MARKETS IN CRYPTO- ASSETS ACT

CHAPTER 647

MARKETS IN CRYPTO- ASSETS ACT

AN ACT to provide for the establishment of a framework for the

requirements applicable to offers to the public and admission to trading on a

trading platform of asset-referenced tokens, e-money tokens, other crypto-

assets, and the requirements applicable to crypto-asset service providers.

30th June, 2024

ACT XXXVI of 2024, as amended by Act XI of 2025.

(1)

The short title of this Act is the Markets in Crypto-

Assets Act.

(2)

The principal scope of this Act is to implement the relevant

provisions of Regulation (EU) 2023/1114 of the European Parliament

and of the Council of 31 May 2023 on markets in crypto-assets, and

amending Regulations (EU) No. 1093/2010 and (EU) No. 1095/2010

and Directives 2013/36/EU and (EU) 2019/1937, and it shall be

interpreted and applied accordingly.

MARKETS IN CRYPTO-ASSETS

(1)

In this Act, unless the context otherwise requires

"AIFs" shall have the same meaning as that assigned

to it in paragraph (a) of Article 4(1) of Directive 2011/61/EU;

"alternative investment fund manager" shall have the

same meaning as that assigned to it in point (48) of Article

3(1) of the MiCA Regulation and shall include investment

services licence holders licensed in accordance with the

Investment Services Act to carry out the investment service

referred to in item 4 of the First Schedule of the said Act in

relation to AIFs;

"asset-referenced token" shall have the same meaning as

that assigned to it in point (6) of Article 3(1) of the MiCA

Regulation;

"binding legal instruments" means any directly

applicable measures, including but not limited to, any

implementing technical standards, regulatory technical

standards or similar measures, issued in accordance with

European Union legislation;

"Central Bank" means the Central Bank of Malta as

defined in the Central Bank of Malta Act;

"central securities depository" shall have the same

meaning as that assigned to it in point (1) of Article 2(1) of

Regulation (EU) No. 909/2014;

"competent authority" means the Malta Financial

Services Authority established by the Malta Financial Services

Authority Act;

"credit institution" shall have the same meaning as that

assigned to it in point (28) of Article 3(1) of the MiCA

Regulation;

"crypto-asset" shall have the same meaning as that

assigned to it in point (5) of Article 3(1) of the MiCA

Regulation;

"crypto-asset service" shall have the same meaning as

that assigned to it in point (16) of Article 3(1) of the MiCA

Regulation;

"crypto-asset service provider" shall have the same

meaning as that assigned to it in point (15) of Article 3(1) of

the MiCA Regulation;

"Directive 2009/65/EC" means Directive 2009/65/EC of

the European Parliament and of the Council of 13 July 2009 on

the coordination of laws, regulations and administrative

provisions relating to undertakings for collective investment in

transferable securities (UCITS), as may be amended from time

to time, and includes any binding legal instruments, guidelines

and other measures that have been or may be issued thereunder;

"Directive 2011/61/EU" means Directive 2011/61/EU of

the European Parliament and of the Council of 8 June 2011 on

Alternative Investment Fund Managers and amending

Directives 2003/41/EC and 2009/65/EC and Regulations

(EC) No. 1060/2009 and (EU) No. 1095/2010, as may be

amended from time to time, and includes any binding legal

instruments, guidelines and other measures that have been or

may be issued thereunder;

"Directive 2013/34/EU" means Directive 2013/34/EU of

the European Parliament and of the Council of 26 June

2013 on the annual financial statements, consolidated financial

statements and related reports of certain types of undertakings,

amending Directive 2006/43/EC of the European Parliament

and of the Council and repealing Council Directives 78/660/

EEC and 83/349/EEC, as may be amended from time to time,

and includes any binding legal instruments, guidelines and

other measures that have been or may be issued thereunder;

"Directive 2014/65/EU" means Directive 2014/65/EU of

the European Parliament and of the Council of 15 May 2014

on markets in financial instruments and amending Directive

2002/92/EC and Directive 2011/61/EU, as may be amended

from time to time, and includes any binding legal instruments,

guidelines and other measures that have been or may be issued

thereunder;

"Directive (EU) 2015/849" means Directive (EU) 2015/

849 of the European Parliament and of the Council of 20 May

2015 on the prevention of the use of the financial system for

the purposes of money laundering or terrorist financing,

amending Regulation (EU) No. 648/2012 of the European

Parliament and of the Council, and repealing Directive 2005/

60/EC of the European Parliament and of the Council and

Commission Directive 2006/70/EC, as may be amended from

time to time, and includes any implementing measures,

implementing technical standards, regulatory technical

standards, guidelines and similar measures that have been or

may be issued thereunder;

"Directive (EU) 2015/2366" means Directive (EU)

2015/2366 of the European Parliament and of the Council of 25

November 2015 on payment services in the internal market,

amending Directives 2002/65/EC, 2009/110/EC and 2013/36/

EU and Regulation (EU) No. 1093/2010, and repealing

MARKETS IN CRYPTO-ASSETS

Directive 2007/64/EC, as may be amended from time to time,

and includes any binding legal instruments, guidelines and

other measures that have been or may be issued thereunder;

"EBA" means the European Banking Authority

established by Regulation (EU) No. 1093/2010;

"European Central Bank" or "ECB" means the

European Central Bank established by the Treaty on the

Functioning of the European Union;

"electronic money institution" shall have the same

meaning as that assigned to it in point (43) of Article 3(1) of the

MiCA Regulation and shall include financial institutions

authorised to issue electronic money in accordance with the

Financial Institutions Act;

"electronic money token" or "e-money token" shall have

the same meaning as that assigned to it in point (7) of Article

3(1) of the MiCA Regulation;

"ESMA" means the European Securities and Markets

Authority established by Regulation (EU) No. 1095/2010;

"European regulatory authority" means a body or bodies

designated by a Member State other than Malta in accordance

with Article 93(1) of the MiCA Regulation for the purpose of

carrying out the functions and duties provided for under the

said Regulation;

"Financial Intelligence Analysis Unit" means the

Financial Intelligence Analysis Unit as established by article

15 of the Prevention of Money Laundering Act;

"GDPR" means Regulation (EU) 2016/679 of the

European Parliament and of the Council of 27 April 2016 on

the protection of natural persons with regard to the processing

of personal data and on the free movement of such data, and

repealing Directive 95/46/EC (General Data Protection

Regulation), as may be amended from time to time, and

includes any binding legal instruments, guidelines and other

measures that have been, or may be issued thereunder;

"home Member State" shall have the same meaning as

that assigned to it in point (33) of Article 3(1) of the MiCA

Regulation;

"host Member State" shall have the same meaning as

that assigned to it in point (34) of Article 3(1) of the MiCA

Regulation;

"investment firm" shall have the same meaning as that

assigned to it in point (29) of Article 3(1) of the MiCA

Regulation and shall include investment services licence

holders licensed in accordance with the Investment Services Act

to carry out any of the investment services referred to in items

1 to 4, 6 to 9 and 11 of the First Schedule of the said Act in

relation to an instrument as defined in the Investment Services

Act;

"issuer" shall have the same meaning as that assigned to

it in point (10) of Article 3(1) of the MiCA Regulation;

"market operator" shall have the same meaning as that

assigned to it in point (18) of Article 4(1) of Directive 2014/

65/EU and shall include investment services licence holders

licensed in accordance with the Investment Services Act to

carry out the investment services referred to in item 9 of the

First Schedule of the said Act in relation to an instrument as

defined in the Investment Services Act;

"MiCA Regulation" means Regulation (EU) 2023/1114

of the European Parliament and of the Council of 31 May 2023

on markets in crypto-assets, and amending Regulations (EU)

No. 1093/2010 and (EU) No. 1095/2010 and Directives 2013/

36/EU and (EU) 2019/1937, as may be amended from time to

time, and includes any binding legal instruments, guidelines

and other measures that have been or may be issued thereunder;

"Minister" means the Minister responsible for the

regulation of financial services;

"offeror" shall have the same meaning as that assigned

to it in point (13) of Article 3(1) of the MiCA Regulation;

"qualified investor" shall have the same meaning as that

assigned to it in point (30) of Article 3(1) of the MiCA

Regulation;

"Regulation (EU) No. 1093/2010" means Regulation

(EU) No. 1093/2010 of the European Parliament and of the

Council of 24 November 2010 establishing a European

Supervisory Authority (European Banking Authority),

amending Decision No. 716/2009/EC and repealing

Commission Decision 2009/78/EC, as may be amended from

time to time, and includes any binding legal instruments,

guidelines and other measures that have been or may be issued

thereunder;

"Regulation (EU) No. 1095/2010" means Regulation

(EU) No. 1095/2010 of the European Parliament and of the

Council of 24 November 2010 establishing a European

MARKETS IN CRYPTO-ASSETS

Supervisory Authority (European Securities and Markets

Authority), amending Decision No. 716/2009/EC and repealing

Commission Decision 2009/77/EC, as may be amended from

time to time, and includes any binding legal instruments,

guidelines and other measures that have been or may be issued

thereunder;

"Regulation (EU) No. 909/2014" means Regulation

(EU) No. 909/2014 of the European Parliament and of the

Council of 23 July 2014 on improving securities settlement in

the European Union and on central securities depositories and

amending Directives 98/26/EC and 2014/65/EU and Regulation

(EU) No. 236/2012, as may be amended from time to time, and

includes any binding legal instruments, guidelines and other

measures that have been or may be issued thereunder;

"Rules" refers to Rules which may be issued by the

competent authority in accordance with this Act;

"UCITS" shall have the same meaning as that assigned

to it in article 2(1) of the Investment Services Act;

"UCITS management company" shall have the same

meaning as that assigned to it in point (47) of Article 3(1) of the

MiCA Regulation and shall include investment services licence

holders licensed in accordance with the Investment Services

Act to carry out the investment service referred to in item 4 of

the First Schedule of the said Act in relation to UCITS in the

form of common funds or of investment companies.

(2)

Unless the context otherwise requires, the words used in

this Act which are not defined herein shall have the same meaning as

assigned to them in the MiCA Regulation.

(3)

In this Act, and in any regulations made thereunder, where

there are any conflicts between the English and the Maltese texts, the

English text shall prevail.

(4)

In the event that there is any conflict between this Act and

the provisions of the MiCA Regulation, the provisions of the MiCA

Regulation shall prevail.

(1)

The provisions of this Act and any regulations made,

or Rules issued thereunder shall not apply to

(a)

persons who provide crypto-asset services

exclusively for their parent companies, for their own

subsidiaries or for other subsidiaries of their parent companies;

(b)

a liquidator or an administrator acting in the

course of an insolvency procedure, except for the purposes of

Article 47 of the MiCA Regulation and article 21;

(c)

the ECB, central banks of the Member States

when acting in their capacity as monetary authorities, or other

public authorities of the Member States;

(d)

the

European

Investment

Bank

and

its

subsidiaries;

(e)

the European Financial Stability Facility and the

European Stability Mechanism; and

(f)

public international organisations.

(2)

The provisions of this Act and any regulations made, or

Rules issued thereunder shall not apply to crypto-assets that are unique

and not fungible with other crypto-assets.

(3)

The provisions of this Act and any regulations made, or

Rules issued thereunder shall not apply to crypto-assets that qualify

as one or more of the following

(a)

financial instruments;

(b)

deposits, including structured deposits;

(c)

funds, except if they qualify as e-money tokens;

(d)

securitisation positions in the context of a

securitisation as defined in Article 2, point (1), of Regulation

(EU) 2017/2402;

(e)

non-life or life insurance products falling within

the classes of insurance listed in Annexes I and II to Directive

2009/138/EC of the European Parliament and of the Council of

25 November 2009 on the taking-up and pursuit of the business

of Insurance and Reinsurance (Solvency II) or reinsurance and

retrocession contracts referred to in such Directive;

(f)

pension products that under national law are

recognised as having the primary purpose of providing the

investor with an income in retirement and that entitle the

investor to certain benefits;

(g)

officially recognised occupational pension

schemes falling within the scope of Directive (EU) 2016/2341

of the European Parliament and of the Council of 14 December

2016 on the activities and supervision of institutions for

occupational retirement provision (IORPs) or Directive 2009/

138/EC of the European Parliament and of the Council of 25

November 2009 on the taking-up and pursuit of the business of

Insurance and Reinsurance;

(h)

individual pension products for which a financial

MARKETS IN CRYPTO-ASSETS

contribution from the employer is required by national law and

where the employer or the employee has no choice as to the

pension product or provider;

(i)

a pan-European Personal Pension Product as

defined in point 2 of Article 2 of Regulation (EU) 2019/1238

of the European Parliament and of the Council of 20 June 2019

on a pan-European Personal Pension Product (PEPP); and

(j)

social security schemes covered by Regulation

(EC) No. 883/2004 of the European Parliament and of the

Council of 29 April 2004 on the coordination of social security

systems and Regulation (EC) No. 987/2009 of the European

Parliament and of the Council of 16 September 2009 laying

down the procedure for implementing Regulation (EC) No.

883/2004 on the coordination of social security systems.

(1)

The competent authority shall carry out its functions

under this Act and in particular shall ensure compliance with the

provisions of the MiCA Regulation, this Act and any regulations

made, and Rules issued thereunder.

(2)

The competent authority shall also carry out the functions

and duties as competent authority for all purposes of the MiCA

Regulation.

PART II

CRYPTO-ASSETS OTHER THAN ASSET-REFERENCED

TOKENS OR E-MONEY TOKENS

The competent authority shall not require the prior approval

of crypto-asset white papers drawn up by persons intending to make an

offer to the public or seeking admission to trading of crypto-assets

other than asset-referenced tokens or e-money tokens in the European

Union, nor of any marketing communications relating thereto, before

their respective publication.

(1)

The provisions of this article shall only apply where

Malta is the home Member State.

(2)

Offerors, persons seeking admission to trading, or operators

of trading platforms for crypto-assets other than asset-referenced

tokens or e-money tokens shall notify their crypto-asset white paper to

the competent authority.

(3)

Offerors and persons seeking admission to trading of crypto-

assets other than asset-referenced tokens or e-money tokens shall,

together with the notification referred to in sub-article (2), provide the

competent authority with a list of the host Member States, if any, where

they intend to offer their crypto-assets to the public, or intend to seek

admission to trading and they shall inform the competent authority of

the starting date of the intended offer to the public or intended

admission to trading and of any change to that date

Provided that the competent authority shall notify the single

point of contact of the host Member States of the intended offer to the

public or the intended admission to trading and communicate to that

single point of contact the corresponding crypto-asset white paper

within five (5) working days of receipt of the list of host Member

States referred to in this sub-article.

(4)

The notification of the crypto-asset white paper referred to

in sub-article (2) shall be accompanied by an explanation of why the

crypto-asset described in the crypto-asset white paper should not be

considered to be

(a)

a crypto-asset excluded from the scope of the

MiCA Regulation, this Act and any regulations made, and

Rules issued thereunder pursuant to Article 2(4) of the MiCA

Regulation and article 3(3) of this Act;

(b)

an e-money token; or

(c)

an asset-referenced token.

(5)

The notification and explanation referred to in sub-articles

(2) and (4) respectively shall be notified to the competent authority at

least twenty (20) working days before the date of publication of the

crypto-asset white paper.

(1)

Where Malta is the home Member State or the host

Member State, marketing communications shall upon request, be

notified to the competent authority when addressing prospective

holders of crypto-assets other than asset-referenced tokens or e-money

tokens in Malta.

(2)

When marketing communications are disseminated in

Malta, the competent authority shall have the power to assess their

compliance with Article 7(1) of the MiCA Regulation in respect of

those marketing communications.

(1)

The provisions of this article shall only apply where

Malta is the home Member State.

(2)

Where for each twelve (12) month period starting from the

beginning of the initial offer to the public, the total consideration of

an offer to the public of a crypto-asset, other than an asset-referenced

token or e-money token, in the European Union exceeds one million

euro (€1,000,000), the offeror shall send a notification to the

competent authority containing a description of the offer and

explaining why the offer is exempt from the provisions of Title II of

the MiCA Regulation and Part II of this Act pursuant to paragraph (d)

of Article 4(3) of the MiCA Regulation

MARKETS IN CRYPTO-ASSETS

Provided that for the purposes of this sub-article, a "crypto-

asset, other than an asset-referenced token or e-money token" means a

crypto-asset, other than an asset-referenced token or e-money token,

which grants its holder the right to use it only in exchange for goods

and services in a limited network of merchants with contractual

arrangements with the offeror.

(3)

Based on the notification referred to in sub-article (2), the

competent authority shall take a duly justified decision where it

considers that the activity does not qualify for an exemption as a

limited network in a c c o r d a n c e w i t h Article 4(3)(d) of the

MiCA Regulation, and shall inform the offeror accordingly.

