+Guidelines on internal governance arrangements for issuers of ARTs under MiCAR (EBA/GL/2024/06)
---+Compliance and reporting obligations
------+Status of these guidelines
---------+1. This document contains guidelines issued pursuant to Article 16 of Regulation (EU) No 1093/2010 …
---------+2. Guidelines set the EBA view of appropriate supervisory practices within the European System of …
------+Reporting requirements
---------+3. According to Article 16(3) of Regulation (EU) No 1093/2010, competent authorities must notify …
---------+4. Notifications will be published on the EBA website, in line with Article 16(3).
---+Subject matter, scope, and definitions
------+Subject matter
---------+5. These guidelines specify in accordance with Article 34(13) of Regulation (EU) 2023/1114 the …
------+Scope of application
---------+6. These Guidelines apply at authorisation and on an ongoing basis to competent authorities, as …
---------+7. The guidelines apply to all issuers of ARTs, independently of their existing board structures.
---------+8. Any reference to management body also includes issuers of ARTs that are legal persons managed by …
---------+9. Issuers of ARTs should comply and competent authorities should ensure that issuers of ARTs …
------+Addressees
---------+10. These Guidelines are addressed to competent authorities as defined in Article 3(1), point …
---------+11. These Guidelines are also addressed to issuers of ARTs as defined in Article 3(1), point 10 of …
------+Definitions
---------+12. Unless otherwise specified, terms used and defined under Regulation (EU) 2023/1114, Directive …
---+Implementation
------+Date of application
---------+13. These Guidelines apply from 20.12.2024.
---+4. Guidelines
------+Title I - Application of the proportionality principle
---------+14. Issuers of ARTs and competent authorities should have regard to the principle of …
---------+15. For the purpose of applying the principle of proportionality and to ensure the appropriate …
---------+16. Issuers of ARTs that are managed by a single natural person should have alternative …
------+Title II – Role and composition of the management body
------+1. Role and responsibilities of the management body
---------+17. In accordance with Article 34 of Regulation (EU) 2023/1114, the management body of an issuer of …
---------+18. The duties of the management body should be clearly defined, distinguishing, where applicable …
---------+19. Where applicable, the management body in its supervisory function and its management function …
---------+20. The management body’s responsibilities should include at least setting, approving, and …
---------+21. When setting up, approving and overseeing the implementation of the aspects listed in paragraph …
---------+22. The management body should oversee the process of disclosure, in particular as mandated by …
---------+23. All members of the management body should be informed about the overall activity, financial and …
---------+24. A member of the management body may be responsible for an internal control function as referred …
---------+25. The management body should monitor, periodically review and address any weaknesses identified …
---------+26. Where the issuers of ARTs are legal persons managed by a single natural person in accordance …
------+2. Management function of the management body
---------+27. The management body in its management function should actively engage in the business of the …
---------+28. The management body in its management function, should be responsible for the implementation of …
---------+29. Members of the management body in its management function should constructively challenge and …
---------+30. Where applicable, the management body in its management function, should regularly, timely and …
------+3. Supervisory function of the management body
---------+31. Without prejudice to the responsibilities assigned under the applicable national company law …
------+Title III – Governance framework
------+4. Organisational framework and structure
---------+32. The management body of an issuer of ARTs should ensure a suitable and transparent …
---------+33. The management body should ensure that the internal control functions have the appropriate …
---------+34. The structure of the issuer of ARTs should not impede the ability of the management body to …
---------+35. The management body should assess whether and how material changes to the group’s structure …
---------+36. The management body should fully know and understand the legal, organisational and operational …
---------+37. The management body should ensure that the structure of an issuer of ARTs and, where …
---------+38. The management body should guide the issuer of ARTs ’ structure, its evolution and its …
---------+39. When setting up such structures, the management body should understand them and their purpose …
---------+40. Issuer of ARTs should take into account in their decision-making the results of a risk …
---------+41. In any case issuers of ARTs should not set up opaque structures or unnecessary complex …
