Insights from pre-scan procedures for potential CASP’s

Clear legal argumentation on regulatory scope of activities and considerations

Many potential CASPs offer services of a technically, legally, and operationally complex nature. The potential CASP is responsible for adequately describing these services in the license application, combined with a sound legal analysis detailing which MiCAR services, as listed in art. 3 par 1 (16) MiCAR, that it offers. It is highly recommended to provide flow charts and other visual representations that clarify the services, as this will enable the AFM to properly assess (the regulatory scope of) the services for which authorization is being sought.

Level of detail in policies and other documentation

As general guidance, we want to emphasize that a CASP’s activities, policies and procedures should be detailed and concrete. We need to be able to assess whether a CASP’s activities, policies and procedures are compliant with MiCAR’s requirements. We expect timely implementation of all policies and procedures at the time of the potential granting of the license.

DORA implementation needs further attention

As DORA enters into force on 17 January 2025, the AFM expects CASPs to create DORA-compliant policies and procedures and implement these within their organization in a timely manner. Given the overlap between MiCAR and DORA on certain requirements such as ICT-governance arrangements (incl. ICT-risk management, business continuity) and third-party risk management (incl. outsourcing), potential CASPs should include finalized policies and procedures in the CASP-license application in accordance with amongst others art. 68 par 7 and 8 MiCAR and the MiCAR RTS on authorization of crypto-asset providers (art. 9). If certain other DORA related areas are not yet fully implemented within the organization, please elaborate on this in your application, and provide a clear DORA roadmap. We expect timely implementation of all policies and procedures at the time of the potential granting of the license.

Conflicts of interest must be adequately identified, prevented and managed

The AFM expects CASPs to take adequate measures to identify, prevent, mitigate and manage conflicts of interest. Such risks may arise, for example, with dual roles at the board level, including roles within a special purpose vehicle (for example, Stichting Derdengelden) and the operating company, as well as with other related activities and services provided by other entities within the group.

Broad scope of market abuse detection & reporting requirements

The AFM requests potential CASPs to take notice of the requirements in accordance with art. 92 MiCAR. Persons professionally arranging or executing transactions (PPAETs) in crypto-assets should have in place effective arrangements, systems and procedures to prevent and detect market abuse. In the license application, AFM will check if these policies and procedures are present and assess the content. ESMA proposes that the following persons should be considered as PPAETs for the purpose of art. 92 MiCAR;

• CASPs operating a trading platform
• CASPs providing services related to crypto-assets such as:

1. reception and transmission of orders for crypto-assets on behalf of clients
2. execution of orders for crypto-assets on behalf of clients
3. providing portfolio management on crypto-assets
4. exchange of crypto-assets for funds
5. exchange of crypto-assets for other crypto assets

• Persons dealing on own account in crypto-assets on a professional basis or as part of their business activity.