72e8db5c-e168-4f4e-9b5a-aaf2f6007ef5_en?filename=240903-letter-esma-mica-crypto-asset-service-provider_en.pdf

Here are the key points summarized in English:

The European Commission intends to endorse a draft Regulatory Technical Standard (RTS) submitted by the European Securities and Markets Authority (ESMA), with changes. The reasons for these changes include:

• Clarifying the exhaustive list of information required for the personal history of management body members.
• Limiting criminal record requests to relevant information for authorisation assessment.

Regarding Article 9(b) of the draft RTS, which concerns ICT systems and related security arrangements:

• The Commission suggests amending this article to provide that a cybersecurity audit, if available, should be included, but not mandatorily.
• The current requirement for a vulnerability assessment, penetration tests, and configuration approaches is too broad and links it with threat-led penetration testing, which is regulated separately under the Digital Operational Resilience Act (DORA).

The Commission will adopt the RTS once ESMA makes the necessary modifications.