serious crimes; (b) where complying with the request is likely to adversely affect its own investigation, enforcement activities or, where applicable, a criminal investigation; (c) where proceedings have already been initiated in respect of the same actions and against the same natural or legal persons before the courts of the Member State addressed; (d) where a final judgment has already been delivered in respect of the same action and against the same natural or legal person in the Member State addressed. 3. Competent authorities shall, upon request, without undue delay provide any information required for the purposes of this Regulation. 4. A competent authority may request assistance from the competent authority of another Member State with regard to on-site inspections or investigations. A requesting competent authority shall inform EBA and ESMA of any request made pursuant to the first subparagraph. Where a competent authority receives a request from a competent authority of another Member State to carry out an on-site inspection or investigation, it may: (a) carry out the on-site inspection or investigation itself; (b) allow the competent authority which submitted the request to participate in an on-site inspection or investigation; (c) allow the competent authority which submitted the request to carry out the on-site inspection or investigation itself; (d) share specific tasks related to supervisory activities with the other competent authorities. 5. In the case of an on-site inspection or investigation referred to in paragraph 4, ESMA shall coordinate the inspection or investigation, where requested to do so by one of the competent authorities. Where the on-site inspection or investigation referred to in paragraph 4 concerns an issuer of an asset-referenced token or e-money token or concerns crypto-asset services related to asset-referenced tokens or e-money tokens, EBA shall, where requested to do so by one of the competent authorities, coordinate the inspection or investigation. 6. The competent authorities may bring the matter to the attention of ESMA in situations where a request for cooperation, in particular to exchange information, has been rejected or has not been acted upon within a reasonable time. Article 19(4) of Regulation (EU) No 1095/2010 shall apply in such situations mutatis mutandis . 7. By way of derogation from paragraph 6 of this Article, the competent authorities may bring the matter to the attention of EBA in situations where a request for cooperation, in particular for information concerning an issuer of an asset-referenced token or e-money token or concerning crypto-asset services related to asset-referenced tokens or e-money tokens, has been rejected or has not been acted upon within a reasonable time. Article 19(4) of Regulation (EU) No 1093/2010 shall apply in such situations mutatis mutandis . 8. Competent authorities shall closely coordinate their supervision in order to identify and remedy infringements of this Regulation, develop and promote best practices, facilitate collaboration, foster consistency of interpretation, and provide cross-jurisdictional assessments in the event of any disagreements. For the purposes of the first subparagraph of this paragraph, EBA and ESMA shall fulfil a coordination role between competent authorities and across supervisory colleges as referred to in Article 119 with a view to building a common supervisory culture and consistent supervisory practices and ensuring uniform procedures. 9. Where a competent authority finds that any of the requirements under this Regulation has not been met or has reason to believe that to be the case, it shall inform the competent authority of the entity or entities suspected of such infringement of its findings in a sufficiently detailed manner. 10. ESMA, in close cooperation with EBA, shall develop draft regulatory technical standards to further specify the information to be exchanged between competent authorities pursuant to paragraph 1. ESMA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by 30 June 2024. Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010. 11. ESMA, in close cooperation with EBA, shall develop draft implementing technical standards to establish standard forms, templates and procedures for the cooperation and exchange of information between competent authorities. ESMA shall submit the draft implementing technical standards referred to in the first subparagraph to the Commission by 30 June 2024. Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph of this paragraph in accordance with Article 15 of Regulation (EU) No 1095/2010.
Article 96 Cooperation with EBA and ESMA
1. For the purposes of this Regulation, the competent authorities shall cooperate closely with ESMA in accordance with Regulation (EU) No 1095/2010 and with EBA in accordance with Regulation (EU) No 1093/2010. They shall exchange information in order to carry out their duties under this Chapter and Chapters 2 and 3 of this Title. 2. The competent authorities shall without delay provide EBA and ESMA with all information necessary to perform their duties, in accordance with Article 35 of Regulation (EU) No 1093/2010 and Article 35 of Regulation (EU) No 1095/2010 respectively. 3. ESMA, in close cooperation with EBA, shall develop draft implementing technical standards to establish standard forms, templates and procedures for the cooperation and exchange of information between competent authorities and EBA and ESMA. ESMA shall submit the draft implementing technical standards referred to in the first subparagraph to the Commission by 30 June 2024. Power is conferred on the Commission to adopt the implementing technical standards referred to in the first subparagraph of this paragraph in accordance with Article 15 of Regulation (EU) No 1095/2010.
Article 97 Promotion of convergence on the classification of crypto-assets
1. By 30 December 2024, the ESAs shall jointly issue guidelines in accordance with Article 16 of Regulation (EU) No 1093/2010, Article 16 of Regulation (EU) No 1094/2010 and Article 16 of Regulation (EU) No 1095/2010 to specify the content and form of the explanation accompanying the crypto-asset white paper referred to in Article 8(4) and of the legal opinions on the qualification of asset-referenced tokens referred to in Article 17(1), point (b)(ii), and Article 18(2), point (e). The guidelines shall include a template for the explanation and the opinion and a standardised test for the classification of crypto-assets. 2. The ESAs shall, in accordance with Article 29 of Regulation (EU) No 1093/2010, Article 29 of Regulation (EU) No 1094/2010 and Article 29 of Regulation (EU) No 1095/2010, respectively, promote discussion among competent authorities on the classification of the crypto-assets, including on the classification of those crypto-assets that are excluded from the scope of this Regulation pursuant to Article 2(3). The ESAs shall also identify the sources of potential divergences in the approaches of the competent authorities to the classification of those crypto-assets and shall, to the extent possible, promote a common approach thereto. 3. Competent authorities of the home or the host Member States may request ESMA, EIOPA or EBA, as appropriate, for an opinion on the classification of crypto-assets, including those that are excluded from the scope of this Regulation pursuant to Article 2(3). ESMA, EIOPA or EBA, as applicable, shall provide such opinion in accordance with Article 29 of Regulation (EU) No 1093/2010, Article 29 of Regulation (EU) No 1094/2010 and Article 29 of Regulation (EU) No 1095/2010, as applicable, within 15 working days of receipt of the request from the competent authorities. 4. The ESAs shall jointly draw up an annual report based on the information contained in the register referred to in Article 109 and on the results of their work referred to in paragraphs 2 and 3 of this Article, identifying difficulties in the classification of crypto-assets and divergences in the approaches of the competent authorities.
Article 98 Cooperation with other authorities
Where an offeror, person seeking admission to trading, an issuer of an asset-referenced token or e-money token or a crypto-asset service provider engages in activities other than those covered by this Regulation, the competent authorities shall cooperate with the authorities responsible for the supervision or oversight of such other activities pursuant to Union or national law, including tax authorities and relevant supervisory authorities of third countries.
Article 99 Duty of notification
Member States shall notify the laws, regulations and administrative provisions implementing this Title, including any relevant criminal law provisions, to the Commission, EBA and ESMA by 30 June 2025. Member States shall notify the Commission, EBA and ESMA without undue delay of any subsequent amendments thereto.