---------+42. Issuers of ART should document their decisions and be able to justify their decisions to …
---------+43. These structures and activities, including their compliance with legislation and professional …
------+5. Organisational framework in a group context
---------+44. Where applicable, issuers of ARTs should ensure that governance arrangements, processes and …
---------+45. While policies and documentation may be included in separate documents, issuers of ARTs should …
------+6. Outsourcing
---------+46. The management body should approve and regularly review and update the outsourcing policy of an …
---------+47. The outsourcing policy should consider the impact of the use of the outsourcing on an issuer of …
---------+48. The policy should include the reporting and monitoring arrangements to be implemented from …
---------+49. The outsourcing of functions cannot result in the delegation of the management body’s …
---------+50. The policy should state that outsourcing arrangements, should not hinder effective on-site or …
---------+51. Issuers of ARTs should maintain at all times sufficient substance and not become ‘empty shells’ …
------+Title IV – Risk culture and business conduct
------+7. Risk culture
---------+52. A sound, diligent and consistent risk culture should be a key element of issuers of ARTs …
---------+53. Issuers of ARTs should develop an integrated and enterprise wide risk culture, based on a full …
---------+54. Issuers of ARTs should develop a risk culture through policies, communication and staff …
---------+55. Staff should be fully aware of their responsibilities relating to risk management. Risk …
---------+56. A strong risk culture should include but is not necessarily limited to: a. Tone from the top …
------+8. Corporate values and code of conduct
---------+57. The management body should develop, adopt, adhere to and promote high ethical and professional …
---------+58. Issuers of ARTs should ensure that there is no discrimination towards staff based on gender …
---------+59. The policies of issuers of significant ARTs should be gender-neutral . This includes, but is …
---------+60. The standards implemented should aim to enhance the issuer of ARTs’ robust governance …
---------+61. The management body should have clear and documented policies for how these standards should be …
---------+62. Issuers of ARTs should monitor compliance with such standards and ensure staff awareness, e.g. …
------+Title V – Internal control framework and mechanisms
------+9. Internal control framework
---------+63. Issuers of ARTs should develop and maintain a culture that encourages a positive attitude …
---------+64. The internal control framework of the issuers of ARTs concerned should be adapted on an …
---------+65. The internal control framework should cover the whole organisation, including the management …
---------+66. The internal control framework of an issuer of ARTs should ensure: a. effective and efficient …
------+10. Implementing an internal control framework
---------+67. The management body should be responsible for establishing and monitoring the adequacy and …
---------+68. An issuer of ARTs should have a clear, transparent and documented decision-making process and a …
---------+69. Issuers of ARTs should communicate these policies, mechanisms and procedures to all staff and …
---------+70. The internal control functions should verify that the policies, mechanisms and procedures set …
---------+71. Internal control functions should regularly submit to the management body written reports on …
------+11. Risk management framework
---------+72. As part of the overall internal control framework, issuers of ARTs should have a holistic …
---------+73. The risk management framework should enable the issuer of ARTs to make fully informed decisions …
---------+74. An issuer of ARTs risk management framework should include policies, procedures, risk limits …
---------+75. An issuer of ARTs risk management framework should provide specific guidance on the …
---------+76. The risk management framework should be subject to independent internal review, e.g., performed …
---------+77. Regular and transparent reporting mechanisms should be established so that the management body …
---------+78. Effective communication and awareness regarding risks and the risk strategy is crucial for the …
------+12. Operational risk management and operational resilience
---------+79. An issuer of ARTs should have an adequate operational risk management framework and operational …
---------+80. An issuer of ARTs management body should, as part of the risk management framework, approve …
---------+81. The management body ensures that these policies and processes are implemented effectively …
---------+82. An issuer of ARTs should clearly assign the responsibilities for the assessment and management …
---------+83. An issuer of ARTs should identify its exposures to operational risk, track relevant operational …
---------+84. Issuer of ARTs should identify its critical operations, consistently with its operational …
