Credit institutions, central securities depositories authorised under Regulation (EU) No 909/2014, investment firms, electronic money institutions, UCITS management companies, alternative investment fund managers and market operators may provide specified crypto‑asset services in the Union if they notify their home competent authority of the information set out in paragraph 7 at least 40 working days before first providing those services. Services covered include custody and administration, transfer services, operation of trading platforms, exchange, dealing, execution, placement, reception and transmission of orders, advice and portfolio management where those activities are deemed equivalent to the relevant EU regimes.

Paragraph 7 requires a programme of operations and disclosures including AML compliance arrangements, risk assessment, business continuity, ICT and security documentation, client segregation, custody policy, trading rules and market‑abuse detection, pricing methodology, execution policy, staff competence evidence, token classification and transfer arrangements. Competent authorities must assess completeness within 20 working days and may request missing information with a further deadline not exceeding 20 working days (suspending the 40‑day period); services may not commence while notification is incomplete. Previously submitted identical information need not be resubmitted; Articles 62, 63, 64, 67, 83 and 84 do not apply. Rights are revoked on withdrawal of the underlying authorisation. Competent authorities shall transmit verified information to ESMA for publication; ESMA, in cooperation with EBA, shall submit draft RTS and ITS by 30 June 2024 for Commission adoption.