Market in Crypto-Assets Act

This Act regulates the activities, liability, dissolution and supervision of a participant in markets in crypto-assets, elaborating and supplementing the provisions contained in

1) Regulation (EU) 2023/1114 of the European Parliament and of the Council on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (OJ L 150, 9.6.2023, p. 40–205), and

2) Regulation (EU) 2022/2554 of the European Parliament and of the Council on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1–79).

(1) This Act applies to persons who are engaged in the issuance, offer and admission of crypto-assets to trading on a trading platform for crypto-assets, and who provide crypto-asset services for the purposes and within the scope of application of Regulation (EU) 2023/1114 of the European Parliament and of the Council.

(2) If a credit institution, payment institution, e-money institution, investment firm, UCITS management company or alternative fund manager, central securities depository and operator of a regulated securities market is a participant in markets in crypto-assets for the purposes of § 3 of this Act, the provisions of §§ 5 and 6, subsections 4 and 5 of § 7, § 8, subsections 3 and 5–8 of § 15, subsections 3 and 4 of § 17, Chapters 7 and 8 and § 48 apply to it. A small alternative fund manager is not considered an alternative fund manager.

(3) Only the provisions of subsection 4 of § 6, subsection 4 of § 7, Chapters 7 and 8 and § 48 of this Act apply to the person issuing, offering and seeking admission to trading of crypto-assets other than an asset-referenced token or e-money token (hereinafter other crypto-assets). If the person issuing other crypto-assets (hereinafter issuer of other crypto-assets) is not an offeror of other crypto-assets or a person seeking admission to trading of other crypto-assets, the provisions of Chapters 7 and 8 of this Act do not apply to it.

(4) The provisions of §§ 82 and 10 of the Securities Market Act are followed in determining a controlled company, ownership of voting rights and close links in this Act.

(5) The provisions of the Administrative Procedure Act apply to the administrative proceedings prescribed in this Act, taking into account the special rules provided by this Act and the Financial Supervision Authority Act.

(1) For the purposes of this Act, a participant in markets in crypto-assets is

1) a crypto-asset service provider;

2) an issuer of asset-referenced tokens, issuer of e-money tokens and issuer of other crypto-assets (hereinafter jointly issuer of crypto-assets);

3) an offeror of other crypto-assets and person seeking admission to trading of other crypto-assets, unless it falls outside the scope of application of Regulation (EU) 2023/1114 of the European Parliament and of the Council.

(2) An issuer of asset-referenced tokens is a person who issues the asset-referenced tokens specified in Article 3(1), point (6), of Regulation (EU) 2023/1114 of the European Parliament and of the Council.

(3) An issuer of e-money tokens is a credit institution or e-money institution who issues the e-money tokens specified in Article 3(1), point (7), of Regulation (EU) 2023/1114 of the European Parliament and of the Council.

(4) An offeror of other crypto-assets is a person who offers other crypto-assets to the public.

(5) A person seeking admission to trading of other crypto-assets is a person who seeks admission to trading of other crypto-assets or on whose request other crypto-assets have been admitted to trading, including without the consent of the issuer of other crypto-assets.

(1) In this Act, terms are used for the purposes of Regulations (EU) 2023/1114 and (EU) 2022/2554 of the European Parliament and of the Council, unless otherwise provided by this Act.

(2) Consolidation group means a group for the purposes of Regulation (EU) 2023/1114 of the European Parliament and of the Council.

(3) For the purposes of this Act, a contracting state is state which is a contracting party to the EEA agreement, except Estonia.

(1) In order to operate on markets in crypto-assets, a participant in markets in crypto-assets must hold an authorisation (hereinafter authorisation), unless otherwise provided in § 6 of this Act or in Regulation (EU) 2023/1114 of the European Parliament and of the Council.

(2) An authorisation is granted to a participant in markets in crypto-assets and revoked by the Financial Supervision Authority.

(3) An authorisation is granted for an unspecified term and it cannot be transferred to another person.

(4) The registered office of a participant in markets in crypto-assets who has obtained an authorisation must be in Estonia and it must be determined in the memorandum of association or articles of association of the participant in markets in crypto-assets.

(5) An authorisation expires upon

1) making a decision to dissolve the participant in markets in crypto-assets if the Financial Supervision Authority has granted permission therefor;

2) revocation of the authorisation;

3) merger of a crypto-asset service provider and merger of an issuer of asset-referenced tokens, in which event the authorisation of the company being acquired expires;

4) foundation of a new crypto-asset service provider and issuer of asset-referenced tokens by way of merger, in which event the authorisations of the merging companies expire;

5) declaration of bankruptcy of the participant in markets in crypto-assets.

(6) In the event of expiry of the authorisation provided in subsection 5 of this section, a participant in markets in crypto-assets forfeits its right to offer crypto-assets, apply for their operationalisation and provide the crypto-asset service for which the authorisation had been granted to it, including the participant in markets in crypto-assets forfeits its right to operate in a foreign state.

(7) The Financial Supervision Authority publishes a decision to grant and revoke an authorisation on its website no later than on the working day following the day the decision enters into force.

(1) The Financial Supervision Authority approves, by its decision, the right of a credit institution, e-money institution, investment firm, UCITS management company or alternative fund manager, central securities depository and operator of a regulated securities market to operate as a crypto-asset service provider if the aforementioned complies with the conditions of provision of crypto-asset services provided in Article 60 of Regulation (EU) 2023/1114 of the European Parliament and of the Council and has submitted proper and complete information to the Financial Supervision Authority.

(2) The Financial Supervision Authority approves, by its decision, the right of a credit institution to offer and seek admission to trading of asset-referenced tokens issued by it if the credit institution complies with the conditions provided in Article 17 of Regulation (EU) 2023/1114 of the European Parliament and of the Council and has submitted proper and complete information to the Financial Supervision Authority and the Financial Supervision Authority has approved the crypto-asset white paper.

(3) The Financial Supervision Authority approves, by its decision, the right of a credit institution and e-money institution to offer and seek admission to trading of e-money tokens issued by them if the credit institution or e-money institution complies with the conditions provided in Article 48 of Regulation (EU) 2023/1114 of the European Parliament and of the Council and has notified the white paper to the Financial Supervision Authority.

(4) An offeror and person seeking admission to trading of other crypto-assets has the right to operate as a participant in markets in crypto-assets if the conditions provided in Article 4(1) and Article 5(1) of Regulation (EU) 2023/1114 of the European Parliament and of the Council are met.

(1) A participant in markets in crypto-assets may only operate as a private limited company or public limited company.

(2) A participant in markets in crypto-assets who is a private limited company has a supervisory board consisting of at least three members. A crypto-asset service provider who is a private limited company is not required to have a supervisory board if it does not provide the service specified in Article 3(1), point (16)(a) or (b), of Regulation (EU) 2023/1114 of the European Parliament and of the Council. In the event provided in the second sentence of this subsection, the requirements set for a member of the management body in Article 68 of the said Regulation and in legislation issued on the basis of that Regulation apply to the shareholders of the crypto-asset service provider.

(3) The management board of a crypto-asset service provider consists of at least two members.

(4) A participant in markets in crypto-assets follows the requirements for operating on markets in crypto-assets provided in Regulation (EU) 2023/1114 of the European Parliament and of the Council when commencing and conducting its activities and providing its services.

(5) A crypto-asset service provider follows, in addition to the provisions of this Act, the requirements provided in Regulation (EU) 2023/1113 of the European Parliament and of the Council on information accompanying transfers of funds and certain crypto-assets and amending Directive (EU) 2015/849 (OJ L 150, 9.6.2023, p. 1–39).

(6) An issuer of asset-referenced tokens and crypto-asset service provider notify the Financial Supervision Authority, in accordance with Article 33 or 69 of Regulation (EU) 2023/1114 of the European Parliament and of the Council, of a change to its management body at least 30 days before the commencement of activities of a new member of the management body, unless notification is not possible with good reason before that deadline.

(7) An issuer of asset-referenced tokens and crypto-asset service provider establish rules for their employees for the reporting of violations of the requirements provided in Regulation (EU) 2023/1114 of the European Parliament and of the Council and establish a reporting channel allowing for internal reporting of violations of law.

