12.3 Arrangements with third-party entities for operating the reserve of assets, for the investment of the reserve assets, the custody of the reserve assets, or the distribution of the asset-referenced tokens to the public

The management body of an issuer of ARTs that has arrangements in place with third-party entities for operating the reserve of assets, for the investment of the reserve assets, the custody of the reserve assets, or, where applicable, for the distribution of the asset-referenced tokens to the public or plans on entering into such arrangements should approve, regularly review and update a policy on the requirements for operational reliance of these third-party entities and ensure their implementation at an individual and, as applicable, group wide basis.

This policy should include the main phases of the life cycle of these third-party arrangements and define the principles, responsibilities and processes in relation to the use of third-party. In particular, the policy should cover at least:

• a. the responsibilities of the management body including its involvement, as appropriate, in the decision-making;
• b. the involvement of business lines, internal control functions and other individuals in respect of those arrangements;
• c. the planning and structuring of third-party arrangements, including the definition of business requirements regarding the use of third-parties.
• d. risk identification, assessment and management in accordance with Section 11;
• e. due diligence checks on prospective third-parties;
• f. policies and procedures to identify, prevent, manage and disclose conflicts of interest, in line with Article 32 of Regulation (EU) 2023/1114;
• g. business continuity planning and exit strategies to ensure the issuer of ARTs ’ operational resilience in the event of a failure or disruption at a third-party entity impacting the provision of critical operations. The issuer of ARTs ’ business continuity and exit plans should assess the substitutability of the third-party entity that it uses for critical operations, and other viable alternatives that may facilitate operational resilience in the event of an outage at a third-party entity such as bringing the activity back in-house;
• h. the approval process of new arrangements;
• i. the implementation, monitoring and management of those arrangements, including the ongoing assessment of the third-party entit ies’ performance to ensure that the relationship remains within the issuer of ARTs ’ risk appetite and tolerance for disruption of critical operations and core business lines;
• j. the procedures for being notified and responding to changes to an arrangement by third-party entities;
• k. the independent review and audit of compliance with legal and regulatory requirements and policies;
• l. the renewal processes for arrangements with third-party entities;
• m. the documentation and record-keeping; and
• n. the exit strategies and termination processes, including a requirement for a documented exit plan for each arrangement with a third-party entity, where such an exit is considered possible, taking into account possible service interruptions or the unexpected termination of an agreement.

Issuers of ARTs should assess the potential impact of arrangements with third-party entities on their operational risk and operational resilience, in accordance with section 12, and should take into account the assessment results when deciding, if a function should be performed by a third-party entity and should take appropriate steps to avoid undue additional operational risks before entering into these arrangements.

Within the risk assessment, issuer of ARTs should also take into account the expected benefits and costs of the proposed arrangement, including weighing any risks that may be reduced or better managed against any risks that may arise as a result of the proposed arrangement, taking into account at least the measures implemented by the issuer of ARTs and by the service provider to manage and mitigate those risks.

When carrying out the risk assessment prior to the reliance on third-party entity and during ongoing monitoring of the third- party entity’s performance, issuer of ARTs should, at least:

• a. identify and classify the relevant functions and related data and systems as regards their sensitivity and criticality and required security measures;
• b. conduct a thorough risk-based analysis of the functions and related data and systems that are being considered for the arrangement and address the potential risks, in particular the operational risks, including subcontracting, legal, ICT, compliance and reputational risks, and the oversight limitations related to the countries where the services are or may be provide;
• c. consider the geographic dependencies and management of related risks. These risks may relate to the economic, financial, political, legal and regulatory environment in the jurisdiction(s) where the relevant service will be.

Before entering into an arrangement with a third-party and considering the risks, including operational risks and counterparty risk, issuers of ARTs should ensure in their selection and assessment process that the third-party entity is suitable.

Issuers of ARTs should ensure that the third-party entity has an adequate business reputation, appropriate and sufficient abilities, the expertise, the capacity, the resources (e.g. human, IT, financial), the organisational structure and, if applicable, the required regulatory authorisation(s) or registration(s) to perform the function in a reliable and professional manner to meet its obligations over the duration of the draft contract.

Additional factors to be considered when conducting due diligence on a potential third-party entity include, but are not limited to:

• a. its business model, nature, scale, complexity, financial situation, ownership and group structure;
• b. the long-term relationships with the third-party entity that have already been assessed and perform services for the issuer of ARTs;
• c. the level of substitutability of the service and service provider including the ability to exit the third-party arrangement and either transition to another service provider or bring the critical service back in-house or the potential impact of such substitution on the issuer of ARTs ’ critical operations;
• d. whether or not the third-party entity is supervised by competent authorities.

Issuers of ARTs should take appropriate steps to ensure that the third-party act in a manner consistent with their values and code of conduct.

Issuers of ARTs should ensure at all times that the third party they use to distribute ARTs to the public complies with the procedures ensuring the compliance with the obligations in relation to the prevention of money laundering and terrorist financing under Directive (EU) 2015/849 and, where applicable, Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets. The third-party entity should in its internal control systems ensure a continuous compliance with the obligations in relation to the prevention of money laundering and terrorist financing under Directive (EU) 2015/849 and, where applicable, Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets.