26/02/2025
ESMA35-1872330276-2032

ESMA
European Securities and Markets Authority

Guidelines

On the procedures and policies, including the rights of clients, in the context of transfer services for crypto-assets under the Markets in Crypto Assets Regulation (MiCA) on investor protection

ESMA
European Securities and Markets Authority

ESMA - 201-203 rue de Bercy - CS 80910 - 75589 Paris Cedex 12 - France - Tel. +33 (0) 1 58 36 43 21 - www.esma.europa.eu

Table of Contents

1 Scope............................................................................................................................4

2 Legislative references, abbreviations and definitions....................................................4

2.1 Legislative references ............................................................................................4

2.2 Abbreviations .........................................................................................................5

3 Purpose.........................................................................................................................5

4 Compliance and reporting obligations...........................................................................5

4.1 Status of the guidelines..........................................................................................5

4.2 Reporting requirements .........................................................................................6

5 Guidelines on the policies and procedures in the context of transfer services for crypto-assets...................................................................................................................................6

5.1 General provisions on the policies and procedures on transfer of crypto-assets (Guideline 1) .....................................................................................................................6

5.2 Information on individual transfers for crypto-assets (Guideline 2)........................8

5.3 Execution times and cut-off times (Guideline 3) ..................................................10

5.4 Rejection or suspension of an instruction to transfer crypto-assets or return of crypto-asset transferred (Guideline 4) ............................................................................10

5.5 Liability of the crypto-asset service provider (Guideline 5) ..................................10

1 Scope

Who?

1. These guidelines apply to:

(i) competent authorities and

(ii) crypto-asset service providers that act as providers of transfer services for cryptoassets on behalf of clients within the meaning of Article 3(1)(26) of MiCA.

What?

2. These guidelines apply in relation to Article 82 of MiCA.

When?

3. These guidelines apply 60 calendar days from the date of their publication on ESMA’s website in all official EU languages.

2 Legislative references, abbreviations and definitions

2.1 Legislative references

ESMA Regulation	Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC1
MiCA	Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) 1095/2010 and Directives 2013/36/EU and (EU) 2019/19372
TOFR	Regulation (EU) 2023/1113 of the European Parliament and the Council of 31 May 2023 on information accompanying

[1] OJ L 331, 15.12.2010, p. 84.

[2] OJ L 150, 9.6.2023, p. 40–205.

transfers of funds and certain crypto-assets and amending Directive (EU) 2015/8493

2.2 Abbreviations

EC	European Commission
ESFS	European System of Financial Supervision
ESMA	European Securities and Markets Authority
EU	European Union

3 Purpose

4. These guidelines, developed by ESMA in close cooperation with EBA, are based on Article 82(2) of MiCA. The objectives of these guidelines are to establish consistent, efficient and effective supervisory practices within the ESFS and to ensure the common, uniform and consistent application of the provisions in Article 82 of MiCA. In particular, they aim at providing more clarity on the requirements for crypto-asset service providers providing transfer services for crypto-assets on behalf of clients as regards procedures and policies, including the rights of clients, in the context of transfer services for crypto-assets. In this regard, ESMA anticipates a corresponding strengthening of investor protection.

These guidelines apply without prejudice to the relevant rules under PSD 2, where applicable to relevant transfers of crypto-assets, notably EMTs.

4 Compliance and reporting obligations

4.1 Status of the guidelines

5. In accordance with Article 16(3) of the ESMA Regulation, competent authorities and crypto-asset service providers shall make every effort to comply with these guidelines.

6. Competent authorities to which these guidelines apply should comply by incorporating them into their national legal and/or supervisory frameworks as appropriate, including where particular guidelines are directed primarily at financial market participants. In this

[3] OJ L 150, 9.6.2023, p. 1–39.

case, competent authorities should ensure through their supervision that crypto-asset service providers comply with the guidelines.

4.2 Reporting requirements

7. Within two months of the date of publication of the guidelines on ESMA’s website in all EU official languages, competent authorities to which these guidelines apply must notify ESMA whether they (i) comply, (ii) do not comply but intend to comply, or (iii) do not comply and do not intend to comply with the guidelines.