(1) A crypto-asset service provider ensures that the person providing advice or information on crypto-assets or crypto-asset services on its behalf has the necessary knowledge and skills to do so, including the person

1) knows the policies relating to the provision of the crypto-asset services, the nature of the crypto-asset services and the types of the crypto-assets on which advice is provided, including is able to explain the risks associated with the crypto-assets;

2) is able to execute client orders in the best manner, including in accordance with the provisions of Article 78 of Regulation (EU) 2023/1114 of the European Parliament and of the Council;

3) knows the policies of identification, prevention and mitigation of conflicts of interest;

4) knows the requirements for the protection of personal data;

5) is able to explain how client complaints concerning the provision of crypto-asset services are resolved as quickly and transparently as possible in accordance with the provisions of Article 71 of Regulation (EU) 2023/1114 of the European Parliament and of the Council;

6) is able to recommend where a client can turn to resolve disputes;

7) knows the rules for the prevention of market abuse involving crypto-assets;

8) knows the rules for the prevention of money laundering and terrorist financing;

9) is able to explain the rights and obligations of the parties, including the total costs and service fees to be incurred by the client in connection with the crypto-asset services, and the conditions of withdrawal from and cancellation of the contract.

(2) The minister in charge of the policy sector may, by a regulation, establish more detailed requirements for the knowledge and skills of the person specified in subsection 1 of this section.

(1) A crypto-asset service provider and issuer of asset-referenced tokens follow the requirements for digital operational resilience provided in Regulation (EU) 2022/2554 of the European Parliament and of the Council.

(2) A crypto-asset service provider and issuer of asset-referenced tokens report a major information and communication technology (ICT)-related incident to the Financial Supervision Authority and to the Information System Authority in accordance with the provisions of Article 19 of Regulation (EU) 2022/2554 of the European Parliament and of the Council.

(3) A crypto-asset service provider and issuer of asset-referenced tokens transmit an initial notification and reports using the reporting templates established on the basis of Article 20 of Regulation (EU) 2022/2554 of the European Parliament and of the Council and adhere to the established time limits, unless it is not possible for technical reasons to transmit the initial notification using the template.

(4) If a crypto-asset service provider and issuer of asset-referenced tokens decide to notify a significant cyber threat to the Financial Supervision Authority pursuant to Article 19(2) of Regulation (EU) 2022/2554 of the European Parliament and of the Council, they will also transmit the notice to the Information System Authority.

(1) If a participant in markets in crypto-assets holding the right to operate on markets in crypto-assets pursuant to § 5 of this Act wishes to found a branch, provide crypto-asset services on a cross-border basis, offer crypto-assets or seek admission to trading of crypto-assets in a foreign state other than a contracting state (hereinafter third country), it will apply to the Financial Supervision Authority for permission (hereinafter in this Chapter permission for operation in a third country).

(2) In order to apply for the permission for operation in a third country, a participant in markets in crypto-assets submits a written application to the Financial Supervision Authority along with the following data and documents (hereinafter in this Chapter application)

1) the name of the third country where it intends to found a branch, provide services on a cross-border basis, offer crypto-assets or seek admission to trading of crypto-assets;

2) the programme of operations containing data on all the services and activities to be provided in the third country, including information on whether activities or duties will be outsourced to a third party in that country in connection with the foundation of the branch or operation on a cross-border basis;

3) in the event of the foundation of a branch, the address of the seat of the branch in the third country, a description of the organisational structure of the branch and the name, personal identification code or, in the absence of a personal identification code, the date of birth and residence of the person responsible for the management of the branch, as well as the documents confirming the reliability of the responsible person and their compliance with the requirements of this section, which the applicant considers important to submit;

4) confirmation that the participant in markets in crypto-assets has analysed and is able to meet the requirements of the legislation of the country of destination applicable to it.

(3) A participant in markets in crypto-assets may found a branch, provide services on a cross-border basis, offer and seek admission to trading of crypto-assets in a third country in accordance with that provided for its activities in the legislation of the respective third country, in this Act and in legislation issued on the basis thereof, and taking into account the requirements established by the Financial Supervision Authority and, where appropriate, by the competent authority of the third country.

(4) A person responsible for the management of a branch may not be a person

1) whose acts or omissions have led to the bankruptcy, compulsory dissolution or revocation of the authorisation of a participant in markets in crypto-assets or of another person subject to financial supervision at the initiative of a financial supervision authority;

2) who has been convicted of a crime in the first degree and information concerning their punishments has not been deleted from the criminal records database pursuant to the Criminal Records Database Act;

3) with respect to whom a court has imposed an occupational ban in accordance with § 49 or a prohibition to engage in enterprise in accordance with § 491 of the Penal Code, with respect to whom a prohibition on business or a prohibition to work in a particular profession or position applies or who has been punished for a violation of such a prohibition;

4) who is not capable of organising the activities related to crypto-assets in such a manner that the interests of their clients are sufficiently protected;

5) who has submitted false information or failed to submit important information to the supervisory authority;

6) who has been punished for an economic offence, official misconduct, offence against property or offence against public trust or an act of terrorism or for the financing or supporting of activities aimed at committing thereof, and the respective information concerning their punishments has not been deleted from the criminal records database pursuant to the Criminal Records Database Act or on whom an international sanction has been imposed.

(5) The Financial Supervision Authority may refuse to grant permission for operation in a third country if it is of the opinion that at least one of the following circumstances exists

1) the activities of the participant in markets in crypto-assets in the third country through a branch or on a cross-border basis harm the interests, financial situation or reliability of activities of its clients;

2) the financial situation and organisational structure or other resources of the participant in markets in crypto-assets are insufficient for the provision of the crypto-asset services, offering of crypto-assets or seeking admission to trading of crypto-assets as specified in the programme of operations in the third country;

3) one of the circumstances provided in subsection 4 of this section exists in the event of the person responsible for the management of the branch;

4) the activities of the participant in markets in crypto-assets in a third country through a branch or on a cross-border basis are related to money laundering or terrorist financing or to an attempt thereof or to a violation or circumvention of an international sanction or to an attempt thereof or increase such risks;

5) the participant in markets in crypto-assets is unable to meet the requirements prescribed for operating in a third country;

6) the data or documents submitted by the participant in markets in crypto-assets are incorrect or misleading or not in compliance with the requirements provided in this Act;

7) the competent authority of the third country has no legal ground or possibilities for co-operating with the Financial Supervision Authority due to which the Financial Supervision Authority cannot exercise adequate supervision over the branch founded or services provided in the third country.

(6) The Financial Supervision Authority decides to grant or refuse to grant permission for operation in a third country within two months of the receipt of complete data and documents from the participant in markets in crypto-assets and immediately notifies the decision to the participant in markets in crypto-assets.

(7) A participant in markets in crypto-assets may commence activities in a third country after the receipt of the decision to grant the permission as specified in subsection 6 of this section. Before commencing activities in a third country, the participant in markets in crypto-assets notifies the Financial Supervision Authority of the date on which it commences operation in that country.

(8) A participant in markets in crypto-assets immediately notifies the Financial Supervision Authority of a change to the data or documents specified in subsection 2 of this section, but at least one month before the change takes effect. The Financial Supervision Authority may issue a precept to prohibit the change on the ground specified in subsection 5 of this section.

(1) The Financial Supervision Authority may revoke permission for operation in a third country if

1) the participant in markets in crypto-assets has submitted false data when applying for the permission for operation in the third country;

2) the participant in markets in crypto-assets has committed a material violation of the requirements of the legislation of the respective third country regulating its activities and this may harm the interests of the clients of the participant in markets in crypto-assets;

3) the participant in markets in crypto-assets no longer complies with the conditions for obtaining permission for operation in a third country, including if the circumstances specified in subsection 5 of § 10 of this Act have become evident;

4) the participant in markets in crypto-assets has not complied with the precept of the Financial Supervision Authority by the prescribed due date or to the extent prescribed;

5) the risks arising from the activities of the branch are significantly greater than the risks arising from the activities of the participant in markets in crypto-assets.

(2) The Financial Supervision Authority immediately notifies the participant in markets in crypto-assets and, where appropriate, the financial supervision authority of a third country of the decision to revoke the permission for operation in the third country.

(3) After becoming aware of the revocation of the permission for operation in a third country, the participant in markets in crypto-assets will discontinue its operation in the third country no later than by the due date set by the Financial Supervision Authority.

(1) A participant from a contracting state in markets in crypto-assets may offer and seek admission to trading of crypto-assets in Estonia and provide crypto-asset services pursuant to the provisions of Article 65 of Regulation (EU) 2023/1114 of the European Parliament and of the Council by registering to this end a branch or operating in Estonia on a cross-border basis.

(2) Before commencing its activities in Estonia through a branch, a participant from a contracting state in markets in crypto-assets notifies, through the financial supervision authority of its home country, the Financial Supervision Authority of the date on which the branch will commence its operation in Estonia.

