4.4 Information on governance

Issuers should include in their recovery plan a clear and detailed description of the governance processes related to the development, maintenance and implementation of the recovery plan.

The information on governance referred to in the previous paragraph should cover at least the following:

• a) the role(s) and function(s) of the person(s) responsible for preparing, implementing and updating the plan;
• b) the description of how the recovery plan fits with the issuer’s internal governance, business strategy and risk management framework (including the risk appetite statement);
• c) the description of the processes and timeframes to be used for the periodical update of the plan and for updating it to respond to any material changes affecting the specific token, the issuer or its environment;
• d) the policies and procedures governing the approval of the recovery plan and its reviews and updates;
• e) the description of the escalation procedures, meaning the conditions and procedures necessary to ensure the timely implementation of particular recovery options foreseen in the recovery plan. These should include at least clear information on the decision-making process with regard to the activation of the recovery plan based on a clearly detailed escalation process that applies when a breach of a recovery plan indicator threshold is detected or is likely to materialise in the near future, to consider and determine which recovery option may need to be applied to restore the compliance with the relevant regulatory requirements applicable to the reserve of asset or to continue rendering services related to the relevant token;
• f) the time limit for the decision on taking recovery actions and the point in time, as well as the modalities, for informing the competent authority;
• g) the description of quantitative and qualitative indicators reflecting possible vulnerabilities, weaknesses or threats to the amount, liquidity and allocation of the reserve of assets and the funds that issuers have to maintain at any time pursuant to Regulation (EU) 2023/1114, as further specified in paragraphs 22-41.

Where the issuers have entered into an arrangement with third party entities for operating the reserve of assets, and for the investment of the reserve of assets, for the custody of the reserve of assets, and, where applicable, for the distribution of the tokens to the public pursuant to point (5)(h) of Article 34 of Regulation (EU) 2023/1114, they should include in their recovery plan a clear and detailed description of the processes established to exchange information in a way that would ensure the timely activation of the escalation process laid down in paragraph 37 in case a breach of a recovery plan indicator threshold is detected, either by the issuer or by the relevant third party entity. The issuer should also specify in the recovery plan how the agreement with any of those third parties ensures the information is timely shared in a way that would allow the issuer to be aware of the breach or to acknowledge that the breach is likely to occur in the near future so that the plan can be activated in a timely manner.

In addition, issuers should ensure that actions foreseen in their recovery plan are consistent with the ICT response and recovery plan requirements as well as with other relevant parts of the ICT risk management laid down in Regulation (EU) 2022/2554⁵ , when the relevant issuers were also subject to those requirements .

Recovery plan indicators and monitoring thresholds

⁵ Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).

Issuers should lay down in the recovery plan an adequate framework of recovery plan indicators, via which the issuer can establish predetermined criteria that may signal the necessity of an increased frequency of monitoring or the activation of the recovery plan. These criteria should be set in a way to allow the issuer to monitor, escalate and activate recovery options as appropriate.

Recovery plan indicators should reflect both the token’s and the issuer’s specific risk profile and operating environment. As such, the calibration of recovery plan indicators and thresholds should be applied at the level of the token, except for the capital adequacy indicators that should be calibrated at the level of the issuer, based on its specific size, complexity, nature and business model and the operational risk indicators and the market confidence indicators that should be calibrated both at the level of the issuer and at the level of the token.

When assessing what type of indicators will be included in the recovery plans, each issuer should carefully consider the types of events that may lead to a breach of regulatory requirements and elaborate specific indicators based on its internal risk assessment. Therefore, issuers should consider the list of indicators provided in Annex I as illustrative, so they may choose any or all of the indicators under each category.

In addition, issuers should not limit their set of recovery plan indicators to the list provided in Annex I. Rather, they should consider the inclusion of the most appropriate indicators, even if not included in Annex I, based on the criteria laid down in these guidelines, including for instance indicators that would be helpful to address environmental, social and governance risks, and in any other circumstances when issues on a relevant field were identified.

Issuers should ensure that the list of recovery plan indicators and the calibration of their threshold is based on their internal risk assessment and that it is always consistent with its risk appetite framework. Changes to the issuers ’ risk appetite should trigger a review of the list of recovery indicators and thresholds, aimed to assess that they remain suitable in case of changes to their risk appetite framework.

Issuers should include in the recovery plan that they will monitor the recovery plan indicators with an adequate frequency which would allow the timely submission of the indicators’ data records to the competent authority upon request. Issuers should also specify how they will monitor said indicators.

Issuers should include recovery plan indicators of both quantitative and qualitative nature. When setting the quantitative recovery plan indicator thresholds, consistently with their overall risk management framework set up in accordance with Article 45(3) and 45(7)(b) of Regulation (EU) 2023/1114, issuers should use progressive metrics (‘traffic light approach’) in order to inform the issuer ’s management body that such indicator threshold could potentially be reached.

