Table of Contents

1. The key provisions (Articles 59 and 62-63 MiCAR)
   1. General requirements (Articles 59 and 62)
      1. The provisions of Article 59
         1. Overview
         2. In particular: the single passport/license
      2. Application for authorisation as a CASP
         1. The provisions of Article 62
         2. Delegated and Implementing Regulations adopted by virtue of Article 62(5)-(6)
            27. Commission Delegated Regulation (EU) 2025/305
            54. Commission Implementing Regulation (EU) 2025/306
   2. Assessment of the application by NCAs – granting or refusal of authorisation (Article 63)
      1. The provisions of Article 63
         1. The procedure
         2. Grounds for refusal of authorisation
            27. Existence of close links (Article 63(7)-(8))
                703. Close links between the applicant CASP and other natural or legal persons (Article 63(7))
                1406. Close links between the applicant CASP and other natural or legal persons through third-country-related impediments (Article 63(8))
            54. Existence of objective and demonstrable grounds (Article 63(10))
         3. Transparency requirements regarding the granting or refusal of an authorisation as a CASP
      2. The EBA/ESMA Joint Guidelines adopted by virtue of Article 63(11)
      3. Judicial protection
2. Specific related provisions (Articles 68 and 72 MiCAR)
   1. Governance arrangements (Article 68)
      1. The considerations set out in recital (81)
      2. The general provisions of Article 68(1)-(3) MiCAR
      3. The obligations imposed on CASPs under Article 68(4)-(10)
      4. The relation of Article 68 with Article 69 (and with Article 62(2),
         point (g))
   2. Identification, prevention, management and disclosure of conflicts of interest (Article 72)
      1. Introductory remarks
      2. The requirements set out in Article 72
      3. The link to Article 62(2)
      4. The Delegated Regulation adopted by virtue of Article 72(5)
3. Concluding remarks
4. Secondary sources

A. The key provisions (Articles 59 and 62-63 MiCAR)

I. General requirements (Articles 59 and 62)

1. The provisions of Article 59

a) Overview

(1) The regulation of crypto-asset service providers (‘CASPs’) and the crypto-asset services they provide in the European Union (‘EU’) is governed by Articles 59-85 (Title V) of the Regulation of the European Parliament and of the Council (hereinafter the ‘co-legislators’) on Markets in Crypto-Assets^[1]Regulation (EU) 2023/1114 of 31 May 2023 “on markets in crypto-assets (…)”, OJ L 150, 9.6.2023, pp. 40-205. This legislative act is applicable to all Member States and fully applies (in … Continue reading (‘MiCAR’).^[2]Under recital (73), since in most Member States the provision of crypto-asset services was not regulated despite the potential risks they pose to investor protection, market integrity and financial … Continue reading The term ‘crypto-asset service provider’ (CASP) is defined^[3]MiCAR, Article 3(1), point (15). to mean a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis, and that is allowed to provide crypto-asset services in accordance with Article 59. Furthermore:^[4]Ibid., Article 3(1), points (39), (16), (5) and (1), respectively.

(a) ‘client’ means any natural or legal person to whom a CASP provides crypto-asset services;

(b) ‘crypto-asset service’ means any of the services and activities relating to any crypto-asset set out in point (16)(a)-(j) of Article 3(1);^[5]On this definition, see details in Zetzsche and Woxholth (2025), pp. 96-97. On the “dichotomy” between crypto-assets and financial instruments, see ex multis Schinerl (2026) (and the extensive … Continue reading

(c) ‘crypto-asset’ means a digital representation of a value or of a right that is able to be transferred and stored electronically using distributed ledger technology (‘DLT’) or similar technology; and

(d) ‘DLT’ means a technology that enables the operation and use of distributed ledgers.

(2) Under Article 59(1) (points (a) and (b), respectively) of this legislative act, a person is allowed to provide crypto-asset services within the EU only if it is either a legal person or other undertaking that has been authorised as a CASP in accordance with Article 63 (further discussed under II. below);^[6]For these purposes, ‘other undertakings’ that are not legal persons shall only provide crypto-asset services if: first, their legal form ensures a level of protection for third parties’ … Continue reading or a credit institution, central securities depository, investment firm, market operator, electronic money institution, undertaking for collective investment in transferable securities’ (‘UCITS’) management company, or an alternative investment fund manager that is allowed to provide crypto-asset services pursuant to Article 60.^[7]See in this respect also recital (78). As noted by Annunziata (2023) (at p. 57), the MiCAR sets out two distinct regimes for market access by CASPs: one that can be defined as ordinary, i.e., … Continue reading

(3) CASPs are authorised in accordance with Article 63. In order to enable effective supervision and to eliminate the possibility of evading or circumventing supervision, they are required to:

(a) have a registered office in a Member State where they carry out at least part of their crypto-asset services and have their place of effective management in the EU and at least one of the directors shall be resident in the EU;^[8]MiCAR, Article 59(2). and

(b) meet at all times the conditions for their authorisation.^[9]Ibid., Article 59(4); see also recital (74).

A person who is not a CASP is not allowed to use a name or corporate name, or issue marketing communications or undertake any other process suggesting that it is a CASP or that is likely to create confusion in that respect.^[10]Ibid., Article 59(5). From the combined reading of this provision with Article 5(1) and Article 3(1), point (15) (on the definition of CASPs, as discussed), the conclusion is drawn that the … Continue reading

(4) Competent authorities granting authorisations in accordance with Article 63 shall ensure that such authorisations specify the crypto-asset services that CASPs are authorised to provide.^[11]Ibid., Article 59(6).