8. In case of non-compliance, competent authorities must also notify ESMA within two months of the date of publication of the guidelines on ESMA’s website in all EU official languages of their reasons for not complying with the guidelines.

9. A template for notification is available on ESMA’s website. 4 Once the template has been filled in, it shall be transmitted to ESMA.

10. Crypto-asset service providers are not required to report whether they comply with these guidelines.

5 Guidelines on the policies and procedures in the context of transfer services for crypto-assets

5.1 General provisions on the policies and procedures on transfer of crypto-assets (Guideline 1)

11. Crypto-asset service providers should establish, implement and maintain adequate policies and procedures (including appropriate tools) to ensure that, in good time before the client enters into any agreement for the provision of transfer services for crypto-assets, they provide the client, in an electronic format, with the information and conditions related to the transfer services for crypto-assets.

12. The information provided should include at least the following:

• the name of the crypto-asset service provider, the address of its head office, and any other address and means of communication, including electronic mail address, relevant for communication with the crypto-asset service provider;

[4] See: https://www.esma.europa.eu/sites/default/files/library/esma42-110-1132_confirmation_of_compliance_with_guidelines.pdf

ESMA
European Securities and Markets Authority

• the name of the national competent authority in charge of supervising the crypto-asset service provider;

• a description of the main characteristics of the transfer service for crypto-assets to be provided;

• a description of the form of and procedure for initiating or consenting to a transfer of crypto-assets and withdrawing an instruction or consent, including the specification of the information that has to be provided by the client in order for a transfer of crypto-assets to be properly initiated or executed (including, how to authenticate);

• the conditions under which the crypto-asset service provider may reject an instruction to carry out a transfer of crypto-assets;

• a reference to the procedure or process established by the crypto-asset service provider to determine the time of receipt of an instruction or consent to a transfer of crypto-assets and any cut-off time established by the crypto-asset service provider;

• an explanation per crypto-asset, of which distributed ledger technology (DLT) network is supported for the transfer of this crypto-asset;

• the maximum execution time for the transfer of crypto-assets service to be provided;

• for each DLT network, reasonably estimated time or number of block confirmations needed for the transfer to be irreversible on the DLT network or considered sufficiently irreversible in case of probabilistic settlement taking into account the rules and circumstances of the DLT network;

• all charges, fees or commissions payable by the client in relation to the crypto-assets transfer service, including those connected to the manner in and frequency with which information is provided or made available and, where applicable, the breakdown of the amounts of such charges;

• the means of communication, including basic information about the technical requirements for the client’s equipment and software (for example, the minimum software or mobile operating system), agreed between the parties for the transmission of information or notifications related to the crypto-asset transfer service ;

• the manner in, and frequency with which, information related to the service of crypto-asset transfer is to be provided or made available;

• the language or languages in which the agreement referred to in Article 82(1) of MiCA will be concluded and communication during this contractual relationship undertaken;

• the secure procedure for notification of the client by the crypto-asset service provider in the event of suspected or actual fraud or security threats;

• the means and time period within which the client is to notify the crypto-asset service provider of any unauthorised or incorrectly initiated or executed transfers of crypto-assets as well as the crypto-asset service provider’s liability, including maximum amount thereof, for unauthorised or incorrectly initiated or executed transfers;

• the right of the client to terminate the agreement on the provision of crypto-asset transfer services and the modalities to do so;

  13. The policies and procedures relating to the transfer services of crypto-assets should ensure that the crypto-asset service provider provides the relevant information in easily understandable words and in a clear and comprehensible form.

  14. The policies and procedures referred to in paragraph 12 should also ensure that:

• at any time during the contractual relationship related to the crypto-asset transfer services, the client should be able to access or receive, on request, the agreement referred to in Article 82(1) of MiCA as well as the information listed in paragraph 12, in an electronic format;

• the client is made aware, of any intended change to the information listed in paragraph 12 in good time before such change starts to apply.