Issuers should include in the recovery plan at least the following categories of recovery plan indicators, as further detailed in Annex I (Section A – “Minimum categories for all issuers of ARTs or EMTs”), in particular:

1) liquidity risk indicators, informing the issuer of a potential or actual deterioration of the liquidity profile of the reserve of assets;

2) operational risk indicators, describing the potential risks resulting from inadequate or failed internal processes, people and systems or from external events, including legal risk. When calibrating this type of indicators, issuers should specifically take into account the type of underlying technology (e.g. permissioned/permissionless distributed ledger) as well as its complexity (e.g. the existence of bridges, the quality of the cryptography, etc). Issuers should also consider that relying on a unique and complex infrastructure rather than on a standard one may have repercussions not only on the ability to replace it, but also on the availability of people able to maintain and fix it. In case of multi-chain issuances, issuers should include specific indicators for each distributed ledger technology used to distribute the asset-referenced token and/or the e-money token;

3) credit risk/asset-quality indicators, measuring the asset quality evolution of the reserve of assets; 4) referenced asset(s)-related indicators, measuring the risk of massive redemption requests, e.g. triggered by the loss of peg;

5) capital adequacy indicators, measuring the potential deterioration in the quantity and quality of the capital position of the issuer, including the level of compliance with the own funds requirements laid down in Article 35 of Regulation (EU) 2023/1114. The calibration of such indicators should be set above their applicable minimum regulatory requirement. Capital adequacy indicators should only be used by issuers of asset-referenced tokens and e-money tokens that are not credit institutions.

Issuers should also include in the recovery plan the following categories of recovery plan indicators, as further detailed in Annex I (Section B – Additional minimum categories for issuers of significant ARTs and EMTs, and for other issuers that do not provide appropriate justification for the non-inclusion to the competent authority):

6) market risk indicators, stemming from all the positions included in the reserve of assets, including the volatility related to that of the asset(s) referenced;

7) concentration risk indicators, highlighting the excessive exposure of the reserve of assets to a single counterparty or an interconnected set of counterparties;

8) market confidence indicators, capturing the potential negative perception of market participants of the issuer or the token that could disrupt the issuer’s access to funding and capital markets or determine a rapid increase of redemption requests;

By way of derogation, issuers of non-significant tokens are exempted from including the categories of recovery plan indicators laid down in the previous paragraph as long as they provide appropriate justifications to their competent authority that such categories are not suitable or relevant to the risk profile, business model, size and/or complexity of the issuer.

Among the referenced asset(s)-related indicators, issuers should always incorporate at least a de-pegging risk indicator, aimed to capture the risk that the market value of the token differs from the market value of the asset(s) referenced. The de-pegging risk indicator should be measured as the ratio between the market value of the token and the market value of the referenced asset(s) and is expected to equal 1 at all times, with a tolerance interval not exceeding 1%. Instances of ratios lower than 1 shoul d trigger the issuer’s action as laid down in its recovery plan.

Issuers should clearly describe in the recovery plan to the satisfaction of the competent authority how the calibrations of the recovery plan indicators have been determined and how the thresholds would be breached early enough to be effective.

Issuers should describe in the recovery plan how they will regularly monitor and update the appropriateness of the recovery plan indicators and the calibration of their thresholds. In particular, issuers should specify how they would ensure the recovery plan is updated where it is needed due to a change in the financial and business situation of the issuer and/or of the specific token. Issuers should include in the recovery plan that any update in the calibration of recovery plan indicator thresholds should be promptly notified and explained to the competent authority. Issuers should ensure at all times that the recovery plan indicators and their thresholds are fully consistent with the issuers’ risk management framework.

The content of the recovery plan should be drawn by issuers considering that there should be no automaticity in the activation of recovery options upon breaching recovery plan indicator thresholds, and that it would be for the issuer to decide whether and when to activate the recovery plan in the case of a breach. When calibrating the recovery plan indicators, issuers should ensure that they have this decision point at an early enough stage to be able to implement action if needed.

Issuers should set out in the recovery plan their internal decision-making process. Issuers should ensure that said process would be thorough and well-grounded, in line with paragraphs 39, 40 and 41. In addition, issuers should state in their recovery plan that, whether the issuer decides to take action or not, they will keep an open and active dialogue with the competent authority.

For breaches of recovery plan indicator thresholds to effectively fulfil their warning potential, issuers should lay down in their recovery plan that they will promptly and in any event:

• • within maximum 24 hours from the breach of the recovery plan indicator threshold, alert the issuer ’s management body by activating the appropriate escalation process in order to ensure that any breach is considered and, where relevant, acted upon; and
• • at the latest within 24 hours following the activation of the internal escalation process, notify the breach of the recovery plan indicator threshold to the competent authority.

To account for the probability that the timeframes set under the previous paragraph may not allow the issuer to react to the breach of a threshold in a timely manner, issuers should determine the most appropriate time limit for the execution of those activities, on the basis of the specificities of its operations, size and complexity of the reserve of assets. In any case, the timeframes specified in the previous paragraph should not be extended.

Issuers should specify in the recovery plan that where a recovery plan indicator threshold has been breached, the management body of the issuer will assess the situation, decide whether to trigger the activation of the recovery plan and promptly notify the competent authorities. Issuers should also include in the recovery plan that the decision to activate the recovery plan will cover the type of recovery actions to be taken.

Issuers should also specify in the recovery plan that the decision referred to in the previous paragraph should be based on a reasoned analysis of the circumstances surrounding the breach.

Issuers should describe in the recovery plan that where they decide to take action in accordance with the recovery plan, the competent authority will be provided, without undue delay, with an action plan based on a list of credible and feasible recovery options to be used in this stress situation, together with a time plan to remediate the breach. The recovery plan should also include that, if no action has been decided, the competent authority will be provided with an explanation clearly articulating the reasons why and, where appropriate, demonstrating how the restoration of specific types of indicators and their breaches is possible without the use of recovery measures.