+4. Guidelines
---+Title I - Application of the proportionality principle
------+14. Issuers of ARTs and competent authorities should have regard to the principle of …
------+15. For the purpose of applying the principle of proportionality and to ensure the appropriate …
------+16. Issuers of ARTs that are managed by a single natural person should have alternative …
---+Title II – Role and composition of the management body
---+1. Role and responsibilities of the management body
------+17. In accordance with Article 34 of Regulation (EU) 2023/1114, the management body of an issuer of …
------+18. The duties of the management body should be clearly defined, distinguishing, where applicable …
------+19. Where applicable, the management body in its supervisory function and its management function …
------+20. The management body’s responsibilities should include at least setting, approving, and …
------+21. When setting up, approving and overseeing the implementation of the aspects listed in paragraph …
------+22. The management body should oversee the process of disclosure, in particular as mandated by …
------+23. All members of the management body should be informed about the overall activity, financial and …
------+24. A member of the management body may be responsible for an internal control function as referred …
------+25. The management body should monitor, periodically review and address any weaknesses identified …
------+26. Where the issuers of ARTs are legal persons managed by a single natural person in accordance …
---+2. Management function of the management body
------+27. The management body in its management function should actively engage in the business of the …
------+28. The management body in its management function, should be responsible for the implementation of …
------+29. Members of the management body in its management function should constructively challenge and …
------+30. Where applicable, the management body in its management function, should regularly, timely and …
---+3. Supervisory function of the management body
------+31. Without prejudice to the responsibilities assigned under the applicable national company law …
---+Title III – Governance framework
---+4. Organisational framework and structure
------+32. The management body of an issuer of ARTs should ensure a suitable and transparent …
------+33. The management body should ensure that the internal control functions have the appropriate …
------+34. The structure of the issuer of ARTs should not impede the ability of the management body to …
------+35. The management body should assess whether and how material changes to the group’s structure …
------+36. The management body should fully know and understand the legal, organisational and operational …
------+37. The management body should ensure that the structure of an issuer of ARTs and, where …
------+38. The management body should guide the issuer of ARTs ’ structure, its evolution and its …
------+39. When setting up such structures, the management body should understand them and their purpose …
------+40. Issuer of ARTs should take into account in their decision-making the results of a risk …
------+41. In any case issuers of ARTs should not set up opaque structures or unnecessary complex …
------+42. Issuers of ART should document their decisions and be able to justify their decisions to …
------+43. These structures and activities, including their compliance with legislation and professional …
---+5. Organisational framework in a group context
------+44. Where applicable, issuers of ARTs should ensure that governance arrangements, processes and …
------+45. While policies and documentation may be included in separate documents, issuers of ARTs should …
---+6. Outsourcing
------+46. The management body should approve and regularly review and update the outsourcing policy of an …
------+47. The outsourcing policy should consider the impact of the use of the outsourcing on an issuer of …
------+48. The policy should include the reporting and monitoring arrangements to be implemented from …
------+49. The outsourcing of functions cannot result in the delegation of the management body’s …
------+50. The policy should state that outsourcing arrangements, should not hinder effective on-site or …
------+51. Issuers of ARTs should maintain at all times sufficient substance and not become ‘empty shells’ …
---+Title IV – Risk culture and business conduct
---+7. Risk culture
------+52. A sound, diligent and consistent risk culture should be a key element of issuers of ARTs …
------+53. Issuers of ARTs should develop an integrated and enterprise wide risk culture, based on a full …
------+54. Issuers of ARTs should develop a risk culture through policies, communication and staff …
------+55. Staff should be fully aware of their responsibilities relating to risk management. Risk …
------+56. A strong risk culture should include but is not necessarily limited to: a. Tone from the top …
---+8. Corporate values and code of conduct
------+57. The management body should develop, adopt, adhere to and promote high ethical and professional …
------+58. Issuers of ARTs should ensure that there is no discrimination towards staff based on gender …