  15. Crypto-asset service providers should be able to provide the relevant information at the time of providing a copy of the draft agreement referred to in Article 82(1) of MiCA.

  16. As a good practice, crypto-asset service providers are encouraged to also take into account, in the policies and procedures referred to in paragraph 11, how to provide clients with educational material helping them to learn about and better understand their rights and the function and risks of crypto-asset transfers.

5.2 Information on individual transfers for crypto-assets (Guideline 2)

17. Crypto-asset service providers should establish, implement and maintain adequate policies and procedures (including appropriate tools) to ensure that, after receipt of an instruction to transfer crypto-assets, but before the execution of the transfer of crypto-assets, the crypto-asset service provider provides the client with at least the following information:

• a brief and standardised warning as to whether and when the crypto-asset transfer will be irreversible or sufficiently irreversible in case of probabilistic settlement5 ;

• the amount of any charges for the crypto-asset transfer payable by the client and, where applicable, a breakdown of the amounts of such charges, distinguishing, for example, between the gas fees charged for the transaction through the relevant DLT network and other fees crypto-asset service providers charge for their services.

  18. The policies and procedures referred to in the previous paragraph should also ensure that initiation or execution of the transfer does not take place before adequate steps have been taken to ensure compliance with TOFR, including Article 14 thereof.

  19. Crypto-asset service providers should establish, implement and maintain adequate policies and procedures (including appropriate tools) to ensure that, after execution of individual transfers for crypto-assets, the crypto-asset service provider provides the client with at least the following information:

• the names of the originator and the beneficiary;

• the originator’s distributed ledger address or crypto-asset account number;

• the beneficiary’s distributed ledger address or crypto-asset account number;

• a reference enabling the client to identify each transfer of crypto-assets;

• the amount and type of crypto-assets transferred or received;

• the debit value date or the credit value date of the transfer of crypto-assets.

• the amount of any charges, fees or commissions relating to the transfer of crypto-assets and, where applicable, a breakdown of the amounts of such charges.

  20. The policies and procedures referred to in paragraph 19 should also cover the periodicity of the information listed in paragraph 19, any fees or charges incurred for the provision of the information and how the information is to be provided.

  21. The information listed in paragraph 19 should be provided in an electronic format and, where not provided more frequently than once a month, free of charge

  22. Crypto-asset service providers should establish, implement and maintain adequate policies and procedures (including appropriate tools) to ensure, without prejudice to other applicable regulatory requirements, that, where a transfer of crypto-assets is rejected, returned or suspended, the client is provided with, at least, the following information:

[5] Depending on the type of consensus algorithms relating to the relevant DLT.

• the reason for the rejection, return or suspension;

• if applicable, how to remedy the rejection, return or suspension;

• the amount of any charges or fees incurred by the client and whether reimbursement is possible.

5.3 Execution times and cut-off times (Guideline 3)

23. Crypto-asset service providers should establish, implement and maintain adequate policies and procedures relating to, at least:

• the cut-off times for instructions for the transfer of crypto-assets to be regarded as received on the same business day;

• the maximum execution times depending on the crypto-asset transferred

• the reasonable estimation of the time or number of block confirmations needed for the transfer of crypto-assets to be irreversible on the DLT, or sufficiently irreversible in case of probabilistic settlement, for each DLT network.

5.4 Rejection or suspension of an instruction to transfer crypto-assets or return of crypto-asset transferred (Guideline 4)

24. Crypto-asset service providers should establish, implement and maintain adequate risk-based policies and procedures for determining whether and how to execute, reject, return or suspend a transfer of crypto-assets. Such policies and procedures should particularly take into account the provisions of TOFR, as relevant and as specified in the European Banking Authority’s Guidelines preventing the abuse of funds and certain crypto-assets transfers for money laundering and terrorist financing purposes.

5.5 Liability of the crypto-asset service provider (Guideline 5)

25. Crypto-asset service providers should establish, implement and maintain adequate policies and procedures determining the conditions of the liability of the crypto-asset service provider to clients in case of unauthorised or incorrectly initiated or executed transfers of crypto-assets.