Reporting obligations for CASPs
Crypto service providers have a reporting obligation in certain areas.
What reports do CASPs have to make?
CASPs with a license or notification from the AFM should take the following reporting obligations into account:
- Reporting of suspicious transactions and/or orders (STOR)
- Reporting obligation under the Sanctions Act 1997 and/or European regulations regarding sanctions
- Reporting obligation under TFR
- Reporting of ICT incidents (DORA)
- Obligation to report material changes
STORs
CASPs with reporting obligations under Article 92 of MiCAR are required to report suspicious transactions and/or orders at the AFM. CASPs must report STORs (suspicious transactions and/or orders reports) via the AFM portal. We have written an instruction manual for reporting a STOR.
Sanctions Act
CASPs with reporting responsibilities based on Article 3 of the Regulation on Supervision pursuant to the Sanctions Act 1977 (Regeling toezicht Sanctiewet 1977) and/or European regulations regarding sanctions must report a Sanction Hit via the Report Form Sanctions Act 1977 (Meldformulier Sanctiewet 1977). The report form should be sent to meldingsanctiewet@afm.nl via Cryptshare. More information about the Sanction Act 1977.
Transfer of Funds Regulation
CASPs with reporting responsibilities based on Article 17(2) and/or Article 21(2) Transfer of Funds Regulation (TFR) must report via the Report Form TFR (Meldformulier TFR). The report form should be sent to crypto@afm.nl via Cryptshare.
ICT-related incidents (DORA)
As part of DORA, CASPs must report serious ICT-related incidents, (new) agreements with ICT service providers, and cyber threats to the AFM. CASPs must submit notifications through the AFM Portal. The 'DORA' button in the portal provides access to the section (the 'DORA app') where you can submit DORA notifications, view the status and response from AFM, and possibly withdraw them. More information about DORA notifications and frequently asked questions DORA.
Obligation to report material changes
CASPs must immediately inform the AFM (in writing) of any material change in the circumstances under which the licence was granted. This concerns changes in the information provided with the application. This may include changes in the company's business operations, the cessation of certain crypto-asset services, changes in shareholders or the persons responsible for the company's management, and new antecedents.
Other examples are a change of name of the company, changes to the articles of association or legal form, outsourcing of activities or termination of outsourcing. This also includes the evidence that has been provided or is to be provided in the context of Article 62 paragraph 2, points g and h MiCAR. Changes to information provided during the granting of the licence must be reported via the e-mail address casp.notifications.micar@afm.nl