CSSF Circular 25/873 on EBA Guidelines for Recovery Plans under Regulation (EU) 2023/1114

Circular CSSF 25/873 Application of the Guidelines of the European Banking Authority on recovery plans under Articles 46 and 55 of Regulation (EU) 2023/1114 (EBA/GL/2024/07)

CIRCULAR CSSF 25/873 2/3 Circular CSSF 25/873 Application of the Guidelines of the European Banking Authority on recovery plans under Articles 46 and 55 of Regulation (EU) 2023/1114 (EBA/GL/2024/07) To all the issuers, as defined in Article 3(1), point 10 of Regulation (EU) 2023/11141 (“MiCAR”), of asset-referenced tokens (“ARTs”) and e-money tokens (“EMTs”) as defined in Article 3(1), points 6 and 7 of MiCAR. Luxembourg, 17 February 2025 Ladies and Gentlemen, The purpose of this circular is to inform you that the CSSF, in its capacity as competent authority, applies the Guidelines of European Banking Authority (the “EBA”) on recovery plans under Articles 46 and 55 of MiCAR (Ref. EBA/GL/2024/07) (the “Guidelines”), published on 13 June 2024. Consequently, the CSSF has integrated the Guidelines into its administrative practice and regulatory approach with a view to promoting supervisory convergence in this field at European level.

1. The Guidelines The Guidelines are issued by the EBA on the basis of Article 46(6) of MiCAR pursuant to Article 16 of Regulation (EU) No 1093/2010. The Guidelines apply as from 13 November 2024. These guidelines specify the format and the information that should be contained in the recovery plan that issuers of ARTs and issuers of EMTs have to draw up and maintain according to Articles 46 and 55 of MiCAR. The Guidelines are attached to this circular and are available on the EBA’s website https://www.eba.europa.eu/.
2. Scope of application This circular shall apply to issuers of ARTs and EMTs as defined in Article 3(1), points 6 and 7 of MiCAR. 1 Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto￾assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937

CIRCULAR CSSF 25/873 3/3 3. Date of application This circular shall apply with immediate effect. Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General Annex EBA Guidelines on recovery plans under Articles 46 and 55 of Regulation (EU) 2023/1114 (EBA/GL/2024/07)

EBA/GL/2024/07 13 June 2024 Final Report Guidelines on recovery plans under Articles 46 and 55 of Regulation (EU) 2023/1114

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 2 Contents Final Report 1 1.Executive Summary 3 2.Background and rationale 4 3.Guidelines 7 Guidelines 8 1.Compliance and reporting obligations 9 2.Subject matter, scope and definitions 10 3.Implementation 12 5.Accompanying documents 29

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 3

1. Executive Summary Regulation (EU) 2023/1114 on markets in crypto-assets (MiCAR) establishes a holistic approach for the regulation of crypto-asset issuance and crypto-asset service provision in the EU. Articles 46 and 55 of MiCAR set out an obligation for issuers of asset-reference tokens (ARTs) and issuers of e￾money tokens (EMTs) to develop and maintain a recovery plan providing for measures to be taken by the issuer to restore compliance with the requirements applicable to the reserve of assets in cases where the issuer fails to comply with those requirements. This requirement is imposed on all issuers, regardless of whether the tokens are classified as significant. These guidelines specify the format of the recovery plan and the information to be provided therein. The guidelines set out that recovery plans should comprise four elements: a summary of the key elements of the recovery plan, the information on governance, the description of the applicable recovery options, and a communication and disclosure plan. As part of the information on governance, issuers should include in the recovery plan a minimum set of categories of recovery plan indicators. Among these categories, issuers should identify and calibrate the most relevant recovery plan indicators based on their specific risk profile and operating environment. When assessing what type of indicators will be included in the recovery plan, issuers should consider carefully the type of events that may lead to a breach of the regulatory requirements applicable to the reserve of assets. Recovery plan indicators should be of both quantitative and qualitative nature. Moreover, all issuers should include a de-pegging risk indicator, aimed to keep track of the alignment between the market price of the token and the market value of the referenced asset(s). The guidelines also provide guidance on the steps to take in case of breaches of recovery plan indicator thresholds. When drafting the recovery plan, each issuer should identify the most appropriate recovery options based on the size, complexity, business model, as well as the type of token. Among these, issuers should include at least one recovery option that would strengthen the capital position and one recovery option aimed at improving the liquidity position of the issuer. Issuers should also lay down in their recovery plan an adequate number of scenarios whose nature is sufficiently varied to cope with a wide range of shocks. Finally, the guidelines include provisions aimed to avoid inconsistencies and overlaps with other recovery plans, either drafted under MiCAR (i.e. in case of multiple issuers of the same token or in case of issuers offering two or more tokens to the public) or under the Directive 2014/59/EU (so￾called ‘BRRD’).

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 4 2. Background and rationale Pursuant to Articles 46 and 55 of Regulation (EU) 2023/1114 ('MiCAR’), issuers of asset-referenced tokens (ARTs) and issuers of e-money tokens (EMTs) have to draft and maintain a recovery plan laying down measures to be taken by the issuer to restore compliance with the requirements applicable to the reserve of assets in cases where the issuer fails to comply with those requirements. In addition, pursuant to Article 46 MiCAR, recovery plans shall include: (i) the preservation of the issuer’s services related to the tokens; (ii) the timely recovery of operations; (iii) the fulfilment of the issuer’s obligations in the case of events that pose a significant risk of disrupting operations; (iv) appropriate conditions and procedures to ensure the timely implementation of recovery actions; and (v) a wide range of recovery options. Article 46(6) of MiCAR further mandate the EBA to ‘‘issue guidelines in accordance with Article 16 of Regulation (EU) No 1093/2010 to specify the format of the recovery plan and the information to be provided in the recovery plan”. Through recovery planning, issuers of ARTs and EMTs should prepare in advance to face adverse scenarios that may impact on their ability to comply with the regulatory requirements applicable to the reserve of assets, inter alia by identifying and understanding their own risks and laying down possible actions to restore compliance with regulatory requirements. The drafting of a recovery plan should create awareness and preparedness and enable the issuer to consider and evaluate pre￾emptively the most appropriate and effective mitigation actions, without the pressures resulting from actual severe stress. In specifying the format and the information to be contained in the recovery plans, these guidelines are largely based on the existing legislative framework and supervisory experience with recovery planning for credit institutions adapted, where relevant, to reflect the specificities of ART and EMT issuers. Accordingly, the recovery plan should be composed of three key elements (information on governance, recovery options and a communication and disclosure plan) preceded by a summary. However, considering that MiCAR provisions on recovery planning are less comprehensive and detailed and also lack sufficient industry experience, these guidelines are based on high-level principles on the key elements of the recovery plan, as well as on the minimum list of categories of recovery plan indicators that issuers of ARTs and EMTs should include in their recovery plans. Recovery plan indicators allow the issuer to identify any emerging risks that, if unmitigated, could develop into severe stress situations. With an adequate framework of recovery plan indicators, the issuer can establish predetermined criteria that may signal the necessity of an increased monitoring or the activation of the recovery plan. In other words, these criteria should be set in a way to allow the issuer to monitor, escalate and activate recovery options as appropriate. Therefore, as part of the information on governance, each issuer should include the most appropriate recovery plan indicators and thresholds that reflect the issuer’s specific size, complexity, nature and business model as well as the token’s specific risk profile and operating environment. When doing so, each issuer should also carefully consider the types of events that may lead to a breach of the regulatory requirements applicable to the reserve of assets and calibrate the recovery plan indicators accordingly. For this reason, rather than setting a minimum list of indicators, these guidelines set a minimum list of

