RTS on CASP complaints handling

To ensure a prompt and timely handling of complaints, crypto-asset service providers should acknowledge receipt of complaints and inform the complainant as to whether that complaint is admissible without undue delay. Upon acknowledgment of receipt of the complaint, the complainant should also receive the contact details of the person or department to be contacted for any queries related to the complaint, as well as an indicative timeframe within which a decision on the complaint can be expected. Where a complaint has been found to be inadmissible, the crypto-asset service provider should inform the complainant of its decision and provide the complainant with the reasons for the inadmissibility.

To ensure a prompt, timely and fair investigation of complaints, crypto-asset service providers should, upon receipt of a complaint, assess whether that complaint is clear, complete and contains all information necessary for handling it. Where appropriate, crypto-asset service providers should request additional information without undue delay. Crypto-asset services providers should gather and investigate all relevant information regarding the complaint. Complainants should be kept duly informed about the complaints handling process.

To ensure a fair and effective handling of complaints, it is necessary that decisions on complaints address all points raised by the complainant in his or her complaint. Moreover, to ensure compliance with the equality principle, complaints presenting similar circumstances should result in consistent decisions, unless the crypto-assset service provider is able to provide an objective justification for any possible deviation from a previously taken decision.

To ensure a prompt handling of complaints, crypto-asset service providers should communicate decisions on complaints to the complainant without undue delay within the timeframe determined by the crypto asset service provider in the complaints-handling procedure. This timefrome should not exceed 2 months from the date the complaint was received by the crypto-asset service provider. Only in exceptional circumstances where the crypto-asset service provider is not able to meet that timeframe, the complainant should be informed of the reasons for the delay and of the expected date by which a decision will be delivered.

In order to ensure efficient interactions between crypto-asset service providers and complainants, crypto-asset service providers should communicate with complainants in clear and plain language that is easily understandable. For the same reason, crypto-asset service providers should communicate in writing by electronic means or, upon the complainant’s request, in paper form.

In order to achieve procedural and substantive consistency of complaints handling, crypto-asset service providers should analyse complaints-handling data on a continuous basis, including, inter alia, the average processing time, per year (on a rolling basis), for each step of the complaints handling procedure. Such analysis should enable crypto-asset service providers to detect promptly inefficiencies, inconsistencies or deviations from the relevant policies and procedures for the handling of complaints by the crypto-asset service provider. The results of the analysis should enable the crypto-asset service provider to enhance its overall complaints handling processes.

To ensure that the complaints handling procedures are effective and meet their objective of a prompt, fair and consistent handling of complaints received from clients, it is of paramount importance to ensure that the relevant persons in charge of applying such procedures within the crypto-asset service provider are well aware and appropriately trained with regard to such procedures. Such communication and training should also contribute to effective policies and procedures and to ensure compliance with the requirement to employ personnel with the knowledge, skills and expertise necessary for the discharge of the responsibilities allocated to them, in accordance with Article 68(4) and (5) of Regulation (EU) 2023/1114. The training should be proportionate to the efficient handling of complaints and should not result in an excessive burden for crypto-asset service providers.

To ensure that complaints are investigated fairly and effectively, adequate resources should be dedicated by the crypto-asset service provider to their management. Such resources should also ensure that complaints are handled without conflicts of interests. In accordance with Article 68(6) of Regulation (EU) 2023/1114, the management body of the crypto-asset service provider should assess and periodically review the effectiveness of policy arrangements and procedures put in place to comply with Chapters 2 and 3 of Title V of the same Regulation. As a requirement concerning the complaint handling policies and procedures and in order to ensure compliance with Article 68(6) of Regulation (EU) 2023/1114, crypto-asset service providers’ management body should endorse and subsequently monitor the implementation of the complaints-handling policies and procedures.

Any processing of personal data under this Regulation should be carried out in accordance with applicable Union law on the protection of personal data. This Regulation is without prejudice to the rights and obligations under Regulation (EU) 2016/679 of the European Parliament and of the Council(²)Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119 4.5.2016, p. 1, ELI: http://data.europa.eu/eli/reg/2016/679/oj)..This Regulation is based on the draft regulatory technical standards submitted to the Commission by the European Securities and Markets Authority (‘ESMA’), developed in close cooperation with the European Banking Authority.

ESMA has conducted open public consultations on the draft regulatory technical standards on which this Regulation is based, analysed the potential related costs and benefits and requested the advice of the Securities and Markets Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1095/2010 of the European Parliament and of the Council(³)Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84, ELI: http://data.europa.eu/eli/reg/2010/1095/oj).. The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council(⁴)Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). and delivered an opinion on 21 June 2024,