PART III

ASSET-REFRENCED TOKENS

(1)

A person shall not make an offer to the public, or

seek the admission to trading of an asset-referenced token in Malta,

unless that person is the issuer of that asset-referenced token and is

(a)

a legal person or other undertaking that is

established in the European Union and has been authorised in

accordance with Article 21 of the MiCA Regulation by the

competent authority of its home Member State; or

(b)

a credit institution that complies with Article 17

of the MiCA Regulation

Provided that for the purposes of paragraph (a),

other undertakings may issue asset-referenced tokens only if

their legal form ensures a level of protection for third parties’

interests equivalent to that afforded by legal persons and if they

are subject to equivalent prudential supervision appropriate to

their legal form.

(2)

Notwithstanding the provisions of sub-article (1), upon the

written consent of the issuer of an asset-referenced token, other

persons may offer to the public or seek the admission to trading of

that asset-referenced token

Provided that the persons referred to in this sub-article

shall comply with Articles 27, 29 and 40 of the MiCA Regulation and

article 16.

(3)

The provisions of sub-articles (1) and (2) shall not apply

where

(a)

over a period of twelve (12) months, calculated

at the end of each calendar day, the average outstanding value

of the asset-referenced token issued by an issuer never

exceeds five million euro (€5,000,000), or the equivalent

amount in another official currency, and the issuer is not linked

to a network of other exempt issuers; or

(b)

the offer to the public of the asset-referenced

token is addressed solely to qualified investors and the asset-

referenced token can only be held by such qualified investors

Provided that where this sub-article applies, issuers of asset-

referenced tokens shall draw up a crypto-asset white paper as provided

for in Article 19 of the MiCA Regulation and notify such crypto-

asset white paper, and upon request, any marketing communications to

the competent authority where Malta is the home Member State.

(1)

For the purposes of this article, "credit institution"

means a credit institution which is licensed as such under the Banking

(2)

An asset-referenced token issued by a credit institution may

be offered to the public or admitted to trading if the credit institution

(a)

draws up a crypto-asset white paper as referred to

in Article 19 of the MiCA Regulation for the asset-referenced

token, submits such crypto-asset white paper for approval by

the competent authority of its home Member State in

accordance with the procedure set out in the regulatory

technical standards adopted pursuant to Article 17(8) of the

MiCA Regulation, and has the crypto-asset white paper

approved by the competent authority; and

(b)

notifies the competent authority, at least ninety

(90) working days before issuing the asset-referenced token for

the first time, by providing it with the following information

(i)

a programme of operations, setting out the

business model that the credit institution intends to

follow;

(ii)

a legal opinion that the asset-referenced

token does not qualify as either a crypto-asset excluded

from the scope of the MiCA Regulation, this Act and any

regulations made, and Rules issued thereunder pursuant

to Article 2(4) of the MiCA Regulation and article

3(3) of this Act;

(iii) a detailed description of the governance

arrangements referred to in Article 34(1) of the MiCA

Regulation;

(iv) the policies and procedures listed in the

first sub-paragraph of Article 34(5) of the MiCA

Regulation;

(v)

a

description

of

the

contractual

MARKETS IN CRYPTO-ASSETS

arrangements with third-party entities as referred to in

the second sub- paragraph of Article 34(5) of the MiCA

Regulation;

(vi) a description of the business continuity

policy referred to in Article 34(9) of the MiCA

Regulation;

(vii) a description of the internal control

mechanisms and risk management procedures referred

to in Article 34(10) of the MiCA Regulation; and

(viii)

a description of the systems and

procedures in place to safeguard the availability,

authenticity, integrity and confidentiality of data

referred to in Article 34(11) of the MiCA Regulation.

(3)

Notwithstanding the provisions of sub-article (2), a credit

institution that has previously notified the competent authority in

accordance with sub-article (2)(b), when issuing another asset-

referenced token, shall not be required to submit any information that

was previously submitted by it to the competent authority where such

information would be identical

Provided that when submitting the information listed in sub-

article (2)(b), the credit institution shall expressly confirm that any

information not resubmitted in accordance with this sub-article is still

up-to-date.

(4)

When receiving a notification as referred to in sub-article

(2)(b), the competent authority shall, within twenty (20) working

days of receipt of the information listed in the said sub-article, assess

whether the information required under that paragraph has been

provided.

(5)

Where the competent authority concludes, following the

assessment carried out in accordance with sub-article (4), that a

notification is not complete because some information is missing, it

shall immediately inform the notifying credit institution thereof and

set a deadline by which that credit institution is required to provide the

missing information

Provided that the deadline for providing any missing

information shall not exceed twenty (20) working days from the date

of the request and, until the expiry of such deadline, the period set out

in sub-article (2)(b) shall be suspended.

(6)

Without prejudice to the provisions of sub-article (5), any

further request by the competent authority for completion or

clarification of the information provided in terms of this article shall be

at its discretion but shall not result in a suspension of the period set out

in sub-article (2)(b).

(7)

The credit institution shall not make an offer to the public

or seek the admission to trading of the asset-referenced token as long

as the notification referred to in sub-article (2)(b) is incomplete.

(8)

The competent authority shall communicate to the ECB

without delay the complete information received under sub-article (2)

and, where the credit institution is established in a Member State

whose official currency is not the euro or where an official currency

of a Member State that is not the euro is referenced by the asset-

referenced token, also to the Central Bank.

(9)

The ECB and, where applicable, the Central Bank shall

within twenty (20) working days of receipt of the complete

information in accordance with sub-article (8), issue an opinion on

that information and transmit that opinion to the competent authority.

(10) The competent authority shall require the credit institution

not to offer to the public or seek the admission to trading of the asset-

referenced token in cases where the ECB or, where applicable, the

Central Bank, give a negative opinion on the grounds of a risk posed

to the smooth operation of payment systems, monetary policy

transmission or monetary sovereignty.

(1)

The provisions of this article shall only apply when

Malta is the home Member State.

(2)

Legal persons or other undertakings that intend to offer to

the public or seek the admission to trading of asset-referenced tokens

shall submit their application for an authorisation as referred to in

article 9 to the competent authority.

(3)

Without prejudice to Article 18(6) and (7) of the MICA

Regulation, the application referred to in sub-article (2) shall contain

all of the following information

(a)

the address of the applicant;

(b)

the legal entity identifier of the applicant;

(c)

the articles of association of the applicant,

where applicable;

(d)

a programme of operations, setting out the

business model that the applicant intends to follow;

(e)

a legal opinion that the asset-referenced token

does not qualify as either of the following

(i)

a crypto-asset excluded from the scope of

the MiCA Regulation, this Act and any regulations

MARKETS IN CRYPTO-ASSETS

made, and Rules issued thereunder pursuant to Article

2(4) of the MiCA Regulation and article 3(3) of this Act;

or

(ii)

an e-money token;

(f)

a detailed description of the applicant’s

governance arrangements as referred to in Article 34(1) of the

MiCA Regulation;

(g)

where cooperation arrangements with specific

crypto-asset service providers exist, a description of their

internal control mechanisms and procedures to ensure

compliance with the obligations in relation to the prevention of

money laundering and terrorist financing under Directive (EU)

2015/849;

(h)

the identity of the members of the management

body of the applicant;

(i)

proof that the persons referred to in paragraph

(h) are of sufficiently good repute and possess the appropriate

knowledge, skills and experience to manage the applicant;

(j)

proof that any shareholder or member, whether

direct or indirect, that has a qualifying holding in the applicant

is of sufficiently good repute;

(k)

a crypto-asset white paper as referred to in

Article 19 of the MiCA Regulation;

(l)

the policies and procedures referred to in the

first sub-paragraph of Article 34(5) of the MiCA Regulation;

(m) a description of the contractual arrangements

with the third-party entities as referred to in the second sub-

paragraph of Article 34(5) of the MiCA Regulation;

(n)

a description of the applicant’s business

continuity policy referred to in Article 34(9) of the MiCA

Regulation;

(o)

a description of the internal control mechanisms

and risk management procedures referred to in Article 34(10)

of the MiCA Regulation;

(p)

a description of the systems and procedures in

place to safeguard the availability, authenticity, integrity and

confidentiality of data as referred to in Article 34(11) of the

MiCA Regulation;

(q)

a description of the applicant’s complaints-

handling procedures as referred to in Article 31 of the MiCA

Regulation; and

(r)

where applicable, a list of host Member States

where the applicant intends to offer the asset-referenced token

to the public or intends to seek admission to trading of the

asset- referenced token.

(4)

For the purposes of sub-article (3)(i) and (j), the applicant

shall provide proof of all of the following

(a)

for all members of the management body, the

absence of a criminal record in respect of convictions or the

absence of penalties imposed under the applicable commercial

law, insolvency law and financial services law, or in relation to

anti-money laundering and counter-terrorist financing, to fraud

or to professional liability;

(b)

that the members of the management body of the

applicant of the asset-referenced token collectively possess the

appropriate knowledge, skills and experience to manage the

issuer of the asset-referenced token and that such persons are

required to commit sufficient time to perform their duties; and

(c)

for all shareholders and members, whether direct

or indirect, that have qualifying holdings in the applicant, the

absence of a criminal record in respect of convictions and the

absence of penalties imposed under the applicable commercial

law, insolvency law and financial services law, or in relation to

anti-money laundering and counter-terrorist financing, to fraud

or to professional liability.

(5)

Notwithstanding the provisions of sub-article (3), issuers

that have already been authorised in respect of one (1) asset-referenced

token shall not be required to submit, for the purposes of authorisation

in respect of another asset-referenced token, any information that was

previously submitted by them to the competent authority where such

information would be identical

Provided that when submitting the information listed in sub-

article (3), the issuer shall expressly confirm that any information not

resubmitted is still up to date.

(6)

The competent authority shall promptly, and in any event

within two (2) working days of receipt of an application referred to in

sub-article (2), acknowledge receipt thereof in writing to the applicant.

(7)

The competent authority shall, within twenty-five (25)

working days of receipt of the application referred to in sub-article

(2), assess whether that application, including the crypto-asset white

paper referred to in Article 19 of the MiCA Regulation, comprises all

MARKETS IN CRYPTO-ASSETS

of the required information and it shall immediately notify the

applicant whether the application, including the crypto-asset white

paper, is missing required information

Provided that where the application, including the crypto-

asset white paper, is not complete, the competent authority shall set a

deadline by which the applicant is to provide any missing information.

(8)

The competent authority shall, within sixty (60) working

days of receipt of a complete application, assess whether the applicant

complies with the requirements of Title III of the MiCA Regulation

and the provisions of this Part, and prepare a fully reasoned draft

decision granting or refusing authorisation to offer asset-referenced

tokens to the public or seek their admission to trading

Provided that, within the period referred to in this sub-

article, the competent authority may request from the applicant any

information on the application, including on the crypto-asset white

paper referred in Article 19 of the MiCA Regulation

Provided further that for the purposes of the assessment to

be carried out in accordance with this sub-article, the competent

authority may cooperate with competent authorities for anti-money

laundering and counter-terrorist financing, financial intelligence units

or other public bodies.

(9)

The assessment periods referred to in sub-articles (7) and

(8) shall be suspended for the period between the date of request for

missing information by the competent authority and the receipt by the

said competent authority of a response from the applicant

Provided that the suspension referred to in this sub-article

shall not exceed twenty (20) working days.

(10) Without prejudice to the provisions of sub-article (9), any

further requests by the competent authority for completion or

clarification of the information provided in terms of this article shall

be at its discretion but shall not result in a suspension of the

assessment periods set out in sub-articles (7) and (8).

(11) The competent authority shall, after the period referred to

in sub-article (8), transmit its draft decision as referred to in the said

sub-article and the relative application to the EBA, ESMA and the

ECB

Provided that where an official currency of a Member State

that is not the euro is referenced by the asset-referenced token, the

competent authority shall also transmit its draft decision and the

application to the central bank of such Member State.

(12)

The opinion to be issued by the EBA and ESMA

respectively, at the request of the competent authority, as regards their

evaluation of the legal opinion referred to in Article 18(2)(e) of the

MiCA Regulation and sub-article (3)(e), shall be transmitted to the

competent authority within twenty (20) working days of receipt of the

draft decision referred to in sub-article (8) and the relative application.

(13) The opinion to be issued by the ECB or, where applicable,

the central bank referred to in sub-article (11) as regards its evaluation

of the risks that issuing such asset-referenced token might pose to

financial stability, the smooth operation of payment systems, monetary

policy transmission and monetary sovereignty, in accordance with

Article 21(5) of the MiCA Regulation, shall be transmitted to the

competent authority within twenty (20) working days of receipt of the

draft decision referred to in sub-article (8) and the relative application.

(14) Without prejudice to the provisions of sub-article (11), the

opinions referred to in sub-articles (12) and (13) shall be non-binding

Provided that the competent authority shall duly consider

the opinions referred to in this sub-article.

(15) The competent authority shall, within twenty-five (25)

working days of receipt of the opinions referred to in sub-articles (12)

and (13), take a fully reasoned decision to grant or refuse to grant to

the applicant authorisation to offer asset-referenced tokens to the

public or seek their admission to trading and, within five (5) working

days of taking such decision, notify it to the applicant

Provided that where an applicant is authorised, its crypto-

asset white paper shall be deemed to be approved.

(16) In granting an authorisation under this article, the competent

authority may subject the issuer of an asset-referenced token to such

conditions as it may deem appropriate and having granted such an

authorisation, it may from time to time, vary or revoke any condition

so imposed or impose new conditions.

(1)

The competent authority shall refuse to grant

authorisation under Article 21 of the MiCA Regulation and article 11,

to offer asset-referenced tokens to the public or seek their admission to

trading where there are objective and demonstrable grounds that

(a)

the management body of the applicant may pose

a threat to its effective, sound and prudent management and

business continuity and to the adequate consideration of the

interest of its clients and the integrity of the market;

(b)

members of the management body of the

applicant do not meet the criteria set out in Article 34(2) of

the MiCA Regulation;

(c)

shareholders and members, whether direct or

MARKETS IN CRYPTO-ASSETS

indirect, of the applicant that have qualifying holdings who do

not meet the criteria of sufficiently good repute set out in

Article 34(4) of the MiCA Regulation;

(d)

the applicant fails to meet or is likely to fail to

meet any of the requirements of Title III of the MiCA

Regulation or the provisions of this Part; and, or

(e)

the applicant’s business model may pose a

serious threat to market integrity, financial stability, the smooth

operation of payment systems, or exposes the issuer or the

sector to serious risks of money laundering and terrorist

financing.

(2)

The competent authority shall also refuse to grant

authorisation under Article 21 of the MiCA Regulation and article 11

to offer asset-referenced tokens to the public or seek their admission to

trading if the ECB or, where applicable, the central bank referred to in

article 11(11) gives a negative opinion under Article 20(5) of the

MiCA Regulation and article 12(13) on the grounds of a risk posed to

the smooth operation of payment systems, monetary poli cy

transmission, or monetary sovereignty.

(1)

The competent authority shall withdraw an

authorisation granted under Article 21 of the MiCA Regulation and

article 11 to an issuer of an asset-referenced token in any of the

following situations

(a)

the issuer has ceased to engage in business for

six (6) consecutive months, or has not used its authorisation for

twelve (12) consecutive months;

(b)

the issuer has obtained its authorisation by

irregular means, such as by making false statements in the

application for authorisation referred to in Article 18 of the

MiCA Regulation and article 11 or in any crypto-asset white

paper modified in accordance with Article 25 of the MiCA

Regulation and article 15;

(c)

the issuer no longer meets the conditions under

which the authorisation was granted;

(d)

the issuer has seriously infringed the provisions

of Title III of the MiCA Regulation and, or the provisions of

this Part;

(e)

the issuer has been subject to a redemption plan;

(f)

the issuer has expressly renounced

its

authorisation or has decided to cease operations; and, or

(g)

the issuer’s activity poses a serious threat to

market integrity, financial stability, the smooth operation of

payment systems, or exposes the issuer, or the sector to serious

risks of money laundering and terrorist financing

Provided that the issuer of the asset-referenced token

authorised under Article 21 of the MiCA Regulation and article 11

shall notify the competent authority of any of the situations referred

to in paragraphs (e) and (f) of this sub-article.

(2)

Without prejudice to sub-articles (1) and (3), the competent

authority shall withdraw an authorisation granted under Article 21 of

the MiCA Regulation and article 11 to an issuer of an asset-referenced

token when the ECB or, where applicable, the central bank referred to

in article 11(11) issue an opinion that the asset-referenced token poses

a serious threat to the smooth operation of payment systems, monetary

policy transmission or monetary sovereignty.