(3) In order to provide crypto-asset services, offer and seek admission to trading of crypto-assets in Estonia, a participant from a contracting state in markets in crypto-assets must follow the requirements established for its activities by this Act and on the basis thereof.

(4) A participant from a contracting state in markets in crypto-assets notifies the Financial Supervision Authority if it intends to discontinue its activities in Estonia through a branch.

(1) The Financial Supervision Authority may prohibit, by its precept, the acquisition and increase of a qualifying holding and turning an issuer of asset-referenced tokens and crypto-asset service provider into a controlled company if the circumstances of filing an objection as provided in Article 42(2) or Article 84(2) of Regulation (EU) 2023/1114 of the European Parliament and of the Council exist.

(2) If the circumstances of filing an objection as provided in subsection 1 of this section become evident after the acquisition or increase of a qualifying holding or after turning an issuer of asset-referenced tokens or crypto-asset service provider into a controlled company, the Financial Supervision Authority may issue a precept pursuant to which the acquisition of the holding or turning the issuer of asset-referenced tokens or crypto-asset service provider into a controlled company is considered to be in conflict with Regulation (EU) 2023/1114 of the European Parliament and of the Council.

(3) The Financial Supervision Authority has the right to prohibit or restrict, by its precept, the exercise of voting rights and other rights enabling control in an issuer of asset-referenced tokens or in a crypto-asset service provider by the acquirer and person who has a qualifying holding in or controls the issuer of asset-referenced tokens or crypto-asset service provider if the circumstances provided in Article 42(2) or Article 84(2) of Regulation (EU) 2023/1114 of the European Parliament and of the Council or in subsection 2 of this section exist. The Financial Supervision Authority may issue the precept regardless of whether the precept provided in subsection 1 or 2 of this section is issued. The Financial Supervision Authority may disclose the precept on its website, and the acquirer may also demand that the precept be disclosed.

(4) As a result of a transaction by which a qualifying holding is acquired or increased, the person does not acquire the voting rights attached to the shares, and the votes represented by the shares or the holding are not included in the quorum of the general meeting or meeting of shareholders if

1) the transaction is in conflict with the precept issued by the Financial Supervision Authority;

2) the Financial Supervision Authority has issued the precept provided in subsection 2 or 3 of this section;

3) the Financial Supervision Authority has not been notified of the transaction in accordance with the rules provided in Article 41 or 83 of Regulation (EU) 2023/1114 of the European Parliament and of the Council;

4) the transaction is conducted after the expiry of the time limit specified on the basis of Article 41(8) or Article 83(9) of Regulation (EU) 2023/1114 of the European Parliament and of the Council or before the acquisition of a qualifying holding was permitted.

(5) As a result of a transaction in the event of which any of the circumstances specified in subsection 4 of this section exist, no rights will be created for a person that would turn an issuer of asset-referenced tokens or crypto-asset service provider into a company controlled by the person.

(6) If, as a result of a transaction in the event of which any of the circumstances specified in subsection 4 of this section existed, the rights representing the acquired or increased qualifying holding have been included in the quorum of the general meeting or meeting of shareholders and they have affected the adoption of a resolution of the general meeting or meeting of shareholders, the resolution of the general meeting or meeting of shareholders will be void. A court may declare a resolution of the general meeting or meeting of shareholders void on the basis of a petition of the Financial Supervision Authority, a shareholder or a member of the management body of a company if the petition is filed within three months of the adoption of the resolution of the general meeting or meeting of shareholders.

(7) If a transaction has been conducted by which an issuer of asset-referenced tokens or crypto-asset service provider had to become a company controlled by a person and in the event of which any of the circumstances specified in subsection 4 of this section exist and which served as a basis for the rights enabling control, a court may declare the exercise of such rights void on the basis of a petition of the Financial Supervision Authority, a shareholder or a member of the management body of a company if the petition is filed within three months of the exercise of the rights.

Accounting and reporting are organised in accordance with the provisions of this Act, the Accounting Act, the articles of association and accounting policies and procedures of the participant in markets in crypto-assets and other legislation related to accounting.

(1) A participant in markets in crypto-assets submits to the Financial Supervision Authority the annual report, the proposal for and resolution on the distribution of profit or covering of loss and an extract from the minutes of the general meeting or meeting of shareholders concerning the approval of or refusal to approve the annual report within two weeks of the general meeting of shareholders or meeting of shareholders, but no later that within six months of the end of the financial year.

(2) A participant in markets in crypto-assets is not required to submit the data and documents specified in subsection 1 of this section to the Financial Supervision Authority if it has disclosed these on its website or submitted an audited annual report approved by the general meeting or meeting of shareholders to the commercial register by the time limit provided in subsection 1. Upon disclosure, the participant in markets in crypto-assets must ensure that the aforementioned data and documents are available on its website for at least five years.

(3) A participant in markets in crypto-assets, the Estonian branch of a crypto-asset service provider of a contracting state and the Estonian branch of an issuer of asset-referenced tokens of a contracting state prepare and submit reports to the Financial Supervision Authority in accordance with the rules provided in this Act, in Regulation (EU) 2023/1114 of the European Parliament and of the Council and in legislation issued on the basis thereof.

(4) The Estonian branch of an issuer of asset-referenced tokens of a contracting state submits to the Financial Supervision Authority a supervisory report on the number of holders of asset-referenced tokens and on the value of the asset-referenced tokens issued. The reporting period is a quarter.

(5) The period of regular supervisory reports to be submitted to the Financial Supervision Authority is a quarter or a year and the reports must be submitted to the Financial Supervision Authority within 20 days of the end of the reporting period, unless otherwise provided in this Act or in Regulation (EU) 2023/1114 of the European Parliament and of the Council or in legislation established on the basis thereof. If the last date of submission of the report falls on a day off, the regular report will be submitted no later than on the first working day following the day off.

(6) The Financial Supervision Authority has the right to demand more frequent submission of reports than that provided in this section and submission of additional specific or regular reports necessary for exercising supervision to the extent provided in this Act and in Regulation (EU) 2023/1114 of the European Parliament and of the Council or in order to perform the obligation provided in Article 35(1) of Regulation (EU) No 1095/2010 of the European Parliament and of the Council establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84–119).

(7) Based on the reports submitted to the Financial Supervision Authority for supervision purposes, the Financial Supervision Authority may submit data to the Ministry of Finance for the performance of the duties provided by the Government of the Republic Act, and to Eesti Pank for the performance of the duties provided by the Bank of Estonia (Eesti Pank) Act.

(8) The content, formats, methods of preparation and rules for submission of the regular supervisory reports of a participant in markets in crypto-assets, the Estonian branch of a crypto-asset service provider of a contracting state and the Estonian branch of an issuer of asset-referenced tokens of a contracting state to be submitted to the Financial Supervision Authority may be established by a regulation of the minister in charge of the policy sector.

(1) The Financial Supervision Authority verifies the compliance of a report submitted for supervision purposes with the requirements provided in this Act, in Regulation (EU) 2023/1114 of the European Parliament and of the Council and in legislation issued on the basis thereof.

(2) If the Financial Supervision Authority discovers deficiencies in a report submitted for supervision purposes, it will immediately notify the person who submitted the report thereof.

(3) The person who submitted the report for supervision purposes is required to eliminate the deficiencies specified in subsection 2 of this section and submit an adjusted report to the Financial Supervision Authority without undue delay. The adjusted report must also be submitted to the Financial Supervision Authority if the person who submitted the report has themselves discovered an error in the data submitted earlier or if the audited data differ from the unaudited data submitted earlier.

(4) The person who submitted the report for supervision purposes is required to preserve the documents forming the source of the initial data used in the preparation of the report for five years. The said time limit does not restrict the right of a participant in markets in crypto-assets to preserve the data and documents over a longer period of time if the participant in markets in crypto-assets has another legal ground for the processing thereof.

(1) It is mandatory for the annual accounts of a participant in markets in crypto-assets to be audited.

(2) A participant in markets in crypto-assets appoints a trustworthy person with adequate expertise and experience as specified in subsection 2 of § 7 of the Auditors Activities Act as an audit firm and notifies the Financial Supervision Authority of the intention to appoint an audit firm at least ten days before making the respective decision. A participant in markets in crypto-assets submits to the Financial Supervision Authority the auditor’s confirmation that no circumstances exist with regard to the auditor which preclude their right to be an auditor of the participant in markets in crypto-assets.

