On 16 October 2024, the European Securities and Markets Authority (ESMA) issued an Opinion responding to the European Commission’s (Commission) proposal to amend the two draft regulatory technical standards (RTS) under the Markets in Crypto Assets Regulation (MiCAR) which specify the information to be included in:
- A notification by certain financial entities of their intention to provide crypto-asset services.
On 25 March 2024, ESMA published its first final report on draft technical standards specifying certain requirements of MiCAR (including the draft RTS on notifications and the draft RTS on authorisations) and submitted it to the Commission for adoption. On 3 September 2024, ESMA received two letters from the Commission informing ESMA that it intended to adopt the two proposed RTS with amendments, which were included in an Annex to the letters, and invited ESMA to submit new draft RTS to the Commission reflecting these amendments. The Opinion now published sets out ESMA’s view on how the draft RTS should be amended in light of the approach set out by the Commission.
ESMA notes the legal interpretation by the Commission limiting the mandates to ESMA in Articles 60(13) and 62(5) of MiCAR. However, ESMA also reiterates the importance of the policy objectives pursued by its initial proposal to require a cybersecurity audit realised by a third-party cybersecurity auditor. To ensure that crypto-asset service providers are subject to a thorough screening process, including in relation to their ICT systems, prior to their entering into the crypto-asset market, ESMA recommends that the Commission amends MiCAR’s level 1 text to include such a requirement for a cybersecurity audit realised by a third-party auditor at the time of the authorisation.
Next steps
The Opinion has been communicated by ESMA to the Commission, the European Parliament and the European Council.
The Commission may adopt the two draft RTS with the amendments it considers relevant or reject it. The European Parliament and the Council may object to an RTS adopted by the EC within a period of three months.