(a)

a comprehensive description of the internal compliance function as part of the internal control mechanism according to Article 34(10) of Regulation (EU) 2023/1114 having sufficient authority, stature, resources and direct access to the management body;

(b)

a comprehensive description of the risk management framework, and of the risk management function where it is established, or where in accordance with proportionality in terms of size, complexity and risk profile, it is entrusted to a third-party provider, of the related third-party arrangements in accordance with Article 4(2);

(c)

a comprehensive description of the risk management systems and controls, explaining the applicant issuer’s strategy for identifying, assessing, monitoring, mitigating and reporting all risks the applicant issuer is or might be exposed to, including risks to the holders of an asset-referenced token, market, liquidity, concentration, operational, ICT, reputational, legal, conduct, compliance, ESG, money laundering and terrorism financing and strategic risks;

(d)

a comprehensive description of the internal audit function as part of the internal control mechanism according to Article 34(10) of Regulation (EU) 2023/1114 where that is established, or, where in accordance with proportionality in terms of size, complexity and risk profile of the activities of the issuer applicant, that mechanism has been entrusted to a third party provider, a comprehensive description of the arrangements with the third-party that shall include all of the elements referred to in Article 4(2), points (a) to (g) of this Regulation, as well as the name and contact details of the external auditor appointed;

(e)

an explanation of the governance arrangements implemented to ensure the separation and adequate segregation of duties of the business lines and units from the internal control functions as part of the internal control mechanism according to Article 34(10) of Regulation (EU) 2023/1114, and an explanation of the arrangements implemented to ensure the independence of the internal control functions, including through their direct access to the management body in its management and in its supervisory function.

(a)

a detailed technical documentation including a description of the ICT risk management framework in accordance with Article 6(1) of Regulation (EU) 2022/2554, demonstrating the applicant issuer’s ability to address ICT risk rapidly, efficiently and comprehensively and to ensure a high level of digital operational resilience;

(b)

details showing that the applicant issuer maintains updated ICT systems, protocols and tools that are appropriate, reliable, equipped with sufficient capacity to accurately process the data necessary for the performance of activities and the timely provision of services, and technologically resilient in accordance with Article 7 of Regulation (EU) 2022/2254;

(c)

a detailed description of the security policy demonstrating that the applicant issuer’s systems and procedures are capable to protect the availability, authenticity, integrity and confidentiality of data, information assets and ICT assets, including those of their customers in accordance with Article 9(4) of Regulation (EU) 2022/2554;

(d)

a comprehensive description of the ICT process and systems showing the ability to provide the applicant issuer with reliable information and data to support data reporting requirements.

(a)

the mapping of the essential data and functions;

(b)

an overview of available back-up and recovery systems;

(c)

a description of the availability of key staff in business continuity situations in accordance with Article 34(8) of Regulation (EU) 2023/1114 and Article 11(1) of Regulation (EU) 2022/2554.

(a)

the description of the applicant issuer’s legal title towards the DLT or similar technology, whether it is right of property or other contractual relationships providing control of the distributed ledger technology or of the similar technology to the applicant issuer, irrespective of the circumstance that the DLT is operated by a different undertaking;

(b)

the name and contact details of the operator or operators of the DLT, if different from the applicant issuer;

(c)

the applicant issuer’s or third-party operator’s plan on risk identification, monitoring, assessment, mitigation, and prevention, also having regard to the potential spill-over to other crypto-assets issued, transferred or stored on that DLT and the related crypto-asset service providers, and the plan on the regular technological maintenance and update of the DLT or of similar technology;

(d)

a technical and security audit report on the consistency of the DLT functioning with quality standards in use in the market, and on the appropriateness and adequacy of the plans referred to in point (c);

(e)

in case the proprietary DLT is permissioned, a detailed description of the transparency mechanisms.