Article 100 Professional secrecy
1. All information exchanged between the competent authorities under this Regulation that concerns business or operational conditions and other economic or personal affairs shall be considered confidential and shall be subject to the requirements of professional secrecy, except where the competent authority states at the time of communication that such information may be disclosed or such disclosure is necessary for legal proceedings or cases covered by national taxation or criminal law. 2. The obligation of professional secrecy shall apply to all natural and legal persons who work or have worked for the competent authorities. Information covered by professional secrecy may not be disclosed to any other natural or legal person or authority except by virtue of Union or national legislative acts.
Article 101 Data protection
With regard to the processing of personal data within the framework of this Regulation, competent authorities shall carry out their tasks for the purposes of this Regulation in accordance with Regulation (EU) 2016/679. The processing of personal data by EBA and ESMA for the purposes of this Regulation shall be carried out in accordance with Regulation (EU) 2018/1725.
Article 102 Precautionary measures
1. Where the competent authority of a host Member State has clear and demonstrable grounds for suspecting that there are irregularities in the activities of an offeror or person seeking admission to trading of crypto-assets, an issuer of an asset-referenced token or e-money token, or a crypto-asset service provider, it shall notify the competent authority of the home Member State and ESMA thereof. Where the irregularities referred to in the first subparagraph concern an issuer of an asset-referenced token or e-money token, or a crypto-asset service related to asset-referenced tokens or e-money tokens, the competent authority of the host Member State shall also notify EBA. 2. Where, despite the measures taken by the competent authority of the home Member State, the irregularities referred to in paragraph 1 persist, amounting to an infringement of this Regulation, the competent authority of the host Member State, after informing the competent authority of the home Member State, ESMA and, where appropriate, EBA, shall take appropriate measures in order to protect clients of crypto-asset service providers and holders of crypto-assets, in particular retail holders. Such measures include preventing the offeror, person seeking admission to trading, the issuer of the asset-referenced token or e-money token or the crypto-asset service provider from conducting further activities in the host Member State. The competent authority shall inform ESMA and, where appropriate, EBA thereof without undue delay. ESMA, and, where involved, EBA, shall inform the Commission accordingly without undue delay. 3. Where a competent authority of the home Member State disagrees with any of the measures taken by a competent authority of the host Member State pursuant to paragraph 2 of this Article, it may bring the matter to the attention of ESMA. Article 19(4) of Regulation (EU) No 1095/2010 shall apply in such situations mutatis mutandis . By way of derogation from the first subparagraph of this paragraph, where the measures referred to in paragraph 2 of this Article concern an issuer of an asset-referenced token or e-money token, or a crypto-asset service related to asset-referenced tokens or e-money tokens, the competent authority of the host Member State may bring the matter to the attention of EBA. Article 19(4) of Regulation (EU) No 1093/2010 shall apply in such situations mutatis mutandis .
Article 103 ESMA temporary intervention powers
1. In accordance with Article 9(5) of Regulation (EU) No 1095/2010, ESMA may, where the conditions in paragraphs 2 and 3 of this Article are fulfilled, temporarily prohibit or restrict: (a) the marketing, distribution or sale of certain crypto-assets other than asset-referenced tokens or e-money tokens or crypto-assets other than asset-referenced tokens or e-money tokens with certain specified features; or (b) a type of activity or practice related to crypto-assets other than asset-referenced tokens or e-money tokens. A prohibition or restriction may apply in certain circumstances, or be subject to exceptions, specified by ESMA. 2. ESMA shall take a measure pursuant to paragraph 1 only if all of the following conditions are fulfilled: (a) the proposed prohibition or restriction addresses a significant investor protection concern or a threat to the orderly functioning and integrity of markets in crypto-assets or to the stability of the whole or part of the financial system in the Union; (b) the regulatory requirements under Union law that are applicable to the relevant crypto-assets and crypto-asset services do not address the threat at issue; (c) a relevant competent authority has not taken action to address the threat at issue or the actions that have been taken do not adequately address that threat. 3. When taking a measure pursuant to paragraph 1, ESMA shall ensure that the measure does not: (a) have a detrimental effect on the efficiency of markets in crypto-assets or on holders of crypto-assets or clients receiving crypto-asset services that is disproportionate to the benefits of the measure; and (b) create a risk of regulatory arbitrage. Where competent authorities have taken a measure pursuant to Article 105, ESMA may take any of the measures referred to in paragraph 1 of this Article without issuing an opinion pursuant to Article 106(2). 4. Before deciding to take a measure pursuant to paragraph 1, ESMA shall notify the relevant competent authorities of the measure it intends to take. 5. ESMA shall publish on its website a notice of a decision to take a measure pursuant to paragraph 1. That notice shall specify the details of the prohibition or restriction imposed and specify a time after the publication of the notice from which the measures will take effect. A prohibition or restriction shall only apply to activities after the measure has taken effect. 6. ESMA shall review a prohibition or restriction imposed pursuant to paragraph 1 at appropriate intervals, and at least every six months. Following at least two consecutive renewals and based on a proper analysis assessing the impact on consumers, ESMA may decide on the annual renewal of the prohibition or restriction. 7. Measures taken by ESMA pursuant to this Article shall prevail over any previous measure taken by the relevant competent authorities on the same matter. 8. The Commission shall adopt delegated acts in accordance with Article 139 to supplement this Regulation by specifying the criteria and factors to be taken into account by ESMA in determining whether there is a significant investor protection concern or a threat to the orderly functioning and integrity of markets in crypto-assets or to the stability of the whole or part of the financial system of the Union for the purposes of paragraph 2, point (a), of this Article.
Article 104 EBA temporary intervention powers
1. In accordance with Article 9(5) of Regulation (EU) No 1093/2010, EBA may, where the conditions in paragraphs 2 and 3 of this Article are fulfilled, temporarily prohibit or restrict: (a) the marketing, distribution or sale of certain asset-referenced tokens or e-money tokens or asset-referenced tokens or e-money tokens with certain specified features; or (b) a type of activity or practice related to asset-referenced tokens or e-money tokens. A prohibition or restriction may apply in certain circumstances, or be subject to exceptions, specified by EBA. 2. EBA shall take a measure pursuant to paragraph 1 only if all of the following conditions are fulfilled: (a) the proposed prohibition or restriction addresses a significant investor protection concern or a threat to the orderly functioning and integrity of markets in crypto-assets or to the stability of the whole or part of the financial system in the Union; (b) the regulatory requirements under Union law that are applicable to the relevant asset-referenced tokens, e-money tokens or crypto-asset services related to them do not address the threat at issue; (c) a relevant competent authority has not taken action to address the threat at issue or the actions that have been taken do not adequately address that threat. 3. When taking a measure pursuant to paragraph 1, EBA shall ensure that the measure does not: (a) have a detrimental effect on the efficiency of markets in crypto-assets or on holders of asset-referenced tokens or e-money tokens or clients receiving crypto-asset services that is disproportionate to the benefits of the measure; and (b) create a risk of regulatory arbitrage. Where competent authorities have taken a measure pursuant to Article 105, EBA may take any of the measures referred to in paragraph 1 of this Article without issuing an opinion pursuant to Article 106(2). 4. Before deciding to take a measure pursuant to paragraph 1, EBA shall notify the relevant competent authorities of the measure it intends to take. 5. EBA shall publish on its website a notice of a decision to take a measure pursuant to paragraph 1. That notice shall specify the details of the prohibition or restriction imposed and specify a time after the publication of the notice from which the measures will take effect. A prohibition or restriction shall only apply to activities after the measure has taken effect. 6. EBA shall review a prohibition or restriction imposed pursuant to paragraph 1 at appropriate intervals, and at least every six months. Following at least two consecutive renewals and based on a proper analysis assessing the impact on consumers, EBA may decide on the annual renewal of the prohibition or restriction. 7. Measures taken by EBA pursuant to this Article shall prevail over any previous measure taken by the relevant competent authority on the same matter. 8. The Commission shall adopt delegated acts in accordance with Article 139 to supplement this Regulation by specifying the criteria and factors to be taken into account by EBA in determining whether there is a significant investor protection concern or a threat to the orderly functioning and integrity of markets in crypto-assets or to the stability of the whole or part of the financial system of the Union for the purposes of paragraph 2, point (a), of this Article.