(3) If the prudential safeguards of a crypto-asset service provider take the form of own funds pursuant to Article 67(4) of Regulation (EU) 2023/1114 of the European Parliament and of the Council, the audit firm must verify, as at the balance sheet date, compliance by the crypto-asset service provider with the own funds requirements imposed on it and submit the result of the verification to the crypto-asset service provider. The crypto-asset service provider forwards the result of the verification to the Financial Supervision Authority along with the data and documents specified in subsection 1 of § 15 of this Act, unless the time limit for the performance of the duty of the audit firm has been changed pursuant to subsection 5 of this section.

(4) The performance of the duty of an audit firm provided in Article 36(9) and Article 58(1) and, where appropriate, in Article 58(2) of Regulation (EU) 2023/1114 of European Parliament and of the Council is an audit assurance service to which the provisions of the Auditors Activities Act apply with the special rules provided in this Act.

(5) The Financial Supervision Authority may, at the request of a participant in markets in crypto-assets and in the event of justified need, extend the time limit for the performance of the duty of the audit firm for up to four months.

(6) A court of the seat of a participant in markets in crypto-assets appoints an audit firm on the basis of a petition of the Financial Supervision Authority if

1) the general meeting or meeting of shareholders has not appointed an audit firm;

2) the audit firm appointed by the general meeting or meeting of shareholders has refused to conduct an audit;

3) in the opinion of the Financial Supervision Authority, the audit firm is no longer trustworthy.

(7) The term of office of the audit firm appointed by the Financial Supervision Authority continues until the general meeting or meeting of shareholders appoints a new audit firm.

(1) Upon issue of a sworn auditor’s report and in the event of cancellation of a client contract, an audit firm is required to notify the Financial Supervision Authority in writing of any circumstances that have come to the knowledge of the audit firm in the course of auditing a participant in markets in crypto-assets and that lead or may lead to

1) a material violation of the legislation regulating the activities of the participant in markets in crypto-assets;

2) interruption of further activities of the participant in markets in crypto-assets or of its subsidiary;

3) a sworn auditor’s modified opinion on the annual accounts;

4) a situation, or the risk of a situation arising, due to which the participant in markets in crypto-assets is unable to perform its obligations;

5) a significant pecuniary harm to the participant in markets in crypto-assets or to its clients arising from acts by a member of the management body or by an employee of the participant in markets in crypto-assets.

(2) Upon issue of a sworn auditor’s report in the audit of a person which has a close link with a participant in markets in crypto-assets or in the event of cancellation of a client contract with such a person, an audit firm is required to notify the Financial Supervision Authority in writing of any circumstances that lead or may lead to a consequence specified in subsection 1 of this section.

(1) The transformation of a crypto-asset service provider and issuer of asset-referenced tokens is only permitted from a private limited company into a public limited company.

(2) A crypto-asset service provider and issuer of asset-referenced tokens are transformed in accordance with the rules provided in the Commercial Code, unless otherwise provided by this Act.

(3) Transformation requires the permission of the Financial Supervision Authority (hereinafter permission for transformation) and, in order to obtain it, a crypto-asset service provider or issuer of asset-referenced tokens submits an application to the Financial Supervision Authority along with the following documents

1) the resolution of the meeting of shareholders on amendment of the articles of association;

2) the minutes of the meeting of shareholders;

3) the new text of the articles of association;

4) the transformation report audited by an audit firm pursuant to § 479 of the Commercial Code.

(4) The Financial Supervision Authority makes a decision to grant or refuse to grant permission for transformation within one month of the receipt of all the proper data and documents, but no later than three months after the receipt of the application.

(5) The Financial Supervision Authority may refuse to grant permission for transformation if

1) the financial soundness of the crypto-asset service provider or issuer of asset-referenced tokens applying for the permission for transformation is not in compliance with the requirements provided in Regulation (EU) 2023/1114 of the European Parliament and of the Council;

2) the documentation related to the transformation is not in compliance with the requirements provided in this Act or in the Commercial Code;

3) the transformation may, for any other reason, harm the interests of the clients of a crypto-asset service provider or of issuers of asset-referenced tokens, holders of crypto-assets or other creditors.

(6) The permission of the Financial Supervision Authority for the transformation of a crypto-asset service provider or issuer of asset-referenced tokens is appended to the petition specified in subsection 1 of § 485 of the Commercial Code and to be submitted to the registrar of the commercial register.

(7) The Financial Supervision Authority discloses a decision to grant permission for transformation on its website no later than on the working day following the day of making such decision.

(1) The merger of a crypto-asset service provider and the merger of an issuer of asset-referenced tokens take place in accordance with the rules provided in the Commercial Code, unless otherwise provided by this Act.

(2) A crypto-asset service provider and issuer of asset-referenced tokens may, as a company being acquired, only merge with a crypto-asset service provider or issuer of asset-referenced tokens from Estonia or another contracting state or with a credit institution, investment firm, e-money institution or payment institution of another contracting state.

(3) A crypto-asset service provider and issuer of asset-referenced tokens may, as an acquiring company, merge with

1) a crypto-asset service provider or issuer of asset-referenced tokens from Estonia or another contracting state or with a credit institution, investment firm, e-money institution or payment institution of another contracting state or with a company to whom an authorisation has been issued on the basis of Regulation (EU) 2020/1503 of the European Parliament and of the Council on European crowdfunding service providers for business, and amending Regulation (EU) 2017/1129 and Directive (EU) 2019/1937(OJ L 347, 20.10.2020, p. 1–49);

2) a financial institution or an ancillary services undertaking whose principal and permanent activity is the provision of financial services, information technology services, compliance services or other such services, or activities supplementary to the principal activities of the crypto-asset service provider or issuer of asset-referenced tokens.

(4) In the event specified in subsection 3 of this section, the crypto-asset service provider and issuer of asset-referenced tokens continue their activities after the merger on the basis of the authorisation of the acquiring crypto-asset service provider or issuer of asset-referenced tokens.

(5) If a crypto-asset service provider or issuer of asset-referenced tokens merges by way of founding a new crypto-asset service provider or issuer of asset-referenced tokens, the new crypto-asset service provider or issuer of asset-referenced tokens must apply for an authorisation in accordance with the rules provided in Regulation (EU) 2023/1114 of the European Parliament and of the Council.

(6) In the event provided in subsection 5 of this section, the Financial Supervision Authority makes a decision on the termination of validity of the authorisation of the merging Estonian crypto-asset service provider or Estonian issuer of asset-referenced tokens at the same time with making a decision to grant the permission for merger and authorisation as provided in subsection 10 of § 21 of this Act. The decision to revoke the authorisation does not enter into force before the day when the new crypto-asset service provider or issuer of asset-referenced tokens is entered in the commercial register.

(7) The Financial Supervision Authority decides on the termination of validity of the authorisation of the Estonian crypto-asset service provider or Estonian issuer of asset-referenced tokens being acquired in the event of a merger of the crypto-asset service provider or issuer of asset referenced tokens at the same time with making a decision to grant the permission for merger as provided in subsection 9 of § 21 of this Act. The decision to revoke the authorisation does not enter into force before the day when a new merger entry is made in the commercial register.

(1) Merger requires the permission of the Financial Supervision Authority (hereinafter permission for merger).

(2) In order to obtain the permission for merger, the acquiring company submits an application for the permission for merger to the Financial Supervision Authority along with the following data and documents

1) the merger agreement;

2) the merger report;

3) the merger resolutions if the adoption thereof is required;

4) the sworn auditor’s report on the results of the audit of the merger agreement;

5) data on the persons having a qualifying holding;

6) data on the companies in which the holding of the crypto-asset service provider or issuer of asset-referenced tokens or a member of its management body exceeds 20 per cent. These data must include the amount of the share capital, a list of the areas of activity and the amount of the holding of the crypto-asset service provider or issuer of asset-referenced tokens and every member of the management body;

7) in the event of a crypto-asset service provider, the programme of operations specified in Article 62(2)(d) of Regulation (EU) 2023/1114 of the European Parliament and of the Council for the three years following the merger.

(3) In the event provided in subsection 5 of § 20 of this Act, the merging companies jointly submit an application for the permission for merger to the Financial Supervision Authority along with the following data and documents

1) the merger agreement;

2) the merger report;

3) the merger resolutions if the adoption thereof is required;

4) the sworn auditor’s report on the results of the audit of the merger agreement;

5) an application for an authorisation provided in Article 18 or 62 of Regulation (EU) 2023/1114 of the European Parliament and of the Council.

(4) The merger agreement may not be entered into with a suspensive or resolutive condition, unless the condition is to obtain permission for merger from the Financial Supervision Authority.

(5) The Financial Supervision Authority may refuse to review an application for the permission for merger if the application has been submitted with significant deficiencies.