(3)

Without prejudice to sub-articles (1) and (2), the competent

authority shall withdraw an authorisation granted under Article 21 of

the MiCA Regulation and article 11 to an issuer of an asset-referenced

token where it is of the opinion that the situations referred to in Article

24(4) of the MiCA Regulation affect the good repute of the members

of the management body of that issuer, or the good repute of any

shareholders or members, whether direct or indirect, of the issuer that

have qualifying holdings, or if there is an indication of a failure of the

governance arrangements, or internal control mechanisms as referred

to in Article 34 of the MiCA Regulation

Provided that when an authorisation is withdrawn in terms

of this sub-article, the issuer of the asset-referenced token shall

implement the procedure under Article 47 of the MiCA Regulation

and article 21.

(1)

Where the competent authority proposes to

(a)

refuse an application for authorisation submitted

to the competent authority in accordance with the provisions of

Article 21 of the MiCA Regulation and article 11, or to

withdraw the authorisation granted to an issuer of an asset-

referenced token under the said provisions; or

(b)

vary any condition to which an authorisation

granted under Article 21 of the MiCA Regulation and article 11

is subject, or impose a condition thereon,

it shall give the applicant or the issuer of an asset-referenced token,

as applicable, notice in writing of its intention to do so, while setting

out the reasons for the decision it proposes to take.

(2)

Every notice given under sub-article (1) shall state that the

recipient of such notice may, within a reasonable period after the

MARKETS IN CRYPTO-ASSETS

service thereof as may be stated in the notice, make representations in

writing to the competent authority in which he gives the reasons why

the proposed decision should not be taken, and the competent authority

shall consider any representation so made before reaching a final

decision.

(3)

Subject to the provisions of Article 21 of the MiCA

Regulation and article 11, the competent authority shall as soon as

practicable notify its final decision in writing to any of the persons to

whom notice is to be given under sub-article (1).

(1)

The provisions of this article shall only apply when

Malta is the home Member State.

(2)

Issuers of asset-referenced tokens shall notify the competent

authority of any intended change of their business model likely to have

a significant influence on the purchase decision of any holders or

prospective holders of asset-referenced tokens, which occurs after the

authorisation pursuant to Article 21 of the MiCA Regulation and

article 11, or after the approval of the crypto-asset white paper

pursuant to Article 17 of the MiCA Regulation and article 10, as well

as in the context of Article 23 of the MiCA Regulation

Provided that the competent authority shall be notified of

the intended changes referred to in this sub-article at least thirty (30)

working days before the said changes take effect.

(3)

The changes referred to in sub-article (2) shall include,

amongst others, any material modifications to

(a)

the governance arrangements, including reporting

lines to the management body and risk management framework;

(b)

the reserve assets and the custody of the reserve

assets;

(c)

the rights granted to the holders of asset-

referenced tokens;

(d)

the mechanism through

which

an

asset-

referenced token is issued and redeemed;

(e)

the protocols for validating the transactions in

asset- referenced tokens;

(f)

the functioning of issuers’ proprietary distributed

ledger technology, where the asset-referenced tokens are issued,

transferred and stored using such a distributed ledger

technology;

(g)

the mechanisms to ensure the liquidity of asset-

referenced tokens, including the liquidity management policy

and procedures for issuers of significant asset-referenced tokens

referred to in Article 45 of the MiCA Regulation;

(h)

the arrangements with third-party entities,

including for managing the reserve assets and the investment of

the reserve, for the custody of reserve assets, and where

applicable, for the distribution of the asset-referenced tokens to

the public;

(i)

the complaints handling procedures; and, or

(j)

the money laundering and terrorist financing risk

assessment and general policies and procedures related thereto.

(4)

Where any intended change as referred to in sub-article (2)

has been notified to the competent authority, the issuer of an asset-

referenced token shall draw up a draft modified crypto-asset white

paper and shall ensure that the order of the information appearing

therein is consistent with that of the original crypto-asset white paper.

(5)

The issuer of the asset-referenced token shall notify the

draft modified crypto-asset white paper referred to in sub-article (4)

to the competent authority and the competent authority shall

electronically acknowledge receipt of the said white paper as soon as

possible, but in any case not later than five (5) working days from

receipt thereof.

(6)

The competent authority shall grant approval of, or refuse

to approve, the draft modified crypto-asset white paper referred to in

sub-article (4) within thirty (30) working days of acknowledgement

of receipt thereof in accordance with sub-article (5)

Provided that during the examination of the draft modified

crypto-asset white paper, the competent authority may request any

additional information, explanations or justifications concerning the

said white paper and, when the competent authority makes such

request, the time limit referred to in this sub-article shall only

commence when the competent authority has received the requested

additional information.

(1)

The competent authority shall not require the prior

approval of marketing communications relating to an offer to the

public of an asset-referenced token, or to the admission to trading of

such asset-referenced token, before their publication.

(2)

Marketing communications as referred to in sub-article (1)

shall, upon request, be notified to the competent authority.

Where the issuer of an asset-referenced token, being a credit

institution licensed under the Banking Act or a legal person or other

undertaking authorised under Article 21 of the MiCA Regulation and

article 11, decides to discontinue the provision of its services and

MARKETS IN CRYPTO-ASSETS

activities, including by discontinuing the issue of such asset-referenced

token, it shall submit a plan to the competent authority for approval of

such discontinuation.

(1)

For the purposes of this article

(a)

"proposed acquirer" means any natural or legal

persons or such persons acting in concert who intend to acquire,

directly or indirectly, a qualifying holding in an issuer of an

asset-referenced token; and

(b)

"issuer of an asset-referenced token" means an

issuer of an asset-referenced token which is a credit institution

licensed under the Banking Act or a legal person or other

undertaking authorised under Article 21 of the MiCA

Regulation and article 11.

(2)

Any natural or legal persons or such persons acting in

concert who intend to acquire, directly or indirectly, a qualifying

holding in an issuer of an asset-referenced token or to increase,

directly or indirectly, such a qualifying holding so that the proportion

of the voting rights or of the capital held would reach or exceed

twenty per cent (20%), thirty per cent (30%) or fifty per cent (50%),

or so that the issuer of the asset-referenced token would become its

subsidiary, shall notify the competent authority of such issuer in

writing, indicating the size of the intended holding and the information

required by the regulatory technical standards adopted by the

European Commission in conformity with Article 42(4) of the MiCA

Regulation.

(3)

Any natural or legal person who has taken a decision to

dispose, directly or indirectly, of a qualifying holding in an issuer of

an asset-referenced token shall, prior to disposing of such holding,

notify in writing the competent authority of its decision and indicate

the size of such holding

Provided that any such person as referred to in this sub-

article shall also notify the competent authority when it has taken a

decision to reduce a qualifying holding so that the proportion of the

voting rights or of the capital held would fall below ten per cent (10%),

twenty per cent (20%), thirty per cent (30%) or fifty per cent (50%), or

so that the issuer of the asset-referenced token would cease to be such

person’s subsidiary.

(4)

The competent authority shall, immediately and in any event

within two (2) working days following receipt of a notification

pursuant to sub-article (2), acknowledge receipt thereof in writing

Provided that when acknowledging receipt of the

notification provided in accordance with this sub-article, the

competent authority shall inform the proposed acquirer of the date of

expiry of the assessment period determined in accordance with sub-

article (5).

(5)

The competent authority shall assess the proposed

acquisition referred to in sub-article (2) and the information required

pursuant to the regulatory technical standards adopted by the European

Commission in conformity with Article 42(4) of the MiCA

Regulation, within sixty (60) working days of the date of the written

acknowledgement of receipt referred to in sub-article (4).

(6)

When performing the assessment referred to in sub-article

(5), the competent authority may request from the proposed acquirer

any additional information that is necessary to complete such

assessment

Provided that such requests shall be made in writing and

shall specify the additional information needed

Provided further that such requests shall be made before

the assessment is finalised, and in any case not later than fifty (50)

working days from the date of the written acknowledgement of receipt

referred to in sub-article (4).

(7)

The competent authority shall suspend the assessment

period referred to in sub-article (5) until it has received the additional

information referred to in sub-article (6)

Provided that the suspension referred to in this sub-article

shall not exceed twenty (20) working days

Provided further that the competent authority may extend

the suspension referred to in this sub-article by up to thirty (30)

working days if the proposed acquirer is situated outside the European

Union or regulated in accordance with the law of a third country.

(8)

Without prejudice to the provisions of sub-article (7), any

further requests by the competent authority for additional information

or for clarification of the information received shall not result in a

suspension of the assessment period set out in sub-article (5).

(9)

Where the competent authority, upon completion of the

assessment referred to in sub-article (5), decides to oppose the

proposed acquisition referred to in sub-article (2), it shall notify the

proposed acquirer of its decisions, and provide the reasons for its

decision, within two (2) working days, and in any event before the

date referred to in sub-article (5) as extended, where applicable, in

accordance with the provisions of this article.

(10) Where the competent authority does not oppose the

proposed acquisition referred to in sub-article (2) before the date

referred to in sub-article (5) as extended, where applicable, in

MARKETS IN CRYPTO-ASSETS

accordance with the provisions of this article, the proposed acquisition

shall be deemed to be approved.

(11) The competent authority may set a maximum period for

the conclusion of the proposed acquisition referred to in sub-article

(2), and extend that maximum period when appropriate.

(1)

When performing the assessment referred to in

Article 41(4) of the MiCA Regulation and article 18(5), the competent

authority shall appraise the suitability of the proposed acquirer and the

financial soundness of the proposed acquisition referred to in Article

41(1) of the MiCA Regulation and article 18(2) on the basis of all of

the following criteria

(a)

the reputation of the proposed acquirer;

(b)

the reputation, knowledge, skills and experience

of any person who shall direct the business of the issuer of

the asset-referenced token as a result of the proposed

acquisition;

(c)

the financial soundness of the proposed acquirer,

in particular in relation to the type of business envisaged and

pursued in respect of the issuer of the asset-referenced token in

which the acquisition is proposed;

(d)

whether the issuer of the asset-referenced token

shall be able to comply and continue to comply with the

provisions of Title III of the MiCA Regulation and this Part;

and

(e)

whether there are reasonable grounds to suspect

that, in connection with the proposed acquisition, money

laundering or the funding of terrorism within the meaning of

article 2(1) of the Prevention of Money Laundering Act is

being or has been committed or attempted, or that the proposed

acquisition could increase the risk thereof.

(2)

The competent authority may oppose the proposed

acquisition referred to in Article 41(1) of the MiCA Regulation and

article 18(2) where there are reasonable grounds for doing so based

on the criteria set out in sub-article (1), or where the information

provided in accordance with Article 41(4) of the MiCA Regulation

and article 18(5) is incomplete or false.

(3)

The competent authority shall not examine the proposed

acquisition referred to in Article 41(1) of the MiCA Regulation and

article 18(2) in terms of the economic needs of the market.

(1)

For the purposes of this article, "issuer of an asset-

referenced token" means an issuer of an asset-referenced token which

is a credit institution licensed under the Banking Act or a legal person

or other undertaking authorised under Article 21 of the MiCA

Regulation and article 11.

(2)

The issuer of an asset-referenced token shall notify the

recovery plan drawn up in accordance with Article 46(1) of the MiCA

Regulation to the competent authority within six (6) months of the

date of authorisation pursuant to Article 21 of the MiCA Regulation

and article 11 or within (6) six months of the date of approval of the

crypto-asset white paper pursuant to Article 17 of the MiCA

Regulation and article 10.

(3)

The competent authority shall require amendments to the

recovery plan referred to in sub-article (2) where necessary to ensure

its proper implementation and shall notify its decision requesting those

amendments to the issuer of the asset-referenced token within forty

(40) working days of the date of notification of such plan.

(4)

The decision of the competent authority referred to in sub-

article (3) shall be implemented by the issuer of the asset-referenced

token within forty (40) working days of the date of notification of such

decision.

(5)

The issuer of the asset-referenced token shall regularly

review and update the recovery plan.

(6)

Where the issuer of the asset-referenced token fails to

comply with the requirements applicable to the reserve of assets as

referred to in Chapter 3 of Title III of the MiCA Regulation or, due to

a rapidly deteriorating financial condition, is likely in the near future

to not be able to comply with such requirements, the competent

authority, in order to ensure compliance with the applicable

requirements, shall have the power to require the said issuer to

implement one or more of the arrangements or measures set out in the

r e c o v e r y p l a n o r t o u p d a t e su c h a r e co v e r y p l a n w h en t h e

circumstances are different from the assumptions set out in the initial

recovery plan and implement one or more of the arrangements or

measures set out in the updated plan within a specific time frame.

(7)

In the circumstances referred to in sub-article (6), the

competent authority shall have the power to temporarily suspend the

redemption of asset-referenced tokens, provided that the suspension

is justified while having regard to the interests of the holders of asset-

referenced tokens and financial stability.

(1)

For the purposes of this article, "issuer of an asset-

referenced token" means an issuer of an asset-referenced token which

is a credit institution licensed under the Banking Act or a legal person

or other undertaking authorised under Article 21 of the MiCA

Regulation and article 11.

(2)

The issuer of an asset-referenced token shall notify the

MARKETS IN CRYPTO-ASSETS

redemption plan drawn up in accordance with Article 47(1) and (2) of

the MiCA Regulation to the competent authority within six (6) months

of the date of authorisation pursuant to Article 21 of the MiCA

Regulation and article 11 or within six (6) months of the date of

approval of the crypto-asset white paper pursuant to Article 17 of the

MiCA Regulation and article 10.

(3)

The competent authority shall require amendments to the

redemption plan referred to in sub-article (2) where necessary, to

ensure its proper implementation and shall notify its decision

requesting those amendments to the issuer of the asset-referenced

token within forty (40) working days of the date of notification of such

plan.

(4)

The decision of the competent authority referred to in sub-

article (3) shall be implemented by the issuer of the asset-referenced

token within forty (40) working days of the date of notification of the

said decision.

(5)

The issuer of the asset-referenced token shall regularly

review and update the redemption plan.

PART IV

E-MONEY TOKENS

The competent authority shall neither require prior approval

of crypto-asset white papers for e-money tokens, nor of any marketing

communications relating thereto, before their respective publication.

(1)

For the purposes of this article, "issuers of e-money

tokens" means issuers of e-money tokens which are licensed as a

credit institution under the Banking Act or as a financial institution

authorised to issue electronic money under the Financial Institutions

Act.

(2)

Issuers of e-money tokens shall, at least forty (40) working

days before the date on which they intend to offer to the public such

e-money tokens or seek their admission to trading, notify the

competent authority of that intention.

(3)

Issuers of e-money tokens shall notify their crypto-asset

white paper to the competent authority at least twenty (20) working

days before the date of its publication.

(4)

Issuers of e-money tokens shall, together with the

notification of the crypto-asset white paper referred to in sub-article

(3), provide the competent authority with the information referred to

in Article 109(4) of the MiCA Regulation.

(5)

Without prejudice to the provisions of sub-article (3), where

the provisions of Article 48(5) of the MiCA Regulation apply, the

issuers of e-money tokens shall draw up a crypto-asset white

paper and notify such crypto-asset white paper to the competent

authority in accordance with Article 51 of the said Regulation and

sub-articles (3) and (4).

(6)

Marketing communications relating to an offer to the public

of an e-money token, or to the admission to trading of such e-money

token shall, upon request, be notified to the competent authority.

(1)

For the purposes of this article, "issuer of an e-money

token" means an issuer of an e-money token which is licensed as a

credit institution under the Banking Act or as a financial institution

authorised to issue electronic money under the Financial Institutions

Act.

(2)

The issuer of an e-money token shall notify the recovery

plan drawn up in accordance with Article 46(1) of the MiCA

Regulation, as applicable pursuant to Article 55 of the said Regulation,

to the competent authority within six (6) months of the date of the offer

to the public or admission to trading of the e-money token.

(3)

The competent authority shall require amendments to the

recovery plan referred to in sub-article (2) where necessary to ensure

its proper implementation and shall notify its decision requesting those

amendments to the issuer of an e-money token within forty (40)

working days of the date of notification of such plan.

(4)

The decision of the competent authority referred to in sub-

article (3) shall be implemented by the issuer of the e-money token

within forty (40) working days of the date of notification of such

decision.

(5)

The issuer of the e-money token shall regularly review and

update the recovery plan.

(6)

Where the issuer of an e-money token fails to comply with

the applicable requirements under the MiCA Regulation or, due to a

rapidly deteriorating financial condition, is likely in the near future to

not be able to comply with those requirements, the competent authority

in order to ensure compliance with the applicable requirements, shall

have the power to require the said issuer to implement one or more of

the arrangements or measures set out in the recovery plan, or to update

such a recovery plan when the circumstances are different from the

assumptions set out in the initial recovery plan and implement one or

more of the arrangements or measures set out in the updated plan

within a specific time frame.