Article 105 Product intervention by competent authorities
1. A competent authority may prohibit or restrict the following in or from its Member State: (a) the marketing, distribution or sale of certain crypto-assets or crypto-assets with certain specified features; or (b) a type of activity or practice related to crypto-assets. 2. A competent authority shall only take a measure pursuant to paragraph 1 if it is satisfied on reasonable grounds that: (a) a crypto-asset gives rise to significant investor protection concerns or poses a threat to the orderly functioning and integrity of markets in crypto-assets or to the stability of the whole or part of the financial system within at least one Member State; (b) existing regulatory requirements under Union law applicable to the crypto-asset or crypto-asset service concerned do not sufficiently address the risks referred to in point (a) and the issue would not be better addressed by improved supervision or enforcement of existing requirements; (c) the measure is proportionate, taking into account the nature of the risks identified, the level of sophistication of investors or market participants concerned and the likely effect of the measure on investors and market participants who may hold, use or benefit from the crypto-asset or crypto-asset service concerned; (d) the competent authority has properly consulted the competent authorities in other Member States that might be significantly affected by the measure; and (e) the measure does not have a discriminatory effect on services or activities provided from another Member State. Where the conditions set out in the first subparagraph of this paragraph are fulfilled, the competent authority may impose the prohibition or restriction referred to in paragraph 1 on a precautionary basis before a crypto-asset has been marketed, distributed or sold to clients. The competent authority may decide to apply the prohibition or restriction referred to in paragraph 1 only in certain circumstances or to make it subject to exceptions. 3. The competent authority shall not impose a prohibition or restriction under this Article unless, not less than one month before the measure is intended to take effect, it has notified all other competent authorities and ESMA, or EBA for asset-referenced tokens and e-money tokens, in writing or through another medium agreed between the authorities, the following details: (a) the crypto-asset or activity or practice to which the proposed measure relates; (b) the precise nature of the proposed prohibition or restriction and when it is intended to take effect; and (c) the evidence upon which it has based its decision and upon which it is satisfied that each of the conditions in paragraph 2, first subparagraph, are met. 4. In exceptional cases where the competent authority considers it necessary in order to prevent any detrimental effects arising from the crypto-asset or activity or practice referred to in paragraph 1, the competent authority may take an urgent measure on a provisional basis with no less than 24 hours’ written notice before the measure is intended to take effect to all other competent authorities and ESMA, provided that all of the criteria listed in this Article are met and, in addition, that it is clearly established that a one-month notification period would not adequately address the specific concern or threat. The duration of measures taken on a provisional basis shall not exceed three months. 5. The competent authority shall publish on its website a notice of a decision to impose a prohibition or restriction as referred to in paragraph 1. That notice shall specify the details of the prohibition or restriction imposed and specify a time after the publication of the notice from which the measures will take effect and the evidence upon which the competent authority has based its decision, and is satisfied that each of the conditions in paragraph 2, first subparagraph, is met. The prohibition or restriction shall only apply to activities after the measures have taken effect. 6. The competent authority shall revoke a prohibition or restriction if the conditions in paragraph 2 no longer apply. 7. The Commission shall adopt delegated acts in accordance with Article 139 to supplement this Regulation by specifying the criteria and factors to be taken into account by the competent authorities in determining whether there is a significant investor protection concern or a threat to the orderly functioning and integrity of markets in crypto-assets or to the stability of the whole or part of the financial system within at least one Member State as for the purposes of paragraph 2, first subparagraph, point (a).
Article 106 Coordination with ESMA or EBA
1. ESMA or, for asset-referenced tokens and e-money tokens, EBA, shall perform a facilitating and coordinating role in relation to measures taken by competent authorities pursuant to Article 105. ESMA or, for asset-referenced tokens and e-money tokens, EBA, shall ensure that measures taken by a competent authority are justified and proportionate and that a consistent approach is taken by competent authorities, where appropriate. 2. After receiving notification in accordance with Article 105(3) of any measure to be taken pursuant to that Article, ESMA or, for asset-referenced tokens and e-money tokens, EBA, shall issue an opinion on whether the prohibition or restriction is justified and proportionate. If ESMA or, for asset-referenced tokens and e-money tokens, EBA, considers that the taking of a measure by other competent authorities is necessary to address the risk, it shall state this in its opinion. The opinion shall be published on the website of ESMA or, for asset-referenced tokens and e-money tokens, EBA. 3. Where a competent authority proposes to take, or takes or declines to take measures contrary to an opinion issued by ESMA or EBA pursuant to paragraph 2, it shall immediately publish on its website a notice fully explaining its reasons therefor.
Article 107 Cooperation with third countries
1. The competent authorities of Member States shall, where necessary, conclude cooperation arrangements with supervisory authorities of third countries concerning the exchange of information with those supervisory authorities of third countries and the enforcement of obligations under this Regulation in those third countries. Those cooperation arrangements shall ensure at least an efficient exchange of information that allows the competent authorities to carry out their duties under this Regulation. A competent authority shall inform EBA, ESMA and the other competent authorities where it intends to conclude such an arrangement. 2. ESMA, in close cooperation with EBA, shall, where possible, facilitate and coordinate the development of cooperation arrangements between the competent authorities and the relevant supervisory authorities of third countries. 3. ESMA, in close cooperation with EBA, shall develop draft regulatory technical standards establishing a template document for cooperation arrangements referred to in paragraph 1 for use by competent authorities of Member States where possible. ESMA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by 30 June 2024. Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010. 4. ESMA, in close cooperation with EBA, shall also, where possible, facilitate and coordinate the exchange between competent authorities of information obtained from supervisory authorities of third countries that might be relevant for taking measures under Chapter 3 of this Title. 5. The competent authorities shall conclude cooperation arrangements on exchange of information with the supervisory authorities of third countries only where the information disclosed is subject to guarantees of professional secrecy that are at least equivalent to those set out in Article 100. Such exchange of information shall be intended for the performance of the tasks under this Regulation of those competent authorities.
Article 108 Complaints-handling by competent authorities
1. Competent authorities shall set up procedures that allow clients and other interested parties, including consumer associations, to submit complaints to them with regard to alleged infringements of this Regulation by offerors, persons seeking admission to trading, issuers of asset-referenced tokens or e-money tokens, or crypto-asset service providers. Complaints shall be accepted in writing, including electronically, and in an official language of the Member State in which the complaint is submitted, or in a language accepted by the competent authorities of that Member State. 2. Information on the complaints-handling procedures referred to in paragraph 1 of this Article shall be made available on the website of each competent authority and communicated to EBA and ESMA. ESMA shall publish hyperlinks to the sections of the websites of the competent authorities related to complaints-handling procedures in its crypto-asset register referred to in Article 109.
Article 109 Register of crypto-asset white papers, of issuers of asset-referenced tokens and e-money tokens, and of crypto-asset service providers
1. ESMA shall establish a register of: (a) crypto-asset white papers for crypto-assets other than asset-referenced tokens and e-money tokens; (b) issuers of asset-referenced tokens; (c) issuers of e-money tokens; and (d) crypto-asset service providers. ESMA’s register shall be publicly available on its website and shall be updated on a regular basis. In order to facilitate such updating, the competent authorities shall communicate to ESMA any changes notified to them regarding the information specified in paragraphs 2 to 5. The competent authorities shall provide ESMA with the data necessary for the classification of crypto-asset white papers in the register, as specified in accordance with paragraph 8. 2. As regards crypto-asset white papers for crypto-assets other than asset-referenced tokens or e-money tokens, the register shall contain the crypto-asset white papers and any modified crypto-asset white papers. Any out-of-date versions of the crypto-asset white papers shall be kept in a separate archive and be clearly marked as out-of-date versions. 3. As regards issuers of asset-referenced tokens, the register shall contain the following information: (a) the name, legal form and legal entity identifier of the issuer; (b) the commercial name, physical address, telephone number, email and website of the issuer; (c) the crypto-asset white papers and any modified crypto-asset white papers, with the out-of-date versions of the crypto-asset white paper kept in a separate archive and clearly marked as out-of-date; (d) the list of host Member States where the applicant issuer intends to offer an asset-referenced token to the public or intends to seek admission to trading of the asset-referenced tokens; (e) the starting date, or, if not available at the time of the notification by the competent authority, the intended starting date, of the offer to the public or the admission to trading; (f) any other services provided by the issuer not covered by this Regulation, with a reference to the applicable Union or national law; (g) the date of authorisation to offer to the public or seek the admission to trading of an asset-referenced token or of authorisation as a credit institution and, where applicable, of withdrawal of either authorisation. 4. As regards issuers of e-money tokens, the register shall contain the following information: (a) the name, legal form and legal entity identifier of the issuer; (b) the commercial name, physical address, telephone number, email and website of the issuer; (c) the crypto-asset white papers and any modified crypto-asset white papers, with the out-of-date versions of the crypto-asset white paper kept in a separate archive and clearly marked as out-of-date; (d) the starting date, or, if not available at the time of the notification by the competent authority, the intended starting date, of the offer to the public or the admission to trading; (e) any other services provided by the issuer not covered by this Regulation, with a reference to the applicable Union or national law; (f) the date of authorisation as a credit institution or as an electronic money institution and, where applicable, of withdrawal of that authorisation. 5. As regards crypto-asset service providers, the register shall contain the following information: (a) the name, legal form and legal entity identifier of the crypto-asset service provider and, where applicable, of the branches of the crypto-asset service provider; (b) the commercial name, physical address, telephone number, email and website of the crypto-asset service provider and, where applicable, of the trading platform for crypto-assets operated by the crypto-asset service provider; (c) the name and address of the competent authority that granted authorisation and its contact details; (d) the list of crypto-asset services provided by the crypto-asset service provider; (e) the list of host Member States in which the crypto-asset service provider intends to provide crypto-asset services; (f) the starting date, or, if not available at the time of the notification by the competent authority, the intended starting date, of the provision of crypto-asset services; (g) any other services provided by the crypto-asset service provider not covered by this Regulation with a reference to the applicable Union or national law; (h) the date of authorisation and, where applicable, of the withdrawal of an authorisation. 6. Competent authorities shall notify ESMA without delay of the measures listed in Article 94(1), first subparagraph, point (b), (c), (f), (l), (m), (n), (o) or (t), and of any public precautionary measures taken pursuant to Article 102 affecting the provision of crypto-asset services or the issuance, offer to the public or use of crypto-assets. ESMA shall include such information in the register. 7. Any withdrawal of an authorisation of an issuer of an asset-referenced token, of an issuer of an e-money token, or of a crypto-asset service provider, and any measure notified in accordance with paragraph 6, shall remain published in the register for five years. 8. ESMA shall develop draft regulatory technical standards to further specify the data necessary for the classification, by type of crypto-asset, of crypto-asset white papers, including the legal entity identifiers, in the register and specify the practical arrangements to ensure that such data is machine-readable. ESMA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by 30 June 2024. Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1095/2010.
Article 110 Register of non-compliant entities providing crypto-asset services
1. ESMA shall establish a non-exhaustive register of entities that provide crypto-asset services in violation of Article 59 or 61. 2. The register shall contain at least the commercial name or the website of a non-compliant entity and the name of the competent authority that submitted the information. 3. The register shall be publicly available on ESMA’s website in a machine-readable format and shall be updated on a regular basis to take into account any changes of circumstances or any information that is brought to ESMA’s attention concerning the registered non-compliant entities. The register shall enable centralised access to information submitted by competent authorities from the Member States or third countries, as well as by EBA. 4. ESMA shall update the register to include information on any case of infringement of this Regulation identified on its own initiative in accordance with Article 17 of Regulation (EU) No 1095/2010 in which it has adopted a decision under paragraph 6 of that Article addressed to a non-compliant entity providing crypto-asset services, or any information on entities providing crypto-asset services without the necessary authorisation or registration submitted by the relevant supervisory authorities of third countries. 5. In the cases referred to in paragraph 4 of this Article, ESMA may apply the relevant supervisory and investigative powers of competent authorities as referred to in Article 94(1) to non-compliant entities providing crypto-asset services.