---------+85. The operational risk and operational resilience management framework should be subject to …
---------+86. A system of reporting to management body that provides for adequate operational risk and …
---------+87. The issuer of ARTs should identify and assess the operational risk inherent to the issuer of …
---------+88. Considering Title I on the application of the principle of proportionality, issuer of ARTs …
---------+89. Considering Title I, issuers of ARTs may use qualitative risk assessment approaches, while …
------+12.1 New product, system and process approval
---------+90. The issuer of ARTs should have policies and procedures for the assessment and approval of new …
---------+91. The approval process should consider all the risks, including legal and ICT risks, in the …
---------+92. The approval process should also consider effects on the delivery of critical or important …
---------+93. The issuer of ARTs should ensure the assessment of the evolution of risks associated with new …
---------+94. The issuers of ART should have a strong internal control system in accordance with Title V also …
------+12.2 ICT risk management
---------+95. Issuers of ARTs should establish an ICT risk management framework in line with the requirements …
------+12.3 Arrangements with third-party entities for operating the reserve of assets, for the investment of the reserve assets, the custody of the reserve assets, or the distribution of the asset-referenced tokens to the public
---------+96. The management body of an issuer of ARTs that has arrangements in place with third-party …
---------+97. This policy should include the main phases of the life cycle of these third-party arrangements …
---------+98. Issuers of ARTs should assess the potential impact of arrangements with third-party entities on …
---------+99. Within the risk assessment, issuer of ARTs should also take into account the expected benefits …
---------+100. When carrying out the risk assessment prior to the reliance on third-party entity and during …
---------+101. Before entering into an arrangement with a third-party and considering the risks, including …
---------+102. Issuers of ARTs should ensure that the third-party entity has an adequate business reputation …
---------+103. Additional factors to be considered when conducting due diligence on a potential third-party …
---------+104. Issuers of ARTs should take appropriate steps to ensure that the third-party act in a manner …
---------+105. Issuers of ARTs should ensure at all times that the third party they use to distribute ARTs to …
------+13. Internal control functions
---------+106. The internal control functions should include an effective and permanent internal compliance …
---------+107. Issuers of significant ARTs are encouraged to establish internal risk management and internal …
------+13.1 Heads of the internal control functions
---------+108. Heads of internal control functions should be established at an adequate hierarchical level …
---------+109. Where necessary, the heads of internal control functions should be able to have access and …
---------+110. Issuers of ARTs should have documented processes in place to assign the position of the head …
------+13.2 Independence of internal control functions
---------+111. In order for the internal control functions to be regarded as operating independently, the …
------+13.3 Resources of internal control functions
---------+112. Internal control functions should have sufficient resources. Taking into account the …
---------+113. Internal control functions should have appropriate ICT systems and support at their disposal …
------+14. Risk management function
---------+114. Where established, the risk management function (RMF) should cover the whole issuer of ARTs. …
---------+115. The RMF should have, where necessary, direct access to the management body in its supervisory …
---------+116. The RMF should have access to all business lines and other internal units that have the …
---------+117. Staff within the RMF should possess sufficient knowledge, skills and experience in relation to …
---------+118. Where established, the RMF should be a central organisational feature of the issuer of ARTs …
---------+119. The RMF should provide relevant independent information, analyses and expert judgement on risk …
------+14.1 RMF’s role in risk strategy and decisions
---------+120. The RMF’s involvement in decision -making processes should ensure that risk considerations are …
------+14.2 RMF’s role in material changes
---------+121. Before decisions on material changes to products, processes or systems or on exceptional …
---------+122. The RMF should evaluate how the risks identified could affect the issuer of ART’s ability to …
------+14.3 RMF’s role in identifying, measuring, assessing, managing, mitigating, monitoring and reporting on risks
---------+123. The RMF should ensure an appropriate implementation of the risk management framework and that …
---------+124. The RMF should ensure that identification and assessment are not based only on quantitative …
