CASP : Internal Control and Governance to Comply with MiCA Regulation
- BECTRA
- Feb 17
- 2 min read
Article 62 of MiCA requires, among other things, that CASPs (Crypto-Asset Service Providers) justify their governance mechanisms and internal control procedures to detect, assess, and manage risks, particularly in anti-money laundering (AML) compliance.
According to the ESMA RTS, CASPs must provide the following information :
Organization and Structure
📍 Describe the company’s organizational structure, including the allocation of responsibilities and reporting architecture.
📍 Provide a detailed organizational chart with information on key internal managers (CVs, skills, and locations).
Internal Controls and Compliance
📍 Detail the policies and procedures in place to ensure regulatory compliance.
📍 Explain the monitoring of internal controls, their independence, and their ability to report major risks to senior management.
📍 Maintain a clear and secure record-keeping system for business operations and internal organization.
📍 Implement mechanisms for employees to report potential violations.
IT Security and Systems
📍 Describe the IT tools and cybersecurity measures used to protect business operations and data.
📍 Establish backup systems and risk management strategies to ensure business continuity.
Financial Transparency and Audits
📍 Indicate whether an external auditor has been appointed (name and contact details).
📍 Describe the accounting policies and fiscal period used by the company.
Management of Conflicts of Interest
📍 Provide a clear policy on conflict of interest management.
📍 Explain how the company identifies, prevents, and resolves conflicts (e.g., remuneration policies, separation of sensitive activities).
📍 Maintain a register of conflicts of interest and indicate whether any cases have been reported to clients.
Conclusion
To comply with MiCA, a CASP must ensure robust internal controls, governance, and risk management. Anticipating and structuring the organization effectively is essential for compliance and avoiding regulatory sanctions.
Comments