(7)

In the circumstances referred to in sub-article (6), the

competent authority shall have the power to temporarily suspend the

redemption of e-money tokens, provided that the suspension is

MARKETS IN CRYPTO-ASSETS

justified while having regard to the interests of the holders of e-money

tokens and financial stability.

(1)

For the purposes of this article, "issuer of an e-money

token" means an issuer of an e-money token which is licensed as a

credit institution under the Banking Act or as a financial institution

authorised to issue electronic money under the Financial Institutions

Act.

(2)

The issuer of an e-money token shall notify the redemption

plan drawn up in accordance with Article 47(1) and (2) of the MiCA

Regulation, as applicable pursuant to Article 55 of the said Regulation,

to the competent authority within six (6) months of the date of the offer

to the public or admission to trading of the e-money token.

(3)

The competent authority shall require amendments to the

redemption plan referred to in sub-article (2) where necessary to

ensure its proper implementation and shall notify its decision

requesting those amendments to the issuer of the e-money token within

forty (40) working days of the date of notification of such plan.

(4)

The decision of the competent authority referred to in sub-

article (3) shall be implemented by the issuer of the e-money token

within forty (40) working days of the date of notification of such

decision.

(5)

The issuer of the e-money token shall regularly review and

update the redemption plan.

PART V

CRYPTO-ASSET SERVICE PROVIDERS

(1)

Without prejudice to the provisions of Article 61 of

the MiCA Regulation, a person shall not provide crypto-asset services

in Malta unless that person is

(a)

a legal person or other undertaking that has

been authorised to act as a crypto-asset service provider in

accordance with Article 63 of the MiCA Regulation; or

(b)

a credit institution, central securities depository,

investment firm, market operator, electronic money institution,

UCITS management company, or an alternative investment fund

manager that is allowed to provide crypto-asset services

pursuant to Article 60 of the MiCA Regulation.

(2)

Without prejudice to sub-article (1), crypto-asset service

providers shall be allowed to provide crypto-asset services in Malta

either through the right of establishment, including through a branch,

or through the freedom to provide services

Provided that where Malta is the host Member State, crypto-

asset service providers that provide crypto-asset services in Malta shall

not be required to have a physical presence in Malta.

(1)

The provisions of this article shall only apply where

Malta is the home Member State.

(2)

A credit institution may provide crypto-asset services if it

notifies the information referred to in sub-article (9) to the competent

authority at least forty (40) working days before providing such

services for the first time.

(3)

A central securities depository authorised under Regulation

(EU) No. 909/2014 shall only provide the custody and administration

of crypto-assets on behalf of clients if it notifies the information

referred to in sub-article (9) to the competent authority at least forty

(40) working days before providing such service for the first time

Provided that for the purposes of this sub-article, the

provision of the custody and administration of crypto-assets on behalf

of clients shall be deemed equivalent to providing, maintaining or

operating securities accounts in relation to the settlement service

referred to in point (3) of Section B of the Annex to Regulation (EU)

No. 909/2014.

(4)

An investment firm may provide crypto-asset services in

the European Union equivalent to the investment services and

activities for which it is specifically authorised under Directive 2014/

65/EU if it notifies to the competent authority the information referred

to in sub-article (9) at least forty (40) working days before providing

such services for the first time

Provided that for the purposes of this sub-article

(a)

the provision of the custody and administration of

crypto-assets on behalf of clients shall be deemed equivalent to

the ancillary service as referred to in point (1) of Section B of

Annex I to Directive 2014/65/EU;

(b)

the operation of a trading platform for crypto-

assets shall be deemed equivalent to the operation of a

multilateral trading facility and operation of an organised

trading facility as referred to in points (8) and (9) respectively,

of Section A of Annex I to Directive 2014/65/EU;

(c)

the exchange of crypto-assets for funds and

other crypto-assets shall be deemed equivalent to dealing on

own account as referred to in point (3) of Section A of

Annex I to Directive 2014/65/EU;

(d)

the execution of orders for crypto-assets on behalf

of clients shall be deemed equivalent to the execution of orders

on behalf of clients as referred to in point (2) of Section A of

MARKETS IN CRYPTO-ASSETS

Annex I to Directive 2014/65/EU;

(e)

the placing of crypto-assets is deemed equivalent

to the underwriting or placing of financial instruments on a firm

commitment basis and placing of financial instruments without

a firm commitment basis as referred to in points (6) and (7)

respectively, of Section A of Annex I to Directive 2014/65/EU;

(f)

the reception and transmission of orders for

crypto- assets on behalf of clients shall be deemed equivalent to

the reception and transmission of orders in relation to one or

more financial instruments as referred to in point (1) of Section

A of Annex I to Directive 2014/65/EU;

(g)

providing advice on crypto-assets shall be

deemed equivalent to investment advice as referred to in point

(5) of Section A of Annex I to Directive 2014/65/EU; and

(h)

providing portfolio management on crypto-assets

shall be deemed equivalent to management of investments as

referred to in point (4) of Section A of Annex I to Directive

2014/65/EU.

(5)

An electronic money institution authorised in accordance

with Directive 2009/110/EC shall only provide the custody and

administration of crypto-assets on behalf of clients and transfer

services for crypto-assets on behalf of clients with regard to the e-

money tokens it issues, if it notifies the competent authority w i t h

the information referred to in sub-article (9) at least forty (40)

working days before providing those services for the first time.

(6)

A UCITS management company or an alternative

investment fund manager may provide crypto-asset services equivalent

to the management of portfolios of investment and non-core services

for which it is authorised i n a c c o r d a n c e w i t h Directive 2009/65/

EC or Directive 2011/61/EU if it notifies the competent authority with

the information referred to in sub-article (9) at least forty (40) working

days before providing those services for the first time

Provided that for the purposes of this sub-article

(a)

the reception and transmission of orders for

crypto- assets on behalf of clients shall be deemed equivalent to

the reception and transmission of orders in relation to financial

instruments as referred to in point (b)(iii) of Article 6(4) of

Directive 2011/61/EU;

(b)

providing advice on crypto-assets shall be

deemed equivalent to investment advice as referred to in point

(b)(i) of Article 6(4) of Directive 2011/61/EU and in point

(b)(i) of Article 6(3) of Directive 2009/65/EC;

(c)

providing portfolio management on crypto-assets

shall be deemed equivalent to the services as referred to in point

(a) of Article 6(4) of Directive 2011/61/EU and in point (a) of

Article 6(3) of Directive 2009/65/EC.

(7)

A market operator authorised in accordance with

Directive 2014/65/EU may operate a trading platform for crypto-assets

if it notifies the competent authority with the information referred to in

sub-article (9) at least forty (40) working days before providing such

services for the first time.

(8)

Notwithstanding the provisions of sub-articles (2) to (7),

the entities referred to in the said sub-articles shall not be required to

submit any information referred to in sub-article (9) that was

previously submitted by them to the competent authority where such

information would be identical

Provided that when submitting the information referred to in

sub-article (9), the entities referred to in sub-articles (2) to (7) shall

expressly state that any information that was submitted previously is

still up-to-date.

(9)

Without prejudice to the provisions of Article 60(13) and

(14) of the MiCA Regulation, for the purposes of sub-articles (2) to

(7) the following information shall be notified to the competent

authority

(a)

a programme of operations setting out the types

of crypto-asset services that the applicant intends to provide,

including where and how those services are to be marketed;

(b)

a description of

(i)

the internal control mechanisms, policies

and procedures to ensure compliance with the provisions

of national law transposing Directive (EU) 2015/849;

(ii)

the risk assessment framework for the

management of money laundering and terrorist financing

risks; and

(iii)

the business continuity plan;

(c)

the technical documentation of the ICT systems

and security arrangements, and a description thereof in non-

technical language;

(d)

a description of the procedure for the segregation

of clients’ crypto-assets and funds;

(e)

a description of the custody and administration

policy, where it is intended to provide custody and

MARKETS IN CRYPTO-ASSETS

administration of crypto-assets on behalf of clients;

(f)

a description of the operating rules of the trading

platform and of the procedures and system to detect market

abuse, where it is intended to operate a trading platform for

crypto-assets;

(g)

a description of the non-discriminatory

commercial policy governing the relationship with clients as

well as a description of the methodology for determining the

other crypto-assets, where it is intended to exchange crypto-

assets for funds or other crypto-assets;

(h)

a description of the execution policy, where it is

intended to execute orders for crypto-assets on behalf of clients;

(i)

evidence that the natural persons giving advice on

behalf of the applicant or managing portfolios on behalf of the

applicant have the necessary knowledge and expertise to fulfil

their obligations, where it is intended to provide advice on

crypto-assets or provide portfolio management on crypto-

assets;

(j)

whether the crypto-asset service relates to asset-

referenced tokens, e-money tokens or other crypto-assets; and

(k)

information on the manner in which such transfer

services shall be provided, where it is intended to provide

transfer services for crypto-assets on behalf of clients.

(10) The competent authority shall, within twenty (20) working

days of receipt of such notification as referred to in sub-articles (2) to

(7), assess whether all required information has been provided.

(11) Where the competent authority concludes that a notification

as referred to in sub-articles (2) to (7) is not complete, it shall

immediately inform the notifying entity thereof and set a deadline by

which that entity is required to provide the missing information

Provided that the deadline for providing any missing

information shall not exceed twenty (20) working days from the date

of the request and, until the expiry of the said deadline, each period as

set out in sub-articles (2) to (7) shall be suspended

Provided further that the crypto-asset service provider shall

not begin providing the crypto-asset services as long as the notification

referred to in sub-articles (2) to (7) is incomplete.

(12) Without prejudice to sub-article (11), any further request

by the competent authority for completion or clarification of the

information provided in terms of this article, shall be at its discretion

but shall not result in a suspension of the period set out in sub-articles

(2) to (7).

(1)

The provisions of this article shall only apply where

Malta is the home Member State.

(2)

Legal persons or other undertakings that intend to provide

crypto-asset services shall submit their application for an authorisation

to act as a crypto-asset service provider to the competent authority.

(3)

The application referred to in sub-article (2) shall contain

all of the following information

(a)

the name, including the legal name and any

other commercial name used, the legal entity identifier of the

applicant, the website operated by such applicant, a contact

email address, a contact telephone number and its physical

address;

(b)

the legal nature of the applicant;

(c)

the articles of association of the applicant,

where applicable;

(d)

a programme of operations, setting out the types

of crypto-asset services that the applicant intends to provide,

including where and how those services are to be marketed;

(e)

proof that the applicant meets the requirements

for prudential safeguards set out in Article 67 of the MiCA

Regulation;

(f)

a description of the applicant’s governance

arrangements;

(g)

proof that members of the management body of

the applicant are of sufficiently good repute and possess the

appropriate knowledge, skills and experience to manage such

provider;

(h)

the identity of any shareholders and members,

whether direct or indirect, that have qualifying holdings in the

applicant and the amounts of those holdings, as well as proof

that those persons are of sufficiently good repute;

(i)

a description of the applicant’s internal control

mechanisms, policies and procedures to identify, assess and

manage risks, including money laundering and terrorist

financing risks, and business continuity plan;

(j)

the technical documentation of the ICT systems

and security arrangements, and a description thereof in non-

MARKETS IN CRYPTO-ASSETS

technical language;

(k)

a description of the procedure for the segregation

of clients’ crypto-assets and funds;

(l)

a description of the applicant’s complaints-

handling procedures;

(m) where the applicant intends to provide custody

and administration of crypto-assets on behalf of clients, a

description of the custody and administration policy;

(n)

where the applicant intends to operate a trading

platform for crypto-assets, a description of the operating rules

of the trading platform and of the procedure and system to

detect market abuse;

(o)

where the applicant intends to exchange crypto-

assets for funds or other crypto-assets, a description of the

commercial policy, which shall be non-discriminatory,

governing the relationship with clients as well as a description

of the methodology for determining the price of the crypto-

assets that the applicant crypto-asset service provider proposes

to exchange for funds or other crypto-assets;

(p)

where the applicant intends to execute orders for

crypto-assets on behalf of clients, a description of the execution

policy;

(q)

where the applicant intends to provide advice on

crypto-assets or portfolio management of crypto-assets, proof

that the natural persons giving advice on behalf of the applicant

crypto-asset service provider or managing portfolios on behalf

of the applicant have the necessary knowledge and expertise to

fulfil their obligations;

(r)

where the applicant intends to provide transfer

services for crypto-assets on behalf of clients, information on

the manner in which such transfer services shall be provided;

and

(s)

the type of crypto-asset to which the crypto-

asset service relates

Provided that for the purposes of paragraphs (g) and (h), an

applicant shall provide proof of all of the following

(a)

for all members of the management body of the

applicant, the absence of a criminal record in respect of

convictions and the absence of penalties imposed in accordance

with the applicable commercial law, insolvency law and

financial services law, or in relation to anti-money laundering

and counter-terrorist financing, to fraud or to professional

liability;

(b)

that the members of the management body of the

applicant collectively possess the appropriate knowledge, skills

and experience to manage the crypto-asset service provider and

that such persons are required to commit sufficient time to

perform their duties; and

(c)

for all shareholders and members, whether direct

or indirect, that have qualifying holdings in the applicant, the

absence of a criminal record in respect of convictions or the

absence of penalties imposed in accordance with the applicable

commercial law, insolvency law and financial services law, or in

relation to anti-money laundering and counter-terrorist

financing, to fraud or to professional liability.

(4)

Notwithstanding the provisions of sub-articles (2) and (3),

the competent authority shall not require an applicant to provide any

information referred to in sub-article (3) that it has already received

under the respective authorisation procedures in accordance with the

Financial Institutions Act or the Investment Services Act, or pursuant

to national law applicable to crypto-asset services prior to 29 June

2023, provided that such previously submitted information or

documents are still up-to-date.

(5)

The competent authority shall immediately, and in any event

within five (5) working days of receipt of an application referred to in

sub-article (2), acknowledge receipt thereof in writing to the applicant.

(6)

The competent authority shall, within twenty-five (25)

working days of receipt of an application referred to in sub-article (2),

assess whether that application is complete by verifying that the

information referred to in sub-article (3) has been submitted

Provided that where the application is not complete, the

competent authority shall set a deadline by which the applicant shall

provide any missing information.

(7)

The competent authority may refuse to review an

application referred to in sub-article (2) when such application remains

incomplete after the expiry of the deadline set by it in accordance with

sub-article (6).

(8)

Once an application is complete, the competent authority

shall immediately notify the applicant thereof.

(9)

The competent authority shall, within forty (40) working

days from the date of receipt of a complete application, assess whether

the applicant complies with the requirements of Title V of the MiCA

Regulation and the provisions of this Part, and shall take a fully

MARKETS IN CRYPTO-ASSETS

reasoned decision granting or refusing an authorisation to act as a

crypto-asset service provider

Provided that the competent authority shall notify the

applicant of its decision within five (5) working days of the date of

such decision

Provided further that the assessment referred to in this sub-

article shall take into account the nature, scale and complexity of the

crypto-asset services that the applicant intends to provide.

(10) The competent authority may, during the assessment period

provided for in sub-article (9), and not later than the twentieth (20th)

working day of the said period, request any further information that

is necessary to complete the assessment referred to in sub-article (6)

Provided that such request shall be made in writing to the

applicant and shall specify the additional information needed.

(11) The assessment period referred to in sub-article (9) shall be

suspended for the period between the date of request for missing

information by the competent authority and the receipt by it of a

response thereto from the applicant

Provided that suspension referred to in this sub-article shall

not exceed twenty (20) working days.

(12) Without prejudice to the provisions of sub-article (11), any

further requests by the competent authority for completion or

clarification of the information provided in terms of this article, shall

be at its discretion but shall not result in a suspension of the

assessment period set out in sub-article (9).

(13) In granting an authorisation under this article, the competent

authority may impose on the crypto-asset service provider such

conditions as it may deem appropriate and, wh en having granted

such an authorisation it may, from time to time, vary or revoke any

condition so imposed or impose new conditions.

(14) An authorisation granted i n ac co r d a n c e w i t h Article 63

of the MiCA Regulation and this article shall specify the crypto-asset

services that the crypto-asset service provider, to which such

authorisation was granted, is authorised to provide.

(15) Where a crypto-asset service provider to which an

authorisation was granted under Article 63 of the MiCA Regulation

and this article intends to provide crypto-asset services additional to

those which it is authorised to provide, it shall submit a request to the

competent authority for an extension of the authorisation granted to it,

by complementing and updating the information referred to in Article

62 of the MiCA Regulation and this article

Provided that the request for extension shall be processed in

accordance with Article 63 of the MiCA Regulation and this article.