Article 111 Administrative penalties and other administrative measures
1. Without prejudice to any criminal penalties and without prejudice to the supervisory and investigative powers of competent authorities listed in Article 94, Member States shall, in accordance with national law, provide for competent authorities to have the power to take appropriate administrative penalties and other administrative measures in relation to at least the following infringements: (a) infringements of Articles 4 to 14; (b) infringements of Articles 16, 17, 19, 22, 23, 25, Articles 27 to 41, Articles 46 and 47; (c) infringements of Articles 48 to 51, Articles 53, 54 and 55; (d) infringements of Articles 59, 60, 64 and Articles 65 to 83; (e) infringements of Articles 88 to 92; (f) failure to cooperate or to comply with an investigation, with an inspection or with a request as referred to in Article 94(3). Member States may decide not to lay down rules for administrative penalties where the infringements referred to in the first subparagraph, point (a), (b), (c), (d) or (e), are already subject to criminal penalties in their national law by 30 June 2024. Where they so decide, Member States shall notify to the Commission, ESMA and to EBA, in detail, the relevant parts of their criminal law. By 30 June 2024, Member States shall notify to the Commission, EBA and ESMA, in detail, the rules referred to in the first and second subparagraphs. They shall also notify the Commission, ESMA and EBA without delay of any subsequent amendment thereto. 2. Member States shall, in accordance with their national law, ensure that competent authorities have the power to impose at least the following administrative penalties and other administrative measures in relation to the infringements referred to in paragraph 1, first subparagraph, points (a) to (d): (a) a public statement indicating the natural or legal person responsible and the nature of the infringement; (b) an order requiring the natural or legal person responsible to cease the conduct constituting the infringement and to desist from a repetition of that conduct; (c) maximum administrative fines of at least twice the amount of the profits gained or losses avoided because of the infringement where those can be determined, even if it exceeds the maximum amounts set out in point (d) of this paragraph, as regards natural persons, or in paragraph 3 as regards legal persons; (d) in the case of a natural person, maximum administrative fines of at least EUR 700 000, or, in the Member States whose official currency is not the euro, the corresponding value in the official currency on 29 June 2023. 3. Member States shall, in accordance with their national law, ensure that competent authorities have the power to impose, in relation to infringements committed by legal persons, maximum administrative fines of at least: (a) EUR 5 000 000, or, in the Member States whose official currency is not the euro, the corresponding value in the official currency on 29 June 2023, for the infringements referred to in paragraph 1, first subparagraph, points (a) to (d); (b) 3 % of the total annual turnover of the legal person according to the last available financial statements approved by the management body, for the infringements referred to in paragraph 1, first subparagraph, point (a); (c) 5 % of the total annual turnover of the legal person according to the last available financial statements approved by the management body, for the infringements referred to in paragraph 1, first subparagraph, point (d); (d) 12,5 % of the total annual turnover of the legal person according to the last available financial statements approved by the management body, for the infringements referred to in paragraph 1, first subparagraph, points (b) and (c). Where the legal person referred to in the first subparagraph, points (a) to (d), is a parent undertaking or a subsidiary of a parent undertaking which is required to prepare consolidated financial statements in accordance with Directive 2013/34/EU, the relevant total annual turnover shall be the total annual turnover or the corresponding type of income in accordance with applicable Union law in the field of accounting according to the last available consolidated accounts approved by the management body of the ultimate parent undertaking. 4. In addition to the administrative penalties and other administrative measures as well as administrative fines referred to in paragraphs 2 and 3, Member States shall, in accordance with their national law, ensure that competent authorities have the power to impose, in the event of infringements referred to in paragraph 1, first subparagraph, point (d), a temporary ban preventing any member of the management body of the crypto-asset service provider, or any other natural person who is held responsible for the infringement, from exercising management functions in a crypto-asset service provider. 5. Member States shall, in accordance with their national law, ensure that, in the event of the infringements referred to in paragraph 1, first subparagraph, point (e), competent authorities have the power to impose at least the following administrative penalties and to take at least the following administrative measures: (a) a public statement indicating the natural or legal person responsible and the nature of the infringement; (b) an order requiring the natural or legal person responsible to cease the conduct constituting the infringement and to desist from a repetition of that conduct; (c) the disgorgement of the profits gained or losses avoided due to the infringement insofar as they can be determined; (d) withdrawal or suspension of the authorisation of a crypto-asset service provider; (e) a temporary ban of any member of the management body of the crypto-asset service provider, or any other natural person who is held responsible for the infringement, from exercising management functions in crypto-asset service providers; (f) in the event of a repeated infringement of Article 89, 90, 91 or 92, a ban of at least 10 years for any member of the management body of a crypto-asset service provider, or any other natural person who is held responsible for the infringement, from exercising management functions in a crypto-asset service provider; (g) a temporary ban of any member of the management body of a crypto-asset service provider or any other natural person who is held responsible for the infringement, from dealing on own account; (h) maximum administrative fines of at least three times the amount of the profits gained or losses avoided because of the infringement, where those can be determined, even if it exceeds the maximum amounts set out in point (i) or (j), as applicable; (i) in respect of a natural person, maximum administrative fines of at least EUR 1 000 000 for infringements of Article 88 and EUR 5 000 000 for infringements of Articles 89 to 92 or in the Member States whose official currency is not the euro, the corresponding value in the official currency on 29 June 2023; (j) in respect of legal persons, maximum administrative fines of at least EUR 2 500 000 for infringements of Article 88 and EUR 15 000 000 for infringements of Articles 89 to 92, or 2 % for infringements of Article 88 and 15 % for infringements of Articles 89 to 92 of the total annual turnover of the legal person according to the last available accounts approved by the management body, or in the Member States whose official currency is not the euro, the corresponding value in the official currency on 29 June 2023. For the purpose of point (j) of the first subparagraph, where the legal person is a parent undertaking or a subsidiary of a parent undertaking which is required to prepare consolidated financial statements in accordance with Directive 2013/34/EU, the relevant total annual turnover shall be the total annual turnover or the corresponding type of income in accordance with applicable Union law in the field of accounting according to the last available consolidated accounts approved by the management body of the ultimate parent undertaking. 6. Member States may provide that competent authorities have powers in addition to those referred to in paragraphs 2 to 5 and may provide for higher levels of penalties than those established in those paragraphs, in respect of both natural and legal persons responsible for the infringement.
Article 112 Exercise of supervisory powers and powers to impose penalties
1. Competent authorities, when determining the type and level of an administrative penalty or other administrative measure to be imposed in accordance with Article 111, shall take into account all relevant circumstances, including, where appropriate: (a) the gravity and the duration of the infringement; (b) whether the infringement has been committed intentionally or negligently; (c) the degree of responsibility of the natural or legal person responsible for the infringement; (d) the financial strength of the natural or legal person responsible for the infringement, as indicated by the total turnover of the responsible legal person or the annual income and net assets of the responsible natural person; (e) the importance of the profits gained or losses avoided by the natural or legal person responsible for the infringement, insofar as those can be determined; (f) the losses for third parties caused by the infringement, insofar as those can be determined; (g) the level of cooperation of the natural or legal person responsible for the infringement with the competent authority, without prejudice to the need to ensure disgorgement of profits gained or losses avoided by that person; (h) previous infringements of this Regulation by the natural or legal person responsible for the infringement; (i) measures taken by the person responsible for the infringement to prevent its repetition; (j) the impact of the infringement on the interests of holders of crypto-assets and clients of crypto-asset service providers, in particular retail holders. 2. In the exercise of their powers to impose administrative penalties and other administrative measures under Article 111, competent authorities shall cooperate closely to ensure that the exercise of their supervisory and investigative powers, and the administrative penalties and other administrative measures that they impose, are effective and appropriate. They shall coordinate their action in order to avoid duplication and overlaps when exercising their supervisory and investigative powers and when imposing administrative penalties and other administrative measures in cross-border cases.
Article 113 Right of appeal
1. Member States shall ensure that decisions taken by competent authorities under this Regulation are properly reasoned and subject to the right of appeal before a court. The right of appeal before a court shall also apply where, in respect of an application for authorisation which provides all of the required information, no decision is taken within six months of its submission. 2. Member States shall provide that one or more of the following bodies, as determined by national law, may, in the interests of consumers and in accordance with national law, take action before the courts or competent administrative bodies to ensure that this Regulation is applied: (a) public bodies or their representatives; (b) consumer organisations having a legitimate interest in protecting holders of crypto-assets; (c) professional organisations having a legitimate interest in protecting their members.