(6) If the acquiring company or merging companies has/have not submitted all the data and documents specified in subsection 2 or 3 of this section or they are incorrect, misleading or incomplete, or have not been prepared in accordance with the requirements, the Financial Supervision Authority has the right to demand that the acquiring company or merging companies eliminate the deficiencies within a reasonable term determined by the Financial Supervision Authority.

(7) In order to specify and verify the data and documents specified in subsection 2 or 3 of this section, the Financial Supervision Authority may demand additional data and documents which must be submitted within a reasonable term determined by the Financial Supervision Authority. The Financial Supervision Authority specifies which additional data and documents must be submitted.

(8) If the deficiencies specified in subsection 6 of this section have not been eliminated by the determined time limit or the additional data and documents specified in subsection 7 have not been submitted to the Financial Supervision Authority by the determined time limit or the additional data and documents have been submitted with significant deficiencies, the Financial Supervision Authority may refuse to review the application for the permission for merger or demand that the applicant eliminate the deficiencies.

(9) The Financial Supervision Authority makes a decision to grant or refuse to grant the permission for merger specified in subsection 2 of this section within one month of the receipt of all the proper data and documents, but no later than three months after the receipt of the application for the permission for merger.

(10) The Financial Supervision Authority makes a decision to grant or refuse to grant the permission for merger specified in subsection 3 of this section within the term applicable to making a decision on an application for an authorisation provided in Regulation (EU) 2023/1114 of the European Parliament and of the Council.

(11) The Financial Supervision Authority may refuse to grant permission for merger if

1) the members of the management body of the acquiring crypto-asset service provider or issuer of asset-referenced tokens or new company are not in compliance with the requirements provided in Regulation (EU) 2023/1114 of the European Parliament and of the Council;

2) the financial soundness of the acquiring crypto-asset service provider or issuer of asset-referenced tokens or new company is not in compliance with the requirements provided in Regulation (EU) 2023/1114 of the European Parliament and of the Council;

3) the merger agreement is not in compliance with the requirements provided in this Act or in the Commercial Code;

4) the merger may prevent the exercise of the necessary level of supervision over a crypto-asset service provider or issuer of asset-referenced tokens;

5) the merger may, for any other reason, harm the interests of the clients of a crypto-asset service provider or of an issuer of asset-referenced tokens, holders of crypto-assets or other creditors.

(12) The merging companies must immediately publish a notice of obtaining permission for merger at least on their website.

(13) A crypto-asset service provider and issuer of asset-referenced tokens submit a petition for entry of a merger in the commercial register immediately after the publication of the notice specified in subsection 12 of this section.

Division of a crypto-asset service provider and issuer of asset-referenced tokens is not permitted.

(1) A crypto-asset service provider and issuer of asset-referenced tokens are dissolved in accordance with the rules provided in the Commercial Code, unless otherwise provided by this Act.

(2) Voluntary dissolution of a crypto-asset service provider and issuer of asset-referenced tokens requires the permission of the Financial Supervision Authority (hereinafter permission for dissolution).

(3) In order to obtain the permission for dissolution, a crypto-asset service provider or issuer of an asset-reference token submits an application to the Financial Supervision Authority, appending thereto the following data and documents

1) the resolution of the general meeting or meeting of shareholders of the crypto-asset service provider or issuer of asset-referenced tokens on dissolution and application for permission for dissolution;

2) the plan provided in Article 34(7) or in Article 74 of Regulation (EU) 2023/1114 of the European Parliament and of the Council, including the assessment of the participant in markets in crypto-assets on the impact of its dissolution on the interests of its clients;

3) confirmation that all client relationships and client contracts have been terminated or assigned to another crypto-asset service provider or issuer of asset-referenced tokens;

4) a regular report of the crypto-asset service provider or issuer of asset-referenced tokens about the period from the submission of the most recent regular report to the making of the resolution specified in clause 1 of this subsection.

(4) The Financial Supervision Authority makes a decision to grant or refuse to grant permission for dissolution within three months of the receipt of all proper data and documents.

(5) The Financial Supervision Authority may refuse to grant permission for dissolution if the dissolution of a crypto-asset service provider or issuer of asset-referenced tokens is in conflict with the interests of its clients.

(6) The Financial Supervision Authority immediately notifies a crypto-asset service provider or issuer of asset-referenced tokens of the decision to grant or refuse to grant permission for dissolution.

(7) An issuer of asset-referenced tokens and crypto-asset service provider may be compulsorily dissolved on the basis of a petition of the Financial Supervision Authority by a court order if the Financial Supervision Authority has revoked an authorisation of the issuer of asset-referenced tokens or crypto-asset service provider on the basis of Article 24 or 64 of Regulation (EU) 2023/1114 of the European Parliament and of the Council.

(8) Evidence concerning the circumstances provided in Article 24 or 64 of Regulation (EU) 2023/1114 of the European Parliament and of the Council must be submitted to the court along with the petition.

(9) A court decides on the compulsory dissolution within three working days of the submission of the respective petition.

(10) An order on compulsory dissolution is subject to immediate execution and the filing of and proceedings regarding an appeal do not suspend the activities of liquidators.

(11) The provisions of subsection 3 of § 203 and subsection 3 of § 366 of the Commercial Code do not apply in the event specified in subsection 7 of this section.

(1) The filing of and proceedings regarding a bankruptcy petition, the declaration of bankruptcy and bankruptcy proceedings with respect to a crypto-asset service provider and issuer of asset-referenced tokens take place in accordance with the rules provided in the Bankruptcy Act, taking into account the special rules provided in this section.

(2) A bankruptcy petition against a crypto-asset service provider and issuer of asset-referenced tokens may be filed by

1) the Financial Supervision Authority;

2) the liquidators;

3) the creditors.

(3) An operating crypto-asset service provider or issuer of asset-referenced tokens which is a debtor may only file a bankruptcy petition with the consent of the Financial Supervision Authority.

(4) An operating crypto-asset service provider or issuer of asset-referenced tokens immediately notifies the Financial Supervision Authority if a bankruptcy petition has been filed against it by liquidators or creditors.

(5) The assets of the client entrusted to a crypto-asset service provider in connection with the provision of services as well as the assets acquired on the account of such assets belong to the client in accordance with Article 70 of Regulation (EU) 2023/1114 of the European Parliament and of the Council and they are not included in the bankruptcy estate of the service provider and the claims of other creditors of the crypto-asset service provider are not satisfied on the account of such assets.

The purpose of supervision is to ensure that the foundation and activities of a participant in markets in crypto-assets and the provision of crypto-asset services by and dissolution of a participant in markets in crypto-assets comply with this Act, Regulations (EU) 2022/2554 and (EU) 2023/1114 of the European Parliament and of the Council and other legislation regulating the activities of a participant in markets in crypto-assets, with particular attention being paid to the protection of the interests and rights of holders of crypto-assets and clients of crypto-asset services.

(1) The Financial Supervision Authority exercises supervision over the activities of a participant in markets in crypto-assets pursuant to this Act, Regulations (EU) 2022/2554 and (EU) 2023/1114 of the European Parliament and of the Council, the Financial Supervision Authority Act and other legislation regulating the activities of a participant in markets in crypto-assets and in accordance with the rules provided in legislation issued on the basis thereof.

(2) In exercising supervision over appropriate compliance with the requirements provided in Regulations (EU) 2022/2554 and (EU) 2023/1114 of the European Parliament and of the Council, the Financial Supervision Authority has all the rights provided in the aforementioned Regulations, in this Act and in the Financial Supervision Authority Act.

(3) The supervision activities of the Financial Supervision Authority cover

1) all participants in markets in crypto-assets who have been founded in Estonia;

2) branches of an Estonian participant in markets in crypto-assets founded in a foreign state, unless supervision over them is exercised by a financial supervision authority of a foreign state or if a respective agreement has been entered into with a financial supervision authority of the state;

3) the third parties to whom the duties of a participant in markets in crypto-assets have been outsourced;

4) the persons who have the right to operate in the European Union on the basis of Regulation (EU) 2023/1114 of the European Parliament and of the Council and who operate in Estonia through a branch or on a cross-border basis.

(4) In order to exercise supervision, the Financial Supervision Authority

1) decides on the grant, amendment and revocation of the authorisation and permissions provided in this Act and in Regulation (EU) 2023/1114 of the European Parliament and of the Council;

2) verifies everything relating to the acquisition, increase and reduction of holdings provided in Articles 41, 42, 83 and 84 of Regulation (EU) 2023/1114 of the European Parliament and of the Council;

3) monitors reports and other documents, also by on-the-spot verification of the compliance of the activities of a participant in markets in crypto-assets with the legislation applicable to it;

4) issues mandatory precepts and gives orders, where necessary;

5) performs other duties provided by Regulations (EU) 2022/2554 and (EU) 2023/1114 of the European Parliament and of the Council and by this Act.