(1)

Where an applicant operates establishments or relies

on third parties established in high-risk third countries identified

pursuant to Article 9 of Directive (EU) 2015/849, the competent

authority shall ensure that the applicant complies with the provisions

of regulations 12(2), 6(3) and 6(4) of the Prevention of Money

Laundering and Funding of Terrorism Regulations before granting or

refusing an authorisation to act as a crypto-asset service provider in

accordance with the provisions of the MiCA Regulation and this Act.

(2)

Before granting or refusing an authorisation to act as a

crypto-asset service provider in accordance with the provisions of the

MiCA Regulation and this Act, the competent authority shall ensure

that the applicant complies with the provisions of regulation 11(10)

and (12) of the Prevention of Money Laundering and Funding of

Terrorism Regulations, where applicable.

(3)

The competent authority shall refuse to grant an

authorisation under Article 63 of the MiCA Regulation and article 28

where there are objective and demonstrable grounds that

(a)

the management body of the applicant poses a

threat to its effective, sound and prudent management and

business continuity, and to the adequate consideration of the

interest of its clients and the integrity of the market, or exposes

the applicant to a serious risk of money laundering or terrorist

financing;

(b)

the members of the management body of the

applicant do not meet the criteria set out in Article 68(1) of the

MiCA Regulation;

(c)

the shareholders or members, whether direct or

indirect, that have qualifying holdings in the applicant do not

meet the criteria of sufficiently good repute set out in Article

68(2) of the MiCA Regulation; and, or

(d)

the applicant fails to meet or is likely to fail to

meet any of the requirements of Title V of the MiCA

Regulation and this Part.

(4)

Without prejudice to the provisions of sub-article (3), the

competent authority shall also refuse to grant an authorisation under

Article 63 of the MiCA Regulation and article 28 where

(a)

there exist close links between the applicant and

other natural or legal persons and the said links prevent the

effective exercise of their supervisory functions; and, or

(b)

the laws, regulations or administrative provisions

MARKETS IN CRYPTO-ASSETS

of a third country governing one or more natural or legal

persons with which the applicant has close links, or any

difficulties involved in their enforcement, prevent the effective

exercise of its supervisory functions.

(1)

The competent authority shall withdraw an

authorisation granted to a crypto-asset service provider under Article

63 of the MiCA Regulation and article 28 in any of the following

situations

(a)

the crypto-asset service provider has not used

its authorisation within twelve (12) months of the date of the

authorisation;

(b)

the crypto-asset service provider has expressly

renounced its authorisation;

(c)

the crypto-asset service provider has not

provided crypto-asset services for nine (9) consecutive months;

(d)

the crypto-asset service provider has obtained its

authorisation by irregular means, such as by making false

statements in its application for authorisation;

(e)

the crypto-asset service provider no longer meets

the conditions under which the authorisation was granted and

has not taken the remedial action requested by the competent

authority within the specified time frame;

(f)

the crypto-asset service provider fails to have in

place effective systems, procedures and arrangements to detect

and prevent money laundering and terrorist financing in

accordance with Directive (EU) 2015/849 as transposed in

national law; and, or

(g)

the crypto-asset service provider has seriously

infringed the provisions of the MiCA Regulation, this Act and,

or any regulations made and, o r Rules issued thereunder,

including the provisions relating to the protection of holders of

crypto-assets or of clients of crypto-asset service providers, or

market integrity.

(2)

Without prejudice to the provisions of sub-article (1), the

competent authority may withdraw an authorisation granted to a

crypto-asset service provider under Article 63 of the MiCA Regulation

and article 28 in any of the following situations

(a)

the crypto-asset service provider has infringed

the provisions of national law transposing Directive (EU) 2015/

849; and, or

(b)

the crypto-asset service provider has lost its

authorisation as a payment institution or its authorisation as an

electronic money institution, and such crypto-asset service

provider has failed to remedy the situation within forty (40)

calendar days.

(3)

Without prejudice to the provisions of sub-articles (1) and

(2), the competent authority may limit the withdrawal of an

authorisation granted to a crypto-asset service provider under Article

63 of the MiCA Regulation and article 28 to a particular crypto-asset

service.

(1)

Where the competent authority proposes to

(a)

refuse an application for authorisation submitted

to the competent authority in accordance with Article 62 of

the MiCA Regulation and article 28 or to withdraw the

authorisation granted to a crypto-asset service provider under

Article 63 of the MiCA Regulation and article 28; or

(b)

vary any condition to which an authorisation

granted under Article 63 of the MiCA Regulation and article

28 is subject to or to impose a condition thereon, it shall give

the applicant or the issuer of an asset-referenced token, as

applicable, notice in writing of its intention to do so, while

setting out the reasons for the decision it proposes to take.

(2)

Every notice given under sub-article (1) shall state that the

recipient of the notice may, within such reasonable period after the

service thereof as may be stated in the notice, make representations in

writing to the competent authority giving reasons why the proposed

decision should not be taken, and the competent authority shall

consider any representation so made before arriving at a final decision.

(3)

Subject to the provisions of Article 63 of the MiCA

Regulation and article 28, the competent authority shall as soon as

practicable notify its final decision in writing to any of the persons to

whom notice is to be given under sub-article (1).

(1)

Where Malta is the home Member State, a crypto-

asset service provider that intends to provide crypto-asset services in

a Member State other than Malta shall submit the following

information to the competent authority

(a)

a list of the Member States in which the crypto-

asset service provider intends to provide crypto-asset services;

(b)

the crypto-asset services that the crypto-asset

service provider intends to provide on a cross-border basis;

(c)

the starting date of the intended provision of

the crypto-asset services; and

MARKETS IN CRYPTO-ASSETS

(d)

a list of all other activities provided by the crypto-

asset service provider not covered by the MiCA Regulation and

this Act.

(2)

The competent authority shall, within ten (10) working days

of rec eipt of the information re ferred to in sub-article (1),

communicate the said information to the single points of contact of the

host Member States, to ESMA and to the EBA.

(3)

The competent authority shall inform the crypto-asset

service provider concerned of the communication referred to in sub-

article (2) without delay.

(4)

The crypto-asset service provider may begin to provide

crypto-asset services in a Member State other than Malta from the date

of receipt of the communication referred to in sub-article (3) or at the

latest from the fifteenth (15th) calendar day after having submitted the

information referred to in sub-article (1).

(1)

For the purposes of this article

(a)

"proposed acquirer" means any natural or legal

persons or such persons acting in concert who intend to acquire,

directly or indirectly, a qualifying holding in a crypto-asset

service provider; and

(b)

"crypto-asset service provider" means a legal

person or other undertaking authorised under Article 63 of the

MiCA Regulation and article 28, a credit institution licensed

under the Banking Act, a central securities depository

authorised under the Financial Markets Act, a financial

institution authorised to issue electronic money under the

Financial Institutions Act, or a person licensed as an investment

services licence holder under the Investment Services Act.

(2)

Any natural or legal persons or such persons acting in

concert who intend to acquire, directly or indirectly, a qualifying

holding in a crypto-asset service provider or to increase, directly or

indirectly, such a qualifying holding so that the proportion of the

voting rights or of the capital held would reach or exceed twenty per

cent (20%), thirty per cent (30%) or fifty per cent (50%), or so that

the crypto-asset provider would become its subsidiary, shall notify the

competent authority thereof in writing, indicating the size of the

intended holding and the information required by the regulatory

technical standards adopted by the European Commission in

accordance with Article 42(4) of the MiCA Regulation.

(3)

Any natural or legal person who has taken a decision to

dispose, directly or indirectly, of a qualifying holding in a crypto-

asset service provider shall, prior to disposing of such holding, notify

in writing the competent authority of its decision and indicate the size

of such holding

Provided that any such person as referred to in this sub-

article shall also notify the competent authority where it has taken a

decision to reduce a qualifying holding so that the proportion of the

voting rights or of the capital held would fall below ten per cent (10%),

twenty per cent (20%), thirty per cent (30%), or fifty per cent (50%),

or so that the crypto-asset service provider would cease to be that

person’s subsidiary.

(4)

The competent authority shall, promptly and in any event

within two (2) working days following receipt of a notification in

accordance with sub-article (2), acknowledge receipt thereof in

writing

Provided that when acknowledging receipt of the

notification provided in accordance with this sub-article, the

competent authority shall inform the proposed acquirer of the date of

expiry of the assessment period determined in accordance with the

provisions of sub-article (5).

(5)

The competent authority shall assess the proposed

acquisition referred to in sub-article (2) and the information required

pursuant to the regulatory technical standards adopted by the European

Commission in accordance with Article 84(4) of the MiCA

Regulation, within sixty (60) working days of the date of the written

acknowledgement of receipt referred to in sub-article (4).

(6)

When performing the assessment referred to in sub-article

(5), the competent authority may request from the proposed acquirer

any additional information that is necessary to complete that

assessment

Provided that such requests shall be made in writing and

shall specify the additional information needed

Provided further that such requests shall be made before

the assessment is finalised, and in any case no later than fifty (50)

working days from the date of the written acknowledgement of receipt

referred to in sub-article (4).

(7)

The competent authority shall suspend the assessment

period referred to in sub-article (5) until it has received the additional

information referred to in sub-article (6)

Provided that the suspension referred to in this sub-article

shall not exceed twenty (20) working days

Provided further that the competent authority may extend

the suspension referred to in this sub-article by up to thirty (30)

working days if the proposed acquirer is situated outside the European

MARKETS IN CRYPTO-ASSETS

Union or regulated under the law of a third country.

(8)

Without prejudice to the provisions of sub-article (7), any

further requests by the competent authority for additional information

or for clarification of the information received shall not result in a

suspension of the assessment period set out in sub-article (5).

(9)

Where the competent authority, upon completion of the

assessment referred to in sub-article (5), decides to oppose the

proposed acquisition referred to in sub-article (2), it shall notify the

proposed acquirer of its decisions, and provide the reasons for its

decision, within two (2) working days, and in any event before the

date referred to in sub-article (5) as extended, where applicable, in

accordance with the provisions of this article.

(10) Where the competent authority does not oppose the

proposed acquisition referred to in sub-article (2) before the date

referred to in sub-article (5) as extended, where applicable, in

accordance with the provisions of this article, the proposed acquisition

shall be deemed to be approved.

(11) The competent authority may set a maximum period for

the conclusion of the proposed acquisition referred to in sub-article (2)

and extend such maximum period where appropriate.

(1)

When performing the assessment referred to in

Article 83(4) of the MiCA Regulation and article 33(5), the competent

authority shall appraise the suitability of the proposed acquirer and

the financial soundness of the proposed acquisition referred to in

Article 83(1) of the MiCA Regulation and article 33(2) against all of

the following criteria

(a)

the reputation of the proposed acquirer;

(b)

the reputation, knowledge, skills and experience

of any person who is to direct the business of the crypto-asset

provider as a result of the proposed acquisition;

(c)

the financial soundness of the proposed acquirer,

in particular in relation to the type of business envisaged and

pursued in respect of the crypto-asset service provider in which

the acquisition is proposed;

(d)

whether the crypto-asset service provider will be

able to comply and continue to comply with the provisions of

Title V of the MiCA Regulation and this Part; and

(e)

whether there are reasonable grounds to suspect

that, in connection with the proposed acquisition, money

laundering or the funding of terrorism within the meaning of

article 2(1) of the Prevention of Money Laundering Act is

being or has been committed or attempted, or that the proposed

acquisition could increase the risk thereof.

(2)

The competent authority may oppose the proposed

acquisition referred to in Article 83(1) of the MiCA Regulation and

article 33(2) where there are reasonable grounds for doing so based

on the criteria set out in sub-article (1) or where the information

provided in accordance with Article 83(4) of the MiCA Regulation

and article 33(5) is incomplete or false.

(3)

The competent authority shall not examine the proposed

acquisition referred to in Article 83(1) of the MiCA Regulation and

article 33(2) in terms of the economic needs of the market.

PART VI

PREVENTION AND PROHIBITION OF MARKET ABUSE

(1)

Issuers, offerors and persons seeking admission to

trading shall inform the public as soon as possible of inside

information referred to in Article 87 of the MiCA Regulation that

directly concerns them, in a manner that enables fast access as well as

complete, correct and timely assessment of the information by the

public

Provided that issuers, offerors and persons seeking

admission to trading shall not combine the disclosure of inside

information to the public with the marketing of their activities

Provided further that issuers, offerors and persons seeking

admission to trading shall post and maintain on their website, for a

period of at least five (5) years, all inside information that they are

required to disclose publicly.

(2)

Issuers, offerors and persons seeking admission to trading

may, on their own responsibility, delay disclosure to the public of

inside information referred to in Article 87 of the MiCA Regulation

provided that all of the following conditions are met

(a)

immediate disclosure is likely to prejudice the

legitimate interests of the issuers, offerors or persons seeking

admission to trading;

(b)

delay of disclosure is not likely to mislead the

public; and

(c)

issuers, offerors or persons seeking admission to

trading are able to ensure the confidentiality of such

information.

(3)

Where an issuer, offeror or a person seeking admission to

trading has delayed the disclosure of inside information in accordance

with sub-article (2), it shall inform the competent authority that

disclosure of the information was delayed and shall provide a written

MARKETS IN CRYPTO-ASSETS

explanation of how the conditions set out in sub-article (2) were met,

immediately after the information is disclosed to the public.

(4)

The provisions of this article shall only apply

(a)

with respect to issuers, offerors and persons

seeking admission to trading of crypto-assets other than asset-

referenced tokens or e-money tokens when Malta is the home

Member State;

(b)

with respect to issuers, offerors and persons

seeking admission to trading of asset-referenced tokens being

credit institutions licensed as such under the Banking Act or

persons authorised under Article 21 of the MiCA Regulation

and article 11; and

(c)

with respect to issuers, offerors and persons

seeking admission to trading of e-money tokens being credit

institutions licensed as such under the Banking Act or financial

institutions authorised to issue electronic money under the

Financial Institutions Act.

(1)

Any person professionally arranging or executing

t r a n sa c t i o n s i n cr y p t o - a ss e t s s h a l l h a v e i n p l a c e e ff e c t i v e

arrangements, systems and procedures to prevent and detect market

abuse.

(2)

Any such person as referred to in sub-article (1) having its

registered office or its head office in Malta, or if it is a branch situated

in Malta, shall be subject to any applicable notification requirements

established in national law, including this Act and any regulations

made and Rules issued thereunder, and shall without delay report to the

competent authority any reasonable suspicion regarding an order or

transaction, including any cancellation or modification thereof, and

other aspects of the functioning of the distributed ledger technology

suc h a s t he c ons e ns us m e ch a ni sm , whe re th e r e m i ght e xis t

circumstances indicating that market abuse has been committed, is

being committed or is likely to be committed.

(3)

When receiving a report of suspicious orders or transactions

in accordance with sub-article (2), the competent authority shall

transmit such information immediately to the competent authorities of

the trading platforms concerned.

PART VII

REGULATORY AND INVESTIGATIVE POWERS

(1)

The Minister, acting on the advice of the competent

authority, may make regulations to give effect to the provisions of this

Act, and without prejudice to the generality of the foregoing may, by

such regulations, in particular, do any of the following

(a)

provide for and regulate the payment by any

person or body, as the case may be, of authorisation or other

fees and such other charges payable to the competent authority

in respect of any matter provided for, by or under the MiCA

Regulation, this Act and any regulations made, and Rules

issued thereunder, including the fees and charges in respect of

any permission, licence, authorisation, exemption or other

benefit, as well as any fees and charges in respect of the

competent authority’s regulatory, supervisory or investigative

functions under the MiCA Regulation, this Act and any

regulations made, and Rules issued thereunder, as may be

prescribed;

(b)

exempt any person, service or activity from any

one or more of the provisions of the MiCA Regulation and, or

this Act, subject to such variations, additions, adaptations and

modifications as may be prescribed and subject to such

conditions or other requirements, including other forms of

authorisation and notification procedures, as may be

prescribed;

(c)

transpose, implement and give effect to the

provisions and requirements of the MiCA Regulation;

(d)

transpose, implement and give effect to the

provisions and requirements of European Union Directives,

European Union Regulations and any other legislative measures

of the European Union requiring transposition and, or

implementation, as they may be amended from time to time,

including any implementing measures that have been, or may be

issued thereunder and relating to authorised persons and others

as may be specified therein. Regulations made under this

paragraph, and strictly related to transpositions or

implementations as aforesaid, may provide that any provision

of this Act or of any other law shall not apply to matters

falling under such regulations, and that insofar as any of the

provisions of the regulations are inconsistent with the

provisions of this Act or of any other law, such provisions in

any such regulations shall prevail;

(e)

assign powers and functions to the competent

authority for the purposes of the MiCA Regulation and this Act,

and provide for the exercise of such powers and the

performance of such functions;

(f)

provide for the establishment and imposition of

administrative penalties and other administrative measures that

the competent authority may impose on crypto-asset service

providers, issuers, offerors, persons seeking admission to

trading and any other persons as may be specified therein;

MARKETS IN CRYPTO-ASSETS

(g)

prescribe that a breach of any regulations made

under this Act may amount to a criminal offence as may be

specified, and such regulations may impose punishments in

respect of any breach, consisting of a fine (multa) not exceeding

five million euro (€5,000,000) or imprisonment for a term not

exceeding six (6) years or both such fine and imprisonment in the

case of a natural person; and a fine (multa) not exceeding fifteen

million euro (€15,000,000) in the case of a legal person; and a

higher fine (multa) may be imposed on such natural or legal

person, as the case may be, where deemed necessary or

appropriate for any breach or failure of compliance with any

European Union Directive or European Union Regulation or

with any regulations made under this article to transpose or to

give effect to any European Union Directive or European Union

Regulation;

(h)

prescribe anything which may be prescribed; and

(i)

provide for any matter incidental to,

or

connected with any of the above stipulated paragraphs.

