MALTA FINANCIAL SERVICES AUTHORITY
AA119: MiCA Article 60(4) Notification Form

High Level Guidelines
General This Notification Form emanates from Regulation (EU) 2023/1114 on Markets in Crypto-Assets (or "the MiCA Regulation") and the relevant Commission Implementing Regulation laying down implementing technical standards for the application of Regulation (EU) 2023/1114 as published under Title V of the MiCA Regulation. This Notification Form shall be duly filled in by the governing body of the entity authorised to issue electronic money in terms of the Financial Institutions Act, who intends to provide crypto-asset services under the scope of Article 60(4) of the MiCA Regulation ("the notifying entity"). In this respect, the governing body of the notifying entity, or the person authorised by it to act on its behalf, shall to the best of its knowledge, provide information, which is truthful, accurate and complete. The notifying entity, or the person authorised by it to act on its behalf shall notify the MFSA immediately if the information provided changes in any respect. The governing body of the notifying entity, or the person authorised by it to act on its behalf shall note that penalties may be imposed, under applicable legislation, when providing information or making a statement which one knows to be inaccurate, false or misleading in any material respect, or when furnishing information or making a statement which one knows to be inaccurate, false or misleading in any material respect, pursuant to any of the provisions of this Act or of any Regulations made or of any Rules issued thereunder, or any condition, obligation, requirement, directive or order made or given as aforesaid. The governing body of the notifying entity, or the person authorised by it to act on its behalf is required to make reference, and where applicable comply with, the Act, the Regulations made, or Rules issued thereunder during the completion of the Notification Form. The governing body of the notifying entity, or the person authorised by it to act on its behalf shall also refer to the respective National and/or European Regulatory Frameworks or other binding regulation as may be applicable. The governing body of the notifying entity, or the person authorised by it to act on its behalf shall not tamper with, or modify in any manner, this Notification Form. Should it transpire that the documents were tampered with, or modified in any manner, the Authority shall consider the Notification Form to be invalid. Any potential improvements should be communicated to the MFSA for consideration. The Authority may, at its sole discretion, request further information/ documentation from the governing body of the notifying entity, or the person authorised by it to act on its behalf. Definitions For the purposes of this Notification Form, the definitions identified below should be read in conjunction with the provisions of the Act, the Regulations and other respective national or European regulatory frameworks or other binding regulations as may be applicable. In the event that any of the definitions contained hereunder conflict with a definition under the Act, the definitions set out in the Act or in any other such law shall prevail, unless otherwise specified herein. ‘Act’ means the Markets in Crypto-Assets Act (Chapter 647 of the Laws of Malta) ‘Authority’ means the Malta Financial Services Authority established by the Malta Financial Services Authority Act (Chapter 330 of the Laws of Malta) ‘ESMA’ means European Securities Markets Authority ‘Regulatory framework’ means the respective National and/or European Regulatory Frameworks or other binding regulation, as may be applicable ‘RTS’ means the ESMA Regulatory Technical Standard (‘RTS’) specifying the information to be submitted as part of the notification for provision of crypto-asset services, issued in terms of the MiCA Regulation. Instructions All relevant sections of the Notification Form must be completed. If the form is not electronically signed, it must be printed, originally signed, and sent to the Authority at the following address: Fintech Supervision Malta Financial Services Authority Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 In the printed Declaration Form, the Applicant is reminded to enter the name of the notifying entity. It is to be noted that only this declaration Form should be sent physically to the Authority. In order for the Notification Form to be considered complete, and therefore for the prescribed 20 working days to commence, the notifying entity is required to have submitted, along with a duly filled Notification Form, all the required documentation as identified within this Notification Form. Privacy Notice The MFSA ensures that any processing of personal data is conducted in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation), the Data Protection Act (Chapter 586 of the Laws of Malta) and any other relevant European Union and national law. For further details, you may refer to the MFSA Privacy Notice available on the MFSA webpage https://www.mfsa.mt/privacy-notice/.