------+59. The policies of issuers of significant ARTs should be gender-neutral . This includes, but is …
------+60. The standards implemented should aim to enhance the issuer of ARTs’ robust governance …
------+61. The management body should have clear and documented policies for how these standards should be …
------+62. Issuers of ARTs should monitor compliance with such standards and ensure staff awareness, e.g. …
---+Title V – Internal control framework and mechanisms
---+9. Internal control framework
------+63. Issuers of ARTs should develop and maintain a culture that encourages a positive attitude …
------+64. The internal control framework of the issuers of ARTs concerned should be adapted on an …
------+65. The internal control framework should cover the whole organisation, including the management …
------+66. The internal control framework of an issuer of ARTs should ensure: a. effective and efficient …
---+10. Implementing an internal control framework
------+67. The management body should be responsible for establishing and monitoring the adequacy and …
------+68. An issuer of ARTs should have a clear, transparent and documented decision-making process and a …
------+69. Issuers of ARTs should communicate these policies, mechanisms and procedures to all staff and …
------+70. The internal control functions should verify that the policies, mechanisms and procedures set …
------+71. Internal control functions should regularly submit to the management body written reports on …
---+11. Risk management framework
------+72. As part of the overall internal control framework, issuers of ARTs should have a holistic …
------+73. The risk management framework should enable the issuer of ARTs to make fully informed decisions …
------+74. An issuer of ARTs risk management framework should include policies, procedures, risk limits …
------+75. An issuer of ARTs risk management framework should provide specific guidance on the …
------+76. The risk management framework should be subject to independent internal review, e.g., performed …
------+77. Regular and transparent reporting mechanisms should be established so that the management body …
------+78. Effective communication and awareness regarding risks and the risk strategy is crucial for the …
---+12. Operational risk management and operational resilience
------+79. An issuer of ARTs should have an adequate operational risk management framework and operational …
------+80. An issuer of ARTs management body should, as part of the risk management framework, approve …
------+81. The management body ensures that these policies and processes are implemented effectively …
------+82. An issuer of ARTs should clearly assign the responsibilities for the assessment and management …
------+83. An issuer of ARTs should identify its exposures to operational risk, track relevant operational …
------+84. Issuer of ARTs should identify its critical operations, consistently with its operational …
------+85. The operational risk and operational resilience management framework should be subject to …
------+86. A system of reporting to management body that provides for adequate operational risk and …
------+87. The issuer of ARTs should identify and assess the operational risk inherent to the issuer of …
------+88. Considering Title I on the application of the principle of proportionality, issuer of ARTs …
------+89. Considering Title I, issuers of ARTs may use qualitative risk assessment approaches, while …
---+12.1 New product, system and process approval
------+90. The issuer of ARTs should have policies and procedures for the assessment and approval of new …
------+91. The approval process should consider all the risks, including legal and ICT risks, in the …
------+92. The approval process should also consider effects on the delivery of critical or important …
------+93. The issuer of ARTs should ensure the assessment of the evolution of risks associated with new …
------+94. The issuers of ART should have a strong internal control system in accordance with Title V also …
---+12.2 ICT risk management
------+95. Issuers of ARTs should establish an ICT risk management framework in line with the requirements …
---+12.3 Arrangements with third-party entities for operating the reserve of assets, for the investment of the reserve assets, the custody of the reserve assets, or the distribution of the asset-referenced tokens to the public
------+96. The management body of an issuer of ARTs that has arrangements in place with third-party …
------+97. This policy should include the main phases of the life cycle of these third-party arrangements …
------+98. Issuers of ARTs should assess the potential impact of arrangements with third-party entities on …
------+99. Within the risk assessment, issuer of ARTs should also take into account the expected benefits …
------+100. When carrying out the risk assessment prior to the reliance on third-party entity and during …
------+101. Before entering into an arrangement with a third-party and considering the risks, including …
------+102. Issuers of ARTs should ensure that the third-party entity has an adequate business reputation …
------+103. Additional factors to be considered when conducting due diligence on a potential third-party …