(2)

Regulations made under this article may be made subject

to such exemptions or conditions as may be specified therein, may

make different provision for different cases, circumstances or purposes

and may give to the competent authority such powers and, or

functions of adaptation of the regulations as may also be so specified.

(3)

Where regulations have been made in terms of this article,

the competent authority may issue Rules for the better carrying out

and implementation of the provisions of any regulations made in

accordance with this Act.

(4)

Regulations made under this Act and any amendment or

revocation of such regulations, may be published in the English

language only.

(5)

The exercise of any of the powers assigned under this article

shall be subject to any obligations or rights arising from Malta’s

international commitments.

(1)

The competent authority may, from time to time,

issue, publish, amend or revoke Rules which shall be binding on all

persons authorised by it or falling under its regulatory or supervisory

functions, or any other persons, as may be specified therein.

(2)

Without prejudice to the generality of sub-article (1), Rules

issued by the competent authority may

(a)

lay down additional requirements and conditions

in relation to persons authorised by it, seeking its approval, or

falling under the regulatory or supervisory functions of the

competent authority, their activities, the conduct of their

business, their relations with customers, the public and other

parties, their responsibilities to the competent authority,

reporting requirements, financial and other resources and

related requirements, and any other matters as the competent

authority may consider appropriate;

(b)

provide for the statements and notices that shall

be made or given for any purposes in regard to which the

competent authority exercises supervisory or regulatory

functions and the form and contents thereof;

(c)

prescribe the information that such persons are to

submit to the competent authority;

(d)

transpose, implement and give effect to the

provisions and requirements of the MiCA Regulation;

(e)

transpose, implement and give effect to the

provisions and requirements of European Union legislation and

any other legislative measures of the European Union requiring

transposition and, or implementation, as they may be amended

from time to time, including any implementing measures that

have been, or may be issued thereunder and relating to

authorised persons and others as may be specified therein; and,

or

(f)

regulate any matter that is incidental to, or

connected with any of the matters mentioned above as the

competent authority may consider appropriate in the

performance of its functions.

(3)

Rules may be made subject to such exemptions or

conditions as may be specified therein, may make different provision

for different cases, circumstances or purposes and may give to the

competent authority such powers of adaptation of the Rules as may

also be so specified.

(1)

Without prejudice to any other powers conferred to

the competent authority by this Act or by any other law, the competent

authority may, whenever it deems necessary, give by notice in writing

such directives as it may deem appropriate in the circumstances, and

any person to whom the notice is given shall observe, comply with

and otherwise give effect to any such directive within the time and in

the manner stated in the directive or subsequent directives

Provided that the competent authority may give any such

directive even when an authorised person, for whatever reason, ceases

to be so authorised in accordance with this Act

Provided further that any directive given in accordance

MARKETS IN CRYPTO-ASSETS

with this article shall, unless the competent authority otherwise directs,

continue to apply even when an authorised person, for whatever

reason, ceases to be so authorised in accordance with this Act.

(2)

The power to issue directives under this article shall also

include the power to vary, alter, add to or withdraw any directive, as

well as the power to issue subsequent new directives.

(3)

Where the competent authority is satisfied that the

circumstances so warrant, it may at any time make public any directive

it has given in accordance with this article.

(1)

The competent authority may, at any time and by

notice in writing, require the persons referred to in sub-article (2) to

do all or any of the following

(a)

to furnish to the competent authority, at such

time and place and in such form as it may specify, such

information and, or documentation as it may require, including

the power to require existing telephone and data traffic records;

(b)

to furnish to the competent authority any

information and, or documentation as it may require verified in

such manner as it may specify;

(c)

to appear before the competent authority, or

before a person appointed by it, at such time and place as it may

specify, to reply to questions and provide such information and,

or documentation as it may require; and, or

(d)

to provide the competent authority any assistance

which it may require and which that person is reasonably able

to provide.

(2)

The following persons may be required by the competent

authority to provide information, documentation and, or assistance as

specified in sub-article (1)

(a)

crypto-asset service providers, issuers, offerors

and persons seeking admission to trading;

(b)

the natural and, or legal persons that control any

person referred to in paragraph (a) or are controlled by such

person, both in the past and present, as well as past and present

directors, managers, auditors, officers and other employees of

such person, and any third party providing a service to such

person;

(c)

any person who is successively involved in the

transmission of orders or conduct of the operations concerned,

as well as their principals; and, or

(d)

any other person who appears to be in possession

of any relevant information.

(3)

A natural or legal person making information available to

the competent authority in accordance with this article shall not be

considered to be infringing any restriction on disclosure of information

imposed by contract or by any legislative, regulatory or administrative

provision, and shall not be subject to liability of any kind related to the

provision of such information and, or documentation.

(4)

The competent authority may require, make and, or retain

copies of any document furnished, provided or to which it has access

in accordance with this article.

(5)

Where the person required to provide information and, or

documentation under this article does not have the relevant

information and, or documentation, such person shall disclose to the

competent authority where, to the best of his knowledge, that

information and, or documentation can be found, and the competent

authority may require any person, whether indicated as aforesaid or

otherwise, who appears to the said authority to be in possession of such

information and, or documentation to provide it as requested.

(6)

A declaration made, and documentation provided, in

accordance with any requirement under this article may be used in

evidence against the person making the declaration or providing the

documentation as well as against any person to whom they relate.

(7)

The provisions of this article shall not apply to information

and, or documentation which is privileged in accordance with the

provisions of article 642 of the Criminal Code.

(8)

Where the competent authority has appointed a

representative under sub-article (1)(c), such person shall, for the

purposes of carrying out his functions under his appointment, have all

the powers and functions conferred on the competent authority by this

article and a requirement imposed by such person shall be deemed to

be and have the same force and effect as a requirement imposed by

the competent authority.

(1)

The competent authority may, whenever it deems it

necessary or expedient, appoint an inspector to investigate and report

on the affairs of any persons referred to in article 40(2).

(2)

An inspector appointed under sub-article (1)

(a)

may, if he deems it necessary or expedient for

the purposes of an investigation, investigate the affairs of any

person mentioned in sub-article (1);

(b)

shall have and may exercise all the powers

conferred on the competent authority by article 40, and any

MARKETS IN CRYPTO-ASSETS

requirement imposed by the said inspector shall be deemed to

be and have the same force and effect as a requirement of

the competent authority; and

(c)

may, and if so directed by the competent

authority shall, prepare and submit interim reports and, on the

conclusion of the investigation, a final report to the competent

authority.

(3)

In appointing an inspector under sub-article (1), the

competent authority may direct that the investigation shall be carried

out within such time and shall be limited to such specific or general

matters as the competent authority may deem fit.

(4)

For the purposes of this article, the inspectors may include

an advocate, a person authorised to carry out the profession of

accountant or auditor in accordance with the Accountancy Profession

Act, or a person considered by the competent authority as possessing

suitable expertise to exercise such function.

(5)

The competent authority shall have the power to order that

all expenses of, and incidental to an investigation carried out in

accordance with this article shall be paid by the persons referred to in

sub-article (1).

(1)

Any officer, employee or agent of the competent

authority, on producing evidence of his authority, if required, shall

have the power to enter any premises, other than the private residences

of natural persons, occupied by a person on whom a notice has been

served in accordance with article 40 or whose affairs are being

investigated in accordance with article 41, for the purpose of obtaining

therefrom the information or documents required by such notice, or for

the purpose of carrying out on-site inspections or investigations, and

of exercising any of the powers conferred by the said articles

Provided that the right of entry under this sub-article shall

also apply to private residences of natural persons where such entry is

necessary for the competent authority to fulfil its duties under Title

VI of the MiCA Regulation and Part VI.

(2)

Where any officer, employee or agent of the competent

authority has cause to believe that if the notice referred to in article 40

were to be served, it would not be complied with, or that any

documents to which it may relate would be removed, tampered with

or destroyed, such officer, employee or agent shall have the power, on

producing evidence of his authority, if required, to enter any premises

in accordance with sub-article (1) for the purpose of obtaining any

information or documents specified in the authority, being information

or documents that may have been required in accordance to such

notice as referred to in article 40.

(3)

For the purposes of any action taken in accordance with

the provisions of this article, the competent authority may request the

assistance of the Commissioner of Police, who may for such purpose

exercise such powers as are vested in him by law.

(1)

Without prejudice to any other power conferred upon

it by the MiCA Regulation, this Act or any other law, the competent

authority shall have the following powers

(a)

to suspend, or to require a crypto-asset service

provider to suspend the provision of crypto-asset services for a

maximum of thirty (30) consecutive working days on any single

occasion where there are reasonable grounds for suspecting any

of the provisions of the MiCA Regulation, this Act or any

regulations made, or Rules issued thereunder have been

breached;

(b)

to prohibit the provision of crypto-asset services

where the competent authority finds that any of the provisions

of the MiCA Regulation, this Act or any regulations made, or

Rules issued thereunder have been breached;

(c)

to disclose, or to require a crypto-asset servicer

provider to disclose, all material information which might have

an effect on the provision of the crypto-asset services

concerned, in order to ensure the protection of the interests of

clients, in particular retail holders, or the smooth operation of

the market;

(d)

to make public the fact that a crypto-asset service

provider failed or fails to fulfil its obligations;

(e)

to suspend, or to require a crypto-asset service

provider to suspend the provision of crypto-asset services

where the competent authority considers that the crypto-asset

service provider’s situation is such that the provision of the

crypto-asset service would be detrimental to the interests of

clients, in particular retail holders;

(f)

to require the transfer of existing contracts to

another crypto-asset service provider in cases where a crypto-

asset service provider’s authorisation is withdrawn in

accordance with Article 64 of the MiCA Regulation and article

30, subject to the agreement of the clients and the crypto-asset

service provider to which the contracts are to be transferred;

(g)

where there is a reason to assume that a person is

providing crypto-asset services without authorisation, to order

the immediate cessation of the activity without prior warning or

imposition of a deadline;

MARKETS IN CRYPTO-ASSETS

(h)

to require offerors, persons seeking admission to

trading of crypto-assets, or issuers of asset-referenced tokens or

e-money tokens to amend their crypto-asset white paper or

further amend their modified crypto-asset white paper, where

they find that the crypto-asset white paper or the modified

crypto-asset white paper does not contain the information

required by Article 6, Article 19 or Article 51 of the MiCA

Regulation, as applicable;

(i)

to require offerors, persons seeking admission to

trading of crypto-assets, or issuers of asset-referenced tokens or

e-money tokens, to amend their marketing communications,

where they find that the marketing communications do not

comply with the requirements set out in Article 7, Article 29 or

Article 53 of the MiCA Regulation, as applicable;

(j)

to require offerors, persons seeking admission to

trading of crypto-assets, or issuers of asset-referenced tokens or

e-money tokens, to include additional information in their

crypto-asset white papers, where necessary for financial

stability or the protection of the interests of the holders of

crypto-assets, in particular retail holders;

(k)

to suspend an offer to the public or an admission

to trading of crypto-assets for a maximum of thirty (30)

consecutive working days on any single occasion where there

are reasonable grounds for suspecting that any of the provisions

of the MiCA Regulation, this Act or any regulations made, or

Rules issued thereunder have been breached;

(l)

to prohibit an offer to the public or an admission

to trading of crypto-assets where the competent authority

finds that any of the provisions of the MiCA Regulation, this

Act or any regulations made, or Rules issued thereunder have

been breached or where there are reasonable grounds for

suspecting that they are going to be breached;

(m) to suspend, or require a crypto-asset service

provider operating a trading platform for crypto-assets to

suspend, trading of the crypto-assets for a maximum of thirty

(30) consecutive working days on any single occasion where

there are reasonable grounds for suspecting that any of the

provisions of the MiCA Regulation, this Act or any regulations

made, or Rules issued thereunder have been breached;

(n)

to prohibit trading of crypto-assets on a trading

platform for crypto-assets where the competent authority finds

that any of the provisions of the MiCA Regulation, this Act or

any regulations made, or Rules issued thereunder have been

breached or where there are reasonable grounds for suspecting

that they are going to be breached;

(o)

to suspend

or

prohibit

marketing

communications where there are reasonable grounds for

suspecting that any of the provisions of the MiCA

Regulation, this Act or any regulations made, or Rules issued

thereunder have been breached;

(p)

to require offerors, persons seeking admission to

trading of crypto-assets, issuers of asset-referenced tokens or e-

money tokens or relevant crypto-asset service providers to

cease or suspend marketing communications for a maximum of

thirty (30) consecutive working days on any single occasion

where there are reasonable grounds for suspecting that any of

the provisions of the MiCA Regulation, this Act or any

regulations made, or Rules issued thereunder have been

breached;

(q)

to make public the fact that an offeror, a person

seeking admission to trading of a crypto-asset or an issuer of an

asset-referenced token or e-money token, fails to fulfil its

obligations under the MiCA Regulation, this Act or any

regulations made, or Rules issued thereunder;

(r)

to disclose, or to require the offeror, the person

seeking admission to trading of a crypto-asset or the issuer of

the asset-referenced token or e-money token, all material

information which may have an effect on the assessment of the

crypto-asset offered to the public or admitted to trading in order

to ensure the protection of the interests of holders of crypto-

assets, in particular retail holders, or the smooth operation of

the market;

(s)

to suspend, or require the relevant crypto-asset

service provider operating the trading platform for crypto-assets

to suspend, the crypto-assets from trading where the competent

authority considers that the situation of the offeror, the person

seeking admission to trading of a crypto-asset or the issuer of an

asset-referenced token or an e-money token is such that trading

would be detrimental to the interests of the holders of crypto-

assets, in particular retail holders;

(t)

where there is a reason to assume that a person

is issuing asset-referenced tokens or e-money tokens without

authorisation, or a person is offering or seeking admission to

trading of crypto-assets other than asset-referenced tokens or e-

money tokens without a crypto-asset white paper notified in

accordance with Article 8 of the MiCA Regulation and articles

5 to 7, to order the immediate cessation of the activity without

prior warning or imposition of a deadline;

(u)

to take any type of measure to ensure that an

offeror or a person seeking admission to trading of crypto-

MARKETS IN CRYPTO-ASSETS

assets, an issuer of an asset-referenced token or an e-money

token or a crypto-asset service provider comply with the MiCA

Regulation, this Act and any regulations made, and Rules issued

thereunder including to require the cessation of any practice or

conduct that the competent authority considers contrary to the

MiCA Regulation, this Act or any regulations made, or Rules

issued thereunder;

(v)

to outsource verifications or investigations to

auditors or experts;

(w) to require the removal of a natural person from

the management body of an issuer of an asset-referenced token

or of a crypto-asset service provider;

(x)

to request any person to take steps to reduce the

size of its position or exposure to crypto-assets;

(y)

where no other effective means are available to

bring about the cessation of the breach of any of the provisions

of the MiCA Regulation, this Act or any regulations made, or

Rules issued thereunder and in order to avoid the risk of

serious harm to the interests of clients or holders of crypto-

assets, to take all necessary measures, including by requesting a

third party or a public authority to implement such measures to

(i)

remove content or restrict access to an

online interface or to order the explicit display of a

warning to clients and holders of crypto-assets when

they access an online interface;

(ii)

order a hosting service provider to

remove, disable or restrict access to an online interface;

or

(iii) order domain registries or registrars to

delete a fully qualified domain name and allow the

competent authority concerned to register it; and

(z)

to require an issuer of an asset-referenced token

or e-money token, in accordance with Articles 23(4), 24(3) or

58(3) of the MiCA Regulation, to introduce a minimum

denomination amount or to limit the amount issued.

(2)

The competent authority shall exercise any of its powers

under sub-article (1) in any of the following ways

(a)

directly;

(b)

in collaboration with other authorities, including

the Financial Intelligence Analysis Unit;

(c)

under its responsibility, by delegation to the

authority referred to in paragraph (b); or

(d)

by application to the competent courts.