As regards CASPs, ‘competent authority’ means^[12]Ibid., Article 3(1), point (35)(a). one or more authorities designated by each Member State in accordance with Article 93;^[13]Ibid., Article 93(1). By virtue of Article 93(2), if Member States designate more than one NCA, they shall determine their respective tasks and designate one NCA as the single point of contact for … Continue reading they are, thus, in principle national competent authorities (hereinafter ‘NCAs’). According to recital (76): “Given the relatively small scale to date of [CASPs], the power to authorise and supervise such service providers should be conferred upon national competent authorities. Authorisation as a [CASP] should be granted, refused or withdrawn by the competent authority of the Member State where the entity has its registered office. Where an authorisation is granted, it should indicate the crypto-asset services for which the [CASP] is authorised and should be valid for the entire Union.” By means of exception, in the case of a CASP that has been identified as “significant” pursuant to Article 85(1), the supervisory role of the ESMA is enhanced.^[14]In particular, the home Member State NCAs shall provide the ESMA’s Board of Supervisors with annual updates on the supervisory developments in relation to significant CASPs, as set out in … Continue reading

(5) CASPs seeking to add crypto-asset services to their authorisation as referred to in Article 63 shall request the NCA that granted their initial authorisation for its extension by complementing and updating the in­for­ma­tion referred to in Article 62. The request for extension shall be processed in accordance with Article 63 (as discussed below, under II.2.a)).^[15]Ibid., Article 59(8).

(6) The infringement of this Article may activate the imposition by NCAs, in accordance with national law, of appropriate administrative penalties and other administrative measures by virtue of Article 111(1), point (d).^[16]See ex multis Noble (2025), pp. 283-285.

b) In particular: the single passport/license

(1) CASPs shall be allowed to provide crypto-asset services throughout the EU, either through the right of establishment, including through a branch, or through the freedom to provide services. If providing crypto-asset services on a cross-border basis, they shall not be required to have a physical presence in the territory of a host Member State.^[17]MiCAR, Article 59(7); see in this respect also Article 65 on the cross-border provision of crypto-asset services.

‘Host Member State’ means^[18]Ibid., Article 3(1), point (34). the Member State where a CASP provides crypto-asset services, where different from the home Member State. As con­cerns CASPs, ‘home Member State’ means^[19]Ibid., Article 3(1), point (33)(f). the Member State where the CASP has its registered office.

(2) Thus, the authorisation granted by the NCA to a legal person or other undertaking that is established in the EU and has been authorised in accordance with Article 63 by the home Member State NCA shall: be valid for the entire EU/European Economic Area (‘EEA’)^[20]Members of the EEA are the EU Member States and the four member states of the European Free Trade Association (‘EFTA’) – namely, Iceland, Liechtenstein, and Norway. It is governed by the EEA … Continue reading (the ‘single passport/license’),^[21]See ex multis Schürger/Topp (2025), p. 554-555 and Zetzsche and Woxholth (2025), p. 110. On Article 59, see further Hirzle/Holl/Kaulartz (2025), pp. 817-828, Kokorin (2025), p. 141, Pekler … Continue reading since the MiCAR applies in its entirety to the EEA.

2. Application for authorisation as a CASP

a) The provisions of Article 62

(1) Articles 62-63 MiCAR set out a “three step” procedure for authorisation as a CASP.^[22]See Zetzsche and Woxholth (2025), pp. 107-109. According to the first step of this procedure, legal persons or other undertakings intending to provide crypto-asset services are required to submit their application for such an authorisation to the their home Member State NCA.^[23]MiCAR, Article 62(1).

(2) The application must contain the information set out in Article 62(2) MiCAR (points (a)-(s)), namely:

Points (a)-(c): the name, including the legal name and any other commercial name used, the legal entity identifier of the applicant CASP, the website operated by that provider, a contact email address, a contact telephone num­ber and its physical address; its legal form; and its articles of association.

Point (d): a programme of operations, setting out the types of crypto-asset services that the applicant CASP intends to provide, including where and how those services are to be marketed.

Point (e): proof that the applicant CASP meets the requirements for prudential safeguards (established to ensure consumer protection as provided for in recital (80)^[24]On the relationship between the MiCAR and consumer protection law, see ex multis Klausberger (2025) (and the literature cited).) in accordance with Article 67.^[25]According to Annunziata (2023) (at p. 60), these prudential requirements are derived from the MiFID II.In accordance with the answer provided by the ESMA in question ESMA_QA_2343 in its interactive … Continue reading In particular, under Article 67(1) MiCAR, CASPs shall, at all times, have in place prudential safeguards equal to an amount of at least the higher of the following: (a) the amount of permanent minimum capital requirements indicated in Annex IV, depending on the type of the crypto-asset services provided; (b) one quarter of the fixed overheads of the preceding year, reviewed annually.

Since subject to compliance with these prudential requirements are CASPs “authorised under the MiCAR”, the financial entities referred to in Article 60(1)-(6), which are authorised under legislative acts that are the sources of other branches of EU financial law (e.g., credit institutions and investment firms), when providing crypto-asset services are not subject to Article 67. This is explicitly referred to in Article 60(10).^[26]See Aubrunner (2025), p. 462 (at para. 59) and Nemeczek/Stabenow (2025), p. 917 (at para. 4).

Point (f): a description of the applicant CASP’s governance arrangements set out in Article 68 (as further discussed under B.I. below).

Point (g): proof that members of the management body of the applicant CASP are of sufficiently good repute and possess the appropriate knowledge, skills and experience to manage that provider;^[27]On this point, see also below, under I.4. ‘management body’ means^[28]MiCAR, Article 3(1), point 27. This definition of the term management body is taken over from Article 3(1), point (7) of the ‘Capital Requirements Directive No IV’(‘CRD IV’) in relation to … Continue reading the body or bodies of a CASP, which are appointed under national law, are empowered to set the entity’s strategy, objectives and overall direction, and oversee and monitor management decision-making in the entity, “including the persons who effectively direct the business of the entity”.

