Reporting obligations for CASPs
Crypto service providers have a reporting obligation in certain areas.
What reports do CASPs have to make?
CASPs with a license or notification from the AFM should take the following reporting obligations into account:
- Reporting of suspicious transactions and/or orders (STOR)
- Reporting obligation under the Sanctions Act 1977 and/or European regulations regarding sanctions
- Reporting obligation under TFR
- Reporting of ICT incidents (DORA)
- Obligation to report material changes
STORs
CASPs with reporting obligations under Article 92 of MiCAR are required to report suspicious transactions and/or orders at the AFM. CASPs must report STORs (suspicious transactions and/or orders reports) via the AFM portal. We have written an instruction manual for reporting a STOR.
Sanctions Act
CASPs with reporting responsibilities based on Article 3 of the Regulation on Supervision pursuant to the Sanctions Act 1977 (Regeling toezicht Sanctiewet 1977) and/or European regulations regarding sanctions must report a Sanction Hit via the Report Form Sanctions Act 1977 (Meldformulier Sanctiewet 1977). The report form should be sent to meldingsanctiewet@afm.nl via Cryptshare. More information about the Sanction Act 1977.
Transfer of Funds Regulation
CASPs with reporting responsibilities based on Article 17(2) and/or Article 21(2) Transfer of Funds Regulation (TFR) must report via the Report Form TFR (Meldformulier TFR). The report form should be sent to crypto@afm.nl via Cryptshare.
ICT-related incidents (DORA)
As part of DORA, CASPs must report serious ICT-related incidents, (new) agreements with ICT service providers, and cyber threats to the AFM. CASPs must submit notifications through the AFM Portal. The 'DORA' button in the portal provides access to the section (the 'DORA app') where you can submit DORA notifications, view the status and response from AFM, and possibly withdraw them. More information about DORA notifications and frequently asked questions DORA.
Obligation to report material changes
CASPs must immediately inform the AFM (in writing) of any material change in the circumstances under which the licence was granted. This concerns changes to the information provided with the licence application. This may include changes in the company’s business operations, discontinuation of certain crypto asset services, and changes in shareholders.
Other examples include a change of the company’s name, amendments to the articles of association or legal form, outsourcing or termination of outsourced activities. Changes relating to information provided during the licensing process must be reported via the email address crypto@afm.nl.
Obligation to report changes in the management body
If changes in the composition of your company’s management body are planned, such as the appointment or resignation of day to day policymakers, you must notify the AFM without delay and in advance. The proposed change may only be implemented after the AFM has given its approval.
We kindly request that such proposed changes be submitted by email to crypto@afm.nl, including the relevant details of the individuals involved. A copy of this notification will be shared with the department responsible for ongoing supervision.
When registering a new member of the management body, please provide the required information and documentation for assessing their integrity and suitability. Consult the webpage Forms for an overview of the documents you must submit.
The AFM has a review period of 4 months, which may be extended to a maximum of 6 months, to assess the proposed change. Please remember that there is an ongoing obligation to maintain a collective management body with adequate competence at all times.
Obligation to report changes in antecedents
If there is a change in the antecedents of a member of the management body, you must notify the AFM of this without delay and in writing.
The notification must be made using the 'Notification form - change in antecedents'. Please complete the form, sign it, and attach any relevant supporting documents. A copy of this notification will be shared with the department responsible for ongoing supervision. You can then send the documentation to crypto@afm.nl.
Important: failing to report relevant facts may itself be considered an antecedent and may affect the assessment of integrity. In case of doubt, it is advised to report the change.