CSSF Circular 25/888: Application of ESMA Guidelines on Investor Protection for Crypto-Asset Transfer Services under MiCA

Circular CSSF 25/888
Application of the Guidelines of the European Securities and Markets Authority on the procedures and policies, including the rights of clients, in the context of transfer services for crypto-assets under the Markets in Crypto Assets Regulation (ESMA35- 1872330276-2032)

CIRCULAR CSSF 25/888 2/3
Circular CSSF 25/888
Application of the Guidelines of the European Securities and Markets Authority on the procedures and policies, including the rights of clients, in the context of transfer services for crypto-assets under the Markets in Crypto Assets Regulation (ESMA35- 1872330276-2032) To crypto-asset service providers that act as providers of transfer services for crypto-assets on behalf of clients within the meaning of Article 3(1)(26) of Regulation (EU) 2023/1114 (“MiCAR”)1. Luxembourg, 30 April 2025 Ladies and Gentlemen, The purpose of this circular is to inform you that the CSSF, in its capacity as competent authority, applies the Guidelines of the European Securities and Markets Authority (“ESMA”) on the procedures and policies, including the rights of clients, in the context of transfer services for crypto-assets under the Markets in Crypto Assets Regulation (ESMA35-1872330276-2032) (the “Guidelines”), published on 26 February 2025. Consequently, the CSSF has integrated the Guidelines into its administrative practices and regulatory approach with a view to promoting supervisory convergence in this field at European level.

1. The Guidelines
   The Guidelines are issued by ESMA on the basis of Article 82(2) of MiCAR pursuant to Article 16 of Regulation (EU) No 1095/2010. The Guidelines apply as from 27 April 2025. The Guidelines establish consistent, efficient and effective supervisory practices within the European System of Financial Supervision and ensure the common, uniform and consistent application of the provisions in Article 82 of MiCAR. In particular, they aim at providing more clarity on the requirements for crypto-asset service providers providing transfer services for crypto-assets on behalf of clients as regards procedures and policies, including the rights of clients, in the context of transfer services for crypto-assets. The Guidelines are attached to this circular and are available on ESMA’s website https://www.esma.europa.eu/.
2. Scope of application
   This circular shall apply to crypto-asset service providers that act as providers of transfer services for crypto-assets on behalf of clients within the meaning of Article 3(1)(26) of MICAR. 1 Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto￾assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937

CIRCULAR CSSF 25/888 3/3
3. Date of application
This circular shall apply as from 27 April 2025.
Claude WAMPACH
Director
Marco ZWICK
Director
Jean-Pierre FABER
Director
Françoise KAUTHEN
Director
Claude MARX
Director General
Annex ESMA Guidelines on the procedures and policies, including the rights of clients,
in the context of transfer services for crypto-assets under the Markets in Crypto Assets Regulation (MiCA) on investor protection (ESMA35-1872330276-2032)

26/02/2025
ESMA35-1872330276-2032
Guidelines
On the procedures and policies, including the rights of clients, in the context of transfer services for crypto-assets under the Markets in Crypto Assets Regulation (MiCA) on investor protection

ESMA - 201-203 rue de Bercy - CS 80910 - 75589 Paris Cedex 12 - France - Tel. +33 (0) 1 58 36 43 21 - www.esma.europa.eu 2

Table of Contents
1 Scope............................................................................................................................4
2 Legislative references, abbreviations and definitions....................................................4
2.1 Legislative references ............................................................................................4
2.2 Abbreviations .........................................................................................................5
3 Purpose.........................................................................................................................5
4 Compliance and reporting obligations...........................................................................5
4.1 Status of the guidelines..........................................................................................5
4.2 Reporting requirements .........................................................................................6
5 Guidelines on the policies and procedures in the context of transfer services for crypto￾assets...................................................................................................................................6
5.1 General provisions on the policies and procedures on transfer of crypto-assets
(Guideline 1) .....................................................................................................................6
5.2 Information on individual transfers for crypto-assets (Guideline 2)........................8
5.3 Execution times and cut-off times (Guideline 3) ..................................................10
5.4 Rejection or suspension of an instruction to transfer crypto-assets or return of
crypto-asset transferred (Guideline 4) ............................................................................10
5.5 Liability of the crypto-asset service provider (Guideline 5) ..................................10

1 Scope
Who?

1. These guidelines apply to:
   (i) competent authorities and
   (ii) crypto-asset service providers that act as providers of transfer services for crypto￾assets on behalf of clients within the meaning of Article 3(1)(26) of MiCA. What?
2. These guidelines apply in relation to Article 82 of MiCA.
   When?
3. These guidelines apply 60 calendar days from the date of their publication on ESMA’s
   website in all official EU languages.
   2 Legislative references, abbreviations and definitions
   2.1 Legislative references
   ESMA Regulation Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC1 MiCA Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) 1095/2010 and Directives 2013/36/EU and (EU) 2019/19372 TOFR Regulation (EU) 2023/1113 of the European Parliament and the Council of 31 May 2023 on information accompanying