(5) In order to receive the explanations provided in subsection 1 of § 27 of this Act, the Financial Supervision Authority may apply the special state supervision measures provided in § 31 of the Law Enforcement Act.

(6) For the purposes of preventing, detecting and reducing the violation of the requirements provided in Title 6 of Regulation (EU) 2023/1114 of the European Parliament and of the Council, the Financial Supervision Authority may monitor the conduct of the transactions conducted and to be conducted within the framework of offering crypto-assets and providing crypto-asset services, as well as the performance of other operations in connection with possible violations of the requirements. The monitoring may be covert.

(7) The Financial Supervision Authority has the right to implement the measures provided in Article 111(2) and (5) of Regulation (EU) 2023/1114 of the European Parliament and of the Council and in this Act. The Financial Supervision Authority discloses a notice on the decision made on the basis of the right provided in Article 111 of the said Regulation and in §§ 37–42 of this Act on its website pursuant to Article 114 of the Regulation.

(8) The Financial Supervision Authority has the right to implement the measures provided in Article 50(4) of Regulation (EU) 2022/2554 of the European Parliament and of the Council and in this Act. The Financial Supervision Authority discloses a notice on the decision made on the basis of the right provided in Article 50 of the said Regulation and in § 44 of this Act on its website pursuant to Article 54 of the Regulation.

(1) For supervision purposes, the Financial Supervision Authority has the right to demand reports, free information, documents and verbal and written explanations concerning circumstances relevant to the exercise of supervision from the following persons and authorities

1) a participant in markets in crypto-assets and member of the management body and employee of the participant in markets in crypto-assets;

2) a member of the management body and employee of a company belonging to the same consolidation group as a participant in markets in crypto-assets;

3) a shareholder of a participant in markets in crypto-assets;

4) an audit firm of a participant in markets in crypto-assets, including engaging in co-operation with it;

5) another third party in the event of justified need;

6) the liquidator or trustee in bankruptcy of a participant in markets in crypto-assets;

7) a state authority and local government authority;

8) the registrar of a general national register and of a national register and the controller and processor of a state database.

(2) For supervision purposes, the Financial Supervision Authority has the right to

1) receive, in a justified event, information directly from a crypto-asset service provider, credit institution, e-money institution and payment institution about the account and crypto-asset wallet of a client and insider, and about the turnover and balance related to that account and crypto-asset wallet;

2) receive, in a justified event, from a credit institution data containing banking secrecy concerning a crypto-asset service provider and its clients, as well as the third party to whom the duties of a crypto-asset service provider have been outsourced.

(3) For supervision purposes, the Financial Supervision Authority has the right to receive information related to a participant in markets in crypto-assets from a third party without notifying the participant in markets in crypto-assets of the receipt of the information. The third party may not notify the participant in markets in crypto-assets of the communication of the information.

(4) The Financial Supervision Authority explains the purposes of requesting information to the persons specified in subsections 1 and 2 of this section, unless it harms the exercise of supervision.

(1) If a participant in markets in crypto-assets that has founded a branch in a third country provides crypto-asset services on a cross-border basis in a third country, offers on a cross-border basis or seeks admission to trading of crypto-assets in a third country, violates the requirements of the legislation of the respective third country regulating its activities, the Financial Supervision Authority will, on the proposal of a competent authority of the third county, immediately implement measures for the termination of the violation.

(2) The Financial Supervision Authority will, where possible, notify the competent authority of the third country of the measures implemented.

(3) A branch of a participant in markets in crypto-assets and a participant in markets in crypto-assets who provide services on a cross-border basis, offer on a cross-border basis or seek admission to trading of crypto-assets must, at the request of a competent authority of a third country, submit the information necessary for exercising supervision over the activities of the branch or participant in markets in crypto-assets in that country.

(1) The Financial Supervision Authority will, where necessary, explain the rights and obligations of a party to the proceedings in supervision proceedings to the party to the proceedings.

(2) A party to the proceedings has the right to examine the data concerning them which have been collected by the Financial Supervision Authority and to make copies and extracts of such data. The Financial Supervision Authority has the right to refuse to submit the data to a party to the proceedings if this harms or may harm the legitimate interests of a third party or if examining the data hinders the achievement of the objectives of supervision or poses a threat to ascertaining the truth in criminal proceedings.

(3) In supervision proceedings, a party to the proceedings has the right to submit questions to a witness via the Financial Supervision Authority. The Financial Supervision Authority has the right to refuse to forward questions to witnesses with good reason if the questions are irrelevant or in order to prevent the violation of the rights or interests of witnesses.

A person required to provide explanations may refuse to provide explanations to the Financial Supervision Authority on the grounds provided in § 73 of the Code of Criminal Procedure.

(1) In order to exercise supervision, the Financial Supervision Authority has the right to inspect a participant in markets in crypto-assets and a company belonging to the sameconsolidation group as the participant in markets in crypto-assets as well as a person to whom the duties of a participant in markets in crypto-assets have been outsourced (hereinafter in this section person being inspected), at its seat or place of business.

(2) An on-site inspection may be conducted if

1) it is necessary to verify whether the data submitted correspond to reality;

2) the Financial Supervision Authority suspects that the provisions of Regulations (EU) 2022/2554 and (EU) 2023/1114 of the European Parliament and of the Council and this Act or legislation established on the basis thereof have been violated;

3) it is necessary to verify the information received from a participant from a contracting state in markets in crypto-assets on the basis of a request of the financial supervision authority of the contracting state;

4) this is necessary for performing other supervisory duties.

(3) In order to conduct an on-site inspection, the Financial Supervision Authority issues an order which sets out the purpose, extent, duration and time of the inspection. The order is delivered to the person being inspected at least three working days prior to the on-site inspection commencing, unless giving such notice harms the achievement of the purpose of the inspection. An on-site inspection is conducted by an employee authorised by the Financial Supervision Authority (hereinafter inspector), unless otherwise prescribed in this Act.

(4) In the course of an on-site inspection, the inspector has the right to

1) enter all premises, where possible following the security rules in force with regard to the person being inspected;

2) use a separate room necessary for their work;

3) examine documents and data media necessary for exercising supervision, and make extracts, transcripts and copies thereof without restrictions;

4) monitor work processes;

5) demand verbal and written explanations from the managers and employees of the person being inspected.

(5) The person being inspected is required to appoint a competent representative in whose presence the inspection is conducted and who provides the inspector with the documents and other information necessary for the performance of their duties, including the sworn auditor’s reports and sworn auditor’s special reports concerning the reports of the person being inspected and provides necessary explanations with regard to such documents and information.

(6) In the event specified in clause 3 of subsection 2 of this section, the Financial Supervision Authority may authorise a financial supervision authority of a contracting state or an audit firm or expert appointed by it to conduct an on-site inspection.

(7) An inspector is required to prepare a draft report concerning the results of the inspection within two months of the completion of the on-site inspection and the Financial Supervision Authority immediately communicates the report to the person being inspected. The Financial Supervision Authority may extend the said term by up to two months if the explanations provided by the person being inspected or any other material circumstances require additional assessment.

(8) A person being inspected has the right to provide written explanations within one month of the delivery of the draft report.

(9) After receipt of the written explanations of the person being inspected or after failure to provide these by the time limit, but no later than within four months of the completion of the on-site inspection, the Financial Supervision Authority will approve, by its decision, a final report which is delivered to the person being inspected.

(10) The Financial Supervision Authority may extend the term specified in subsection 9 of this section by up to two months if the explanations provided by the person being inspected or any other material circumstances require additional assessment. If significant changes are made to the final report during the respective period, the final report must be sent again to the person being inspected for receiving written explanations.

(11) The Financial Supervision Authority may, by a final report, set a term for the person being inspected to eliminate the discovered deficiencies or impose other obligations on the person being inspected and establish restrictions and impose a non-compliance levy in the event of a failure to perform or inappropriate performance thereof.

(12) The Financial Supervision Authority has the right to disclose the final report on the on-site inspection or a part thereof if this is necessary proceeding from the stability and transparency of the financial sector or the interests of clients.

(13) If the Financial Supervision Authority has carried out an on-site inspection on the basis of clause 3 of subsection 2 of this section, the Financial Supervision Authority will immediately notify the competent authorities of the contracting state of the results of the inspection.