Article 114 Publication of decisions
1. A decision imposing administrative penalties and other administrative measures for an infringement of this Regulation in accordance with Article 111 shall be published by competent authorities on their official websites without undue delay after the natural or legal person subject to that decision has been informed of that decision. The publication shall include at least information on the type and nature of the infringement and the identity of the natural or legal persons responsible. Decisions imposing measures that are of an investigatory nature need not be published. 2. Where the publication of the identity of the legal entities, or the identity or personal data of natural persons, is considered by the competent authority to be disproportionate following a case-by-case assessment conducted on the proportionality of the publication of such data, or where such publication would jeopardise an ongoing investigation, competent authorities shall take one of the following actions: (a) defer the publication of the decision to impose an administrative penalty or other administrative measure until the moment where the reasons for non-publication cease to exist; (b) publish the decision to impose an administrative penalty or other administrative measure on an anonymous basis in a manner which is in conformity with national law, where such anonymous publication ensures the effective protection of the personal data concerned; (c) not publish the decision to impose an administrative penalty or other administrative measure in the event that the options provided for in points (a) and (b) are considered insufficient to ensure: (i) that the stability of financial markets is not jeopardised; (ii) the proportionality of the publication of such a decision with regard to measures which are deemed to be of a minor nature. In the case of a decision to publish an administrative penalty or other administrative measure on an anonymous basis, as referred to in the first subparagraph, point (b), the publication of the relevant data may be deferred for a reasonable period where it is foreseen that within that period the reasons for anonymous publication will cease to exist. 3. Where the decision to impose an administrative penalty or other administrative measure is under appeal before the relevant courts or administrative bodies, competent authorities shall publish, immediately, on their official website such information and any subsequent information on the outcome of such appeal. Moreover, any decision annulling a previous decision to impose administrative penalty or other administrative measure shall also be published. 4. Competent authorities shall ensure that any publication in accordance with this Article remains on their official website for a period of at least five years after its publication. Personal data contained in the publication shall be kept on the official website of the competent authority only for the period which is necessary in accordance with the applicable data protection rules.
Article 115 Reporting of administrative penalties and other administrative measures to ESMA and EBA
1. The competent authority shall, on an annual basis, provide ESMA and EBA with aggregate information regarding all administrative penalties and other administrative measures imposed in accordance with Article 111. ESMA shall publish that information in an annual report. Where Member States have, in accordance with Article 111(1), second subparagraph, laid down criminal penalties for the infringements of the provisions referred to therein, their competent authorities shall provide EBA and ESMA annually with anonymised and aggregated data regarding all relevant criminal investigations undertaken and criminal penalties imposed. ESMA shall publish data on criminal penalties imposed in an annual report. 2. Where the competent authority has disclosed administrative penalties, other administrative measures or criminal penalties to the public, it shall simultaneously report them to ESMA. 3. Competent authorities shall inform EBA and ESMA of all administrative penalties or other administrative measures imposed but not published, including any appeal in relation thereto and the outcome thereof. Member States shall ensure that competent authorities receive information and the final judgment in relation to any criminal penalty imposed and submit it to EBA and ESMA. ESMA shall maintain a central database of penalties and administrative measures communicated to it solely for the purposes of exchanging information between competent authorities. That database shall be only accessible to EBA, ESMA and the competent authorities and it shall be updated based on the information provided by the competent authorities.
Article 116 Reporting of infringements and protection of reporting persons
Directive (EU) 2019/1937 shall apply to the reporting of infringements of this Regulation and the protection of persons reporting such infringements.
Article 117 Supervisory responsibilities of EBA with respect to issuers of significant asset-referenced tokens and issuers of significant e-money tokens
1. Where an asset-referenced token has been classified as significant in accordance with Article 43 or 44, the issuer of such asset-referenced token shall carry out its activities under the supervision of EBA. Without prejudice to the powers of national competent authorities under paragraph 2 of this Article, EBA shall exercise the powers of competent authorities conferred by Articles 22 to 25, 29, 33 Article 34(7) and (12), Article 35(3) and (5), Article 36(10) and Articles 41, 42, 46 and 47 as regards issuers of significant asset-referenced tokens. 2. Where an issuer of a significant asset-referenced token also provides crypto-asset services or issues crypto-assets that are not significant asset-referenced tokens, those services and activities shall remain under the supervision of the competent authority of the home Member State. 3. Where an asset-referenced token has been classified as significant in accordance with Article 43, EBA shall conduct a supervisory reassessment to ensure that the issuer complies with Title III. 4. Where an e-money token issued by an electronic money institution has been classified as significant in accordance with Article 56 or 57, EBA shall supervise the compliance of the issuer of such significant e-money token with Articles 55 and 58. For the purposes of the supervision of compliance with Articles 55 and 58, EBA shall exercise the powers of the competent authorities conferred on them by Articles 22 and 23, Article 24(3), Article 35(3) and (5), Article 36(10) and Articles 46 and 47, as regards electronic money institutions issuing significant e-money tokens. 5. EBA shall exercise its supervisory powers as provided in paragraphs 1 to 4 in close cooperation with the other competent authorities responsible for supervising the issuer, in particular: (a) the prudential supervisory authority, including, where applicable, the ECB under Regulation (EU) No 1024/2013; (b) relevant competent authorities under national law transposing Directive 2009/110/EC, where applicable; (c) the competent authorities referred to in Article 20(1).
Article 118 EBA crypto-asset committee
1. EBA shall create a permanent internal committee pursuant to Article 41 of Regulation (EU) No 1093/2010 for the purposes of preparing EBA’s decisions to be taken in accordance with Article 44 thereof, including decisions relating to the supervisory tasks that have been conferred on EBA by this Regulation. 2. The crypto-asset committee may also prepare decisions in relation to draft regulatory technical standards and draft implementing technical standards relating to supervisory tasks that have been conferred on EBA by this Regulation. 3. EBA shall ensure that the crypto-asset committee performs only the activities referred to in paragraphs 1 and 2 and any other tasks necessary for the performance of its activities related to crypto-assets.