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 5 categories of recovery plan indicators and in Annex I provide an illustrative list of recovery plan indicators that issuers could use as an inspiration. The EBA is of the view that it is key that issuers consider that circumstances where the market price of the token is different than the market price of the referenced asset(s) are likely to determine an increase in redemption requests. The likelihood of sizeable redemption requests is larger when the loss of peg persists over an extended period of time or is of material amount. Therefore, issuers should always include appropriate indicators related to the referenced asset(s) and among these at least the de-pegging risk indicator. For breaches to recovery plan indicator thresholds to effectively fulfil their warning potential, the recovery plan should include how the issuer intends to (i) quickly activate a proper internal escalation process in case of breach and (ii) promptly communicate said breach to the supervisor, so that a constructive dialogue can start. With timing being crucial in deteriorating situations, issuers should ensure that both the processes above take place in a timely manner. Considering that the execution of recovery actions is more difficult when the amount at stake is larger, issuers of significant tokens are expected to apply shorter timeframes to activate these processes. As the ultimate goal of the recovery plan is to demonstrate the issuer’s capacity of restoring compliance with the regulatory requirements by taking appropriate and timely actions, it is crucial that recovery plans lay down a wide range of recovery options in addition to those laid down in MiCAR. In situations of stress, it may be difficult for issuers to restore compliance with the regulatory requirements applicable to the reserve of assets by means of actions that aim to stabilise the liquidity of the reserve of assets only by imposing redemption fees or by limiting or stopping redemptions, as these may not be able to limit the deterioration of the value or of the liquidity of the reserve of assets. Therefore, while issuers are free to include the recovery options that they consider more effective based on their size, complexity, nature and business model, they should always include in their recovery plan at least one recovery option aimed to strengthen the capital position of the issuer and one recovery option aimed to improve the liquidity position of the issuer. To enhance their recovery capacity, when drafting the recovery plan issuers should use financial system-wide distress scenarios and idiosyncratic financial and non-financial distress (including services distress) scenarios to test their recovery planning capabilities. Considering the different type of entities that could become issuers of asset-referenced tokens and e￾money tokens, these guidelines do not provide a minimum list of services that issuers need to preserve pursuant to Article 46(1) of MiCAR. With a view to increasing transparency for token holder and the public, these guidelines consider it crucial that issuers have in place, as part of their recovery plan, a communication and disclosure plan, outlining how the issuer intends to inform token holders and other stakeholder about the implementation of recovery options and to manage possible negative market reactions. Finally, these guidelines include provisions aimed to avoid inconsistencies and overlaps with other recovery plans, either drafted under MiCAR (i.e. in the case of multiple issuers of the same token and in the case of an issuer offering two or more tokens to the public) or under other EU sectorial legislation

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 6 (i.e. under the Directive 2014/59/EU1 , so-called ‘BRRD’ and under Regulation (EU) 2022/25542 , so￾called ‘DORA’). Indeed, the EBA considers it is crucial that, for instance, multiple issuers of the same token calibrate the recovery plan indicators thresholds at the same level and implement recovery options in a coordinated manner to ensure all token holders are treated fairly. In addition, considering the principle of proportionality the EBA is of the view that a certain level of integration of recovery plans drafted in compliance with MiCAR and with the BRRD should be explored, with issuers already subject to draft recovery plans under the BRRD being able to provide the information laid down in these guidelines in a streamlined manner. The application of this option should be subject to the agreement of both authorities supervising compliance with MiCAR and the BRRD (in case these differ) and in full compliance with the confidentiality requirements laid down in the BRRD. However, the EBA is of the view that this option should not apply to credit institutions and investment firms issuing significant ARTs, as these would be subject to its direct supervision. 1 Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending Council Directive 82/891/EEC, and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012, of the European Parliament and of the Council (OJ L 173, 12.6.2014, p. 190). 2 Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 7 3. Guidelines

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 8 EBA/GL/2024/07 13June 2024 Guidelines on recovery plans under Articles 46 and 55 of the Regulation (EU) 2023/1114

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 9

1. Compliance and reporting obligations Status of these guidelines
2. This document contains guidelines issued pursuant to Article 16 of Regulation (EU) No 1093/20103 . In accordance with Article 16(3) of Regulation (EU) No 1093/2010, competent authorities and financial institutions must make every effort to comply with the guidelines.
3. Guidelines set the EBA view of appropriate supervisory practices within the European System of Financial Supervision or of how Union law should be applied in a particular area. Competent authorities as defined in Article 4(2) of Regulation (EU) No 1093/2010 to whom guidelines apply should comply by incorporating them into their practices as appropriate (e.g. by amending their legal framework or their supervisory processes), including where guidelines are directed primarily at institutions. Reporting requirements
4. According to Article 16(3) of Regulation (EU) No 1093/2010, competent authorities must notify the EBA as to whether they comply or intend to comply with these guidelines, or otherwise with reasons for non-compliance, by 13/11/2024. In the absence of any notification by this deadline, competent authorities will be considered by the EBA to be non-compliant. Notifications should be sent by submitting the form available on the EBA website with the reference ‘EBA/GL/2024/07’. Notifications should be submitted by persons with appropriate authority to report compliance on behalf of their competent authorities. Any change in the status of compliance must also be reported to EBA.
5. Notifications will be published on the EBA website, in line with Article 16(3). 3 Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC, (OJ L 331, 15.12.2010, p.12).

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 10 2. Subject matter, scope and definitions Subject matter 5. These guidelines specify the format and the information that should be contained in the recovery plan that issuers of asset-referenced tokens and issuers of e-money tokens have to draw up and maintain according to Articles 46 and 55 of Regulation (EU) 2023/11144 . Scope of application 6. These guidelines apply in relation to issuers of asset-referenced tokens and e-money tokens as defined in points 6 and 7 of Article 3(1) of Regulation (EU) 2023/1114 (hereinafter, for the purposes of these guidelines, jointly referred as the ‘issuers’). 7. Any provision of these guidelines relating to the content of the recovery plan as regards the reserve of assets, including paragraph 29, number 1) and 3), paragraph 30, number 6) and 7), paragraph 31 and paragraph 53, does not apply to issuers of e-money tokens that are not subject to the requirement to hold a reserve of assets in accordance with Regulation (EU) 2023/1114. Addressees 8. These guidelines are addressed to competent authorities as defined in Article 3(1) point (35) of Regulation (EU) No 2023/1114. 9. These guidelines are also addressed to the issuers, as defined in point 10 of Article 3(1) of Regulation (EU) 2023/1114, of: a) asset-referenced tokens as defined in Article 3(1), point 6 of that Regulation (issuers of asset-referenced tokens -ARTs-); and b) e-money tokens defined in Article 3(1), point 7 of that Regulation (issuers of e-money tokens -EMTs-). Definitions 10. Unless otherwise specified, terms used and defined in Regulation (EU) 2023/1114 have the same meaning in the guidelines. In addition, for the purposes of these guidelines, the following definitions apply: 4 Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (OJ L 150, 9.6.2023, P.40).

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 11 Term Definition De-pegging risk is the risk that the value of the asset-referenced token or e-money token misaligns with that of the market value of the reference asset(s), i.e. that differences between the market value of the token and the market value of the asset referenced arise. Multi-chain issuance refers to an asset-referenced token or an e-money token that is issued and distributed on more than one distributed ledger technology (DLT) or similar technology Overall recovery capacity refers to the ability to recover by implementing recovery options in a range of financial and non￾financial distress scenarios

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 12 3. Implementation Date of application 11. These guidelines apply from 13/11/2024.

