Art. 6 Detection and prevention of money laundering and terrorist financing | RTS on CASP authorisation | MiCA

This article sits within the broader authorisation application framework established by Article 62 of Regulation (EU) 2023/1114, and specifically addresses the anti-money laundering and counter-terrorist financing (AML/CTF) obligations that applicants must demonstrate to the competent authority.

Rather than simply declaring an intention to comply, applicants must submit a comprehensive picture of their AML/CTF risk framework: from the initial risk assessment covering their customer base, services, and geographies, through to the concrete controls, staff training arrangements, and the named individual responsible for compliance.

The article also requires applicants to show that their controls are proportionate to the scale, nature, and complexity of their specific business model.

Important points:

Applicants must provide a full AML/CTF risk assessment covering their customer base, services offered, distribution channels, and geographical areas of operation.
Identify and name the person responsible for AML/CTF compliance, including evidence of that person's knowledge, skills, and experience.
Submit copies of AML/CTF policies, procedures, and systems, along with details of how staff are trained on these matters and how frequently the adequacy of controls is assessed.

For the purposes of Article 62(2), point (i), of Regulation (EU) 2023/1114, applicants shall provide the competent authority with information on their internal control mechanisms, policies and procedures to comply with the provisions of national law transposing Directive (EU) 2015/849 and the risk assessment framework to manage risks relating to money laundering and terrorist financing, including all of the following:

the applicant’s assessment of the inherent and residual risks of money laundering and terrorist financing associated with its business, including the risks relating to:
1. the applicant’s customer base;
2. services provided;
3. distribution channels used;
4. geographical areas of operation;
the measures that the applicant has or will put in place to prevent the identified risks and comply with applicable anti-money laundering and counter-terrorist financing requirements, including the applicant’s risk assessment process, the policies and procedures to comply with customer due diligence requirements, and the policies and procedures to detect and report suspicious transactions or activities;
detailed information on how those internal control mechanisms, policies and procedures are adequate and proportionate to the scale, nature, inherent risk of money laundering and terrorist financing, range of crypto-asset services provided, complexity of the business model and how those mechanisms, policies and procedures ensure compliance with Directive (EU) 2015/849 and Regulation (EU) 2023/1113;
the identity of the person in charge of ensuring compliance with anti-money laundering and counter-terrorist financing requirements, and evidence of that person’s knowledge, skills and experience;
arrangements, human and financial resources ensuring that the staff of the applicant is appropriately trained in anti-money laundering and counter-terrorist financing matters (annual indications) and on specific crypto-asset related risks;
a copy of the applicant’s anti-money laundering and counter-terrorism policies, procedures and systems;
the frequency of the assessment of the adequacy and effectiveness of those internal control mechanisms, policies and procedures, and the person or function responsible for such assessment.