Point (h): the identity of any shareholders and members, whether direct or indirect, that have qualifying holdings in the applicant CASP and the amounts of those holdings, as well as proof that those persons are of sufficiently good repute.^[29]Under Article 62(3) MICAR, for the purposes of (g)-(h), an applicant CASP shall provide proof of all of the following:(a) for all members of the management body of the applicant CASP, the absence … Continue reading

‘Qualifying holding’ means^[30]Ibid., Article 3(1), point (36). any direct or indirect holding in (an issuer of asset-referenced tokens (‘ARTs’) or in) a CASP, which meets either of the following criteria:

(a) it represents, at least, 10% of the capital or the voting rights, as set out in Ar­ti­cles 9-10 of the so-called “Transparency Directive”,^[31]Directive 2004/109/EC of the co-legislators of 15 December 2004 “on the harmonisation of transparency requirements in relation to information about issuers whose securities are admitted to trading … Continue reading taking into account the conditions regarding their aggregation as laid down in Article 12(4)-(5) of that leg­isla­tive act; or

(b) it makes it possible to exercise a significant influence over the management of (the ART issuer or) the CASP in which that holding subsists.

Articles 83-84 (included in Chapter 4 of Title V) govern further, respectively, the assessment (“screening”) of proposed acquisitions of a qualifying holding in a CASP and the content of this assessment.^[32]The content of their rules is heavily based on the provisions of Articles 22-23 CRD IV. For a detailed analysis of these CRD IV Articles, see Gortsos (2025), pp. 85-87.

Point (i): a description of the applicant CASP’s internal control mechanisms, policies and procedures to identify, assess and manage risks, including money laundering and terrorist financing risks, and business continuity plan.

Point (j): the technical documentation of the information and communication technology (‘ICT’) systems and security arrangements (as required by the Digital Operational Resilience Act,^[33]Regulation (EU) 2022/2554 of the co-legislators of 14 December 2022 “on digital operational resilience for the financial sector (…)”, OJ L 333, 27.12.2022, pp. 1-79. ‘Digital operational … Continue reading ‘DORA’), and a description thereof in non-technical language.

Points (k)-(l): a description of the procedure for the segregation of clients’ crypto-assets and funds and of the applicant CASP’s complaints-handling procedures.

Points (m)-(r): in relation to specific crypto-asset services that the applicant CASP intends to provide:

• for custody and administration of crypto-assets on behalf of clients, a description of the custody and administration policy;
• for the operation of a trading platform for crypto-assets, a description of the operating rules of the trading platform and of the procedure and system to detect market abuse;
• for the exchange crypto-assets for funds or other crypto-assets, a description of (a) the non-discriminatory commercial policy governing the relationship with clients, and (b) the methodology for determining the price of the crypto-assets that the applicant CASP proposes to exchange for funds or other crypto-assets;
• for the execution of orders for crypto-assets on behalf of clients, a description of the execution policy;
• for advice on crypto-assets or portfolio management of crypto-assets, proof that the natural persons giving advice on behalf of the applicant CASP or managing portfolios on behalf of the applicant CASP have the necessary knowledge and expertise to fulfil their obligations; and
• for the provision of transfer services for crypto-assets on behalf of clients, information on the manner in which such transfer services will be provided;

Point (s): the type of crypto-asset to which the crypto-asset service relates.^[34]See also recital (83) MiCAR. NCAs shall not require an applicant CASP to provide any information referred to in Article 62(2)-(3) above that they have already received under the respective … Continue reading

b) Commission Delegated and Implementing Regulations adopted by virtue of Article 62(5)-(6)

aa) Commission Delegated Regulation (EU) 2025/305

By virtue of Article 62(5), the Commission has adopted on 31 October 2024 its Delegated Regulation (EU) 2025/305 supplementing MiCAR with regard to regulatory technical standards (‘RTSs’) “specifying the information to be included in an application for authorisation as a CASP”^[35]OJ L, 2025/305, 31.3.2025. (based on draft RTSs developed by the ESMA, in close cooperation with the EBA). Inter alia:

(a) Article 3 of this delegated act governs the “Prudential requirements” for the purposes of Article 62(2), point (e) MiCAR;

(b) Article 4 governs the “Information about governance arrangements and internal control mechanisms and conflict of interests” for the purposes of Article 62(2), points (f) and (i) MiCAR (further discussed under II.3. below);

(c) Article 7 governs the “Identity and proof of good repute, knowledge, skills and experience, and of sufficient time commitment of the members of the management body” for the purposes of Article 62(2), point (g) MiCAR (briefly further discussed under II.4. (1) below); and

(d) Article 8 governs the “Information relating to shareholders or members with qualifying holdings” for the purposes of Article 62(2), point (h) MiCAR.^[36]This includes the information referred to in Articles 1-4, 6 (points (b), (d) and (e)) and 8 of the Commission Delegated Regulation (EU) 2025/414 of 18 December 2024 supplementing the MiCAR “with … Continue reading

bb) Commission Implementing Regulation (EU) 2025/306

Furthermore, by virtue of Article 62(6), the Commission has adopted on the same date its Implementing Regulation (EU) 2025/306 laying down implementing technical standards (‘ITSs’) “for the application of [MiCAR] with regard to standard forms, templates and procedures for the information to be included in the application for authorisation as a CASP”^[37]OJ L, 2025/306, 31.3.2025. (based on draft ITSs developed by the ESMA, in close cooperation with the EBA).^[38]On Article 62, see further Hirzle/Holl/Kaulartz (2025), pp. 855-878, Kokorin (2025), pp. 145-149, Pekler (2025), pp. 332-350 and Schürger & Topp (2026), pp. 2297-2301.

II. Assessment of the application by NCAs – granting or refusal of authorisation

1. The provisions of Article 63

a) The procedure

NCAs must promptly, and in any event within 5 working days of receipt of an application under Article 62(1),^[39]See above, under I.2.a) (1). acknowledge receipt thereof in writing to the applicant CASP. Pursuant to Article 63, the second and the third steps of the “three step” procedure set out in the MiCAR for authorisation as a CASP contain two separate assessments. In particular:

(1) According to the second step in this procedure, within 25 working days of receipt of an application, they shall conduct an “assessment of information”. In particular, they are required to assess its completeness by checking that the information listed in Article 62(2)^[40]See above, under I.2.a) (2). has been submitted. If the application is not complete, they shall set a deadline by which the applicant CASP will have to provide any missing information and may refuse to review applications if these remain incomplete after the expiry of the above deadline set by them.^[41]MiCAR, Article 63(1), (2), first and second sub-paragraphs and(3). Once an application is complete, NCAs shall promptly notify the applicant CASP thereof.^[42]Ibid., Article 63(4).