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 13 4. Recovery plans for issuers of asset￾referenced tokens and issuers of e￾money tokens 4.1 Proportionality consideration 12. To ensure that the information to be provided in a recovery plan, its format and its review by competent authorities is consistent with the individual risk profile, the nature and the business model of the ARTs or EMTs issuer and the scale and complexity of its activities, issuers and competent authorities should, when drawing up or assessing recovery plans, have regard to the principle of proportionality. 13. To apply the previous paragraph, issuers and competent authorities should take into account all of the following criteria: a. the size, complexity, nature and business model of the issuer; b. the classification of the asset-referenced token or e-money token issued as significant pursuant to Articles 43 and 44 and Articles 56 and 57 of Regulation (EU) 2023/1114; c. for issuers of asset-referenced tokens, the size, volatility, composition, concentration and nature of the reserve assets and of the asset-referenced token itself; d. for issuers of e-money tokens, the size, volatility, composition, and concentration of the assets backing the funds received; e. the significance and risk profiles of Crypto Asset Service Providers used in rendering the services related to the asset-referenced tokens or e-money tokens issued by the respective issuer; f. the significance and risk profiles of DLT networks which are used by the respective issuer in order to issue asset-referenced tokens or e-money tokens through them; g. the risk profile of third party providers other than Crypto Asset Service Providers and DLT networks which provide a significant or a critical ICT service to the respective issuer. 14. For the application of the principle of proportionality, issuers of tokens that are classified as significant should apply the requirements set out in paragraph 62 at least on annual basis and include in their recovery plan all categories of recovery plan indicators laid down in paragraphs 29 and 30. 4.2 Content of the recovery plan 15. The recovery plan should be made up of all the following elements:

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 14 a) The summary of the key elements of the recovery plan, as further specified in Section 4.3 of these guidelines. b) Information on governance, including a framework of recovery plan indicators and monitoring thresholds, as further specified in Section 4.4 of these guidelines. c) The description of the applicable recovery options, including at least a recovery scenario analysis, a description of preparatory measures and information on the preservation of services as further specified in Section 4.5 of these guidelines. d) The recovery plan’s communication and disclosure plan, as further specified in Section 4.6 of these guidelines. 4.3 Summary of the key elements of the recovery plan 16. Issuers should include in their recovery plan a summary of the key elements of the recovery plan as laid down in letters (b), (c), and (d) of paragraph 15. 17. In the summary of the key elements of the recovery plan, issuers should also list and highlight the main changes to the previous version of the recovery plan submitted to the competent authority. 4.4 Information on governance 18. Issuers should include in their recovery plan a clear and detailed description of the governance processes related to the development, maintenance and implementation of the recovery plan. 19. The information on governance referred to in the previous paragraph should cover at least the following: a) the role(s) and function(s) of the person(s) responsible for preparing, implementing and updating the plan; b) the description of how the recovery plan fits with the issuer’s internal governance, business strategy and risk management framework (including the risk appetite statement); c) the description of the processes and timeframes to be used for the periodical update of the plan and for updating it to respond to any material changes affecting the specific token, the issuer or its environment; d) the policies and procedures governing the approval of the recovery plan and its reviews and updates; e) the description of the escalation procedures, meaning the conditions and procedures necessary to ensure the timely implementation of particular recovery options foreseen in the recovery plan. These should include at least clear information on the decision￾making process with regard to the activation of the recovery plan based on a clearly detailed escalation process that applies when a breach of a recovery plan indicator

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 15 threshold is detected or is likely to materialise in the near future, to consider and determine which recovery option may need to be applied to restore the compliance with the relevant regulatory requirements applicable to the reserve of asset or to continue rendering services related to the relevant token; f) the time limit for the decision on taking recovery actions and the point in time, as well as the modalities, for informing the competent authority; g) the description of quantitative and qualitative indicators reflecting possible vulnerabilities, weaknesses or threats to the amount, liquidity and allocation of the reserve of assets and the funds that issuers have to maintain at any time pursuant to Regulation (EU) 2023/1114, as further specified in paragraphs 22-41. 20. Where the issuers have entered into an arrangement with third party entities for operating the reserve of assets, and for the investment of the reserve of assets, for the custody of the reserve of assets, and, where applicable, for the distribution of the tokens to the public pursuant to point (5)(h) of Article 34 of Regulation (EU) 2023/1114, they should include in their recovery plan a clear and detailed description of the processes established to exchange information in a way that would ensure the timely activation of the escalation process laid down in paragraph 37 in case a breach of a recovery plan indicator threshold is detected, either by the issuer or by the relevant third party entity. The issuer should also specify in the recovery plan how the agreement with any of those third parties ensures the information is timely shared in a way that would allow the issuer to be aware of the breach or to acknowledge that the breach is likely to occur in the near future so that the plan can be activated in a timely manner. 21. In addition, issuers should ensure that actions foreseen in their recovery plan are consistent with the ICT response and recovery plan requirements as well as with other relevant parts of the ICT risk management laid down in Regulation (EU) 2022/25545 , when the relevant issuers were also subject to those requirements. Recovery plan indicators and monitoring thresholds 22. Issuers should lay down in the recovery plan an adequate framework of recovery plan indicators, via which the issuer can establish predetermined criteria that may signal the necessity of an increased frequency of monitoring or the activation of the recovery plan. These criteria should be set in a way to allow the issuer to monitor, escalate and activate recovery options as appropriate. 23. Recovery plan indicators should reflect both the token’s and the issuer’sspecific risk profile and operating environment. As such, the calibration of recovery plan indicators and thresholds should be applied at the level of the token, except for the capital adequacy indicators that should be calibrated at the level of the issuer, based on its specific size, complexity, nature and business model and the operational risk indicators and the market confidence indicators that should be calibrated both at the level of the issuer and at the level of the token. 24. When assessing what type of indicators will be included in the recovery plans, each issuer should carefully consider the types of events that may lead to a breach of regulatory 5 Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 16 requirements and elaborate specific indicators based on its internal risk assessment. Therefore, issuers should consider the list of indicators provided in Annex I as illustrative, so they may choose any or all of the indicators under each category. 25. In addition, issuers should not limit their set of recovery plan indicators to the list provided in Annex I. Rather, they should consider the inclusion of the most appropriate indicators, even if not included in Annex I, based on the criteria laid down in these guidelines, including for instance indicators that would be helpful to address environmental, social and governance risks, and in any other circumstances when issues on a relevant field were identified. 26. Issuers should ensure that the list of recovery plan indicators and the calibration of their threshold is based on their internal risk assessment and that it is always consistent with its risk appetite framework. Changes to the issuers’ risk appetite should trigger a review of the list of recovery indicators and thresholds, aimed to assess that they remain suitable in case of changes to their risk appetite framework. 27. Issuers should include in the recovery plan that they will monitor the recovery plan indicators with an adequate frequency which would allow the timely submission of the indicators’ data records to the competent authority upon request. Issuers should also specify how they will monitor said indicators. 28. Issuers should include recovery plan indicators of both quantitative and qualitative nature. When setting the quantitative recovery plan indicator thresholds, consistently with their overall risk management framework set up in accordance with Article 45(3) and 45(7)(b) of Regulation (EU) 2023/1114, issuers should use progressive metrics (‘traffic light approach’) in order to inform the issuer’s management body that such indicator threshold could potentially be reached. 29. Issuers should include in the recovery plan at least the following categories of recovery plan indicators, as further detailed in Annex I (Section A – “Minimum categories for all issuers of ARTs or EMTs”), in particular:

1. liquidity risk indicators, informing the issuer of a potential or actual deterioration of the liquidity profile of the reserve of assets;
2. operational risk indicators, describing the potential risks resulting from inadequate or failed internal processes, people and systems or from external events, including legal risk. When calibrating this type of indicators, issuers should specifically take into account the type of underlying technology (e.g. permissioned/permissionless distributed ledger) as well as its complexity (e.g. the existence of bridges, the quality of the cryptography, etc). Issuers should also consider that relying on a unique and complex infrastructure rather than on a standard one may have repercussions not only on the ability to replace it, but also on the availability of people able to maintain and fix it. In case of multi-chain issuances, issuers should include specific indicators for each distributed ledger technology used to distribute the asset-referenced token and/or the e-money token;
3. credit risk/asset-quality indicators, measuring the asset quality evolution of the reserve of assets;