Details of Notifying Entity
General and Identification Details
Identification
Registered Name	Enter text
Registered Number	Enter text	Date of Registration	Enter date
Name of Registry (if applicable)	Enter text	Country of Registration	Select country
LEI Code (if applicable)	Enter text
Authorisation Type	Enter text	Date of Authorisation	Enter date
Addresses
Registered Address Indicate registered addresses as indicated on the Registration Document
Number/Name	Enter text	Street/Road	Enter text
City/Town/Village	Enter text	Region/State (if applicable)	Enter text
Post Code	Enter text	Country	Select country
Representation Indicate the details of the internal representatives of the notifying entity and their contact details, as applicable.
Internal Representative
Position	Enter text	If ‘Other’ Specify Position	Enter text
Title	Enter text
Name	Enter text	Surname	Enter text
Representative’s Business Email Address	Enter text	Representative’s Business Direct Number	Enter text

Activities, Business Model and Strategy

Information requirements for financial entities that intend to provide crypto-asset services as requested under the RTS
Article 1: Programme of Operations Note: This section should be populated for the following three years of operations
Where the notifying entity belongs to a group as defined in Article 2(11) of Directive 2013/34/EU, an explanation of how the activities of the notifying entity will fit within the group strategy and interact with the activities of the other entities of the group, including an overview of the current and planned organisation and structure of the group (if applicable).
Enter text
An explanation of how the activities of the entities affiliated with the notifying entity, including where there are regulated entities in the group, is expected to impact the activities of the notifying entity, including a list of and information on the entities affiliated with the notifying entity, and where there are regulated entities, the services provided by these entities (including regulated services, activities and types of clients) and the domain names of each website operated by such entities.
Enter text
A list of crypto-asset services that the notifying entity intends to provide as well as the types of crypto-assets to which the crypto-asset services will relate.
Enter text
Details on other planned activities, regulated in accordance with Union or national law or unregulated, including any other services, than crypto-asset services, that the notifying entity intends to provide.
Enter text
Whether the notifying entity intends to offer crypto-assets to the public or seek admission to trading of crypto- assets and if so, of what type of crypto-assets.
Enter text
A list of jurisdictions, in and outside the European Union, in which the notifying entity plans to provide crypto- asset services, including information on the targeted number of clients by geographical area.
Enter text
Types of prospective clients targeted by the notifying entities’ crypto-asset services.
Enter text

Activities, Business Model and Strategy

A description of the means of access to the notifying entity’s crypto-asset services by clients, including all of the following:
The domain names for each website or other ICT-based application through which the crypto-asset services will be provided by the notifying entity and information on the languages in which the website or other ICT-based application will be available, the types of crypto-asset services that will be accessed through that website or other ICT-based application and, where applicable, from which Member States the website or other ICT-based application will be accessible;
Enter text
The name of any ICT-based application available to clients to access the crypto-asset services, the languages in which that ICT-based application is available, and the crypto-asset services which can be accessed through the ICT-based application
Enter text
The planned marketing and promotional activities and arrangements for the crypto-asset services, including the following: all means of marketing to be used for each of the services; the intended means of identification of the notifying entity; information on the relevant category of clients targeted; types of crypto-assets; languages that will be used for the marketing and promotional activities;
Enter text
A detailed description of the human, financial and ICT resources allocated to the intended crypto-asset services as well as their geographical location.
Enter text
Information on the notifying entity’s outsourcing policy and how it was adapted to crypto-asset services as well as a detailed description of the notifying entity’s planned outsourcing arrangements, including intra-group arrangements, how the notifying entity intends to comply with the requirements set out in Article 73 of Regulation (EU) 2023/1114. This information should also include details on the functions or person responsible for outsourcing, the resources (human and ICT) allocated to the control of the outsourced functions, services or activities of the related arrangements and on the risk assessment related to the outsourcing.
Enter text
The list of entities that will provide outsourced services for the provision of crypto-asset services, their geographical location and the relevant services outsourced.
Enter text

