MiCAR Compass – helping institutions navigate effectively and efficiently through the implementation of MiCAR requirements

What are the MiCAR requirements?

We have developed the MiCAR Compass to provide a practical overview of the comprehensive regulatory requirements of the MiCAR for the European digital asset market. The framework breaks down the requirements into the regulatory dimensions of investor protection, market transparency, and organization, as well as the product and service portfolio.

What types of crypto assets and services are included in MiCAR?

MiCAR contains numerous requirements that can be roughly classified into the following two categories.

• MiCAR products include digital asset classes such as e-money tokens, asset-referenced tokens, and other crypto assets. These products are regulated by clear rules regarding their structure, disclosure requirements, and marketability.
• MiCAR services cover services such as the trading, custody and issuance of various digital assets and ensure compliance with strict rules to protect investors and ensure market integrity.

What are the regulatory objectives of MiCAR?

MiCAR’s regulatory requirements can be grouped into three clusters.

• Investor protection: measures and regulations ensure that investors are transparently informed about risks and are protected against potential losses.
• Market transparency: guidelines promote the fair and transparent operation of markets to prevent manipulation and abuse.
• Organization: requirements for the organizational structure and governance of service providers and token issuers provide stability, security and efficiency.

Figure 1: The MiCAR Compass provides an overview of MiCAR regulatory requirements in the digital asset business

The zeb.MiCAR Compass includes six requirement clusters

The MiCAR Compass categorizes requirements from the dimensions of investor protection, market transparency, and organization into specific business models for MiCAR products and services, resulting in the following requirement clusters.

PRODUCTS: REQUIREMENTS FOR TOKEN ISSUANCE  

• Investor protection: MiCAR prioritizes investor protection in token issuance by requiring token issuers to provide clear and comprehensible information about the crypto assets they offer. This includes creating a white paper that details all relevant aspects of the token, its underlying mechanism and potential risks.^[2] In addition, investors are granted a right of withdrawal to safeguard against poor decision-making. Transparent disclosure and risk information are key requirements to ensure that investors can make informed decisions.
• Market transparency: Market transparency is another key requirement in connection with token issuance. Token issuers must provide access to information about the token both before and after issuance, including, for example, the regular publication of reports and the provision of information on material changes that may affect the token. In addition, the consent of the token issuer must be obtained. These measures are intended to strengthen investor confidence in the market by minimizing information asymmetries and preventing the misuse of inside knowledge. In this context, the disclosure of ESG data is also becoming increasingly important. Token issuers should ensure that relevant ESG metrics that might impact the value or perception of the token are communicated transparently. Sustainability information on the token must also be provided. If energy consumption exceeds a certain threshold (500,000 kWh), additional information such as energy intensity and so-called Scope 1 and Scope 2 DLT GHG emissions must be published.
• Organization: Regarding organizational requirements, MiCAR emphasizes the importance of token issuers maintaining a robust corporate structure and governance. Companies issuing tokens must have adequate internal control systems to monitor their activities and manage risks. They are also obliged to protect customer funds and implement fraud prevention measures. Issuers need well-trained staff and clear processes for risk management and compliance to meet regulatory standards.

SERVICES: REQUIREMENTS FOR SERVICE PROVIDERS

• Investor protection: Service providers operating under MiCAR must ensure that the interests of investors are protected at all times. This includes the obligation to provide customers with comprehensive information about the risks associated with the crypto services they use and to ensure effective protection against fraud and cyberattacks. For instance, it is mandatory to assess the suitability of crypto asset services or assets for each customer. Clear conflict resolution procedures and mechanisms for the secure custody of customer funds must be implemented to ensure protection against loss or misuse.
• Market transparency: Transparency also plays a central role in the realm of crypto services. Providers must disclose comprehensive information about the services offered, associated costs and potential risks. They are also obliged to continuously update customers on any significant changes affecting the service. This ensures fair competition and protection against market abuse, such as inside trading. In addition, service-specific requirements, like the custody and administration of digital assets, must be considered. The disclosure of ESG-relevant aspects should also be part of transparency measures to meet both regulatory requirements and the growing interest of market participants.
• Organization: From an organizational perspective, service providers must ensure that they have appropriate internal control systems and compliance structures in place. This includes establishing a robust risk management system and clearly separating their own assets from customer funds. Service providers also need to maintain a stable IT infrastructure to comply with security standards and guarantee service integrity. Personnel and structural resources have to be available to meet MiCAR requirements in terms of governance and internal processes.

How can organizations achieve MiCAR compliance?

A structured procedure is essential for the implementation of the MiCAR requirements. The following approach, which has been tried and tested by zeb, can be utilized for this purpose.

Figure 2: Steps to achieve MiCAR compliance

1. Creating a target state of the service portfolio:The starting point for the implementation of the MiCAR requirements is to define a target state for the business model under MiCAR. Identifying relevant token types (such as e-money tokens, asset-referenced tokens, or other token types) and services is crucial, as this establishes the framework for future processes and requirements.
2. Deriving relevant requirements:In the second step, specific MiCAR requirements are derived from the envisaged service portfolio. A structured approach is essential for this step, which is why the use of the zeb.MiCAR Compass is particularly recommended.
3. Developing an organizational target state:Next, a rough target state of a MiCAR-compliant organization is developed, which maps the requirements to the institution’s intended services.
4. Performing a gap analysis and defining change measures:The next step is a gap analysis, comparing the organizational and technical status quo of the institution with the organizational target state. This step is particularly important for institutions with an existing securities business, as they already meet many requirements through their current organization. Appropriate change measures are then defined to close identified gaps.
5. Implementing the measures:The final step involves implementing the defined change measures to achieve the organizational target state, thereby establishing the basis for the envisaged business model under MiCAR.

What success factors need to be considered when implementing MiCAR?

These five success factors are critical to the implementation of MiCAR:

• Addressing MiCAR requirements early to gain a clear understanding of their impact on processes and products
• Ensuring close collaboration between various departments along the value chain, such as Compliance, IT, Legal, and Sales
• Conducting training and employee communication to raise employee awareness of the new MiCAR requirements and processes
• Adapting risk management to identify and minimize potential operational risks
• Performing a continuous monitoring and reporting to ensure ongoing compliance with the provisions; tracking amendments to the regulation to implement additional requirements where necessary