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 17 4) referenced asset(s)-related indicators, measuring the risk of massive redemption requests, e.g. triggered by the loss of peg; 5) capital adequacy indicators, measuring the potential deterioration in the quantity and quality of the capital position of the issuer, including the level of compliance with the own funds requirements laid down in Article 35 of Regulation (EU) 2023/1114. The calibration of such indicators should be set above their applicable minimum regulatory requirement. Capital adequacy indicators should only be used by issuers of asset￾referenced tokens and e-money tokens that are not credit institutions. 30. Issuers should also include in the recovery plan the following categories of recovery plan indicators, as further detailed in Annex I (Section B – Additional minimum categories for issuers of significant ARTs and EMTs, and for other issuers that do not provide appropriate justification for the non-inclusion to the competent authority): 6) market risk indicators, stemming from all the positions included in the reserve of assets, including the volatility related to that of the asset(s) referenced; 7) concentration risk indicators, highlighting the excessive exposure of the reserve of assets to a single counterparty or an interconnected set of counterparties; 8) market confidence indicators, capturing the potential negative perception of market participants of the issuer or the token that could disrupt the issuer’s access to funding and capital markets or determine a rapid increase of redemption requests; 31. By way of derogation, issuers of non-significant tokens are exempted from including the categories of recovery plan indicators laid down in the previous paragraph as long as they provide appropriate justifications to their competent authority that such categories are not suitable or relevant to the risk profile, business model, size and/or complexity of the issuer. 32. Among the referenced asset(s)-related indicators, issuers should always incorporate at least a de-pegging risk indicator, aimed to capture the risk that the market value of the token differs from the market value of the asset(s) referenced. The de-pegging risk indicator should be measured as the ratio between the market value of the token and the market value of the referenced asset(s) and is expected to equal 1 at all times, with a tolerance interval not exceeding 1%. Instances of ratios lower than 1 should trigger the issuer’s action as laid down in its recovery plan. 33. Issuers should clearly describe in the recovery plan to the satisfaction of the competent authority how the calibrations of the recovery plan indicators have been determined and how the thresholds would be breached early enough to be effective. 34. Issuers should describe in the recovery plan how they will regularly monitor and update the appropriateness of the recovery plan indicators and the calibration of their thresholds. In particular, issuers should specify how they would ensure the recovery plan is updated where it is needed due to a change in the financial and business situation of the issuer and/or of the specific token. Issuers should include in the recovery plan that any update in the calibration of recovery plan indicator thresholds should be promptly notified and explained to the competent authority. Issuers should ensure at all times that the recovery plan indicators and their thresholds are fully consistent with the issuers’ risk management framework.

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 18 35. The content of the recovery plan should be drawn by issuers considering that there should be no automaticity in the activation of recovery options upon breaching recovery plan indicator thresholds, and that it would be for the issuer to decide whether and when to activate the recovery plan in the case of a breach. When calibrating the recovery plan indicators, issuers should ensure that they have this decision point at an early enough stage to be able to implement action if needed. 36. Issuers should set out in the recovery plan their internal decision-making process. Issuers should ensure that said process would be thorough and well-grounded, in line with paragraphs 39, 40 and 41. In addition, issuers should state in their recovery plan that, whether the issuer decides to take action or not, they will keep an open and active dialogue with the competent authority. 37. For breaches of recovery plan indicator thresholds to effectively fulfil their warning potential, issuers should lay down in their recovery plan that they will promptly and in any event: • within maximum 24 hours from the breach of the recovery plan indicator threshold, alert the issuer’s management body by activating the appropriate escalation process in order to ensure that any breach is considered and, where relevant, acted upon; and • at the latest within 24 hours following the activation of the internal escalation process, notify the breach of the recovery plan indicator threshold to the competent authority. 38. To account for the probability that the timeframes set under the previous paragraph may not allow the issuer to react to the breach of a threshold in a timely manner, issuers should determine the most appropriate time limit for the execution of those activities, on the basis of the specificities of its operations, size and complexity of the reserve of assets. In any case, the timeframes specified in the previous paragraph should not be extended. 39. Issuers should specify in the recovery plan that where a recovery plan indicator threshold has been breached, the management body of the issuer will assess the situation, decide whether to trigger the activation of the recovery plan and promptly notify the competent authorities. Issuers should also include in the recovery plan that the decision to activate the recovery plan will cover the type of recovery actions to be taken. 40. Issuers should also specify in the recovery plan that the decision referred to in the previous paragraph should be based on a reasoned analysis of the circumstances surrounding the breach. 41. Issuers should describe in the recovery plan that where they decide to take action in accordance with the recovery plan, the competent authority will be provided, without undue delay, with an action plan based on a list of credible and feasible recovery options to be used in this stress situation, together with a time plan to remediate the breach. The recovery plan should also include that, if no action has been decided, the competent authority will be provided with an explanation clearly articulating the reasons why and, where appropriate, demonstrating how the restoration of specific types of indicators and their breaches is possible without the use of recovery measures. 4.5 Recovery options

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 19 42. Issuers should lay down in their recovery plan a range of recovery options that are tailored on the issuer’s business model and the nature of the asset-referenced or e-money token issued. 43. As regards the recovery options laid down in Article 46 of the Regulation (EU) 2023/1114, issuers should apply the following: a) the recovery plan should set a maximum amount for liquidity fees to be imposed on redemptions and lay down how the duration of the measure will be communicated to the public; b) in setting the maximum amount of liquidity fees to be imposed on redemptions, issuers should ensure that this recovery option is not applied as a means to increase the issuer’s liquidity resources at the expenses of token holders. Issuers should ensure that this recovery option is applied only temporarily during the distress phase with the sole purpose to reduce redemption requests while stabilising the value of the token; c) the recovery plan should set out different quantitative levels of limits on the number or amount of tokens that can be redeemed on any working day. These levels should be determined based on the severity of the breach(es) of recovery plan indicator threshold(s) and should be set both at aggregate level (e.g. as a percentage of the entire amount of tokens issued) and at wallet level; d) the recovery plan should explain what other remedial actions the issuer will take once it has suspended redemptions. Issuers should include in their recovery plan that they will consider that suspending redemptions could negatively impact their reputation and the confidence of token holders and result in higher volumes of redemption requests once the suspension is lifted. Issuers should include in their recovery plan that they will especially consider whether the lift of the suspension should be accompanied by other measures, including but not limited to liquidity fees or limits to the amount of tokens that can be redeemed on a daily basis; e) issuers should include in the recovery plan how they plan to restore compliance with the regulatory requirements and clearly communicate to the market the next steps. 44. In addition to the recovery options listed in Article 46 of the Regulation (EU) 2023/1114, issuers should include at least one recovery option that would strengthen the capital position and one recovery option aimed at improving the liquidity position of the issuer. A non-exhaustive list of possible recovery options is provided in Annex III. 45. The recovery plan should also include details of any preparatory measure that the issuer should take to facilitate the implementation of the recovery plan or to improve its effectiveness together with a timeline for implementing those measures, as well as a description of any measures necessary to overcome impediments to the effective implementation of recovery options which have been identified in the recovery plan. 46. For every recovery option, issuers should include in the recovery plan a feasibility assessment, which covers at least: a) the assessment of the risks associated with the recovery option, whenever possible drawing on any experience of executing the recovery option or an equivalent measure; and