------+104. Issuers of ARTs should take appropriate steps to ensure that the third-party act in a manner …
------+105. Issuers of ARTs should ensure at all times that the third party they use to distribute ARTs to …
---+13. Internal control functions
------+106. The internal control functions should include an effective and permanent internal compliance …
------+107. Issuers of significant ARTs are encouraged to establish internal risk management and internal …
---+13.1 Heads of the internal control functions
------+108. Heads of internal control functions should be established at an adequate hierarchical level …
------+109. Where necessary, the heads of internal control functions should be able to have access and …
------+110. Issuers of ARTs should have documented processes in place to assign the position of the head …
---+13.2 Independence of internal control functions
------+111. In order for the internal control functions to be regarded as operating independently, the …
---+13.3 Resources of internal control functions
------+112. Internal control functions should have sufficient resources. Taking into account the …
------+113. Internal control functions should have appropriate ICT systems and support at their disposal …
---+14. Risk management function
------+114. Where established, the risk management function (RMF) should cover the whole issuer of ARTs. …
------+115. The RMF should have, where necessary, direct access to the management body in its supervisory …
------+116. The RMF should have access to all business lines and other internal units that have the …
------+117. Staff within the RMF should possess sufficient knowledge, skills and experience in relation to …
------+118. Where established, the RMF should be a central organisational feature of the issuer of ARTs …
------+119. The RMF should provide relevant independent information, analyses and expert judgement on risk …
---+14.1 RMF’s role in risk strategy and decisions
------+120. The RMF’s involvement in decision -making processes should ensure that risk considerations are …
---+14.2 RMF’s role in material changes
------+121. Before decisions on material changes to products, processes or systems or on exceptional …
------+122. The RMF should evaluate how the risks identified could affect the issuer of ART’s ability to …
---+14.3 RMF’s role in identifying, measuring, assessing, managing, mitigating, monitoring and reporting on risks
------+123. The RMF should ensure an appropriate implementation of the risk management framework and that …
------+124. The RMF should ensure that identification and assessment are not based only on quantitative …
------+125. The RMF should ensure that transactions with related parties are reviewed and that the risks …
------+126. The RMF should ensure that all identified risks are effectively monitored by the business or …
------+127. The RMF should regularly monitor the actual risk profile of the issuer of ARTs and scrutinise …
------+128. The RMF should analyse trends and recognise new or emerging risks and increases in risk …
------+129. The RMF should evaluate possible ways to mitigate identified risks. Risk reporting to the …
---+14.4 RMF’s role in risk appetite and limits
------+130. The RMF should independently assess breaches of risk appetite or limits. The RMF should inform …
------+131. The RMF should play a key role in ensuring that a decision on its recommendation is made at …
---+14.5 Head of the risk management function
------+132. Where established, the head of the RMF should be responsible for providing comprehensive and …
------+133. The head of the RMF should have sufficient expertise, independence and seniority to challenge …
------+134. The head of the RMF should be able to challenge decisions taken by the issuer’s management and …
------+135. Issuers of ARTs should establish strengthened processes for the approval of decisions on which …
---+15. Compliance function
------+136. Issuers of ARTs should establish a permanent and effective compliance function to manage …
------+137. The role of compliance officer, taking into account the principle of proportionality as set …
------+138. Staff within the compliance function should possess sufficient knowledge, skills and …
------+139. The management body in its supervisory function should oversee the implementation of a …
------+140. The compliance function should advise the management body on measures to be taken to ensure …
------+141. The compliance function should ensure that compliance monitoring is carried out through a …
------+142. Issuer of ARTs should take appropriate action against internal or external behaviour that …
---+16. Internal audit function
------+143. Where established, the internal audit function (IAF) should be independent and have sufficient …
------+144. The IAF should be independent of the audited activities. Therefore, the IAF should not be …
------+145. The IAF should, following a risk-based approach, independently review and provide objective …
------+146. The IAF should not be involved in designing, selecting, establishing or implementing specific …
------+147. The IAF should assess whether the issuer of ARTs ’ internal control framework as set out in …
