(a)

information on the applicant issuer’s business activities, including:

(b)

description of the business environment where the applicant issuer will operate, focusing on the crypto-asset and payment sectors, including:

(c)

description of the applicant issuer’s overall business strategy and, where the applicant issuer belongs to a group, the overall group strategy, including:

(a)

forecast accounting plans for the three years following the granting of authorisation, including:

(b)

an explanation linking the elements of the programme of operations set out in Article 3(2) with the forecasts referred to in point (a) of this paragraph;

(c)

planning assumptions for the forecasts referred to in point (a), including the expected number of token holders, the expected number and value of transactions per day and the expected average number and average aggregate value of transactions per day for the business plan time horizon, profitability drivers, and explanations of the quantitative information set out in that business plan;

(d)

calculations of the applicant issuer’s own funds requirements pursuant to Article 35(1) of Regulation (EU) 2023/1114 covering the three-year business plan time horizon;

(e)

supporting evidence (including audited financial statement, or extract from the companies register) of the issued capital, paid-up capital and capital which has not yet been paid-up, including:

(f)

forecast calculations of the amount and composition of the reserve of assets and their adequacy to ensure the permanent exercise of the redemption rights throughout the business plan time horizon.

(a)

statutory financial statements of the applicant issuer, at individual level and, where applicable, at consolidated and sub-consolidated level, approved by the statutory auditor, where applicable, or external audit firm, covering at least the last three financial years preceding the application for authorisation, including:

(b)

an outline of any indebtedness incurred or expected to be incurred by the applicant issuer prior to the offer to the public or the admission to trading of the asset-referenced token, including, where applicable, the name of the lenders, the maturities and terms of such indebtedness, the use of the proceeds and, where the lender is not a supervised financial institution, information on the origin of the funds borrowed or expected to be borrowed;

(c)

an outline of any security interests, guarantees or indemnities granted or expected to be granted by the applicant issuer prior to the offer to the public or the admission to trading of the asset-referenced tokens;

(d)

where available, information about the credit rating of the applicant issuer and, where applicable, the overall rating of any group it be a part of;

(e)

where the applicant issuer has been set-up for less than three years, for the years not covered by financial statements, an updated summary dated as close as possible to the date of application for authorisation, of the applicant issuer’s financial situation and for the shareholders or members with qualifying holdings the financial statements of the previous three years in case of legal persons or their tax declaration in case of natural persons.

(a)

the organisational chart laying down the operational structure in terms of business lines and units and related allocation of staff, the interactions between the applicant issuer’s various functions, the indication of clear and effective reporting lines and allocation of responsibilities reflecting the applicant issuer’s business activities;

(b)

the terms of reference of the management body, with a mapping of the roles, duties and reporting lines of each member;

(c)

a detailed and comprehensive description of the foreseen number and profile of human resources, including seniority, skills, expertise of those, and technical resources, including specific features and functions, up-to-datedness, innovative character with an explanation of the adequacy of human and technical resources to implement the business plan;

(d)

detailed description of the procedures and arrangements to ensure the accurate and timely reporting of data relating to the asset-referenced token;

(e)

a description of the code of conduct laying down the applicant issuer’s ethical and professional corporate values and the risk culture;

(f)

a description of the complaints handling procedures as referred to in Article 31 of Regulation (EU) 2023/1114 and in accordance with Commission Delegated Regulation (EU) 2025/293 (12);

(g)

a description of the conflicts of interest policy as referred to in Article 32 of Regulation (EU) 2023/1114, and in accordance with Commission Delegated Regulation establishing regulatory technical standards adopted pursuant to Article 32(5) of Regulation (EU) 2023/1114;

(h)

a description of the procedures ensuring that the applicant issuer will comply with all the disclosure requirements towards the holders of the asset-referenced token set out in Article 30 of Regulation (EU) 2023/1114;

(a)

the rationale for the use of a third-party service provider to support or perform critical or important functions;

(b)

the location of the third-party service provider and where applicable the location where the data are stored or processed;

(c)

the human, financial and technical resources of the third-party service provider related to critical or important functions;

(d)

the applicant issuer’s internal control system for monitoring and managing the arrangement with the third-party provider;

(e)

the business continuity plans in the event that the third-party service provider cannot provide continuity of service;

(f)

the content of the contractual arrangements regarding the obligation to ensure information access and inspection and audit rights to both the applicant issuer and the competent authority;

(g)

the reporting line to the management body.

(a)

a comprehensive description of the internal compliance function as part of the internal control mechanism according to Article 34(10) of Regulation (EU) 2023/1114 having sufficient authority, stature, resources and direct access to the management body;

(b)

a comprehensive description of the risk management framework, and of the risk management function where it is established, or where in accordance with proportionality in terms of size, complexity and risk profile, it is entrusted to a third-party provider, of the related third-party arrangements in accordance with Article 4(2);

(c)

a comprehensive description of the risk management systems and controls, explaining the applicant issuer’s strategy for identifying, assessing, monitoring, mitigating and reporting all risks the applicant issuer is or might be exposed to, including risks to the holders of an asset-referenced token, market, liquidity, concentration, operational, ICT, reputational, legal, conduct, compliance, ESG, money laundering and terrorism financing and strategic risks;

(d)

a comprehensive description of the internal audit function as part of the internal control mechanism according to Article 34(10) of Regulation (EU) 2023/1114 where that is established, or, where in accordance with proportionality in terms of size, complexity and risk profile of the activities of the issuer applicant, that mechanism has been entrusted to a third party provider, a comprehensive description of the arrangements with the third-party that shall include all of the elements referred to in Article 4(2), points (a) to (g) of this Regulation, as well as the name and contact details of the external auditor appointed;

(e)

an explanation of the governance arrangements implemented to ensure the separation and adequate segregation of duties of the business lines and units from the internal control functions as part of the internal control mechanism according to Article 34(10) of Regulation (EU) 2023/1114, and an explanation of the arrangements implemented to ensure the independence of the internal control functions, including through their direct access to the management body in its management and in its supervisory function.