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 20 b) an analysis and description of any material impediment to the effective and timely execution of the recovery option and a description of whether and how such impediments could be overcome. 47. In addition, issuers should outline for every recovery option how the continuity of operations will be ensured when implementing that option. This should include an analysis of internal operations (e.g. information technology systems, suppliers and human resources operations) and of the access of the issuer to key services from third parties which are essential for the regular conduct of its operations. 48. To prove the credibility of recovery options, issuers should provide quantitative and qualitative evidence to support the expected benefits of each option. In any case, the recovery plan should detail at least the items listed in Annex II. 49. Issuers also operating businesses other than the issuance of asset-referenced tokens and/or e￾money tokens should assess the implications for their overall recovery capacity arising from those other businesses and should include in the recovery plan that they will adopt the most appropriate measures to ensure compliance with Articles 46 and 55 of Regulation (EU) 2023/1114. 50. Issuers should include in their recovery plan how they plan to monitor the implementation of the recovery options to ensure that the execution of the recovery plan is likely to restore compliance with the regulatory requirements applicable to the reserve of assets. 51. Issuers should include in the recovery plan the process envisaged for the implementation phase, always including an open and active dialogue with the competent authority to ensure a smooth transition towards the implementation of the issuer’s orderly redemption plan pursuant to Articles 47 and 55 of Regulation (EU) 2023/1114 should it become clear that compliance with regulatory requirements applicable to the reserve of assets cannot be restored. Recovery scenarios 52. Issuers should ensure to lay down in their recovery plans an adequate number of scenarios whose nature is sufficiently varied to cope with a wide range of shocks. 53. When developing their recovery plans, issuers should use financial system-wide distress scenarios and/or idiosyncratic financial distress scenarios and/or non-financial distress (including services distress) scenarios to test their recovery planning capabilities. Scenarios used for recovery planning should be designed in a way that would threaten the issuer’s compliance with requirements applicable to the reserve of assets if the issuer did not implement recovery measures in a timely manner. The number and complexity of scenarios should be determined by each issuer taking into account the principle of proportionality in line with Section 4.1. Preservation of services 54. Issuers should lay down in the recovery plan how they intend to recover operations in a timely manner and fulfil their obligations in case of events that pose a significant risk of disrupting operations. Issuers should also list in the recovery plan the services they intend to preserve based on their business model and detail how they will ensure the preservation of the services

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 21 related to asset-referenced and e-money tokens. The list of services to be preserved should at least include services related to the issuance and the redemption of tokens. Where the implementation of the recovery options has the potential to negatively impact the issuer’s provision of any of the services identified, the description of the recovery options should outline how the issuer plans to ensure the continuity of said services when implementing the recovery plan. 55. Issuers that operate payment arrangements in euro – as defined by the Eurosystem oversight framework for electronic payment instruments, schemes and arrangements (PISA framework) – should ensure that recovery actions foreseen in the recovery plan are consistent with the objective to maintain adherence to the principles outlined in the PISA framework. 56. In addition, issuers should ensure that actions foreseen in their recovery plan do not unduly affect the ability of any Crypto Asset Service Providers they deal with 6 to comply with Regulation (EU) 2022/2554. 4.6 Communication and disclosure plan 57. Issuers should include in the recovery plan a communication and disclosure plan outlining how the issuer intends to inform token holders and other stakeholders, including the public, about the implementation of the recovery options. The communication and disclosure plan should also include effective proposals to manage any potentially negative market reaction. 58. The communication and disclosure plan should clarify how the issuer intends to communicate: a) internally, in particular to staff, works councils and other staff representatives, if any; and b) externally, in particular to token holders, shareholders and other investors, competent authorities, financial markets and financial market infrastructures, other counterparties and the general public, as appropriate. 59. In the communication and disclosure plan issuers should also include how they will ensure the preservation of its token-related services, the foreseen timelines for recovering its operations and for the fulfilment of its obligations. The communication and disclosure plan should also cater for scenarios in which it is unlikely that the issuer will recover operations or will fulfil its obligations, thus leading to the activation of the issuer’s redemption plan. 60. The communication and disclosure plan should clarify the (mix of) communication channels and the strategies that the issuer intends to use during the recovery phase. In doing so, issuers should consider that: a) different stakeholders may have different communication needs; b) internal and external stakeholders may need to be informed at different stages; and 6 Reference is made to Crypto Asset Service Providers (CASP) providing custodial services, offering exchange services for conversion of ART to fiat and vice-versa. The recovery actions undertaken by the issuer should not conflict with the ability of the CASPs to maintain compliance with DORA Regulation.

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 22 c) different recovery options may warrant specific communication strategies. 4.7 Format and maintenance of the recovery plan 61. Issuers should draft their recovery plan in a clear and understandable language. The recovery plan should be complete, self-explanatory, accurate and contain at least all the information listed in these guidelines. 62. Issuers should include in their recovery plan that the information provided therein will be updated periodically and at least every time there is a material change in the business or financial profile of the issuer and/or of the token issued. Any review or update of the plan should be notified to the competent authority without undue delay. Issuers of significant tokens should include in their recovery plan that they will update the information provided therein at least on an annual basis. 4.8 Interaction between different recovery planning obligations Multiple issuers of the same token and issuers offering two or more tokens to the public 63. When an asset-referenced token or an e-money token is issued by multiple issuers, all issuers should include in their recovery plan how they will ensure effective coordination among the respective recovery plans. In particular, issuers should establish in their recovery plan appropriate measures aimed at ensuring that: a) recovery plan indicators are aligned to the maximum possible extent; b) thresholds of token-related recovery plan indicators are set at the same level; c) recovery options laid down in each plan are consistent with each other; d) the activation and execution of the respective recovery plans is agreed and coordinated among all issuers; e) the implementation of certain recovery options by one of the issuers does not unduly impact on the implementation of other recovery options by the other issuers; f) the execution of the recovery plans is done in a way that all token holders are treated fairly and equally. 64. As regards the format, issuers that offer two or more tokens to the public should draft a recovery plan for each asset-referenced and/or e-money token they issue and calibrate token￾specific recovery plan indicators and thresholds therein. 65. Competent authorities should consider whether issuers that offer two or more tokens to the public should draft one separate recovery plan for each token issued or a single recovery plan divided into separate sections, each laying down token-specific elements. This second option should be excluded where one of the tokens is issued by multiple issuers. 66. Issuers offering two or more tokens to the public should at least ensure that:

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 23 a) issuer-related recovery plan indicators are consistent and the respective thresholds are set at the same level; b) recovery options laid down for each token are not contradicting each other; c) the activation and execution of one recovery plan would not negatively impact on the activation and execution of other recovery plans; d) the implementation of any recovery option does not interfere with the provision of services related to the other tokens issued. Issuers subject to other recovery planning obligations under EU sectoral legislation 67. Where the issuer is a credit institution or an investment firm required to draw a recovery plan under the Directive 2014/59/EU 7 , subject to the prior agreement with the competent authorities designated under Regulation (EU) 2023/1114 and Directive 2014/59/EU, and subject to the compliance with the confidentiality requirements laid down in Directive 2014/59/EU, such issuer: a) may include in the recovery plan drafted and approved in accordance with Directive 2014/59/EU (the ‘BRRD recovery plan’) an annex containing all the information specified in these guidelines, by cross-referencing the relevant sections of the BRRD recovery plan which are fit to comply with sections 4.2 to 4.6 of these guidelines, and/or by including new sections or information where necessary to comply with these guidelines; b) issuers opting for option under letter a) above should submit the recovery plan under Regulation (EU) 2023/1114 drafted in the form of the annex referenced under letter a) above to the competent authority designated under Regulation (EU) 2023/1114; the issuer should also clearly identify in a statement/index the specific sections and pages of the BRRD recovery plan where the information laid down in these guidelines is included. 68. The previous paragraph does not apply to credit institutions and investment firms that are issuers of significant asset referenced tokens. 7 Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending Council Directive 82/891/EEC, and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012, of the European Parliament and of the Council (OJ L 173, 12.6.2014, p. 190).