---------+125. The RMF should ensure that transactions with related parties are reviewed and that the risks …
---------+126. The RMF should ensure that all identified risks are effectively monitored by the business or …
---------+127. The RMF should regularly monitor the actual risk profile of the issuer of ARTs and scrutinise …
---------+128. The RMF should analyse trends and recognise new or emerging risks and increases in risk …
---------+129. The RMF should evaluate possible ways to mitigate identified risks. Risk reporting to the …
------+14.4 RMF’s role in risk appetite and limits
---------+130. The RMF should independently assess breaches of risk appetite or limits. The RMF should inform …
---------+131. The RMF should play a key role in ensuring that a decision on its recommendation is made at …
------+14.5 Head of the risk management function
---------+132. Where established, the head of the RMF should be responsible for providing comprehensive and …
---------+133. The head of the RMF should have sufficient expertise, independence and seniority to challenge …
---------+134. The head of the RMF should be able to challenge decisions taken by the issuer’s management and …
---------+135. Issuers of ARTs should establish strengthened processes for the approval of decisions on which …
------+15. Compliance function
---------+136. Issuers of ARTs should establish a permanent and effective compliance function to manage …
---------+137. The role of compliance officer, taking into account the principle of proportionality as set …
---------+138. Staff within the compliance function should possess sufficient knowledge, skills and …
---------+139. The management body in its supervisory function should oversee the implementation of a …
---------+140. The compliance function should advise the management body on measures to be taken to ensure …
---------+141. The compliance function should ensure that compliance monitoring is carried out through a …
---------+142. Issuer of ARTs should take appropriate action against internal or external behaviour that …
------+16. Internal audit function
---------+143. Where established, the internal audit function (IAF) should be independent and have sufficient …
---------+144. The IAF should be independent of the audited activities. Therefore, the IAF should not be …
---------+145. The IAF should, following a risk-based approach, independently review and provide objective …
---------+146. The IAF should not be involved in designing, selecting, establishing or implementing specific …
---------+147. The IAF should assess whether the issuer of ARTs ’ internal control framework as set out in …
---------+148. The IAF should verify, in particular, the integrity of the processes ensuring the reliability …
---------+149. The IAF should review the adequateness of the processes for the development of white papers …
---------+150. The IAF should have unfettered issuer-wide access to all the records, documents, information …
---------+151. The IAF should adhere to national and international professional standards. An example of the …
---------+152. Internal audit work should be performed regularly in accordance with an audit plan and a …
---------+153. An internal audit plan should be drawn up at least once a year on the basis of the annual …
---------+154. All audit recommendations should be subject to a formal follow-up procedure by the appropriate …
------+Title VI – Business continuity management
---------+155. Without prejudice to the applicable requirements under DORA, issuers of ARTs should establish …
---------+156. An issuer of ARTs relies on several critical resources (e.g. IT systems, including cloud …
---------+157. In order to establish a sound business continuity management plan, an issuer of ARTs should …
---------+158. On the basis of the abovementioned analysis, an issuer of ARTs should put in place: a. …
---------+159. Contingency, business continuity and recovery plans should be documented and carefully …
------+Title VII – Transparency
---------+160. Strategies, policies and procedures should be communicated to all relevant staff throughout …
---------+161. Accordingly, the management body should inform and update the relevant staff about the issuer …
 English - European Union - Financial Industry -

Guidelines on internal governance arrangements for issuers of ARTs under MiCAR (EBA/GL/2024/06)

Guidelines on internal governance arrangements for issuers of ARTs under MiCAR (EBA/GL/2024/06)

https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/asset-referenced-and-e-money-tokens-micar/guidelines-internal-governance-arrangements-issuers-arts-under-micar – PDF

1. Overview

,
Compliance and reporting obligations

Compliance and reporting obligations
Subject matter, scope, and definitions

Subject matter, scope, and definitions
Implementation

Implementation
4. Guidelines

4. Guidelines

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

Requirements

3. Related Standards

Standards
  • EBA - Published by the European Banking Authority at https://www.eba.europa.eu/