1 OJ L 331, 15.12.2010, p. 84.
2 OJ L 150, 9.6.2023, p. 40–205.

transfers of funds and certain crypto-assets and amending Directive (EU) 2015/8493
2.2 Abbreviations
EC European Commission
ESFS European System of Financial Supervision
ESMA European Securities and Markets Authority EU European Union 3 Purpose
4. These guidelines, developed by ESMA in close cooperation with EBA, are based on
Article 82(2) of MiCA. The objectives of these guidelines are to establish consistent,
efficient and effective supervisory practices within the ESFS and to ensure the common, uniform and consistent application of the provisions in Article 82 of MiCA. In particular, they aim at providing more clarity on the requirements for crypto-asset service providers providing transfer services for crypto-assets on behalf of clients as regards procedures and policies, including the rights of clients, in the context of transfer services for crypto￾assets. In this regard, ESMA anticipates a corresponding strengthening of investor protection. These guidelines apply without prejudice to the relevant rules under PSD 2, where applicable to relevant transfers of crypto-assets, notably EMTs. 4 Compliance and reporting obligations
4.1 Status of the guidelines
5. In accordance with Article 16(3) of the ESMA Regulation, competent authorities and
crypto-asset service providers shall make every effort to comply with these guidelines.
6. Competent authorities to which these guidelines apply should comply by incorporating
them into their national legal and/or supervisory frameworks as appropriate, including where particular guidelines are directed primarily at financial market participants. In this

3 OJ L 150, 9.6.2023, p. 1–39.

case, competent authorities should ensure through their supervision that crypto-asset service providers comply with the guidelines.
4.2 Reporting requirements
7. Within two months of the date of publication of the guidelines on ESMA’s website in all
EU official languages, competent authorities to which these guidelines apply must notify ESMA whether they (i) comply, (ii) do not comply but intend to comply, or (iii) do not comply and do not intend to comply with the guidelines.
8. In case of non-compliance, competent authorities must also notify ESMA within two
months of the date of publication of the guidelines on ESMA’s website in all EU official languages of their reasons for not complying with the guidelines.
9. A template for notification is available on ESMA’s website. 4 Once the template has been
filled in, it shall be transmitted to ESMA.
10. Crypto-asset service providers are not required to report whether they comply with these
guidelines.
5 Guidelines on the policies and procedures in the context of transfer services for crypto-assets
5.1 General provisions on the policies and procedures on transfer
of crypto-assets (Guideline 1)
11. Crypto-asset service providers should establish, implement and maintain adequate
policies and procedures (including appropriate tools) to ensure that, in good time before the client enters into any agreement for the provision of transfer services for crypto￾assets, they provide the client, in an electronic format, with the information and conditions related to the transfer services for crypto-assets.
12. The information provided should include at least the following:

• the name of the crypto-asset service provider, the address of its head office, and
  any other address and means of communication, including electronic mail address, relevant for communication with the crypto-asset service provider;

4 See: https://www.esma.europa.eu/sites/default/files/library/esma42-110- 1132_confirmation_of_compliance_with_guidelines.pdf

• the name of the national competent authority in charge of supervising the crypto￾asset service provider;

• a description of the main characteristics of the transfer service for crypto-assets to
  be provided;

• a description of the form of and procedure for initiating or consenting to a transfer
  of crypto-assets and withdrawing an instruction or consent, including the specification of the information that has to be provided by the client in order for a transfer of crypto-assets to be properly initiated or executed (including, how to authenticate);

• the conditions under which the crypto-asset service provider may reject an
  instruction to carry out a transfer of crypto-assets;

• a reference to the procedure or process established by the crypto-asset service
  provider to determine the time of receipt of an instruction or consent to a transfer of crypto-assets and any cut-off time established by the crypto-asset service provider;

• an explanation per crypto-asset, of which distributed ledger technology (DLT)
  network is supported for the transfer of this crypto-asset;

• the maximum execution time for the transfer of crypto-assets service to be
  provided;

• for each DLT network, reasonably estimated time or number of block confirmations
  needed for the transfer to be irreversible on the DLT network or considered sufficiently irreversible in case of probabilistic settlement taking into account the rules and circumstances of the DLT network;

• all charges, fees or commissions payable by the client in relation to the crypto￾assets transfer service, including those connected to the manner in and frequency
  with which information is provided or made available and, where applicable, the breakdown of the amounts of such charges;

• the means of communication, including basic information about the technical
  requirements for the client’s equipment and software (for example, the minimum software or mobile operating system), agreed between the parties for the transmission of information or notifications related to the crypto-asset transfer service ;

• the manner in, and frequency with which, information related to the service of
  crypto-asset transfer is to be provided or made available;

• the language or languages in which the agreement referred to in Article 82(1) of
  MiCA will be concluded and communication during this contractual relationship undertaken;

• the secure procedure for notification of the client by the crypto-asset service
  provider in the event of suspected or actual fraud or security threats;