(3)

Without prejudice to sub-article (1), in order to fulfil its

duties under Titles VI of the MiCA Regulation and Part VI the

competent authority shall also have the following powers

(a)

to refer matters for criminal prosecution;

(b)

to require existing data traffic records held by a

telecommunications operator, where there is a reasonable

suspicion of a breach and where such records may be relevant

to the investigation of an infringement of Articles 88 to 91 of

the MiCA Regulation;

(c)

to request the freezing or sequestration of assets,

or both;

(d)

to impose a temporary prohibition on the exercise

of professional activity; and

(e)

to take all necessary measures to ensure that the

public is correctly informed, inter alia, by correcting false or

misleading disclosed information, including by requiring an

offeror, person seeking admission to trading or issuer or other

person who has published or disseminated false or misleading

information to publish a corrective statement.

(1)

Where Malta is the host Member State, the

competent authority shall, where it has clear and demonstrable grounds

for suspecting that there are irregularities in the activities of an offeror

or person seeking admission to trading of crypto-assets, an issuer of

an asset-referenced token or e-money token, or a crypto-asset

service provider, notify the competent authority of the home

Member State and ESMA thereof

Provided that where the irregularities referred to in sub-

article (1) concern an issuer of an asset-referenced token or e-money

token, or a crypto-asset service related to asset-referenced tokens or

e-money tokens, the competent authority shall also notify EBA.

(2)

Where, despite the measures taken by the competent

authority of the home Member State the irregularities referred to in

sub-article (1) persist, amounting to a breach of the MiCA Regulation,

the competent authority shall, after informing the competent authority

of the home Member State, ESMA and, where appropriate, EBA in

accordance with sub-article (1), take appropriate measures in order to

protect clients of crypto-asset service providers and holders of crypto-

assets, in particular retail holders

MARKETS IN CRYPTO-ASSETS

Provided that the competent authority shall inform ESMA

and, where appropriate, the EBA of any measures taken in accordance

with this sub-article without undue delay.

(3)

The measures referred to in sub-article (2) shall include

preventing the offeror, the person seeking admission to trading, the

issuer of the asset-referenced token or e-money token or the crypto-

asset service provider from conducting further activities in Malta.

(1)

The competent authority may prohibit or restrict the

following in or from Malta

(a)

the marketing, distribution or sale of certain

crypto- assets or crypto-assets with certain specified features;

or

(b)

a type of activity or practice related to crypto-

assets.

(2)

The competent authority shall only take a measure in

accordance with sub-article (1) if it is satisfied on reasonable grounds

(a)

a crypto-asset gives rise to significant investor

protection concerns or poses a threat to the orderly functioning

and integrity of markets in crypto-assets or to the stability of the

whole or part of the financial system within at least one (1)

Member State;

(b)

existing regulatory requirements under European

Union law applicable to the crypto-asset or crypto-asset service

concerned do not sufficiently address the risks referred to in

paragraph (a) and the issue would not be better addressed by

improved supervision or enforcement of existing requirements;

(c)

the measure is proportionate, taking into account

the nature of the risks identified, the level of sophistication of

investors or market participants concerned and the likely effect

of the measure on investors and market participants who may

hold, use or benefit from the crypto-asset or crypto-asset

service concerned;

(d)

the competent authority has properly consulted

those European regulatory authorities that might be

significantly affected by the measure; and

(e)

the measure does not have a discriminatory effect

on services or activities provided from another Member State.

(3)

Without prejudice to sub-article (1), where the conditions

set out in sub-article (2) are fulfilled, the competent authority may

impose the prohibition or restriction referred to in sub-article (1) on a

precautionary basis before a crypto-asset has been marketed,

distributed or sold to clients.

(4)

Without prejudice to the provisions of sub-articles (1) and

(3), the competent authority may apply the prohibition or restriction

referred to in sub-article (1) only in certain circumstances or to make

such prohibition or restriction subject to exceptions.

(5)

The competent authority shall not impose a prohibition or

restriction under this article unless, not less than one (1) month before

the measure is intended to take effect, it has notified all the European

regulatory authorities and ESMA, or EBA for asset-referenced tokens

and e-money tokens, in writing or through another medium agreed

between the authorities, the following details

(a)

the crypto-asset or activity or practice to which

the proposed measure relates;

(b)

the precise nature of the proposed prohibition or

restriction and when it is intended to take effect; and

(c)

the evidence upon which it has based its

decision and upon which it is satisfied that each of the

conditions in sub- article (2) are met.

(6)

After receiving a notification, in accordance with sub-article

(5), of a prohibition or restriction to be imposed by the competent

authority in accordance with this article, ESMA or EBA, as

applicable, shall issue and publish an opinion in accordance with

Article 106(2) of the MiCA Regulation and, where the competent

authority proposes to impose, or imposes or declines to impose such a

prohibition or restriction contrary to an opinion issued by ESMA or

EBA, the competent authority shall immediately publish on its official

website a notice fully explaining its reasons therefor.

(7)

In exceptional cases where the competent authority

considers it necessary in order to prevent any detrimental effects

arising from the crypto-asset or activity or practice referred to in sub-

article (1), the competent authority may take an urgent measure, in the

form of a prohibition or restriction as referred to in sub-article (1), on

a provisional basis with not less than twenty-four (24) hours written

notice before the measure is intended to take effect to all the European

regulatory authorities and ESMA, provided that all of the criteria listed

in this article are met and, in addition, that it is clearly established that

a one (1) month notification period would not adequately address the

specific concern or threat

Provided that the duration of urgent measures taken on a

provisional basis in accordance with this sub-article shall not exceed

three (3) months.

MARKETS IN CRYPTO-ASSETS

(8)

The competent authority shall publish on its official website

a notice of a decision to impose a prohibition or restriction as referred

to in sub-article (1), which notice shall specify the details of the

prohibition or restriction imposed and specify a time after the

publication of the notice from which such prohibition or restriction

shall take effect and the evidence upon which the competent authority

has based its decision, and is satisfied that each of the conditions in

sub-article (2) is met.

(9)

Any prohibition or restriction imposed in accordance with

this article shall only apply to activities after such prohibition or

restriction takes effect.

(10) The competent authority shall revoke a prohibition or

restriction imposed in accordance with this article if the conditions in

sub-article (2) no longer apply.

(1)

Without prejudice to any other power conferred upon

it by the MiCA Regulation, this Act or any other law, the competent

authority may impose administrative penalties and other

administrative measures as referred to in sub-article (2) where it

considers that

(a)

a person’s conduct amounts to a breach of any

of the provisions of the MiCA Regulation, this Act or any

regulations made or Rules issued thereunder; and, or

(b)

a person has contravened or failed to comply

with any condition, obligation, requirement or directives made

or given by the competent authority under any of the provisions

of the MiCA Regulation, this Act or any regulations or Rules

issued thereunder, including failure to co-operate with an

investigation or an inspection or any request made by the

competent authority in accordance with article 40.

(2)

Without prejudice to the generality of sub-article (1), the

competent authority may impose administrative penalties and other

administrative measures as referred to in sub-article (2) in relation to

the following infringements

(a)

breaches of Articles 4 to 14 of the MiCA

Regulation and articles 5 to 8;

(b)

breaches of Articles 16, 17, 19, 22, 23, 25,

Articles 27 to 41, Articles 46 and 47 of the MiCA Regulation

and articles 9, 10, 15 to 18, 20 and 21;

(c)

breaches of Articles 48 to 51, Articles 53, 54

and 55 of the MiCA Regulation and articles 22 to 25;

(d)

breaches of Articles 59, 60, 64 and Articles 65 to

83 of the MiCA Regulation and articles 26, 27, 30, 32 and 33;

(e)

breaches of Article 88 of the MiCA Regulation

and article 35;

(f)

breaches of Articles 89 to 92 of the MiCA

Regulation and article 36; and, or

(g)

failure to cooperate or to comply with an

investigation, inspection, requirement or request as referred to in

Article 94(3) of the MiCA Regulation and, or articles 40, 41, 42

or 43(3).

(3)

Without prejudice to any other power conferred upon it by

the MiCA Regulation, this Act or any other law, the competent

authority shall have the power to

(a)

issue a public statement indicating the natural or

legal person responsible and the nature of the breach for any

breach as referred to in sub-article (1);

(b)

issue an order requiring the natural or legal

person responsible to cease the conduct constituting the

breach and to desist from a repetition of such conduct for any

breach as referred to in sub-article (1);

(c)

impose an administrative penalty for any breach

as referred to in sub-article (1), except for those referred to in

sub-article (2)(e) and (f), which administrative penalty may not

exceed twice the amount of the profits gained or losses

avoided because of the breach where those profits or losses

avoided can be determined, even if it exceeds the maximum

amounts set out in paragraph (d) or (e), as applicable;

(d)

impose, in the case of a natural person, an

administrative penalty which may not exceed

(i)

seven hundred thousand euro (€700,000)

for any breach as referred to in sub-article (1), except

for those referred to in sub-article (2)(e) and (f);

(ii)

one million euro (€1,000,000) for any

breach as referred to in sub-article (2)(e); or

(iii) five million euro (€5,000,000) for any

breach as referred to in sub-article (2)(f);

(e)

impose, in the case of a legal person, an

administrative penalty which may not exceed

(i)

five million euro (€5,000,000) for any

breach as referred to in sub-article (1), except for those

referred to in sub-article (2)(e) and (f);

MARKETS IN CRYPTO-ASSETS

(ii)

three per cent (3%) of the total annual

turnover of such legal person according to the last

available financial statements approved by the

management body for any breach as referred to in sub-

article (2)(a);

(iii) five per cent (5%) of the total annual

turnover of such legal person according to the last

available financial statements approved by the

management body for any breach as referred to in sub-

article (2)(d);

(iv) twelve point five per cent (12.5%) of the

total annual turnover of such legal person according to

the last available financial statements approved by the

management body for any infringement as referred to in

sub-article (2)(b) and (c);

(v) two million five hundred thousand euro

(€2,500,000) or two per cent (2%) of the total annual

turnover of such legal person according to the last

available accounts approved by the management body

for any breach as referred to in sub-article (2)(e); or

(vi) fifteen million euro (€15,000,000) or

fifteen per cent (15%) of the total annual turnover of

such legal person according to the last available

accounts approved by the management body for any

breach as referred to in sub-article (2)(f)

Provided that where the legal person referred to in

this paragraph is a parent undertaking or a subsidiary of a parent

undertaking which is required to prepare consolidated financial

statements in accordance with Directive 2013/34/EU, the

relevant total annual turnover shall be the total annual turnover

or the corresponding type of income in accordance with

applicable European Union law in the field of accounting

according to the last available consolidated accounts approved

by the management body of the ultimate parent undertaking;

(f)

impose, in the event of a breach as referred to in

sub-article (2)(d), a temporary ban preventing any member of

the management body of the crypto-asset service provider, or

any other natural person who is held responsible for the breach,

from exercising management functions in a crypto-asset service

provider; and, or

(g)

take the following administrative measures in the

case of a breach as referred to in sub-article (2)(e) and (f)

(i)

order the disgorgement of the profits

gained or losses avoided due to the breach insofar as

they can be determined;

(ii)

withdraw or suspend the authorisation

granted to a crypto-asset service provider in accordance

with Article 63 of the MiCA Regulation and article 28,

in accordance with provisions of the MiCA Regulation

and this Act;

(iii) order a temporary ban of any member of

the management body of the crypto-asset service

provider, or any other natural person who is held

responsible for the breach, from exercising management

functions in crypto-asset service providers;

(iv) in the event of a repeated breach of

Articles 89, 90, 91 or 92 of the MiCA Regulation or

article 36, impose a ban of at least ten (10) years for any

member of the management body of a crypto-asset

service provider, or any other natural person who is held

responsible for the breach, from exercising management

functions in a crypto-asset service provider;

(v)

impose a temporary ban of any member of

the management body of a crypto-asset service provider

or any other natural person who is held responsible for

the breach, from dealing on own account; and, or

(vi) impose an administrative fine which shall

not exceed at least three times the amount of the profits

gained or losses avoided because of the breach, where

those can be determined, even if it exceeds the maximum

amounts set out in paragraphs (d)(ii) and (iii) and

paragraph (e)(v) and (vi), as applicable.

(4)

When determining the type and level of the administrative

penalty to be imposed and, or any other administrative measure to be

taken in accordance with this article, the competent authority shall take

into account relevant circumstances, including where appropriate

(a)

the gravity and the duration of the breach;

(b)

whether the breach

has

been

committed

intentionally or negligently;

(c)

the degree of responsibility of the natural or

legal person responsible for the breach;

(d)

the financial strength of the natural or legal

person responsible for the breach, as indicated by the total

turnover of the responsible legal person or the annual income

MARKETS IN CRYPTO-ASSETS

and net assets of the responsible natural person;

(e)

the importance of the profits gained or losses

avoided by the natural or legal person responsible for the

breach, insofar as those can be determined;

(f)

the losses for third parties caused by the breach,

insofar as those can be determined;

(g)

the level of cooperation of the natural or legal

person responsible for the breach with the competent authority,

without prejudice to the need to ensure disgorgement of profits

gained or losses avoided by such person;

(h)

previous breaches of the MiCA Regulation, this

Act and, or any regulations made and, or Rules issued

thereunder by the natural or legal person responsible for the

breach;

(i)

measures taken by the person responsible for the

breach to prevent its repetition; and

(j)

the impact of the breach on the interests of

holders of crypto-assets and clients of crypto-asset service

providers, in particular retail holders.

(5)

Without prejudice to the provisions of this article, where

obligations imposed in terms of the MiCA Regulation, this Act, or in

any regulations made thereunder, or Rules issued thereunder apply to

a legal person, in the case of a breach of any provision thereof,

administrative penalties and other administrative measures may also

be imposed, subject to the conditions laid down in national law, on the

members of the management or administrative body of the legal entity

concerned, and on other individuals who are responsible for the breach

under national law.

(6)

Any administrative penalty imposed and or, any other

administrative measures taken by the competent authority in terms of

this article shall be effectively implemented.

(7)

The provisions of article 16(4) of the Malta Financial

Services Authority Act shall apply, mutatis mutandis, with respect to

any administrative penalty imposed by the competent authority in

terms of this article.

(8)

The imposition by the competent authority of an

administrative penalty or any other administrative measure in terms

of this article shall be without prejudice to any other consequence

emanating from the act or omission of the person committing the

breach in terms of civil or criminal law

Provided that in all cases where the competent authority

imposes an administrative penalty or any other administrative measure

in respect of anything done or omitted to be done by any person, and

such act or omission also constitutes a criminal offence, no

proceedings may be taken or continued against the said person in

respect of such criminal offence.

(1)

Where the competent authority proposes to impose

an administrative penalty or any other administrative measure on any

person in accordance with article 46, it shall give a notice in writing

of its intention to do so, specifying the reasons for the decision it

proposes to take.

(2)

Every notice given in accordance with sub-article (1) shall

specify that the recipient of the notice may, within such reasonable

period after the service thereof, as may be stated in the notice, make

representations in writing to the competent authority specifying the

reasons why the proposed decision should not be taken, and the

competent authority shall consider any representation so made before

reaching a final decision.

(3)

The competent authority shall as soon as practicable notify

its final decision in writing to any person to whom notice is to be

given in accordance with sub-article (1).

(1)

A decision imposing an administrative penalty and,

or taking other administrative measures for a breach of the MiCA

Regulation, this Act and, or any regulations made and, or Rules

issued thereunder in accordance with article 46 shall be published by

the competent authority on its official website without undue delay

after the natural or legal person subject to such decision has been

informed of the said decision

Provided that the publication referred to in this sub-article

shall include at least information on the type and nature of the breach

and the identity of the natural or legal persons responsible

Provided further that decisions imposing or taking measures

that are of an investigatory nature may not be published.

(2)

Where the publication of the identity of the legal entities,

or the identity or personal data of natural persons, is considered by

the competent authority to be disproportionate following a case-by-

case assessment conducted on the proportionality of the publication

of such data, or where such publication would jeopardise an ongoing

investigation, the competent authority shall take one of the following

actions

(a)

defer the publication of the decision to impose

an administrative penalty or other administrative measure until

the moment where the reasons for non-publication cease to

exist;

MARKETS IN CRYPTO-ASSETS

(b)

publish the decision to impose an administrative

penalty or other administrative measure on an anonymous basis

in a manner which is in conformity with national law, where

such anonymous publication ensures the effective protection of

the personal data concerned; or

(c)

not publish the decision to impose an

administrative penalty or other administrative measure in the

event that the options provided for in paragraphs (a) and (b) are

considered insufficient to ensure

(i)

that the stability of financial markets is

not jeopardised; and

(ii)

the proportionality of the publication of

such a decision with regard to measures which are

deemed to be of a minor nature

Provided that where the competent authority decides, in

accordance with paragraph (b), to publish an administrative penalty

or other administrative measure on an anonymous basis, the

publication of the relevant data may be deferred for a reasonable

period where it is foreseen that within that period the reasons for

anonymous publication will cease to exist.