(a)

a detailed technical documentation including a description of the ICT risk management framework in accordance with Article 6(1) of Regulation (EU) 2022/2554, demonstrating the applicant issuer’s ability to address ICT risk rapidly, efficiently and comprehensively and to ensure a high level of digital operational resilience;

(b)

details showing that the applicant issuer maintains updated ICT systems, protocols and tools that are appropriate, reliable, equipped with sufficient capacity to accurately process the data necessary for the performance of activities and the timely provision of services, and technologically resilient in accordance with Article 7 of Regulation (EU) 2022/2254;

(c)

a detailed description of the security policy demonstrating that the applicant issuer’s systems and procedures are capable to protect the availability, authenticity, integrity and confidentiality of data, information assets and ICT assets, including those of their customers in accordance with Article 9(4) of Regulation (EU) 2022/2554;

(d)

a comprehensive description of the ICT process and systems showing the ability to provide the applicant issuer with reliable information and data to support data reporting requirements.

(a)

the mapping of the essential data and functions;

(b)

an overview of available back-up and recovery systems;

(c)

a description of the availability of key staff in business continuity situations in accordance with Article 34(8) of Regulation (EU) 2023/1114 and Article 11(1) of Regulation (EU) 2022/2554.

(a)

the description of the applicant issuer’s legal title towards the DLT or similar technology, whether it is right of property or other contractual relationships providing control of the distributed ledger technology or of the similar technology to the applicant issuer, irrespective of the circumstance that the DLT is operated by a different undertaking;

(b)

the name and contact details of the operator or operators of the DLT, if different from the applicant issuer;

(c)

the applicant issuer’s or third-party operator’s plan on risk identification, monitoring, assessment, mitigation, and prevention, also having regard to the potential spill-over to other crypto-assets issued, transferred or stored on that DLT and the related crypto-asset service providers, and the plan on the regular technological maintenance and update of the DLT or of similar technology;

(d)

a technical and security audit report on the consistency of the DLT functioning with quality standards in use in the market, and on the appropriateness and adequacy of the plans referred to in point (c);

(e)

in case the proprietary DLT is permissioned, a detailed description of the transparency mechanisms.

(a)

the comprehensive and detailed framework illustrating the constitution, composition, management, and segregation of the reserve of assets, in accordance with Commission Delegated Regulation establishing technical standards adopted pursuant to Article 36(4) of Regulation (EU) 2023/1114;

(b)

the clear and detailed policy describing the stabilisation mechanism of the asset-referenced token for which the authorisation is sought, in accordance with Article 36(8) of Regulation (EU) 2023/1114;

(c)

the name of the external consultant that will be in charge of the independent audit on the reserve of assets every six months in accordance with Article 36(9) of Regulation (EU) 2023/1114;

(d)

the detailed policy and procedures on the custody of the reserve of assets, including the selected custody modality, ensuring compliance with Article 37 of Regulation (EU) 2023/1114;

(e)

the clear and detailed investment policy of the reserve of assets in accordance with Commission Delegated Regulation establishing technical standards adopted pursuant to Article 38(5) of Regulation (EU) 2023/1114;

(f)

the details of the contractual arrangements entered into with third parties for the operation, the investment and the custody of the reserve of assets, in accordance with the policies referred to in points (d) and (e).

(a)

a clear and detailed policy and procedures ensuring the respect of the rights of redemption granted to the holders of the asset-referenced token in accordance with Article 39 of Regulation (EU) 2023/1114;

(b)

an outline of the recovery plan to be developed in accordance with Article 46 of Regulation (EU) 2023/1114;

(c)

the redemption plan to be submitted in accordance with Article 47 of Regulation (EU) 2023/1114.

(a)

full name and, where different, name at birth;

(b)

place and date of birth, address and contact details of the current place of residence, nationality or nationalities, and personal identification number or copy of an ID card or equivalent;

(c)

details of the position held or to be held, including whether the position is executive or non-executive, the start date or planned start date and, where applicable, the duration of the mandate, and a description of the key duties and responsibilities;

(d)

a curriculum vitae containing details of education and experience, including professional experience, academic qualifications, other relevant training, including the name and nature of all organisations for which the person has worked and the nature and duration of the functions performed, in particular highlighting any activities, within the scope of the position sought, relevant to financial services, crypto-assets, or other digital assets, DLT, information technology, cybersecurity, digital innovation or management experience;

(e)

personal history, including all the following, in respect of the nationality or nationalities held by the person, and of the person’s places of residence of the last 10 years if different from the country of nationality or nationalities:

(f)

a description of all financial and non-financial interests that could create potential material conflicts of interest affecting the perceived trustworthiness of the person concerned in the performance of the mandate as member of the management body of the applicant issuer, including:

(g)

information on the ability to commit sufficient time to perform their duties in the applicant issuer, including:

(a)

the relevant board minutes;

(b)

the decision on the suitability assessment;

(c)

where the person concerned has been assessed as not having the experience required, and provided that the minimum experience required is met, details of the training plan imposed, including the content, provider and date by which the training plan has been or will be completed.