Article 119 Colleges for issuers of significant asset-referenced tokens and significant e-money tokens
1. Within 30 calendar days of a decision to classify an asset-referenced token or e-money token as significant pursuant to Article 43, 44, 56 or 57, as applicable, EBA shall establish, manage and chair a consultative supervisory college for each issuer of a significant asset-referenced token or of a significant e-money token, to facilitate the exercise of supervisory tasks and act as a vehicle for the coordination of supervisory activities under this Regulation. 2. A college referred to in paragraph 1 shall consist of: (a) EBA; (b) ESMA; (c) the competent authorities of the home Member State where the issuer of the significant asset-referenced token or of the significant e-money token is established; (d) the competent authorities of the most relevant crypto-asset service providers, credit institutions or investment firms ensuring the custody of the reserve assets in accordance with Article 37 or of the funds received in exchange of the significant e-money tokens; (e) where applicable, the competent authorities of the most relevant trading platforms for crypto-assets where the significant asset-referenced tokens or the significant e-money tokens are admitted to trading; (f) the competent authorities of the most relevant payment service providers providing payment services in relation to the significant e-money tokens; (g) where applicable, the competent authorities of the entities ensuring the functions as referred to in Article 34(5), first subparagraph, point (h); (h) where applicable, the competent authorities of the most relevant crypto-asset service providers providing custody and administration of crypto-assets on behalf of clients in relation to the significant asset-referenced tokens or with the significant e-money tokens; (i) the ECB; (j) where the issuer of the significant asset-referenced token is established in a Member State whose official currency is not the euro, or where an official currency that is not the euro is referenced by the significant asset-referenced token, the central bank of that Member State; (k) where the issuer of the significant e-money token is established in a Member State whose official currency is not the euro, or where an official currency that is not the euro is referenced by the significant e-money token, the central bank of that Member State; (l) competent authorities of Member States where the asset-referenced token or the e-money token is used at large scale, at their request; (m) relevant supervisory authorities of third countries with which EBA has concluded administrative agreements in accordance with Article 126. 3. EBA may invite other authorities to be members of the college referred to in paragraph 1 where the entities they supervise are relevant to the work of the college. 4. The competent authority of a Member State which is not a member of the college may request from the college any information relevant for the performance of its supervisory duties under this Regulation. 5. A college referred to in paragraph 1 of this Article shall, without prejudice to the responsibilities of competent authorities under this Regulation, ensure: (a) the preparation of the non-binding opinion referred to in Article 120; (b) the exchange of information in accordance with this Regulation; (c) agreement on the voluntary entrustment of tasks among its members. In order to facilitate the performance of the tasks assigned to colleges pursuant to the first subparagraph of this paragraph, the members of the college referred to in paragraph 2 shall be entitled to contribute to the setting of the agenda of the college meetings, in particular by adding points to the agenda of a meeting. 6. The establishment and functioning of the college referred to in paragraph 1 shall be based on a written agreement between all of its members. The agreement referred to in the first subparagraph shall determine the practical arrangements for the functioning of the college, including detailed rules on: (a) voting procedures as referred in Article 120(3); (b) the procedures for setting the agenda of college meetings; (c) the frequency of the college meetings; (d) the appropriate minimum timeframes for the assessment of the relevant documentation by the members of the college; (e) the modalities of communication between the members of the college; (f) the creation of several colleges, one for each specific crypto-asset or group of crypto-assets. The agreement may also determine tasks to be entrusted to EBA or another member of the college. 7. As chair of each college, EBA shall: (a) establish written arrangements and procedures for the functioning of the college, after consulting the other members of the college; (b) coordinate all activities of the college; (c) convene and chair all its meetings and keep the members of the college fully informed in advance of the organisation of meetings of the college, of the main issues to be discussed and of the items to be considered; (d) notify the members of the college of any planned meetings so that they can request to participate; (e) keep the members of the college informed, in a timely manner, of the decisions and outcomes of those meetings. 8. In order to ensure the consistent and coherent functioning of colleges, EBA, in cooperation with ESMA and the ECB, shall develop draft regulatory standards specifying: (a) the conditions under which the entities referred to in paragraph 2, points (d), (e), (f) and (h), are to be considered the most relevant; (b) the conditions under which it is considered that asset-referenced tokens or e-money tokens are used at large scale, as referred to in paragraph 2, point (l); and (c) the details of the practical arrangements referred to in paragraph 6. EBA shall submit the draft regulatory standards referred to in the first subparagraph to the Commission by 30 June 2024. Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Article 10 to 14 of Regulation (EU) No 1093/2010.
Article 120 Non-binding opinions of the colleges for issuers of significant asset-referenced tokens and significant e-money tokens
1. A college referred to in Article 119(1) may issue a non-binding opinion on the following: (a) the supervisory reassessment as referred to in Article 117(3); (b) any decision to require an issuer of a significant asset-referenced token or a significant e-money token to hold a higher amount of own funds in accordance with Article 35(2), (3) and (5), Article 45(5) and Article 58(1), as applicable; (c) any update of the recovery plan or redemption plan of an issuer of a significant asset-referenced token or an issuer of a significant e-money token pursuant to Articles 46, 47 and 55, as applicable; (d) any change of the business model of an issuer of a significant asset-referenced token pursuant to Article 25(1); (e) a draft modified crypto-asset white paper drawn up in accordance with Article 25(2); (f) any envisaged appropriate corrective measures pursuant to Article 25(4); (g) any envisaged supervisory measures pursuant to Article 130; (h) any envisaged administrative agreement on the exchange of information with a supervisory authority of a third-country in accordance with Article 126; (i) any delegation of supervisory tasks from EBA to a competent authority pursuant to Article 138; (j) any envisaged change in the authorisation of, or any envisaged supervisory measure on, the members of the college referred to in Article 119(2), points (d) to (h); (k) a draft modified crypto-asset white paper drawn up in accordance with Article 51(12). 2. Where the college issues an opinion in accordance with paragraph 1, at the request of any member of the college and upon adoption by a majority of the college in accordance with paragraph 3, the opinion may include any recommendations aimed at addressing shortcomings of the measure envisaged by EBA or the competent authorities. 3. An opinion of the college shall be adopted based on a simple majority of its members. Where there are several members of the college per Member State, only one of those members shall have a vote. Where the ECB is a member of the college in several capacities, including supervisory capacities, it shall have only one vote. Supervisory authorities of third countries referred to in Article 119(2), point (m), shall have no voting right in respect of an opinion of the college. 4. EBA or the competent authorities, as applicable, shall duly consider the non-binding opinion of the college reached in accordance with paragraph 3, including any recommendations aimed at addressing shortcomings of the supervisory measure envisaged in respect of an issuer of a significant asset-referenced token, an issuer of a significant e-money token, an entity or a crypto-asset service provider as referred to in Article 119(2), points (d) to (h). Where EBA or a competent authority does not agree with an opinion of the college, including any recommendations aimed at addressing shortcomings of the supervisory measure envisaged, its decision shall contain its reasons and an explanation for any significant deviation from that opinion or recommendations.
Article 121 Legal privilege
The powers conferred on EBA by Articles 122 to 125, or on any official or other person authorised by EBA, shall not be used to require the disclosure of information which is subject to legal privilege.
Article 122 Request for information
1. In order to carry out its supervisory responsibilities under Article 117, EBA may by simple request or by decision require the following persons to provide all information necessary to enable EBA to carry out its duties under this Regulation: (a) an issuer of a significant asset-referenced token or a person controlling or being directly or indirectly controlled by an issuer of a significant asset-referenced token; (b) a third party as referred to in Article 34(5), first subparagraph, point (h), with which an issuer of a significant asset-referenced token has a contractual arrangement; (c) a crypto-asset service provider, credit institution or investment firm ensuring the custody of the reserve assets in accordance with Article 37; (d) an issuer of a significant e-money token or a person controlling or being directly or indirectly controlled by an issuer of a significant e-money token; (e) a payment service provider that provides payment services in relation to significant e-money tokens; (f) a natural or legal person in charge of distributing significant e-money tokens on behalf of an issuer of significant e-money tokens; (g) a crypto-asset service provider providing custody and administration of crypto-assets on behalf of clients in relation to significant asset-referenced tokens or significant e-money tokens; (h) an operator of a trading platform for crypto-assets that has admitted to trading a significant asset-referenced token or a significant e-money token; (i) the management body of the persons referred to in points (a) to (h). 2. A simple request for information as referred to in paragraph 1 shall: (a) refer to this Article as the legal basis of that request; (b) state the purpose of the request; (c) specify the information required; (d) include a time limit within which the information is to be provided; (e) inform the person from whom the information is requested that it is not obliged to provide the information but that, in the case of a voluntary reply to the request, the information provided is required to be correct and not misleading; and (f) indicate the fine provided for in Article 131, where the answers to questions asked are incorrect or misleading. 3. When requiring the provision of information by decision pursuant to paragraph 1, EBA shall: (a) refer to this Article as the legal basis of that request; (b) state the purpose of the request; (c) specify the information required; (d) set a time limit within which the information is to be provided; (e) indicate the periodic penalty payments provided for in Article 132 where the production of information is required; (f) indicate the fine provided for in Article 131, where the answers to questions asked are incorrect or misleading; (g) indicate the right to appeal the decision before EBA’s Board of Appeal and to have the decision reviewed by the Court of Justice in accordance with Articles 60 and 61 of Regulation (EU) No 1093/2010. 4. The persons referred to in paragraph 1 or their representatives and, in the case of legal persons or associations having no legal personality, the persons authorised to represent them by law, shall provide the information requested. 5. EBA shall without delay send a copy of the simple request or of its decision to the competent authority of the Member State where the persons concerned by the request for information are domiciled or established.