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 24 Annex I – List of minimum categories of recovery plan indicators and illustrative list of recovery plan indicators List of minimum categories and non-exhaustive list of recovery plan indicators A. Minimum categories for all issuers of ARTs and EMTs Category 1. Liquidity risk indicators a) Sight deposits at credit institutions and (where applicable) central banks / daily redeemed amount (five rolling day average) b) Sight deposits at credit institutions and (where applicable) central banks + reverse repurchase agreements that can be terminated by one working day notice + highly liquid financial instruments / highest daily redeemed amount over the last three months c) Sight deposits at credit institutions and (where applicable) central banks + reverse repurchase agreements that can be terminated by five working day notice + highly liquid financial instruments / sum of the five highest daily redeemed amounts over the last twelve months d) Sight deposits at credit institutions and (where applicable) central banks + reverse repurchase agreements that can be terminated by one working day notice + highly liquid financial instruments / sum of highest daily redeemed amount over the last three months to the (x8 ) largest token holders e) Daily net flow, i.e. token issued – token redeemed (five rolling day average) Category 2. Operational risk indicators a) Any incident significantly disrupting the regular operation of the issuer’s services or its business continuity (e.g. prolonged outage affecting IT systems or token delivery systems; infrastructure failures, including dysfunctions of the Distributed Ledger Technology; risks stemming from interoperability of different infrastructures, e.g. via bridges), also where caused by a third party service provider b) Recovery Time Objective (i.e. the maximum acceptable time to recover from a product or system failure) c) Maximum time since resignation or prolonged absence of key personnel d) Breach or expected breach of any regulatory requirement e) Legal risk Category 3. Credit risk/asset-quality indicators a) Highly liquid financial assets with impairment indicators (e.g. indicators of impairment to credit quality as laid down in IFRS 9) / reserve of assets 8 Number of the largest token holders by taking into account the principles laid down in these guidelines. Multiple indicators may be used, each one with a different number of the largest token holders if this suits better with their risk management practices.

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 25 b) Total amount of the reserve of assets held as deposits placed at credit institutions with the lowest credit rating as per issuer’s risk appetite in line with Article 36(4) of Regulation (EU) 2023/1114 / total banking deposit within the reserve of assets c) Distance from the minimum level of over-collateralization (as specified under Article 36(4) of Regulation (EU) 2023/1114) d) Negative change in the credit rating of key counterparties (e.g. credit institution holding issuer’s deposit) Category 4. Referenced asset(s) related indicators a) De-pegging risk, to be measured as the ratio between the market value of the token and the market value of the referenced asset(s) b) Regulatory changes negatively affecting the referenced asset(s) c) Freeze or significant negative change in the liquidity of the market where the referenced asset(s) is (are) exchanged Category 5. Capital adequacy indicators a) Own funds indicator B. Additional minimum categories for issuers of significant ARTs and EMTs and for other issuers that do not provide appropriate justification for the non-inclusion to the competent authority Category 6. Market risk indicators a) Ratio ‘Daily change of reserve of assets’ market value / (x9 ) rolling day average’ b) Ratio ‘Reserve of assets’ volatility / referenced assets’ volatility’ c) Sensitivity to interest rate changes of the reserve of assets d) Ratio ‘Value At Risk of the reserve of assets / issuer’s own funds’ Category 7. Concentration risk indicators a) Ratio ‘Value of token held by five largest counterparties / total value of token issued’ b) Ratio ‘(Deposit at single banking group + securities issued by a single counterparty) / maximum concentration limit10 ’ c) Concentration ratio of deposits held in credit institutions / maximum concentration ratio for deposits Category 8. Market confidence indicators a) Negative media coverage11 for the issuer or the tokens issued b) Negative news or media coverage for key counterparties (e.g. provider of custodial services; banks holding a material amount of deposits) c) Breach or expected breach of recovery plan indicators’ thresholds relative to any other token issued 9 Number of days, by taking into account the principles laid down in these guidelines. Multiple indicators may be used, each one with a different time horizon if this suits better with their risk management practices. 10 In accordance with Article 36(4) of Regulation (EU) 2023/1114. 11 Reference to media includes social networks and specialised blogging platforms.

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 26 d) Material changes in the frequency or amount of payments executed by using the token as well as in the way tokens are used as a means of payment e) Impairment to the reputation of the issuer or of key representatives of the issuer f) Sudden increase in redemption requests g) Sudden decrease of token issuance

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 27 Annex II – List of items to be included in the description of each recovery option

1. Items for the description of the recovery options: a) A summary of the essential elements. b) A description of the recovery option. c) An overview of the key assumptions underlying each recovery option. d) An assessment of the strategic implications of executing the recovery option. e) An assessment of the financial impact in normal and stressed market conditions. f) The potential adverse consequences of the recovery option. g) A timeline for effective execution, including the expected time frame for the implementation of the necessary actions. h) Any dependency on external counterparties for effective execution. i) Mutual exclusivity – whether some recovery options are mutually exclusive. j) Interdependencies – whether activating one recovery option could affect the subsequent or simultaneous implementation of another option. k) Operational considerations, such as approval requirements and capability to implement two or more recovery option simultaneously. l) An assessment of potential constraints to effective execution. This assessment is particularly relevant with respect to options referred under point (1) of Article 46 of Regulation (EU) 2023/1114. m) The communication strategy to inform the holders of the tokens about any measures that could adversely impact them.

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 28 Annex III – Non-exhaustive list of possible recovery options that issuers could use in their recovery plans

1. Capital raising.
2. Injection of additional funds.
3. Access to standard central bank facilities, where eligible.
4. Change of composition and/or reduction of the riskiness of the reserve of assets.
5. Change of the third-party provider (e.g. Crypto Asset Service Provider).
6. Purchase of financial guarantees from a credit institution or an insurance company covering the value of the reserve of assets.
7. Sale of business.
8. Merger with another issuer.
9. Merger of one issuance of asset-referenced tokens with another one. 10.Commercial measures.

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 29 5. Accompanying documents 5.1 Cost-benefit analysis / impact assessment As per Article 16(2) of Regulation (EU) No 1093/2010 (EBA Regulation), any guidelines and recommendations developed by the EBA shall be accompanied by an Impact Assessment (IA), which analyses ‘the potential related costs and benefits’. This analysis presents the IA of the main policy options included in this Final report on the guidelines on recovery plans under Articles 46 and 55 of the Regulation (EU) 2023/1114 (‘the guidelines’). This IA is high level and qualitative in nature. E. Problem identification According to Article 46 of Regulation (EU) 2023/1114, an issuer of an asset-referenced token shall draw up and maintain a recovery plan providing for measures to be taken by the issuer to restore compliance with the requirements applicable to the reserve of assets in cases where the issuer fails to comply with those requirements. The same applies, mutatis mutandis, to issuers of e-money tokens (Article 55 of Regulation (EU) 2023/1114). However, Regulation (EU) 2023/1114 does not provide a comprehensive list of information that should be included in the recovery plan, nor specifies how issuers should identify the circumstances that could lead the issuer to breach compliance with the regulatory requirements applicable to the reserve of assets. This could lead to a lack of harmonisation in current practices among issuers across the EU in developing recovery plans, especially with regards to recovery plan indicators. This situation would also make the assessment of the recovery plans very challenging for the competent authorities and undermine their supervisory role. B. Policy objectives The general objective of the guidelines is to specify the format and the information to be contained in the recovery plan that issuers must draw up and maintain under Articles 46 and 55 of Regulation (EU) 2023/1114. More specifically, these guidelines aim to ensure consistency of information provided by issuers, with a view to ensure harmonised supervision across the EU. C. Baseline scenario The baseline scenario is the situation where Regulation (EU) 2023/1114 only provides for a general obligation for issuers to draft recovery plans, without any further specification. Considering that some issuers may not be familiar with recovery planning, it is necessary to ensure minimum