(1) The Financial Supervision Authority may involve an expert in supervision proceedings in the event where expertise is required to ascertain circumstances which are relevant to the proceedings.

(2) The Financial Supervision Authority has the right to demand a special audit if

1) there is reasonable doubt that the reports or information submitted to the Financial Supervision Authority or to the public are misleading or inaccurate;

2) transactions have been conducted which may result or have resulted in significant harm to a participant in markets in crypto-assets, company belonging to its consolidation group or its clients;

3) another important matter related to the financial situation of a participant in markets in crypto-assets or of a company belonging to the consolidation group of a participant in markets in crypto-assets needs additional clarification in the supervision proceedings.

(3) The Financial Supervision Authority involves an expert or, for a special audit, an audit firm at its own initiative or at the request of a party to the proceedings. The name of the expert or audit firm and the reasons for the involvement thereof are communicated to a party to the proceedings before the involvement, unless proceedings regarding the matter need to be conducted quickly or communication of the information may hinder the achievement of the objective of the expert assessment or special audit.

(4) An expert and an audit firm who performs a special audit have the right to exercise the rights provided in subsection 4 of § 31 of this Act only for the performance of the duties assigned to them. The audit firm has the right to make proposals to the Financial Supervision Authority and to a party to the proceedings for the submission of additional information and documents. The expert and the audit firm who performs the special audit may exercise the right provided in subsection 4 of § 31 of this Act only with the permission or in the presence of the person being inspected.

(5) If the expert or the audit firm who performs a special audit ascertains circumstances relevant to the supervision proceedings and the Financial Supervision Authority did not directly assign the duty of ascertaining these circumstances to the expert or audit firm, the expert or audit firm will also provide their opinion or assessment with regard to these circumstances.

(6) An expert is required to maintain the secrecy of any information not subject to disclosure which became known to them upon performing the duties specified in this section.

(7) The costs of an expert assessment or special audit are covered by the Financial Supervision Authority. If an expert or audit firm is involved at the request of a party to the proceedings, the costs of the expert assessment or special audit will be covered by the party to the proceedings.

(1) The Financial Supervision Authority has the right to issue a precept if

1) a violation of the requirements provided in the legislation regulating the activities of a participant in markets in crypto-assets has been discovered as a result of supervision;

2) there is a need to prevent the violation of law specified in clause 1 of this subsection;

3) the risks assumed by a participant in markets in crypto-assets have increased significantly or other circumstances exist which endanger or may endanger its activities, the interests of its clients or the soundness or transparency of the financial market as a whole.

(2) The addressee of a precept must commence compliance with the precept immediately after the communication thereof.

(3) The filing of and proceedings regarding an appeal against a precept do not suspend compliance with the precept, unless otherwise prescribed by the Financial Supervision Authority.

(1) The Financial Supervision Authority has the right, by its precept, to

1) prohibit the conduct of certain transactions or the performance of certain operations or restrict their volumes;

2) prohibit or restrict the use or disposal of assets, including accounts or a crypto-asset wallet;

3) prohibit, in part or in full, the making of disbursements from the profit of a participant in markets in crypto-assets;

4) demand that the operating expenses of a participant in markets in crypto-assets be restricted;

5) demand that the internal rules and rules of procedure of a participant in markets in crypto-assets be established, amended and updated;

6) demand that a member of the management body of a participant in markets in crypto-assets be removed or not be elected or appointed, or that their powers be temporarily suspended;

7) make a proposal to the general meeting or meeting shareholders of a participant in markets in crypto-assets for replacing the audit firm of the participant in markets in crypto-assets;

8) demand that an employee of a participant in markets in crypto-assets be suspended from work;

9) demand that the right to provide services granted upon outsourcing the activities of a participant in markets in crypto-assets be withdrawn;

10) demand that a participant in markets in crypto-assets immediately disclose information where the obligation to disclose such information is provided in this Act or in Regulation (EU) 2023/1114 of the European Parliament and of the Council;

11) make other demands, including the demands provided in Article 94(1) of Regulation (EU) 2023/1114 of the European Parliament and of the Council, for compliance with the legislation regulating the activities of a participant in markets in crypto-assets.

(2) In the event of a failure to comply with a precept, the Financial Supervision Authority may apply other measures in accordance with the provisions of the legislation regulating the activities of a participant in markets in crypto-assets, including

1) revoke the authorisation of a participant in markets in crypto-assets;

2) revoke the permission for operation of a participant in markets in crypto-assets in a third country;

3) demand that a member of the management body of a participant in markets in crypto-assets be removed by a court;

4) impose a non-compliance levy.

(3) In the event of a suspected violation of the requirements provided in the legislation regulating the activities of a participant in markets in crypto-assets, the Financial Supervision Authority may, by its precept, impose a prohibition or restriction on the use or disposal of a client’s assets to ensure the preservation of the assets for up to 30 days as of the entry into force of the precept. Among other things, the Financial Supervision Authority has the right to submit a motivated petition to a crypto-asset service provider, credit institution, e-money institution and payment institution for restricting the use of a client’s account or crypto-asset wallet.

(4) During the time when the restriction on the use of an account is in force, a crypto-asset service provider or another respective person does not execute an order issued by the possessor of the account being the addressee of the prohibition or restriction or by a third party for the use or disposal of the assets in the account.

(5) The Financial Supervision Authority releases the assets from the prohibition or restriction specified in subsection 3 of this section after the expiry of the time limit specified in the same subsection. If the respective suspicion ceases to exist before the expiry of the time limit specified in subsection 3 of this section, the Financial Supervision Authority is required to release the assets immediately.

(6) The use and disposal of the assets can be prohibited or restricted for a period longer than that provided in subsection 3 of this section only if criminal proceedings have been commenced in the case. If criminal proceedings have been commenced in the case, the prohibition, restriction and release of assets will take place by the respective court in accordance with the rules provided in the Act regulating criminal proceedings.

(1) The management board of a participant in markets in crypto-assets must notify the Financial Supervision Authority of a general meeting, meeting of shareholders and meeting of the supervisory board at least two weeks in advance. Notice of a special general meeting must be given at least one week in advance, where possible.

(2) The Financial Supervision Authority has the right to issue a precept in order to

1) call the management board, supervisory board, general meeting or meeting of shareholders of a participant in markets in crypto-assets;

2) include an issue on the agenda of the management board, supervisory board, general meeting or meeting of shareholders if this is necessary in the opinion of the Financial Supervision Authority.

(3) The Financial Supervision Authority has the right to send its representatives to a meeting who have the right to present positions and make proposals and demand the recording thereof in the minutes of the meeting.

(4) On the basis of a petition of the Financial Supervision Authority, a district court of the seat of a participant in markets in crypto-assets may revoke a resolution of the general meeting, meeting of shareholders, supervisory board or management board which is in conflict with this Act or the Commercial Code or legislation issued on the basis thereof or the articles of association if the petition is submitted within three months of the adoption of the resolution.

(1) In the event of a failure to comply or inappropriate compliance with a precept of the Financial Supervision Authority issued on the basis of this Act or another administrative decision, the Financial Supervision Authority may impose a non-compliance levy in accordance with the rules provided in the Substitutional Performance and Non-Compliance Levies Act.

(2) In the event of a failure to comply or inappropriate compliance with an administrative decision, the upper limit for non-compliance levy is, in the case of a natural person, up to 5,000 euros on the first and up to 50,000 euros on any subsequent occasion in order to enforce the performance of the same obligation, but in total no more than 5,000,000 euros.

(3) In the event of a failure to comply or inappropriate compliance with an administrative decision, the upper limit for non-compliance levy is, in the case of a legal person, up to 32,000 euros on the first and up to 100,000 euros on any subsequent occasion in order to enforce the performance of the same obligation, but in total no more than 5,000,000 euros or up to ten per cent of the total annual turnover of the legal person according to the last available accounts, whichever is higher. Where the legal person is a parent undertaking or a subsidiary of a parent undertaking which is required to prepare consolidated accounts, the total turnover specified in the first sentence of this section will be the total annual turnover or the corresponding type of income according to the last available consolidated accounts of the parent undertaking of the consolidation group approved by the management body of the ultimate parent undertaking.

(1) A violation of the requirements provided in Articles 59, 60 and 64–83 of Regulation (EU) 2023/1114 of the European Parliament and of the Council

is punishable by a fine of up to 700,000 euros or up to an amount corresponding to twice the amount of the profits earned or losses avoided as a result of the misdemeanour.