Before granting or refusing an authorisation as a CASP, NCAs:

(a) may consult the competent authorities for anti-money laundering and counter-terrorist financing, and financial intelligence units, in order to verify that the applicant CASP has not been the subject of an investigation into conduct relating to money laundering or terrorist financing;

(b) must ensure that the applicant CASP that operates establishments or relies on third parties established in high-risk third countries identified under Article 9 of the AML Directive No V^[43]Directive (EU) 2015/849 of the co-legislators of 20 May 2015 “on the prevention of the use of the financial system for the purposes of money laundering [‘AML’] or terrorist financing … Continue reading (‘AMLD V’) complies with the provisions of national law transposing Articles 26(2), 45(3) and 45(5) of that legislative act; and

(c) if appropriate, must ensure that the applicant CASP has put in place appropriate procedures to comply with the provisions of national law transposing Article 18a (1) and (3) AMLD V.^[44]MiCAR, Article 63(6); see also recital (77).

(2) According to the third step in the “three step” procedure for authorisation as a CASP, NCAs shall, within 40 working days from the date of receipt of a complete application, assess whether the applicant CASP complies with the requirements set out in Title V (“assessment of application”). On the basis of the principle of proportionality, this assessment shall take into account the nature, scale and complexity of the crypto-asset services that the applicant CASP intends to provide.^[45]Ibid., Article 63(9), first and third sentences.

During this assessment period, and no later than on the 20th working day thereof, NCAs may request any further information necessary to complete the assessment; such request shall be made in writing to the applicant CASP and specify the additional information needed. The assessment period shall be suspended for the period between the date of request for missing information by the NCAs and the receipt by them of a response thereto from the applicant CASP. The suspension shall not exceed 20 working days.^[46]Any further requests by the NCAs for completion or clarification of the information shall be at their discretion but shall not result in a suspension of the assessment period (ibid., Article 63(12), … Continue reading

(3) The NCA’s decision on granting or refusing an authorisation as a CASP must be fully reasoned and be notified to the applicant within 5 working days upon its adoption.^[47]Ibid., Article 63(9), second and third sentences. On all the above provisions of Article 63, see further Hirzle/Holl/Kaulartz (2025), pp. 882-886, Kokorin (2025), p. 149, Pekler (2025), … Continue reading

b) Grounds for refusal of authorisation

aa) Existence of close links (Article 63(7)-(8))

Under the conditions set out in Article 63(7) and (8), the NCAs shall refuse the granting of authorisation to an applicant CASP in the existence of close links. The term ‘close links’ is defined^[48]MiCAR, Article 3(1), point (31). It is noted that this term is only used in the MiCAR in relation to CASPs. with reference to Article 4(1), point (35) of the Markets in Financial Instruments Directive No II^[49]Directive 2014/65/EU of the co-legislators of 15 May 2014 “on markets in financial instruments (…)”, OJ L 173, 12.6.2014, pp. 349-496, as in force. (‘MiFID II’^[50]The impact of (inter alia) this legislative act on the MICAR is predominant. Annunziata (2023) (at p. 56, with further references) speaks about the so-called “mifidisation” of the MiCAR, as the … Continue reading) to mean a situation in which two or more natural or legal persons are linked by:

(a) participation in the form of ownership, direct or by way of control, of 20% or more of the voting rights or capital of an undertaking;

(b) ‘control’, meaning: the relationship between a parent undertaking and a subsidiary, in all the cases referred to in Article 22(1)-(2) of the so-called ‘Accounting Directive’;^[51]Directive 2013/34/EU of the co-legislators of 26 June 2013 “on the annual financial statements, consolidated financial statements and related reports of certain types of undertakings (…)”, OJ L … Continue reading or a similar relationship between any natural or legal person and an undertaking, any subsidiary undertaking of a subsidiary undertaking also being considered to be a subsidiary of the parent undertaking which is at the head of those undertakings; or

(c) a permanent link of both or all of them to the same person by a control relationship.

aaa) Close links between the applicant CASP and other natural or legal persons (Article 63(7))

By virtue of Article 63(7), if close links exist between the applicant CASP and other natural or legal persons, authorisation shall be granted by an NCA only if those links do not prevent the “effective” exercise of its supervisory functions.^[52]These are determined under national law. Accordingly, the NCA is called upon to make a double assessment: first, on whether close links exist; and second, on whether the effective exercise of its supervisory functions may be prevented by these links (if present, e.g., due to the shareholding structure of the entities involved or the lack of economic transparency caused by these links^[53]See Hirzle/Holl/Kaulartz (2025), p. 889, at para. 38 (and the literature cited).).

bbb) Close links between the applicant CASP and other natural or legal persons through third-country-related impediments (Article 63(8))

(1) Furthermore, by virtue of Article 63(8), an NCA is required (“shall”) to refuse authorisation if either of the following prevents (in this case again) the “effective” exercise of its supervisory functions: first, the laws, regulations or administrative provisions of a third country governing one or more natural or legal persons with which the applicant CASP has close links; or second, difficulties involved in their enforcement. Effective exercise of an NCA’s supervisory functions may be prevented in this case if, e.g., such laws, regulations or administrative provisions of a third country prohibit the transmission of information necessary for the effective exercise of these functions.^[54]Idem., p. 889, at para. 40 (and the literature cited), see also Schürger & Topp (2026), pp. 2305-2306 (at paras 9-11).