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 30 guidance, especially with regards to the elements and the categories of indicators that issuers should include in the recovery plan. With the entry into force of Regulation (EU) 2023/114, issuers of asset-referenced tokens and e￾money tokens must comply with Articles 46 and 55 of the Regulation. The above legal requirements form the baseline scenario of the impact assessment, i.e. the impact caused by the Regulation is not assessed within this impact assessment, which focuses only on areas where further specifications have been provided in the guidelines. The following aspects have been considered when developing the guidelines. D. Options considered and preferred options

1. Policy issue 1: Format of the recovery plan The first element of the legal mandate for the guidelines on recovery plans under Regulation (EU) 2023/1114 requires the EBA to specify the format of recovery plans. In this context, the EBA considered two policy options. • Option 1a. Design a single template for recovery plans under Regulation (EU) 2023/1114. • Option 1b. Provide only a high-level guidance on the format of the recovery plan, by specifying the elements of the recovery plan and the information to be contained therein. By designing a single template to be filled by each issuer, Option 1a would ensure that Regulation (EU) 2023/1114 recovery plans across the EU are highly standardised and comparable. On the other hand, it would imply higher costs, as the same templates would apply to all types of issuers, regardless of their size, complexity and business model and of the classification of the token as significant. Option 1b envisages providing only a high-level guidance on the format of recovery plans without developing any specific template that would need to be followed by issuers. This option would give issuers more flexibility in preparing their recovery plans, while ensuring harmonisation and consistency on the key elements that issuers should include in their recovery plan. Therefore, Option 1b has been chosen as the preferred option.
2. Policy issue 2: Recovery indicators as part of governance The second element of the legal mandate for the guidelines on recovery plans under Regulation (EU) 2023/1114 requires the EBA to specify the information to be contained in the recovery plan. The following options have been considered.

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 31 • Option 2a. Include only a general, high-level guidance on the appropriate conditions to ensure the timely implementation of recovery actions without requiring issuers to have any specific recovery plan indicators. • Option 2b. Include a general guidance on categories of recovery plan indicators and key recovery plan indicators, without specifying comprehensive requirements on the framework on recovery plan indicators. • Option 2c. Include specific guidance on a framework of recovery plan indicators and on their calibration as part of the information on governance. Clear requirements on the recovery plan indicators (Option 2c) might increase certainty of issuers on the points in time when they would need to consider activating their recovery plans. However, it would also limit the ability of recovery plans to cater for particular risks specific to the size, complexity and business model of the issuer or to the size, volatility, composition, concentration and nature of the reserve of assets. On the other hand, not providing any requirements on recovery plan indicators (Option 2a) would allow issuers excessive discretion, with the risk that recovery plans would not be fit for purpose. The EBA is of the opinion that these guidelines should provide general guidance on the categories of recovery plan indicators to be included in the recovery plan (Option 2b), inter alia by providing examples of possible recovery plan indicators that issuers of asset-referenced tokens and e-money tokens should include in their recovery plan. As a result, this option would ensure that recovery plans are tailored to the specificities of each issuer and token, while providing sufficient information to ensure that the recovery plans cover all the relevant information. Therefore, Option 2b. has been chosen as the preferred option. E. Cost-Benefit Analysis Overall, the guidelines are expected to provide advantages to both issuers and competent authorities by clarifying the format and the information to be provided in the recovery plan under Articles 46 and 55 of Regulation (EU) 2023/1114, without adding any additional material burden. Advantages Disadvantages Issuers Clear indication on the information and format of the recovery plan Flexibility on the recovery plan indicators to be included in the recovery plan None

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 32 Advantages Disadvantages Competent authorities Harmonisation of the key elements and minimum requirements of the recovery plan Lack of a common template may increase the time for supervisory assessment Token holders Increased transparency once a recovery option is implemented None

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 33 5.2 Feedback on the public consultation The EBA publicly consulted on the draft proposal contained in this paper. The consultation period lasted for 3 months and ended on 8 February 2024. Seven responses were received, of which three were published on the EBA website. This paper presents a summary of the key points and other comments arising from the consultation, the analysis and discussion triggered by these comments and the actions taken to address them if deemed necessary. In many cases several industry bodies made similar comments or the same body repeated its comments in the response to different questions. In such cases, the comments, and EBA analysis are included in the section of this paper where EBA considers them most appropriate. Changes to the draft Guidelines have been incorporated as a result of the responses received during the public consultation. Summary of key issues and the EBA’s response Respondents overall supported the content of the guidelines. The majority of comments revolved around the following topics: • Extension of timeframes for notifying the competent authority about the breach of recovery plan indicator threshold(s). • Further clarity on the framework of recovery plan indicators. • Additional clarity on the modalities to inform internal and external stakeholders about the activation of the recovery plan.

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 34 Summary of responses to the consultation and the EBA’s analysis Comments Summary of responses received EBA analysis Amendments to the proposals General comments Communication plan One respondent would welcome additional clarity as to the modalities to inform external parties and argues that informing the public may have negative consequences even after the compliance with the requirements applicable to the reserve of assets has been re-established. Despite understanding that disclosing the activation of the recovery plan may have a negative effect on the public, the EBA is of the view that a lack of communication, especially in times of stress, may be detrimental for token-holders and other stakeholders. For this reason, paragraph 57 of the guidelines requires issuers to outline in the recovery plan how they intend to ‘manage any potentially negative market reaction’. However, considering that not all issuers may be familiar with recovery planning, the EBA has amended paragraph 57 and introduced paragraph 60 to further clarify the modalities for informing stakeholders. See amendments in paragraphs 57 and 60. Accuracy and completeness of the recovery plans One respondent argues that the guidelines are too prescriptive and prevent issuers’ full compliance. These guidelines specify the format and the information to be included in the recovery plans that issuers shall draft pursuant to Articles 46 and 55 of MiCAR. To fulfil its mandate, the EBA took inspiration from the existing legislative framework and supervisory experience with recovery planning for credit institutions adapted to reflect the specificities of ART and EMT issuers. As a result, the guidelines only provide high-level principles and give flexibility to issuers to determine in concrete the most appropriate recovery plan indicators and recovery options. No change.

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 35 Comments Summary of responses received EBA analysis Amendments to the proposals Responses to questions in Consultation Paper EBA/CP/2023/30 Feedback on responses to Question 1 – Is the approach to the application of the principle of proportionality adequate for the purposes of recovery planning? Principle of proportionality Most respondents supported the application of the principle of proportionality, with only one respondent considering the current approach as too complex. This respondent further recommended the guidelines set different requirements for issuers that are not credit institutions. Another respondent argued that the lack of specific benchmarks may lead to inconsistent interpretation and application between firms established in different Member States. Recovery planning aims at ensuring that issuers (i) prepare in advance to face adverse scenarios that may impact on their ability to comply with the requirements applicable to the reserve of assets; (ii) can react in a timely manner by activating an internal escalation process; and (iii) are able to implement specific measures to restore compliance with said requirements. For these reasons, the EBA is of the view that the assessment of proportionality should cover multiple elements, rather than focus on the type of issuer only. In addition, the current approach to proportionality allows both the issuer and the competent authority to assess the necessary level of detail and complexity in a flexible and dynamic way. In this respect, an open dialogue between issuers and competent authorities would be the best way to avoid said inconsistencies. No change. Additional criterion for the proportionality assessment One respondent indicated that the assessment of proportionality should take into account one additional criterion, namely the riskiness of crypto￾assets used as reserves for an asset-referenced token. The EBA is of the view that this criterion is already part of the list of elements that issuers and competent authorities should take into account when applying the principle of proportionality, namely under paragraph 13, letter c (‘the size, volatility, composition, concentration and nature of the reserve of assets’). No change.