(3)

Where the decision to impose an administrative penalty or

any other administrative measure is subject to appeal before a national

judicial, administrative or other authority, the competent authority

shall immediately also publish on its official website information on

the status of the appeal and on the outcome thereof, and any decision

annulling a preceding decision of the competent authority to impose an

administrative penalty or any other administrative measure shall also

be published.

(4)

The competent authority shall ensure that any publication

in accordance with this article remains on its official website for a

period of at least five (5) years after its publication

Provided that personal data contained in the publication

shall be kept on the official website of the competent authority only

for as long as is necessary for the purposes of public interest and

transparency.

PART VIII

APPEALS, OFFENCES AND CONFIDENTIALITY

(1)

For the purposes of this article, Tribunal means the

Financial Services the Tribunal established by article 21 of the Malta

Financial Services Authority Act.

(2)

Any person who feels aggrieved by a decision of the

competent authority in terms of this Act, or in any regulations made

thereunder, or the Rules issued thereunder, may appeal against such

decision to the Tribunal within such period and under such conditions

as etablished in article 21 of the Malta Financial Services Authority

Act.

(3)

Without prejudice to the provisions of sub-article (2), any

person who feels aggrieved by the competent authority’s failure to take

a decision in respect of an application for authorisation which contains

all the information required in accordance with the MiCA Regulation

and this Act within six (6) months from the date of submission of the

complete application, may appeal against such failure to decide to the

Tribunal within such period and under such conditions as established

in article 21 of the Malta Financial Services Authority Act.

(4)

An appeal against a decision of the competent authority

shall not suspend the operation of such decision

Provided that a decision of the competent authority to

withdraw an authorisation granted in accordance with the MiCA

Regulation and this Act shall not become operative until the

expiration of the period within which an appeal is filed in accordance

with this article and, in the case that an appeal is filed within such

period, the decision shall become operative on the date of the decision

of the Tribunal dismissing the appeal, or on the date on which the

appeal is abandoned, whichever is the earliest.

(5)

Subject to the provisions of this article, the provisions of

article 21 of the Malta Financial Services Authority Act shall apply,

mutatis mutandis, to appeals that may be brought before the Tribunal

in accordance with this article.

Consumer organisations having a legitimate interest in

protecting holders of crypto-assets may, in the interest of consumers

and in accordance with national law, take any such action before a

national judicial, administrative or other authority to ensure that the

provisions of the MiCA Regulation, this Act and any regulations

made, and Rules issued thereunder are applied.

(1)

Any person who

(a)

contravenes or fails to comply with any of the

provisions of Articles 16 or 59 of the MiCA Regulation or

articles 9, 26, 39(1), 40(1), 40(5) or 52(1), or of article 40(1) or

40(5) as applied in terms of article 41;

(b)

contravenes or fails to comply with any condition,

obligation, requirement, directive or order made or given in

accordance with any of the provisions of the MiCA Regulation,

this Act or any regulations made, or Rules issued thereunder;

MARKETS IN CRYPTO-ASSETS

(c)

for the purposes of, or in accordance with, any of

the provisions of the MiCA Regulation, this Act or any

regulations made, or Rules issued thereunder, or any condition,

obligation, requirement, directive or order made or given as

aforesaid, furnishes information or makes a statement which he

knows to be inaccurate, false or misleading in any material

respect, or recklessly furnishes information or makes a

statement which is inaccurate, false or misleading in any

material respect;

(d)

with intent to avoid detection of the commission

of an offence in accordance with this Act, removes, destroys,

conceals or fraudulently alters any book, document or other

paper; and, or

(e)

intentionally obstructs a person exercising rights

or powers conferred by the MiCA Regulation, this Act or any

regulations made, or Rules issued thereunder,

shall be guilty of an offence.

(2)

A natural person guilty of an offence under sub-article (1)

shall be liable, on conviction, to imprisonment for a term not

exceeding six (6) years, or to a fine (multa) not exceeding five million

euro (€5,000,000), or to both such fine and imprisonment, unless such

fine (multa) or term of imprisonment is otherwise imposed in

regulations made under this Act.

(3)

A legal person guilty of an offence under sub-article (1)

shall be liable, on conviction, to a fine (multa) not exceeding fifteen

million euro (€15,000,000), unless such fine is otherwise imposed in

regulations made under this Act.

(4)

The provisions of this Act or of any regulations made

thereunder shall not affect any criminal proceedings that may be

initiated under any other law.

(5)

The competent authority shall have the power to

(a)

liaise with the Commissioner of Police to receive

specific

information

related

to

criminal

investigations or proceedings commenced for

breaches of the MiCA Regulation, this Act or any

regulations made, and Rules issued thereunder. The

Commissioner of Police shall cooperate with the

competent authority, thereby providing such

specific information related to any criminal

investigations or proceedings commenced in

relation to such breaches; and

(b)

provide the same information received in

accordance with paragraph (a), and transmit copies

of acts and documents of the courts of criminal

justice in accordance with the second proviso to

article 518 of the Criminal Code, to other

authorities which are deemed competent authorities

for the purposes of Article 93 of the MiCA

Regulation, as well as to the EBA and ESMA, for

the purpose of fulfilling its obligations to cooperate

for the purposes of the MiCA Regulation, this Act

or any regulations made, and Rules issued

thereunder.

Information obtained by the competent authority or by its

officers, employees or agents, whether current or former, or by

inspectors, auditors and experts formerly or currently engaged by the

competent authority for the purposes of, or in accordance with, any of

the provisions of the MiCA Regulation, this Act or any regulations

made, or Rules issued thereunder, or in the discharge of any functions

under any of the said provisions, or by any other person who works,

or has worked for the competent authority, or for any third party to

whom the competent authority has delegated any of its functions or

powers, whether a natural or a legal person, shall be treated as

confidential and protected by the duty of professional secrecy, and

shall not be disclosed to any other person, except in the following

cases

(a)

where the authority, body or person

communicating the information to the competent authority

consents thereto;

(b)

where the disclosure of the information is

necessary for any legal proceedings;

(c)

where the disclosure of the information is

necessary for cases covered by national taxation or criminal

law; and, or

(d)

where the disclosure of the information is

permitted or required by law or European Union legislation.

(2)

The information referred to in sub-article (1) shall include

all information exchanged between the competent authority and

European regulatory authorities in accordance with the MiCA

Regulation, this Act or any regulations made, or Rules issued

thereunder that concerns business or operational conditions and other

economic or personal affairs.

The processing of personal data for the purposes of the

MiCA Regulation, this Act or any regulations made, or Rules issued

thereunder shall be carried out in accordance with the Data Protection

MARKETS IN CRYPTO-ASSETS

Act and the GDPR.

PART IX

COOPERATION WITH OTHER AUTHORITIES

(1)

The competent authority shall cooperate with

European regulatory authorities whenever necessary for the purpose

of carrying out its duties and exercising its powers under the MiCA

Regulation, and it shall render the necessary assistance to other

European regulatory authorities, in particular by exchanging

information and cooperating in any investigatory, supervisory or

enforcement activity.

(2)

A European regulatory authority may request information

from the competent authority, in which case the competent authority

shall without undue delay, provide the requested information required

for the purposes of the MiCA Regulation.

(3)

A European regulatory authority may request the

cooperation of the competent authority in carrying out an on-site

inspection or investigation, in which case the competent authority

may

(a)

carry out the on-site inspection or investigation

itself;

(b)

allow the European regulatory authority which

submitted the request to participate in the on-site inspection or

investigation;

(c)

allow the European regulatory authority which

submitted the request to carry out the on-site inspection or

investigation itself; or

(d)

share specific tasks related to supervisory

activities with European regulatory authorities.

(4)

Notwithstanding the provisions of sub-articles (1) to (3),

the competent authority may refuse to act on the request of a European

regulatory authority for information or to cooperate with an

investigation in any of the following cases

(a)

communication of the relevant information may

adversely affect the security of Malta, in particular with regard

to the fight against terrorism and other serious crimes;

(b)

where complying with the request is likely to

adversely affect its own investigation, enforcement activities or,

where applicable, a criminal investigation;

(c)

when proceedings have already been initiated in

respect of the same actions and against the same natural or legal

persons before the courts of Malta; or

(d)

where a final judgment has already been delivered

in respect of the same action and against the same natural or

legal person in Malta.

(5)

Where the competent authority finds that any of the

requirements under the MiCA Regulation have not been met or has

reason to believe so, it shall inform the European regulatory authority

of the entity suspected of such breach of its findings in a sufficiently

detailed manner.

(1)

For the purposes of the MiCA Regulation, the

competent authority shall cooperate closely with ESMA in accordance

with Regulation (EU) No. 1095/2010 and with the EBA in accordance

with Regulation (EU) No. 1093/2010, and it shall exchange

information with ESMA and the EBA for the purposes of the duties

which shall be carried out by the competent authority, ESMA and the

EBA under Chapters 1 to 3 of Title VII of the MiCA Regulation.

(2)

The competent authority shall, without delay, provide the

EBA and ESMA with all the information necessary for them to

perform their duties, in accordance with Article 35 of Regulation

(EU) No. 1093/2010 and Article 35 of Regulation (EU) No. 1095/2010

respectively.

When an offeror, person seeking admission to trading, an

issuer of an asset-referenced token or e-money token or a crypto-asset

service provider engages in activities other than those covered by the

MiCA Regulation, the competent authority shall cooperate with the

authorities responsible for the supervision or oversight of such other

activities pursuant to European Union or national law, including tax

authorities and relevant supervisory authorities of third countries.

(1)

The competent authority shall, where necessary,

conclude cooperation arrangements with supervisory authorities of

third countries concerning the exchange of information with those

supervisory authorities of third countries and the enforcement of

obligations in accordance with the MiCA Regulation, this Act and

any regulations made, and Rules issued thereunder in those third

countries

Provided that the competent authority shall inform the EBA,

ESMA and all the European regulatory authorities when it intends to

conclude an arrangement as referred to in this sub-article.

(2)

The cooperation arrangements referred to in sub-article (1)

shall ensure at least an efficient exchange of information that allows

the competent authority to carry out its duties under the MiCA

Regulation, this Act and any regulations made, and Rules issued

thereunder.

MARKETS IN CRYPTO-ASSETS

(3)

The competent authorities shall conclude cooperation

arrangements as referred to in sub-article (1) only when the

information disclosed is subject to guarantees of professional secrecy

that are at least equivalent to those set out in Article 100 of the MiCA

Regulation and provided that the exchange of information shall be

intended for the performance of the tasks of the competent authority

under the MiCA Regulation.

PART X

TRANSITORY PROVISIONS

(1)

Articles 4 to 15 of the MiCA Regulation and articles

5 to 8 shall not apply to offers to the public of crypto-assets that

ended before 30 December 2024.

(2)

Notwithstanding the provisions of Title II of the MiCA

Regulation and Part II of this Act, only the following requirements

shall apply in relation to crypto-assets other than asset-referenced

tokens and e-money tokens that were admitted to trading before 30

December 2024

(a)

Articles 7 and 9 of the MiCA Regulation shall

apply to marketing communications published after 30

December 2024; and

(b)

operators of trading platforms shall by 31

December 2027, ensure that a crypto-asset white paper, in the

cases required by the MiCA Regulation and this Act, is drawn

up, notified and published in accordance with Articles 6, 8 and

9 of the MiCA Regulation, and updated in accordance with

Article 12 of the MiCA Regulation.

(3)

Crypto-asset service providers may continue to provide, or

hold themselves out as providing, the VFA services which they are

licensed to provide under the Virtual Financial Assets Act in

accordance with the provisions of the said Act and any regulations

made, and Rules issued thereunder until 1 July 2026 or until they are

granted or refused an authorisation pursuant to Article 63 of the MiCA

Regulation, whichever comes first.

(4)

Notwithstanding the provisions of Articles 62 and 63 of

the MiCA Regulation and articles 28 and 29, the competent authority

shall apply a simplified procedure for applications submitted by

crypto-asset service providers in accordance with Article 62(1) of the

MiCA Regulation and article 28(2) between 30 December 2024 and

1 July 2026

Provided that the competent authority shall ensure that the

provisions of Chapters 2 and 3 of Title V of the MiCA Regulation are

complied with before granting authorisation pursuant to such

simplified procedure.

(5)

For the purposes of this article, "crypto-asset service

providers" means persons who, on 30 December 2024, are licensed in

accordance with the Virtual Financial Assets Act to provide, or hold

themselves out as providing, one or more VFA services, as defined

in the said Act.

PART XI

AMENDMENTS TO THE BANKING ACT

This Part amends the Banking Act and it shall be read and

construed as one with the Banking Act, hereinafter in this Part referred

to as the "principal Act".

In sub-article (1) of article 2 of the principal Act,

immediately after the definition "Member State" there shall be added

the following new definition

" "MiCA Regulation" means Regulation (EU) 2023/

1114 of the European Parliament and of the Council of 31 May

2023 on markets in crypto-assets, and amending Regulations

(EU) No. 1093/2010 and (EU) No. 1095/2010 and Directives

2013/36/EU and (EU) 2019/1937, as may be amended from

time to time, and includes any binding legal instruments,

guidelines and other measures that have been or may be issued

thereunder;".

The First Schedule to the principal Act shall be amended

as follows

(a)

item 13 thereof shall be substituted by the

following new item

"13. Issuing electronic money including

electronic money tokens as defined in point (7) of

Article 3(1) of the MiCA Regulation;"; and

(b)

immediately after item 13 thereof, as substituted,

there shall be added the following new items

"14. Issuing of asset-referenced tokens as

defined in point (6) of Article 3(1) of the MiCA

Regulation;

15. Crypto-asset services as defined in point

(16) of Article 3 of the MiCA Regulation.".

PART XII

AMENDMENTS TO THE VIRTUAL FINANCIAL ASSETS ACT

This Part amends the Virtual Financial Assets Act and it

shall be read and construed as one with the Virtual Financial Assets

Act, hereinafter in this Part referred to as the "principal Act".

MARKETS IN CRYPTO-ASSETS

Immediately after article 64 of the principal Act there shall

Addition of new

articles to the

be added the following new articles

principal Act.

(1)

Where a person has made, either

"Further

transitory

directly or through a VFA agent, a request to the

provisions

competent authority to register a white paper in

relating to white

papers.

accordance with article 3(4) prior to the first date of





coming into force of the Markets in Crypto-Assets



Act and the competent authority has not yet

Act No. XXXVI

determined, in terms of the said article, whether or not

of 2024.

to register that white paper by such date, the said

person shall notify the competent authority in writing,

whether it wishes to proceed with its request for the

registration of the white paper or whether it wishes to

withdraw the said request



Provided that, where such person does not



notify the competent authority, in accordance with this





sub-article, within one (1) month from the first date of



coming into force of the Markets in Crypto-Assets

Act No. XXXVI

Act the competent authority shall deem the request

of 2024.

made by such person to have been withdrawn.

(2)

Notwithstanding the provisions of this Act,

and any regulations made, and rules issued thereunder,

requests for the registration of white papers in

accordance with article 3(4) may not be made to, and

in any case shall not be accepted by the competent

authority as from 1 August 2024.

(3) Any whitepaper relating to an e-money token

which is registered by the competent authority under

this Act shall be deemed to have automatically been

deregistered on 30 June 2024.

(4) Any whitepaper relating to a virtual financial

asset other than an e-money token or an asset-

referenced token which is registered by the competent

authority under this Act shall automatically be

deregistered on 30 December 2024.

(5) The provisions of articles 3 to 13 shall cease to

have effect as from 30 December 2024.

MARKETS IN CRYPTO-ASSETS

(1)

Persons who, on 30 December 2024,

Further

transitory

are licensed under this Act to provide, or hold

provisions

themselves out as providing, one or more VFA

relating to the

provision of

services may continue to provide, or hold themselves

VFA services.

out as providing, those services in accordance with

the applicable provisions of the said Act and any

regulations made, and rules issued thereunder, until 1

July 2026 or until they are granted or refused an

authorisation pursuant to Article 63 of the MiCA

Regulation, whichever comes first.

(2)

Without prejudice to article 21, any licence

granted to a person under this Act shall automatically

be cancelled on 2 July 2026 or upon the granting or

refusal of an authorisation pursuant to Article 63 of

the MiCA Regulation to such person, whichever

c o m e s f i r s t .".

64. The principal Act shall be repealed on 3 July 2026 without

Repeal of the

principal Act.

prejudice to anything done or omitted to be done thereunder.