(2) If the NCA establishes that such or equivalent conditions are present, no authorisation shall be granted to the applicant CASP.

bb) Existence of objective and demonstrable grounds (Article 63(10))

(1) NCAs are also required (“shall”) to refuse authorisation as an applicant CASP if there are objective and demonstrable grounds that any of the following applies:

(a) the applicant CASP’s management body poses a threat to its effective, sound and prudent management and business continuity, and to the adequate consideration of the interest of its clients and the integrity of the market, or exposes the applicant CASP to a serious risk of money laundering or terrorist financing;

(b) the members of its management body do not meet the criteria set out in Article 68(1);^[55]On Article 68(1), see just below, under I.2.

(c) the shareholders or members, whether direct or indirect, that have qualifying holdings in the applicant CASP do not meet the criteria of sufficiently good repute set out in Article 68(2);^[56]Idem. or

(d) the applicant CASP fails or is likely to fail to meet any of the requirements set out in Title V.^[57]MiCAR, Article 63(10), points (a)-(d).

(2) In this respect, two remarks deserve attention:

First, points (a)-(c) above relate to the quality of the CASP’s management and the influence of the CASP’s shareholders. This is a demonstration of the importance attached by the MICAR to the CASP’s key personnel.^[58]See Zetzsche and Woxholth (2025), p. 109.

Second, point (d) above sets out a “catch-all” provision, granting NCAs with a broad mandate to refuse authorisation if they are not satisfied with the submitted information and the prudential or organisational requirements set out in Title V of the MiCAR.^[59]See Kokorin (2025), p. 150. On Article 63(10), see also Hirzle/Holl/Kaulartz (2025), pp. 886-889 and Schürger & Topp (2026), p. 2307 (at para. 17).

c) Transparency requirements regarding the granting or refusal of an authorisation as a CASP

Within 2 working days of granting authorisation, NCAs shall communicate to the ESMA the information specified in Article 109(5), and inform it of any refusals of authorisations. The ESMA shall make the information referred to in Article 109(5) available in the register referred to in that Article by the starting date of the provision of crypto-asset services.^[60]MiCAR, Article 63(13); see also recital (101).

2. The EBA/ESMA Joint Guidelines adopted by virtue of Article 63(11)

(1) By virtue of (inter alia) Article 63(11), the ESMA and the EBA jointly issued on 4 December 2024 their Joint Guidelines “on the assessment of the suitability of the members of the management body of (issuers of ARTs and) [CASPs]” (EBA/GL/2024/09, ESMA75-453128700-10).^[61]These Guidelines were adopted by virtue of Article 21(3) as well, applying thus also to the members of the management body/bodies of issuers of ARTs. As regards CASPs, these Guide­lines apply (from 4 February 2025^[62]Joint Guidelines, para. 7.) – based on the principle of pro­por­tio­nal­ity^[63]Ibid., paras 8-12. – at both the authorisation and on an ongoing basis to NCAs and CASPs, in accordance with Article 68(1) MiCAR with regard to the assessment of the suitability of members of the management body of an applicant CASP seeking for an authorisation under Article 62, or a CASP authorised in accordance with Article 63, or, with reference to Article 68(1), providing crypto-asset services as part of their authorisation in accordance with Article 60(2) and (4)-(6).^[64]Ibid., para. 2.

(2) In relation to the suitability assessment and the requirement that members of the management body of CASPs must meet the criteria set out in Article 68(1), the members to be assessed include persons that will become members of the management body of a CASP and members that have already taken up their position. Reflecting the fact that, while in some Member States corporate governance is based on the ‘one-tier model’, in others it is based on the ‘two-tier model’,^[65]See on this Gortsos (2025), pp. 63-64 (and the literature cited). the Guidelines provide that where the management body consists of a management and a supervisory function, the Guidelines apply to both functions and members of both functions.^[66]Joint Guidelines, paras 3-5. ‘Management body in its management function’ means the management body acting in its role of directing effectively the CASP and includes the persons who direct its … Continue reading

(3) In accordance with the Guidelines, the notions of suitability under Article 68(1) MiCAR govern the following aspects:^[67]Joint Guidelines, paras 13-15, 16-27, 28 and 29-36, respectively. (a) sufficient good repute; (b) individual appropriate knowledge, skills and experience; (c) collective appropriate knowledge, skills and experience; as well as (d) sufficient time commitment of members of the management body. In particular, in ac­cor­dance to paras 14-15 on “Acting in concert, significant influence, indirect shareholders, and decision to acquire”, the Guidelines provide that NCAs should determine whether the circumstances giving rise to a proposed acquisition of qualifying holding in a target undertaking are met, preliminary to the assessment of the suitability of the proposed acquirer. For these purposes, they should apply the assessment methodology set out in the Joint ESAs Guidelines of 20 December 2016 “on the prudential assessment of acquisitions and increases of qualifying holdings in the financial sector” (JC/GL/2016/01).^[68]The Guidelines further specify the term ‘sufficiently good repute’ In respect to these latter Guidelines, the following is briefly noted:

(a) Under para. 4, NCAs should consider as ‘acting in concert’ any legal or natural persons who decide to acquire or increase a qualifying holding in accordance with an explicit or implicit agreement, taking into account all relevant elements in order to establish, on a case-by-case basis, whether certain parties act in concert, which would trigger the conditions for the notification to the target supervisor and the prudential assessment of any intended acquisition. Furthermore, they should not be precluded from concluding that certain persons are acting in concert merely due to the fact that one or several such persons are passive, since inaction may contribute to creating the conditions for an acquisition or increase of a qualifying holding or for exercising influence over the target undertaking.

(b) Under para. 5, in order to assess whether ‘significant influence’ may be exercised, NCAs should take several factors into account, including the ownership structure of the target undertaking, the actual level of involvement of the proposed acquirer in the management of the target undertaking, as well as all the relevant facts and circumstances.

3. Judicial protection

By virtue of Article 113(1), Member States shall ensure that decisions taken by NCAs under the MiCAR are properly reasoned and subject to the right of appeal before a court. This right also applies where, in respect of an application for authorisation which provides all of the required information, no decision is taken within 6 months of its submission.