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 36 Comments Summary of responses received EBA analysis Amendments to the proposals Feedback on responses to Question 2 – Do you have any comments on the need to exchange information between the issuer and the relevant third party provider to avoid delays in the activation of the recovery plan in case the issuer has entered into an agreement pursuant to point (5)(h) of Article 34 of Regulation (EU) 2023/1114? Extension of the addressees While the majority of respondents welcomed the approach of the EBA guidelines, one respondent suggested that the requirement to exchange information should be binding also for the third parties operating the reserve of assets to facilitate the negotiation with the issuers. It is important to note that the EBA has a mandate limited to specify the information to be contained in and the format of the recovery plan that each issuer has to draft pursuant to Articles 46 and 55 MiCAR. As such, these guidelines cannot address third party providers. No change. Timeframes to notify the competent authority One respondent argued the time needed to obtain the necessary information from the third party in case of breach(es) to recovery plan indicator thresholds should be reflected into the timeframes for taking action and notifying the competent authority. The EBA acknowledges that issuers should always take an informed decision in case of breach(es) to recovery plan indicators. However, the guidelines clarify in paragraph 20 that issuers “should include in their recovery plan a clear and detailed description of the processes established to exchange information in a way that would ensure the timely activation of the escalation process laid down in paragraph 37 in case a breach of recovery plan indicators is detected, either by the issuer or by the relevant third party entity”. The issuer should further specify in the recovery plan “how the agreement with any of those third parties ensures the information is timely shared in a way that would allow the issuer to be aware of the breach or to acknowledge that the breach is likely to occur in the near future so that the plan can be activated in a timely manner”. It follows that issuers should be in a position to know in a timely manner about the (possible) breach of a recovery plan indicator, thereby No change.

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 37 Comments Summary of responses received EBA analysis Amendments to the proposals being able to alert competent authorities according to the timelines laid down in paragraph 37. Feedback on responses to Question 3 – Do you have any comments on the categories of recovery plan indicators and on the recovery plan indicators listed in Annex I? Is the list of categories and recovery plan indicators clear? Is there any additional indicator or category of indicators that should be added? Breach of recovery plan indicators and non-compliance One respondent would welcome more guidance on how breaches of some recovery plan indicators would translate into non-compliance in the form of a table. The EBA notes that the list of recovery plan indicators in Annex I is merely illustrative, with issuers being invited to include the most appropriate indicators and thresholds that reflect their specific size, complexity, nature and business model as well as the token’s specific risk profile and operating environment. When doing so, each issuer should also carefully consider the types of events that may lead to a breach of the regulatory requirements applicable to the reserve of assets and calibrate the recovery plan indicators accordingly. No change. Additional details on certain recovery plan indicators One respondent would appreciate further clarity on the level of detail of the ‘appropriate justification’ required under paragraph 31 and suggests to rather exempt all non-significant issuers from including the categories of recovery plan indicators listed in Section B of Annex I. Another respondent argues that the requirement for issuers to calculate ‘in concrete’ some indicators would be too vague. These were developed with the aim to provide only high-level principles on the minimum list of categories of recovery plan indicators that issuers of ARTs and EMTs should include in their recovery plans. The list of recovery plan indicators laid down in Annex I is merely illustrative, with issuers being free to identify and calibrate different indicators that are deemed more appropriate. This approach ensures that the guidelines are flexible enough to be applied to a wide range of issuers and that each issuer is in a position to tailor the content of the recovery plan to its specificities. To avoid any confusion, the reference to ‘in concrete’ has been removed from Annex I. See amendments to Annex I.

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 38 Comments Summary of responses received EBA analysis Amendments to the proposals Third-party assessment of risks One respondent argued that the guidelines should include a requirement for issuers that a third independent party assesses and monitors the risks of (i) the permissionless blockchain(s) used by issuers; and (ii) the crypto-assets used as the reserve of assets. The EBA is of the view that such requirements would be beyond its mandate in the context of recovery plans. No change. Feedback on responses to Question 4 – Is the section on recovery options and recovery scenarios appropriate and sufficiently clear, also when read together with Annexes II and III? Distinguishing recovery option from business operations One respondent would welcome further guidance on how to distinguish if a particular business action represents the execution of a recovery option or a business decision in the context of the regular management. The EBA acknowledges that the recovery plan could include actions that may be executed as part of the business-as-usual decision. If this is the case, issuers are expected to reflect it in the regular update of their recovery plan in line with paragraph 62 (e.g. by removing or appropriately amending the specific recovery options). The difference between the execution of a recovery option and a business decision in the regular management stems from the context in which the action is undertaken (i.e. in case of breach of a recovery plan indicator in time of stress or as part of the execution of the ordinary business plan). No changes. Description of recovery options One respondent argues that some of the information that issuers should include in the description of each recovery option depends on third parties and may not be available to the issuer. Furthermore, this respondent would welcome increased correspondence between the recovery It should be considered that the list of recovery plan indicators provided in annex I is only illustrative. Each issuer should identify the most appropriate recovery plan indicators based on its specific size, complexity, nature, business model and risk profile. In addition, each issuer is required to lay down a range of recovery options that are tailored to its business model and the nature of the token issued. It follows No changes.

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 39 Comments Summary of responses received EBA analysis Amendments to the proposals plan indicators and the recovery option to remedy the specific breach. that the EBA is not in a position to delineate a correspondence between recovery plan indicators and recovery options. In addition, it should be noted that imposing certain actions may hamper the effectiveness of the recovery plan. As to the list of information to be included in the description of the recovery option, the EBA is of the view that reliance on third parties for the execution of certain actions does not, per se, imply an impossibility to describe properly the specific recovery option, including lack of information, if any. Timeframes One respondent suggested extending the timeframe to take action in case of breaches to recovery plan indicators thresholds, especially for issuers of significant tokens. Another respondent suggested that some breaches (i.e. to individual indicators regarding capital and liquidity) would not require a notification to the competent authority. Finally, another respondent would welcome additional clarity as to the possible consequences in case of incorrect decisions. The EBA is of the view that starting the escalation process in a timely manner is crucial to ensure the success of the recovery mechanism, irrespective of the classification as significant of the token issued. In doing so, an open dialogue with the competent authority since the early stages of the process is necessary to ensure the success of the recovery plan. Said dialogue should ideally cover the grounds for activating or not the recovery plan. Indeed, neither the breach of a recovery plan indicator nor the subsequent communication to the competent authority imply the activation of the recovery plan in an automatic way: the issuer should always carefully analyse the circumstances surrounding the breach and take an informed decision. The breach should be clearly communicated to the competent authority in line with paragraphs 39-41 of the guidelines, even if the issuer decides to not activate the recovery plan. No changes.

FINAL REPORT ON GUIDELINES ON RECOVERY PLANS UNDER ARTICLES 46 AND 55 OF THE REGULATION (EU) 2023/1114 40 Comments Summary of responses received EBA analysis Amendments to the proposals Feedback on responses to Question 5 – Do you have any comments on the interaction between recovery planning obligations? Are there any other operational efficiencies that can be achieved? Please describe them. Issuers offering multi-chain tokens One respondent welcomed clarification as to the fact that issuers of tokens distributed on multiple blockchains (so-called multi-chain issuances) should not be required to draft different recovery plans. The EBA acknowledges that distributing a token via different blockchains does not require the issuer to draft multiple recovery plans. However, the EBA sees the need to clarify that issuers should calibrate different operational risk indicators for each blockchain they are using to distribute the token. See amended paragraph 29.