Activities, Business Model and Strategy
A forecast accounting plan including stress scenarios at an individual and, where applicable, at consolidated group and sub-consolidated level in accordance with Directive 2013/34/EU. The financial forecast shall consider any intra-group loans granted or to be granted by and to the notifying entity.
Enter text
Any exchange of crypto-assets for funds and other crypto-asset activities that the notifying entity intends to undertake, including through any decentralised finance applications with which the notifying entity intends to interact on its own account.
Enter text
Article 2: Detection and prevention of money laundering and terrorist financing
The notifying entity’s assessment of the inherent and residual risks of money laundering and terrorist financing associated with its provision of crypto-asset services, including the risks relating to the notifying entity’s customer base, to the products and services provided, to the transactions, to the distribution channels used and to the geographical areas of operation.
Enter text
The measures that the notifying entity has or will put in place to prevent the identified risks and comply with applicable anti-money laundering and counter-terrorist financing requirements and other anti-financial crime, including the risk assessment process, the policies and procedures to comply with customer due diligence requirements, and the policies and procedures to detect and report suspicious transactions or activities.
Enter text
Detailed information on how such mechanisms, systems and procedures are adequate and proportionate to the scale, nature, inherent money laundering and terrorist financing risk, range of crypto-asset services provided, the complexity of the business model and how they ensure the notifying entity’s compliance with Directive (EU) 2015/849 and Regulation (EU) 2023/1113.
Enter text
The identity of the person/s in charge of ensuring compliance with anti-money laundering and counter-terrorist financing and other anti-financial crime obligations, and evidence of the person’s skills and expertise.
Enter text
Arrangements, human and financial resources devoted to ensure, based on annual indications, that staff of the notifying entity is appropriately trained in anti-money laundering and counter-terrorist financing matters (annual indications) and other anti-financial crime and on specific crypto-asset related risks.
Enter text
Attachment Provide a copy of the marked-up version highlighting the changes resulting from the planned introduction of crypto-asset services to the notifying entity’s anti-money laundering and counter-terrorism and other anti-financial crime policies and procedures and systems, business risk assessment and customer risk assessment methodology and systems.
Activities, Business Model and Strategy
The notifying entity`s amendments to the Risk Appetite Statement and Customer Risk Acceptance Policy in the context of the increase in Financial Crime Risks.
Enter text
The frequency of the assessment of the adequacy and effectiveness of such mechanisms, systems and policies and procedures as well as the person or function responsible for such assessment.
Enter text
Article 3: Business Continuity
A detailed description of the notifying entity’s business continuity plan, including which steps shall be taken to ensure continuity and regularity in the provision of the notifying entity’s crypto-asset services.
Enter text
The description shall include details showing that the established business continuity plan is appropriate and that arrangements are set up to maintain and periodically test it. The description shall explain, with regard to critical or important functions supported by third-party service providers, details on how business continuity is ensured in the event that the quality of the provision of such functions deteriorates to an unacceptable level or fails. The description shall also explain how business continuity is ensured in the event of the death of a key person and, where relevant, political risks in the service provider’s jurisdiction.
Enter text
Article 4: ICT systems and related security arrangements
Attachment A notifying entity shall submit to the competent authority all of the following information: Technical documentation of the ICT systems, on DLT infrastructure relied upon, where relevant, and on the security arrangements. The applicant shall include a description of the arrangements, the deployed ICT policies, procedures, systems, protocols, tools and human resources to ensure that the applicant complies with Regulation (EU) 2022/2554; Where available, the outcome of audits or tests on the ICT systems of the notifying entity performed by external independent parties in the last 3 years, including a source code review of the notifying entity’s used and/or developed smart-contracts. A description in non-technical language of the information provided under points a) and b).

Activities, Business Model and Strategy
Article 5: Segregation of Clients’ Crypto-Assets and Funds Note: This section should be populated for notifying entities intending to hold crypto-assets belonging to clients or the means of access to such crypto-assets, or clients’ funds (other than e-money tokens)
A detailed description of its policies and procedures for the segregation of clients’ crypto-assets and funds, including all of the following:
How the notifying entity ensures that:
Clients’ funds are not used for its own account:
Enter text
Crypto-assets belonging to clients are not used for its own account:
Enter text
The wallets holding clients’ crypto-assets are different from the notifying entity’s own wallets:
Enter text
A detailed description of the approval system for cryptographic keys and safeguarding of cryptographic keys including multi-signature wallets:
Enter text
How the notifying entity segregates clients’ crypto-assets, including from other clients’ crypto-assets in the event of wallets containing crypto-assets of more than one client (omnibus accounts);
Enter text
A description of the procedure to ensure that clients’ funds (other than e-money tokens) are deposited with a central bank or a credit institution by the end of the business day following the day on which they were received and are held in an account separately identifiable from any accounts used to hold funds belonging to the notifying entity.
Enter text