B. Specific related provisions (Articles 68 and 72 MiCAR)

I. Governance arrangements

1. The considerations set out in recital (81)

As discussed,^[69]See above, under I.2.a) (2). in accordance with Article 62(2), point (f), the application of the CASP must contain a description of the applicant CASP’s governance arrangements set out in Article 68. Recital (81) makes in this respect the following considerations:

“[CASPs] should be subject to strong organisational requirements. The members of the [CASP’s] management body should be fit and proper and should, in particular, not have been convicted of any offence in the field of money laundering or terrorist financing or of any other offence that would affect their good repute. The shareholders or members, whether direct or indirect, natural or legal persons, that have qualifying holdings in [CASPs] should be of sufficiently good repute and should, in particular, not have been convicted of any offence in the field of money laundering or terrorist financing or of any other offence that would affect their good repute. In addition, where the influence exercised by shareholders and members that have qualifying holdings in [CASPs] is likely to be prejudicial to the sound and prudent management of the [CASP] taking into account, amongst others, their previous activities, the risk of them engaging in illicit activities, or the influence or control by a government of a third country, competent authorities should have the power to address those risks.

[CASPs] should employ management and staff with adequate knowledge, skills and expertise and should take all reasonable steps to perform their functions, including through the preparation of a business continuity plan. They should have sound internal control and risk assessment mechanisms as well as adequate systems and procedures to ensure the integrity and confidentiality of the information received. [CASPs] should have appropriate arrangements to keep records of all transactions, orders and services related to the crypto-asset services that they provide. They should also have systems in place to detect potential market abuse committed by clients.”

2. The general provisions of Article 68(1)-(3)

On the basis of these considerations, Article 68 provides the following in relation to the fit and proper assessment:

First, members of the management body of CASPs shall be of sufficiently good repute and possess the appropriate knowledge, skills and experience, both individually and collectively, to perform their duties. In particular, members of the management body of CASPs shall not have been convicted of offences relating to money laundering or terrorist financing or of any other offences that would affect their good repute. They shall also demonstrate that they are capable of committing sufficient time to effectively perform their duties.^[70]MiCAR, Article 68(1).

Second, shareholders and members, whether direct or indirect, that have qualifying holdings in CASPs shall be of sufficiently good repute and, in par­tic­u­lar, shall not have been convicted of offences relating to money laun­der­ing or terrorist financing or of any other offences that would affect their good repute.^[71]Ibid., Article 68(2).

Third, if the influence exercised by the shareholders or members, whether direct or indirect, that have qualifying holdings in a CASP is likely to be prejudicial to the sound and prudent management of that CASP, NCAs shall take appropriate measures to address those risks. Such measures may include:

(a) applications for judicial orders or the imposition of penalties against directors and those responsible for management; or

(b) the suspension of the exercise of the voting rights attaching to the shares held by the shareholders or members, whether direct or indirect, that have the qualifying holdings.^[72]Ibid., Article 68(3), first and second-sub-paragraphs. On Article 68(1)-(3), see further Kokorin (2025), pp. 153-154, Nemeczek/Stabenow (2025), pp. 923-931 and Zetzsche and Woxholth (2025), … Continue reading

3. The obligations imposed on CASPs under Article 68(4)-(10)

(1) Under these paragraphs, the following obligations are imposed on CASPs:

First, they shall adopt policies and procedures that are sufficiently effective to ensure compliance with MiCAR.^[73]Ibid., Article 68(4).

Second, they shall employ personnel with the knowledge, skills and expertise necessary for the discharge of the responsibilities allocated to them, taking into account the scale, nature and range of crypto-asset services provided.^[74]Ibid., Article 68(5).

Third, they shall take all reasonable steps to ensure continuity and regularity in the performance of their crypto-asset services, employing appropriate and proportionate resources and procedures, including resilient and secure ICT systems as required by DORA. They shall establish a business continuity policy, including ICT business continuity plans, as well as ICT response and recovery plans set up pursuant to Articles 11-12 DORA that aim to ensure, in the case of an interruption to their ICT systems and procedures, the preservation of essential data and functions and the maintenance of crypto-asset services or, where that is not possible, the timely recovery of such data and functions and the timely resumption of crypto-asset services.^[75]Ibid., Article 68(7), first and second-sub-paragraphs. By virtue of Article 68(10), point (a) and on the basis of ESMA’s draft RTSs, the Commission adopted on 31 October 2024 its Delegated Regulation (EU) 2025/299 supplementing the MiCAR “with regard to RTSs on continuity and regularity in the performance of crypto-asset services”.^[76]OJ L, 2025/299, 13.2.2025.

Fourth, they shall have in place mechanisms, systems and procedures as required by DORA, as well as effective procedures and arrangements for risk assessment, to comply with the provisions of national law transposing the AMLD V. They shall monitor and, on a regular basis, evaluate the adequacy and effectiveness of those mechanisms, systems and procedures, taking into account the scale, the nature and range of crypto-asset services provided, and shall take appropriate measures to address any deficiencies in that respect. CASPs shall have systems and procedures to safeguard the availability, authenticity, integrity and confidentiality of data pursuant to DORA.^[77]MiCAR, Article 68(8), first and second-sub-paragraphs.

Fifth, they shall arrange for records to be kept of all crypto-asset services, activities, orders and transactions undertaken by them, which will be sufficient to enable NCAs to fulfil their supervisory tasks, take enforcement measures, and in particular ascertain whether CASPs have complied with all obligations, including those with respect to clients or prospective clients and to market integrity.^[78]The records shall be provided to clients upon request for a period of 5 years and, if requested by the NCA before the lapse of this period, for up to 7 years (ibid., Article 68(9), first and … Continue reading By virtue of Article 68(10), point (b) and on the basis of ESMA’s draft RTSs as well, the Commission adopted on 27 February 2025 its Delegated Regulation (EU) 2025/1140 supplementing the MiCAR “with regard to RTSs specifying records to be kept of all crypto-asset services, activities, orders and transactions undertaken”.^[79]OJ L, 2025/1140, 10.6.2025.