• the means and time period within which the client is to notify the crypto-asset
  service provider of any unauthorised or incorrectly initiated or executed transfers of crypto-assets as well as the crypto-asset service provider’s liability, including maximum amount thereof, for unauthorised or incorrectly initiated or executed transfers;

• the right of the client to terminate the agreement on the provision of crypto-asset
  transfer services and the modalities to do so;

13. The policies and procedures relating to the transfer services of crypto-assets should
    ensure that the crypto-asset service provider provides the relevant information in easily understandable words and in a clear and comprehensible form.
14. The policies and procedures referred to in paragraph 12 should also ensure that:

• at any time during the contractual relationship related to the crypto-asset transfer
  services, the client should be able to access or receive, on request, the agreement referred to in Article 82(1) of MiCA as well as the information listed in paragraph 12, in an electronic format;
• the client is made aware, of any intended change to the information listed in
  paragraph 12 in good time before such change starts to apply.

15. Crypto-asset service providers should be able to provide the relevant information at the
    time of providing a copy of the draft agreement referred to in Article 82(1) of MiCA.
16. As a good practice, crypto-asset service providers are encouraged to also take into
    account, in the policies and procedures referred to in paragraph 11, how to provide clients with educational material helping them to learn about and better understand their rights and the function and risks of crypto-asset transfers.
    5.2 Information on individual transfers for crypto-assets
    (Guideline 2)
17. Crypto-asset service providers should establish, implement and maintain adequate
    policies and procedures (including appropriate tools) to ensure that, after receipt of an instruction to transfer crypto-assets, but before the execution of the transfer of crypto￾assets, the crypto-asset service provider provides the client with at least the following information:

• a brief and standardised warning as to whether and when the crypto-asset transfer
  will be irreversible or sufficiently irreversible in case of probabilistic settlement5 ;
• the amount of any charges for the crypto-asset transfer payable by the client and,
  where applicable, a breakdown of the amounts of such charges, distinguishing, for example, between the gas fees charged for the transaction through the relevant DLT network and other fees crypto-asset service providers charge for their services.

18. The policies and procedures referred to in the previous paragraph should also ensure
    that initiation or execution of the transfer does not take place before adequate steps have been taken to ensure compliance with TOFR, including Article 14 thereof.
19. Crypto-asset service providers should establish, implement and maintain adequate
    policies and procedures (including appropriate tools) to ensure that, after execution of individual transfers for crypto-assets, the crypto-asset service provider provides the client with at least the following information:

• the names of the originator and the beneficiary;
• the originator’s distributed ledger address or crypto-asset account number;
• the beneficiary’s distributed ledger address or crypto-asset account number;
• a reference enabling the client to identify each transfer of crypto-assets;
• the amount and type of crypto-assets transferred or received;
• the debit value date or the credit value date of the transfer of crypto-assets.
• the amount of any charges, fees or commissions relating to the transfer of crypto￾assets and, where applicable, a breakdown of the amounts of such charges.

20. The policies and procedures referred to in paragraph 19 should also cover the periodicity
    of the information listed in paragraph 19, any fees or charges incurred for the provision of the information and how the information is to be provided.
21. The information listed in paragraph 19 should be provided in an electronic format and,
    where not provided more frequently than once a month, free of charge
22. Crypto-asset service providers should establish, implement and maintain adequate
    policies and procedures (including appropriate tools) to ensure, without prejudice to other applicable regulatory requirements, that, where a transfer of crypto-assets is rejected, returned or suspended, the client is provided with, at least, the following information:

5 Depending on the type of consensus algorithms relating to the relevant DLT.

• the reason for the rejection, return or suspension;
• if applicable, how to remedy the rejection, return or suspension;
• the amount of any charges or fees incurred by the client and whether
  reimbursement is possible.
  5.3 Execution times and cut-off times (Guideline 3)

23. Crypto-asset service providers should establish, implement and maintain adequate
    policies and procedures relating to, at least:

• the cut-off times for instructions for the transfer of crypto-assets to be regarded as
  received on the same business day;
• the maximum execution times depending on the crypto-asset transferred
• the reasonable estimation of the time or number of block confirmations needed for
  the transfer of crypto-assets to be irreversible on the DLT, or sufficiently irreversible in case of probabilistic settlement, for each DLT network.
  5.4 Rejection or suspension of an instruction to transfer crypto￾assets or return of crypto-asset transferred (Guideline 4)

24. Crypto-asset service providers should establish, implement and maintain adequate risk￾based policies and procedures for determining whether and how to execute, reject, return
    or suspend a transfer of crypto-assets. Such policies and procedures should particularly take into account the provisions of TOFR, as relevant and as specified in the European Banking Authority’s Guidelines preventing the abuse of funds and certain crypto-assets transfers for money laundering and terrorist financing purposes.
    5.5 Liability of the crypto-asset service provider (Guideline 5)
25. Crypto-asset service providers should establish, implement and maintain adequate
    policies and procedures determining the conditions of the liability of the crypto-asset service provider to clients in case of unauthorised or incorrectly initiated or executed transfers of crypto-assets.