(2) The same act, if committed by a legal person,

is punishable by a fine of up to 5,000,000 euros or up to an amount corresponding to twice the amount of the profits earned or losses avoided as a result of the misdemeanour, or up to five per cent of the turnover of the legal person or of the consolidated turnover of its consolidation group.

(1) A violation of the requirements provided in Articles 16, 17, 19, 22, 23, 25, 27–41, 46 and 47 of Regulation (EU) 2023/1114 of the European Parliament and of the Council

is punishable by a fine of up to 700,000 euros or up to an amount corresponding to twice the amount of the profits earned or losses avoided as a result of the misdemeanour.

(2) The same act, if committed by a legal person,

is punishable by a fine of up to 5,000,000 euros or up to an amount corresponding to twice the amount of the profits earned or losses avoided as a result of the misdemeanour, or up to 12.5 per cent of the turnover of the legal person or of the consolidated turnover of its consolidation group.

(1) A violation of the requirements provided in Articles 48–51 and 53–55 of Regulation (EU) 2023/1114 of the European Parliament and of the Council

is punishable by a fine of up to 700,000 euros or up to an amount corresponding to twice the amount of the profits earned or losses avoided as a result of the misdemeanour.

(2) The same act, if committed by a legal person,

is punishable by a fine of up to 5,000,000 euros or up to an amount corresponding to twice the amount of the profits earned or losses avoided as a result of the misdemeanour, or up to 12.5 per cent of the turnover of the legal person or of the consolidated turnover of its consolidation group.

(1) A violation of the requirements provided in Articles 4–14 of Regulation (EU) 2023/1114 of the European Parliament and of the Council

is punishable by a fine of up to 700,000 euros or up to an amount corresponding to twice the amount of the profits earned or losses avoided as a result of the misdemeanour.

(2) The same act, if committed by a legal person,

is punishable by a fine of up to 5,000,000 euros or up to an amount corresponding to twice the amount of the profits earned or losses avoided as a result of the misdemeanour, or up to three per cent of the turnover of the legal person or of the consolidated turnover of its consolidation group.

(1) A violation of the requirements provided in Article 88 of Regulation (EU) 2023/1114 of the European Parliament and of the Council

is punishable by a fine of up to 1,000,000 euros or up to an amount corresponding to three times the amount of the profits earned or losses avoided as a result of the misdemeanour.

(2) The same act, if committed by a legal person,

is punishable by a fine of up to 2,500,000 euros or up to an amount corresponding to three times the amount of the profits earned or losses avoided as a result of the misdemeanour, or up to two per cent of the turnover of the legal person or of the consolidated turnover of its consolidation group.

(1) A violation of the requirements provided in Articles 89–92 of Regulation (EU) 2023/1114 of the European Parliament and of the Council

is punishable by a fine of up to 5,000,000 euros or up to an amount corresponding to three times the amount of the profits earned or losses avoided as a result of the misdemeanour.

(2) The same act, if committed by a legal person,

is punishable by a fine of up to 15,000,000 euros or up to an amount corresponding to three times the amount of the profits earned or losses avoided as a result of the misdemeanour, or up to 15 per cent of the turnover of the legal person or of the consolidated turnover of its consolidation group.

(1) A refusal to submit a report, document, explanation or other information provided in § 15 of this Act, the submission of which is not required by Regulations (EU) 2022/2554 and (EU) 2023/1114 of the European Parliament and of the Council, or a failure to submit these on time, or submission of incorrect or incomplete information, or submission of data in a form which does not allow the exercise of supervision

is punishable by a fine of up to 700,000 euros or up to an amount corresponding to twice the amount of the profits earned or losses avoided as a result of the misdemeanour.

(2) The same act, if committed by a legal person,

is punishable by a fine of up to 5,000,000 euros or up to an amount corresponding to twice the amount of the profits earned or losses avoided as a result of the misdemeanour, or up to five per cent of the turnover of the legal person or of the consolidated turnover of its consolidation group.

(1) A violation of the requirements provided in Articles 5–14 and 16–18, Article 19(1) and (3)–(5), Articles 24 and 25, Article 26(1)–(8), Article 27, Article 28(1)–(8), Article 29, Article 30(1)–(4) and Article 42(3) of Regulation (EU) 2022/2554 of the European Parliament and of the Council

is punishable by a fine of up to 700,000 euros or up to an amount corresponding to twice the amount of the profits earned or losses avoided as a result of the misdemeanour.

(2) The same act, if committed by a legal person,

is punishable by a fine of up to 5,000,000 euros or up to an amount corresponding to twice the amount of the profits earned or losses avoided as a result of the misdemeanour, or up to ten per cent of the turnover of the legal person or of the consolidated turnover of its consolidation group.

(1) A violation of the restrictions or requirements related to the division, transformation, merger and dissolution of a crypto-asset service provider and issuer of asset-referenced tokens provided in §§ 19–23 of this Act

is punishable by a fine of up to 300 fine units.

(2) The same act, if committed by a legal person,

is punishable by a fine of up to 400,000 euros.

The turnover of a legal person specified in this Chapter is the total annual turnover according to the last available accounts approved by the management body. Where the legal person is a parent undertaking or a subsidiary of a parent undertaking which is required to prepare consolidated financial statements, the total turnover specified in the first sentence will be the total annual turnover or the corresponding type of income according to the last available consolidated accounts approved by the management body of the ultimate parent undertaking.

(1) Extra-judicial proceedings concerning the misdemeanours provided in this Chapter are conducted by the Financial Supervision Authority.

(2) The limitation period for the misdemeanours provided in this Chapter is three years.

(1) A person who wishes to provide crypto-asset services is governed by this Act as of 30 December 2024, unless otherwise provided in subsection (4) of this section.

(2) An issuer of asset-referenced tokens and issuer of e-money tokens are governed by this Act in accordance with the provisions of Article 149(3) of Regulation (EU) 2023/1114 of the European Parliament and of the Council. An issuer of asset-referenced tokens is subject to the transitional provisions of Article 143 (4) and (5) of the said Regulation.

(3) An offeror and person seeking admission to trading of other crypto-assets is governed by this Act as of 30 December 2024, taking into account the provisions of Article 143(1) and (2) of Regulation (EU) 2023/1114 of the European Parliament and of the Council.

(4) A virtual currency service provider and another person who has the right to provide virtual currency services on the basis of the Money Laundering and Terrorist Financing Prevention Act before the entry into force of this Act must bring their activities into compliance with the requirements provided in this Act no later than by 1 July 2026.

(5) If a virtual currency service provider specified in subsection 4 of this section has submitted an application for an authorisation to the Financial Supervision Authority before 1 July 2026 and the Financial Supervision Authority has not decided whether to grant or refuse to grant an authorisation by the said time limit, the activities of the undertaking are not deemed activities without an authorisation for the purposes of § 372 of the Penal Code. In such an event it is not permitted for the virtual currency service provider to enter into new client contracts as of the said date until a decision has been made on granting or refusing to grant an authorisation.

(6) A virtual currency service provider founded and operating before 30 December 2024 who does not provide crypto-asset services as of 1 July 2026 is not required to apply to the Financial Supervision Authority for an authorisation. The provisions of this Act do not apply to a contract related to virtual currency services that such a virtual currency service provider entered into before 30 December 2024. The virtual currency service provider is required to notify a client of the discontinuation of the provision of the service to the client and, within a reasonable time, return the client’s assets to the wallet address or payment account specified by the client.

(7) The provisions of subsection 6 of this section also apply if the Financial Supervision Authority has made a decision refusing to grant an authorisation of a crypto-asset service provider.

(8) A person who wishes to provide crypto-asset services on the basis of Regulation (EU) 2023/1114 of the European Parliament and of the Council may submit an application for an authorisation provided in Article 62 of the Regulation to the Financial Supervision Authority as of 30 September 2024. The provisions of the first sentence of this subsection do not obligate the Financial Supervision Authority to perform any procedural operations before 30 December 2024.

(9) An issuer of asset-referenced tokens and crypto-asset service provider must be in compliance with the requirements for digital operational resilience provided in Regulation (EU) 2022/2554 of the European Parliament and of the Council as of 17 January 2025.

–

[Provisions amending other Acts have been omitted from the translation.]

(1) Clauses 2, 3, 5, 6, 9, 12, 14, 16, 29–35, 38, 40, 44, 46, 48–51 and 53 of § 55, and § 57 of this Act enter into force on 30 December 2024.

(2) Clauses 1, 4, 11, 13, 15, 17, 36, 41, 42, 45 and 47 of § 55, and § 56 of this Act enter into force on 1 July 2026.