Art. 4 Business continuity plans | RTS on continuity and regularity | MiCA

1. When implementing the business continuity policy referred to in Article 68(7) of Regulation (EU) 2023/1114, crypto-asset service providersmeans a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis, and that is allowed to provide crypto-asset services in accordance with Article 59; shall establish business continuity plans. The business continuity plans shall set out the procedures necessary to protect and, where necessary, re-establish:
  1. the confidentiality, integrity, and availability of clientmeans any natural or legal person to whom a crypto-asset service provider provides crypto-asset services; data;
  2. the availability of the business functions, supporting processes and information assets of the crypto-asset service providersmeans a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis, and that is allowed to provide crypto-asset services in accordance with Article 59;.
1. The business continuity plans shall contain the following:
  1. a range of possible adverse scenarios relating to the operation of critical or important functionsmeans a critical or important function as defined in Article 3, point (22), of Regulation (EU) 2022/2554;, including the unavailability of business functions, staff, workspace, external suppliers, data centres, or loss or alteration of critical data and documents;
  2. the procedures and policies to be followed in case of a disruptive incident, including:
    
    the measures that are necessary to recover critical or important functionsmeans a critical or important function as defined in Article 3, point (22), of Regulation (EU) 2022/2554;;
    
    the deadlines by which those critical or important functionsmeans a critical or important function as defined in Article 3, point (22), of Regulation (EU) 2022/2554; are to be recovered;
    
    recovery point objectives;
    
    the maximum time to resume services;
  3. the procedures and policies for relocating the business functions used to provide crypto-asset servicesmeans any of the following services and activities relating to any crypto-asset:providing custody and administration of crypto-assets on behalf of clients;operation of a trading platform for crypto-assets;exchange of crypto-assets for funds;exchange of crypto-assets for other crypto-assets;execution of orders for crypto-assets on behalf of clients;placing of crypto-assets;reception and transmission of orders for crypto-assets on behalf of clients;providing advice on crypto-assets;providing portfolio management on crypto-assets;providing transfer services for crypto-assets on behalf of clients; to a back-up site;
  4. back-up of critical business data, including up-to-date information of the necessary contacts to ensure communication inside the crypto-asset service providermeans a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis, and that is allowed to provide crypto-asset services in accordance with Article 59;, between the crypto-asset service providermeans a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis, and that is allowed to provide crypto-asset services in accordance with Article 59; and its clientsmeans any natural or legal person to whom a crypto-asset service provider provides crypto-asset services;;
  5. procedures for timely communications with clientsmeans any natural or legal person to whom a crypto-asset service provider provides crypto-asset services; and other external stakeholders, including competent authoritiesmeans one or more authorities:designated by each Member State in accordance with Article 93 concerning offerors, persons seeking admission to trading of crypto-assets other than asset-referenced tokens and e-money tokens, issuers of asset-referenced tokens, or crypto-asset service providers;designated by each Member State for the application of Directive 2009/110/EC concerning issuers of e-money tokens;.
1. In the event of a disruption involving a permissionless distributed ledgermeans a specific type of distributed ledger in which no entity controls the distributed ledger and DLT network nodes can be set up by any person complying with the technical requirements and the protocols of that distributed ledger. used by the crypto asset service provider in the provision of its services, the communications referred to in paragraph 2, point (e) shall include the following information:
  1. when the services are expected to be resumed;
  2. the reasons and the impact of the disruptive incident;
  3. any risks concerning clientsmeans any natural or legal person to whom a crypto-asset service provider provides crypto-asset services;’ fundsmeans funds as defined in Article 4, point (25), of Directive (EU) 2015/2366; and crypto-assetsmeans a digital representation of a value or of a right that is able to be transferred and stored electronically using distributed ledger technology or similar technology; held on their behalf;
  4. measures that the crypto-asset servicemeans any of the following services and activities relating to any crypto-asset:providing custody and administration of crypto-assets on behalf of clients;operation of a trading platform for crypto-assets;exchange of crypto-assets for funds;exchange of crypto-assets for other crypto-assets;execution of orders for crypto-assets on behalf of clients;placing of crypto-assets;reception and transmission of orders for crypto-assets on behalf of clients;providing advice on crypto-assets;providing portfolio management on crypto-assets;providing transfer services for crypto-assets on behalf of clients; intends to take in response to the disruption of a permissionless distributed ledgermeans a specific type of distributed ledger in which no entity controls the distributed ledger and DLT network nodes can be set up by any person complying with the technical requirements and the protocols of that distributed ledger..
2. Where that information is not readily available to the crypto-asset service providermeans a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis, and that is allowed to provide crypto-asset services in accordance with Article 59;, the crypto-asset service providermeans a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis, and that is allowed to provide crypto-asset services in accordance with Article 59; shall communicate updates as regards the information in the first subparagraph to clientsmeans any natural or legal person to whom a crypto-asset service provider provides crypto-asset services; and stakeholders, including competent authoritiesmeans one or more authorities:designated by each Member State in accordance with Article 93 concerning offerors, persons seeking admission to trading of crypto-assets other than asset-referenced tokens and e-money tokens, issuers of asset-referenced tokens, or crypto-asset service providers;designated by each Member State for the application of Directive 2009/110/EC concerning issuers of e-money tokens;, on a best effort basis.
1. The business continuity plans shall contain procedures to address any disruptions of outsourced critical or important functionsmeans a critical or important function as defined in Article 3, point (22), of Regulation (EU) 2022/2554;, including where those critical or important functionsmeans a critical or important function as defined in Article 3, point (22), of Regulation (EU) 2022/2554; become unavailable.