Article 123 General investigative powers
1. In order to carry out its supervisory responsibilities under Article 117, EBA may conduct investigations into issuers of significant asset-referenced tokens and issuers of significant e-money tokens. To that end, the officials and other persons authorised by EBA shall be empowered to: (a) examine any records, data, procedures and any other material relevant to the execution of its tasks irrespective of the medium on which they are stored; (b) take or obtain certified copies of or extracts from such records, data, procedures and other material; (c) summon and ask any issuer of a significant asset-referenced token or issuer of a significant of e-money token, or their management body or staff, for oral or written explanations of facts or documents relating to the subject matter and purpose of the investigation and to record the answers; (d) interview any other natural or legal person who consents to be interviewed for the purposes of collecting information relating to the subject matter of an investigation; (e) request records of telephone and data traffic. A college as referred to in Article 119(1) shall be informed without undue delay of any findings that might be relevant for the execution of its tasks. 2. The officials and other persons authorised by EBA for the purposes of the investigation referred to in paragraph 1 shall exercise their powers upon the production of a written authorisation specifying the subject matter and purpose of the investigation. That authorisation shall also indicate the periodic penalty payments provided for in Article 132 where the required records, data, procedures or any other material, or the answers to questions posed to issuers of significant asset-referenced tokens or issuers of significant e-money tokens, are not provided or are incomplete, and the fines provided for in Article 131, where the answers to questions posed to issuers of significant asset-referenced tokens or issuers of significant e-money tokens are incorrect or misleading. 3. The issuers of significant asset-referenced tokens and issuers of significant e-money tokens are required to submit to investigations launched based on a decision of EBA. The decision shall specify the subject matter and purpose of the investigation, the periodic penalty payments provided for in Article 132, the legal remedies available under Regulation (EU) No 1093/2010 and the right to have the decision reviewed by the Court of Justice. 4. Within a reasonable period before an investigation referred to in paragraph 1, EBA shall inform the competent authority of the Member State where the investigation is to be carried out of the investigation and of the identity of the authorised persons. Officials of the competent authority concerned shall, upon the request of EBA, assist those authorised persons in carrying out their duties. Officials of the competent authority concerned may also attend the investigations upon request. 5. If a request for records of telephone or data traffic referred to in paragraph 1, first subparagraph, point (e), requires authorisation from a court pursuant to applicable national law, EBA shall apply for such authorisation. Such authorisation may also be applied for as a precautionary measure. 6. Where a court in a Member State receives an application for the authorisation of a request for records of telephone or data traffic referred to in paragraph 1, first subparagraph, point (e), that court shall verify whether: (a) the decision of EBA referred to in paragraph 3 is authentic; (b) any measures to be taken are proportionate and not arbitrary or excessive. 7. For the purposes of paragraph 6, point (b), the court may ask EBA for detailed explanations, in particular relating to the grounds EBA has for suspecting that an infringement of this Regulation has taken place, the seriousness of the suspected infringement and the nature of the involvement of the person subject to the coercive measures. That court shall, however, not review the necessity for the investigation or demand that it be provided with the information on EBA’s file. The lawfulness of EBA’s decision shall be subject to review only by the Court of Justice following the procedure set out in Regulation (EU) No 1093/2010.
Article 124 On-site inspections
1. In order to carry out its supervisory responsibilities under Article 117, EBA may conduct all necessary on-site inspections at any business premises of the issuers of significant asset-referenced tokens and issuers of significant e-money tokens. The college referred to in Article 119 shall be informed without undue delay of any findings that might be relevant for the execution of its tasks. 2. The officials and other persons authorised by EBA to conduct an on-site inspection may enter any business premises of the persons subject to an investigation decision adopted by EBA and shall have all of the powers provided for in Article 123(1). They shall also have the power to seal any business premises and books or records for the period of, and to the extent necessary for, the inspection. 3. In due time before the inspection, EBA shall give notice of the inspection to the competent authority of the Member State where the inspection is to be conducted. Where the proper conduct and efficiency of the inspection so require, EBA, after informing that competent authority, may carry out the on-site inspection without giving prior notice to the issuer of the significant asset-referenced token or the issuer of the significant e-money token. 4. The officials and other persons authorised by EBA to conduct an on-site inspection shall exercise their powers upon production of a written authorisation specifying the subject matter and purpose of the inspection and the periodic penalty payments provided for in Article 132 where the persons concerned do not submit to the inspection. 5. The issuer of the significant asset-referenced token or the issuer of the significant e-money token shall submit to on-site inspections ordered by a decision of EBA. The decision shall specify the subject matter and purpose of the inspection, appoint the date on which it is to begin and indicate the periodic penalty payments provided for in Article 132, the legal remedies available under Regulation (EU) No 1093/2010 as well as the right to have the decision reviewed by the Court of Justice. 6. Officials of, as well as those authorised or appointed by, the competent authority of the Member State where the inspection is to be conducted shall, at the request of EBA, actively assist the officials and other persons authorised by EBA. Officials of the competent authority of the Member State concerned may also attend the on-site inspections. 7. EBA may also require competent authorities to carry out specific investigatory tasks and on-site inspections as provided for in this Article and in Article 123(1) on its behalf. 8. Where the officials and other accompanying persons authorised by EBA find that a person opposes an inspection ordered pursuant to this Article, the competent authority of the Member State concerned shall afford them the necessary assistance, requesting, where appropriate, the assistance of the police or of an equivalent enforcement authority, so as to enable them to conduct their on-site inspection. 9. If the on-site inspection provided for in paragraph 1 or the assistance provided for in paragraph 7 requires authorisation by a court pursuant to national law, EBA shall make an application for such authorisation. Such authorisation may also be applied for as a precautionary measure. 10. Where a court in a Member State receives an application for the authorisation of an on-site inspection provided for in paragraph 1 or the assistance provided for in paragraph 7, that court shall verify whether: (a) the decision adopted by EBA referred to in paragraph 4 is authentic; (b) any measures to be taken are proportionate and not arbitrary or excessive. 11. For the purposes of paragraph 10, point (b), the court may ask EBA for detailed explanations, in particular relating to the grounds EBA has for suspecting that an infringement of this Regulation has taken place, the seriousness of the suspected infringement and the nature of the involvement of the person subject to the coercive measures. That court shall, however, not review the necessity for the investigation or demand that it be provided with the information on EBA’s file. The lawfulness of EBA’s decision shall be subject to review only by the Court of Justice following the procedure set out in Regulation (EU) No 1093/2010.