(2) The management body of CASPs shall assess and periodically review the effectiveness of the policy arrangements and procedures put in place to comply with Chapters 2 and 3 of Title V and take appropriate measures to address any deficiencies in that respect.^[80]On Articles 68 and 69, see also Foà (2026).

(3) The infringement of this Article may (as in the case of Article 59^[81]See above, under I.1.a) (6).) activate the imposition by NCAs, in accordance with national law, of appropriate administrative penalties and other administrative measures by virtue of Article 111(1), point (d).

4. The relation of Article 68 with Article 69 (and with Article 62(2), point (g))

(1) Article 69 provides that CASPs are subject to two requirements:

First, they must notify their NCA “without delay” of any changes to their management body, “prior to the exercise of activities by any new members”, and provide them with all necessary information to assess compliance with Article 68. The notification concerns “any” changes to the management body of a CASP, including changes relating to the information that must be provided by an applicant CASP to its NCA in accordance with Article 7 of the above-mentioned Commission Delegated Regulation (EU) 2025/305;^[82]See above, under I.2.b)aa). it is confined to changes to this body only.

Second, they must provide their NCAs of “all” of the necessary information to assess compliance with Article 68 on the governance arrangements for members of the management body of CASPs. These notification requirements are directly imposed on CASPs and not on the members of their management body/bodies.^[83]See further Nemeczek/Stabenow (2025), pp. 943-946.

(2) From a systematic point of view, thus, this Article is linked on the one hand, to Article 62(2), point (g),^[84]See above, under I.2.a) (1). relating – in the course of the application of a CASP for authorisation – to the proof that members of the management body of the applicant CASP are of sufficiently good repute and possess the appropriate knowledge, skills and experience to manage that CASP; and on the other hand, to (the partially related) Article 68 above on governance arrangements.^[85]MiCAR, Article 68(6). On Article 68(4)-(10), see further Kokorin (2025), pp. 154-157, Zetzsche and Woxholth (2025), p. 115 and in detail Nemeczek/Stabenow (2025), pp. 931-948.

II. Identification, prevention, management and disclosure of conflicts of interest (Article 72)

1. Introductory remarks

Article 72 on the “Identification, prevention, management and disclosure of conflicts of interest” is included (like Article 68 analysed just above) in Chapter 2 of Title V MiCAR on the “Obligations of all CASPs” (Articles 66-74) and sets out rules which are directly linked to their authorisation (as further discussed under II.3. below). In addition, its infringement may (as in the case of Ar­ti­cles 59 and 68^[86]See above, under I.1.a) (6) and I.3. (3), respectively.) activate the imposition by NCAs, in accordance with national law, of appropriate administrative penalties and other administrative measures by virtue of Article 111(1), point (d).

2. The requirements set out in Article 72

(1) Pursuant to Article 72(1), CASPs are required to implement and maintain effective policies and procedures, taking into account the scale, the nature and range of crypto-asset services provided, to identify, prevent, manage and disclose conflicts of interest between:

(a) themselves and: (i) their shareholders or members; (ii) any person directly or indirectly linked to them or their shareholders or members by control; (iii) members of their management body; (iv) their employees; or (v) their clients; or

(b) two or more clients whose mutual interests conflict.

(2) In this respect, CASPs are subject to two obligations:

First, they must disclose to their clients and prospective clients, in a prominent place on their website, the general nature and sources of conflicts of interest referred to in Article 72(1) and the steps taken to mitigate them. This disclosure shall be made in an electronic format and shall include sufficient detail, taking into account the nature of each client, in order to enable each client to take an informed decision about the crypto-asset service in the context of which the conflicts of interest arise.^[87]MiCAR, Article 72(2)-(3).

Second, they must assess and, at least annually, review their policy on conflicts of interest, and take all appropriate measures to address any deficiencies in that respect.^[88]Ibid., Article 72(4). On Article 72, which is also modelled on similar provisions of (inter alia) the MiFID II, see further Aubrunner (2025), pp. 450-451, Kokorin (2025), pp. 161-162, … Continue reading

3. The link to Article 62(2)

As discussed,^[89]See above, under I.2.b)aa). Article 4 of the Delegated Regulation (EU) 2025/305, adopted by virtue of Article 62(5) MiCAR, governs the “Information about governance arrangements and internal control mechanisms and conflict of interests” for the purposes of Article 62(2), points (f) and (i) MiCAR. Pursuant to Article 4(2) of this delegated act, in accordance with Article 72 MiCAR, applicant CASPs shall provide to the NCA, in the course of the first step in the “three step” procedure set out in Articles 62-63 MiCAR, all the following information on the management of conflicts of interests:

(a) The first set of information comprises a copy of the applicant CASP’s conflicts of interest policy, together with a description of how that policy:

(i) ensures that the applicant CASP identifies, prevents and manages conflicts of interests in accordance with Article 72(1) MiCAR and discloses conflicts of interest in accordance with Article 72(2);^[90]See just above, under II.2. (1) and (2), respectively.

(ii) is commensurate to the scale, nature and range of crypto-asset services that the applicant intends to provide and of the other activities of the group to which the applicant belongs; and

(iii) ensures that the remuneration policies, procedures and arrangements do not create conflicts of interest.

(b) The second set of information refers to how the applicant CASP’s conflicts of interest policy ensures compliance with the Commission Delegated Regulation adopted pursuant to Article 72(5) MiCAR,^[91]See just below, under II.4. including information on the systems and arrangements put in place by the applicant CASP to: (i) monitor, assess, review the effectiveness of its conflicts of interests policy and remedy any deficiencies; and (ii) record cases of conflicts of interests, including the identification, assessment, remedy and the fact whether the case was disclosed to the client.