Activities, Business Model and Strategy
Where the notifying entity does not intend to deposit funds with the relevant central bank, which factors the notifying entity is taking into account to select the credit institutions to deposit clients’ funds, including the notifying entity’s diversification policy, where available, and the frequency of review of the selection of credit institutions to deposit clients’ funds.
Enter text
How the notifying entity ensures that clients are informed in clear, concise and non-technical language about the key aspects of the notifying entity’s systems and policies and procedures to comply with Article 70(1), (2) and (3) of Regulation (EU) 2023/1114.
Enter text
Article 6: Custody and Administration Policy Note: This section should be populated for notifying entities intending to hold crypto-assets belonging to clients or the means of access to such crypto-assets, or clients’ funds (other than e-money tokens)
A description of the arrangements linked to the type or types of custody offered to clients, in accordance with Article 75(3) of Regulation (EU) 2023/1114;
Enter text
Attachment A copy of the notifying entity’s standard agreement for the custody and administration of crypto-assets on behalf of clients as well as a copy of the summary of the custody policy made available to clients in accordance with Article 60 of Regulation (EU) 2023/1114;
Attachment Provide the notifying entity’s custody and administration policy, including a description of identified sources of operational and ICT risks for the safekeeping and control of the crypto-assets or the means of access to the crypto-assets of clients, together with:
The policies and procedures, and a description of, the arrangements to ensure compliance with Article 75(8) of Regulation (EU) 2023/1114;
Enter text
The policies and procedures, and a description of the systems and controls, to manage those risks, including when the custody and administration of crypto-assets on behalf of clients is outsourced to a third party;
Enter text
The policies and procedures relating to, and a description of, the systems to ensure the exercise of the rights attached to the crypto-assets by the clients;
Enter text

Activities, Business Model and Strategy
The policies and procedures relating to, and a description of, the systems to ensure the return of crypto- assets or the means of access to the clients;
Enter text
Information on how the crypto-assets and the means of access to the crypto-assets of the clients are identified.
Enter text
Information on arrangements to minimise the risk of loss of crypto-assets or of means of access to crypto-assets.
Enter text
Where the crypto-asset service provider has delegated the provision of custody and administration of crypto- assets on behalf of clients to a third-party:
Information on the identity of any third-party providing the service of custody and administration of crypto-assets and its status as an authorised entity in accordance with Article 59 of Regulation (EU) 2023/1114;
Enter text
Description of any functions relating to the custody and administration of crypto assets delegated by the crypto-asset service provider, the list of any delegates and sub-delegates (as applicable) and any conflicts of interest that may arise from such a delegation;
Enter text
Article 11: Transfer services Note: This section should be populated for notifying entities intending to provide transfer services for crypto- assets on behalf of clients
Details on the types of crypto-assets for which the notifying entity intends to provide transfer services.
Enter text
The policies and procedures and a detailed description of the arrangements put in place by the notifying entity to ensure compliance with Article 82 of Regulation (EU) 2023/1114, including detailed information on the notifying entity’s arrangements and deployed ICT and human resources to address risks promptly, efficiently and thoroughly during the provision of transfer services for crypto-assets on behalf of clients, considering potential operational failures and cybersecurity risks.
Enter text

Activities, Business Model and Strategy
If any, a description of the notifying entity’s insurance policy, including on the insurance’s coverage of detriment to client’s crypto-assets that may result from cyber security risks.
Enter text
Arrangements to ensure that clients are adequately informed about the policies and procedures and arrangements referred to in point 1.4.6.3 above.
Enter text

Declaration Form

Dear Enter text,

In accordance with the Regulation (EU) 2023/1114 on Markets in Crypto-Assets (or "the MiCA Regulation") and the relevant Commission Implementing Regulation laying down the implementing technical standards for the application of Regulation (EU) 2023/1114 as published under Title V of the MiCA Regulation and of the Council with regard to standard forms, templates and procedures for the notification of certain entities of their intention to provide crypto-asset services, kindly find attached our notification of our intention to provide crypto-asset services.

We Enter the name of the notifying entity declare that the submitted information is true, accurate, complete and not misleading. Unless specifically stipulated otherwise, the information is up to date on the date of this notification.

Information indicating a future date is explicitly identified in the notification and we undertake to notify the authority in writing without delay if any such information should turn out to be untrue, inaccurate, incomplete or is misleading.

Details of person in charge of preparing the notification:

Signature
Name	Enter text	Surname	Enter text
Position	Enter text	Date	Enter date
Telephone Number	Enter text	Email Address	Enter text