------+148. The IAF should verify, in particular, the integrity of the processes ensuring the reliability …
------+149. The IAF should review the adequateness of the processes for the development of white papers …
------+150. The IAF should have unfettered issuer-wide access to all the records, documents, information …
------+151. The IAF should adhere to national and international professional standards. An example of the …
------+152. Internal audit work should be performed regularly in accordance with an audit plan and a …
------+153. An internal audit plan should be drawn up at least once a year on the basis of the annual …
------+154. All audit recommendations should be subject to a formal follow-up procedure by the appropriate …
---+Title VI – Business continuity management
------+155. Without prejudice to the applicable requirements under DORA, issuers of ARTs should establish …
------+156. An issuer of ARTs relies on several critical resources (e.g. IT systems, including cloud …
------+157. In order to establish a sound business continuity management plan, an issuer of ARTs should …
------+158. On the basis of the abovementioned analysis, an issuer of ARTs should put in place: a. …
------+159. Contingency, business continuity and recovery plans should be documented and carefully …
---+Title VII – Transparency
------+160. Strategies, policies and procedures should be communicated to all relevant staff throughout …
------+161. Accordingly, the management body should inform and update the relevant staff about the issuer …
|
4. Guidelines
4. Guidelines
1. Overview
| Summary |
Regulation |
|
Title I - Application of the proportionality principle
|
Title I - Application of the proportionality principle
|
|
Title II – Role and composition of the management body
|
Title II – Role and composition of the management body
|
|
1. Role and responsibilities of the management body
|
1. Role and responsibilities of the management body
|
|
2. Management function of the management body
|
2. Management function of the management body
|
|
3. Supervisory function of the management body
|
3. Supervisory function of the management body
|
|
Title III – Governance framework
|
Title III – Governance framework
|
|
4. Organisational framework and structure
|
4.1 Organisational framework
|
|
5. Organisational framework in a group context
|
5. Organisational framework in a group context
|
|
6. Outsourcing
|
6. Outsourcing
|
|
Title IV – Risk culture and business conduct
|
Title IV – Risk culture and business conduct
|
|
7. Risk culture
|
7. Risk culture
|
|
8. Corporate values and code of conduct
|
8. Corporate values and code of conduct
|
|
Title V – Internal control framework and mechanisms
|
Title V – Internal control framework and mechanisms
|
|
9. Internal control framework
|
9. Internal control framework
|
|
10. Implementing an internal control framework
|
10. Implementing an internal control framework
|
|
11. Risk management framework
|
11. Risk management framework
|
|
12. Operational risk management and operational resilience
|
12. Operational risk management and operational resilience
|
|
12.1 New product, system and process approval
|
12.1 New product, system and process approval
|
|
12.2 ICT risk management
|
12.2 ICT risk management
|
|
12.3 Arrangements with third-party entities for operating the reserve of assets, for the investment of the reserve assets, the custody of the reserve assets, or the distribution of the asset-referenced tokens to the public
|
12.3 Arrangements with third-party entities for operating the reserve of assets, for the investment of the reserve assets, the custody of the reserve assets, or the distribution of the asset-referenced tokens to the public
|
|
13. Internal control functions
|
13. Internal control functions
|
|
13.1 Heads of the internal control functions
|
13.1 Heads of the internal control functions
|
|
13.2 Independence of internal control functions
|
13.2 Independence of internal control functions
|
|
13.3 Resources of internal control functions
|
13.3 Resources of internal control functions
|
|
14. Risk management function
|
14. Risk management function
|
|
14.1 RMF’s role in risk strategy and decisions
|
14.1 RMF’s role in risk strategy and decisions
|
|
14.2 RMF’s role in material changes
|
14.2 RMF’s role in material changes
|
|
14.3 RMF’s role in identifying, measuring, assessing, managing, mitigating, monitoring and reporting on risks
|
14.3 RMF’s role in identifying, measuring, assessing, managing, mitigating, monitoring and reporting on risks
|
|
14.4 RMF’s role in risk appetite and limits
|
14.4 RMF’s role in risk appetite and limits
|
|
14.5 Head of the risk management function
|
14.5 Head of the risk management function
|
|
15. Compliance function
|
15. Compliance function
|
|
16. Internal audit function
|
16. Internal audit function
|
|
Title VI – Business continuity management
|
Title VI – Business continuity management
|
|
Title VII – Transparency
|
Title VII – Transparency
|
,
1.1 References
1.2 Identified Requirements
1.3 Related Standards
2. Identified Requirements
Requirements
| Source |
Requirement |
3. Related Standards
Standards
| Source |
Requirement |
- EBA - Published by the European Banking Authority at https://www.eba.europa.eu/
|