4. The Delegated Regulation adopted by virtue of Article 72(5)

(1) By virtue of Article 72(5), the Commission adopted on 27 February 2025 its Delegated Regulation (EU) 2025/1142 supplementing the MiCAR with regard to RTSs “specifying the requirements for policies and procedures on conflicts of interest for CASPs [in accordance with Article 72(1)] and the details and methodology for the content of disclosures on conflicts of interest [in accordance with Article 72(2)]”.^[92]OJ L, 2025/1142, 10.6.2025. This was based om draft RTSs developed by the ESMA in close cooperation with the EBA.

(2) Article 2 of this delegated act governs the conflicts of interest potentially detrimental to the CASP. It sets out that the policies and procedures referred to in Article 72(1) MiCAR (to identify, prevent, manage and disclose conflicts of interests potentially detrimental to the CASP) must specify the circumstances which are capable of, directly or indirectly, affecting the objectivity and impartiality of the connected persons in exercising their duties and responsibilities.^[93]See in this respect recitals (8)-(9), (12)-(13) and (15) of the Delegated Regulation. In this respect, account must be taken, at least, of situations or relationships where a connected person meets any of the following:^[94]Ibid., Article 2(1), points (a)-(c).

First, it has an economic interest in a person, body or entity with interests conflicting with those of the CASP. For these purposes, CASPs shall take into account situations where the connected person that is a member of the management body, employee of the CASP or a shareholder or member that has a qualifying holding in the CASP: (i) holds shares, tokens (including governance tokens), other ownership rights or membership in that person, body or entity, or holds debt instruments of or has other debt arrangements with that person, body or entity; or (ii), has any form of contractual arrangements related to the activities regulated under the MiCAR with that person, body or entity.^[95]Ibid., Article 2(3), points (a)-(c).

Second, it has a present relationship with a person, body or entity that has interests conflicting with those of the CASP that could be of a personal, professional or political nature or had that relationship within the previous 3 years, starting from when the assessment is made.

Third, it carries out tasks or activities, or is entrusted with responsibilities, conflicting with those of the CASP, or is hierarchically supervised by a person in charge of functions or tasks conflicting with those of the CASP.

For the purposes of identifying the persons, bodies or entities with conflicting interests to those of CASPs, CAPSs shall take into account, at least, whether that person, body or entity:

first, is likely to make a financial gain, or avoid a financial loss, at the expense of the CASP;

second, has an interest in the outcome of a crypto-asset service provided or an activity carried out by the CASP, which is distinct from the latter’s interest in that outcome; or

third, carries out the same business as the CASP or is a client, consultant, adviser, delegatee, outsourcee, service provider or other supplier (including subcontractors) of the CASP and there are demonstrable grounds that there may be a conflict of interests with the CASP.^[96]Ibid., Article 2(2), points (a)-(c).

(3) Furthermore, Articles 3-8 govern, respectively: the conflicts of interest potentially detrimental to clients; the conflict of interest policies and procedures referred to in Article 72(1) MiCAR; the policies and procedures on conflict of interest in the context of remuneration; the policies and procedures on conflicts of interest in the context of personal transactions; the disclosures by the CASP as referred to in Article 72(2) MiCAR; and additional requirements in relation to placing.

C. Concluding remarks

(1) According to the “three step” procedure set out in Articles 62-63 MiCAR for authorisation of a legal person as a CASP:

First, legal persons or other undertakings intending to provide crypto-asset services are required to submit their application for such an authorisation to the their home Member State NCA, which must contain the information set out in Article 62(2) MiCAR (points (a)-(s)) – inter alia, proof that the applicant CASP meets the requirements for prudential safeguards in accordance with Article 67 and that the members of its management body meet specific fit and proper criteria; a description of its governance arrangements set out in Article 68 and of its internal control mechanisms, policies and procedures to identify, assess and manage risks (including conflicts of interest); the identity of any shareholders and members that have direct or indirect qualifying holdings in the applicant CASP and the amounts of those holdings, as well as proof that those persons are of sufficiently good repute.^[97]See above, under I.2.a).

The Commission Delegated Regulation (EU) 2025/305 specifies the in­for­ma­tion to be included in an application for authorisation as a CASP,^[98]See above, under I.2.b)aa). and the Joint ESMA/EBA Guidelines of 4 December 2024 govern the assessment of the suitability of the members of the management body of CASPs.^[99]See above, under II.2.

Second, NCAs must conduct an assessment of the completeness of the in­for­ma­tion listed in Article 62(2).

Third, NCAs must assess whether the applicant CASP complies with the requirements set out in Title V. This “assessment of application” must take into account the nature, scale and complexity of the crypto-asset services that the applicant CASP intends to provide. The NCA’s decision on granting or refusing an authorisation as a CASP must be fully reasoned.^[100]See above, under II.1.a).

(2) Under the conditions set out in Article 63(7) and (8), respectively, the NCAs shall refuse the granting of authorisation to an applicant CASP in the existence of close links between, first, the applicant CASP and other natural or legal persons and, second, the applicant CASP and other natural or legal persons through third-country-related impediments. NCAs are also required, under Article 63(10), to refuse authorisation as an applicant CASP if there are objective and demonstrable grounds that either raise concerns as to the quality of the CASP’s management and the influence of its shareholders, or that the applicant CASP fails or is likely to fail to meet any of the information-related, prudential or organisational requirements set out in Title V.^[101]See above, under II.1.b). The evaluation of these aspects is linked to supervisory considerations.

(3) Articles 68 and 72 further govern, respectively, governance arrangements and the identification, prevention, management and disclosure of conflicts of interest; they were presented with a focus on their relation to Articles 62-63.^[102]See above, under B.I. and B.II., respectively. These provisions form an integral part of the broader governance and organisational framework established by the MiCAR. Read together with Articles 62-63, they reflect the Regulation’s emphasis on effective corporate governance, sound risk management and the mitigation of conflicts of interest as essential safeguards for the provision of crypto-asset services. Their combined effect is to operationalise the principles of prudent management, accountability and client protection, thereby contributing to the attainment of MiCAR’s overarching objectives of ensuring market integrity, fostering confidence in crypto-asset markets and maintaining financial stability within the EU.