EBA MiCA Fines Framework: Calculating Your VASP's Exposure Threshold

The European Banking Authority's (EBA) MiCA Fines Framework establishes a clear structure for penalties that Virtual Asset Service Providers (VASPs) may face for non-compliance with the Markets in Crypto-Assets (MiCA) Regulation. Calculating your VASP's exposure threshold under this framework involves understanding the types of violations, the severity of potential breaches, and the specific criteria the EBA will use to determine fines.

Understanding the MiCA Fines Framework

MiCA, or the Markets in Crypto-Assets Regulation, is a landmark piece of legislation designed to bring comprehensive regulatory oversight to the crypto-asset market within the European Union (EU). It aims to protect consumers and investors, ensure market integrity, and foster financial stability. For VASPs, compliance with MiCA is not optional; it's a prerequisite for operating legally within the EU.

The EBA, in collaboration with national competent authorities, is responsible for developing the technical standards and guidelines that underpin MiCA's implementation, including the MiCA Fines Framework. This framework outlines the criteria for assessing administrative penalties and remedial measures, ensuring a harmonized approach across member states.

Key Principles of the Framework

The EBA's framework emphasizes proportionality, effectiveness, and dissuasiveness. This means fines should be:

• Proportionate: Reflecting the severity and duration of the breach, the financial strength of the VASP, and the impact on consumers or market integrity.
• Effective: Capable of achieving their intended purpose, which is to encourage compliance and punish non-compliance.
• Dissuasive: Significant enough to deter future violations by the VASP and others in the market.

Types of MiCA Violations and Their Severity

The MiCA Fines Framework categorizes violations into different levels of severity, which directly impact the potential financial penalties. While the specific granular details are still being finalized in regulatory technical standards (RTS) and implementing technical standards (ITS), we can anticipate categories based on common regulatory practices:

• Minor Infractions: Technical procedural errors, minor reporting delays, or small-scale non-compliance that has minimal market impact.
• Significant Breaches: Failures in internal controls, insufficient anti-money laundering (AML) / counter-terrorist financing (CTF) procedures, or material misstatements in disclosures that could affect investor decisions.
• Severe Violations: Market manipulation, unauthorized offering of crypto-assets, or systemic failures in safeguarding client assets, leading to substantial harm to consumers or market integrity.

Each category will likely have a corresponding range of penalties, with more severe violations attracting higher fines and potentially other remedial actions, such as revocation of licenses or operational restrictions.

Calculating Your VASP's Exposure Threshold

Calculating your VASP's exposure threshold under the MiCA Fines Framework involves a multi-faceted assessment. It's not a single formula but rather a risk management exercise that considers your operational footprint, compliance posture, and potential impact of non-compliance.

Step 1: Identify Applicable MiCA Requirements

First, thoroughly understand all MiCA requirements relevant to your VASP's specific activities. This includes:

• Authorization and Operating Conditions: Licensing, governance, internal controls, and operational resilience.
• Issuer Obligations: For stablecoin issuers (asset-referenced tokens, ARTs, and e-money tokens, EMTs) and other crypto-asset issuers, covering whitepaper content, marketing, and redemption rights.
• VASP Obligations: Best execution, conflict of interest management, transparency, complaint handling, and safeguarding client funds.
• Market Abuse: Prohibitions against insider trading, market manipulation, and unlawful disclosure of information.
• AML/CTF: While primarily covered by the EU's 6th Anti-Money Laundering Directive (AMLD6), MiCA reinforces requirements for VASPs to have reliable customer due diligence (CDD) and transaction monitoring processes.

Step 2: Conduct a Risk Assessment

Perform a comprehensive risk assessment of your current operations against each identified MiCA requirement. This involves:

• Gap Analysis: Identify areas where your current processes, policies, or technology fall short of MiCA standards.
• Likelihood of Non-Compliance: Assess the probability of each gap leading to a violation.
• Impact of Non-Compliance: Evaluate the potential harm (financial, reputational, operational) that could result from each violation.

Step 3: Quantify Potential Financial Penalties

The MiCA Fines Framework will likely specify maximum fines, often expressed as a percentage of a VASP's annual turnover or a fixed amount, whichever is higher. For example, similar financial regulations often include provisions like "up to X% of annual turnover" or "up to Y million EUR." For instance, the General Data Protection Regulation (GDPR) sets maximum fines at 4% of global annual turnover or €20 million, whichever is higher, for severe infringements.

To estimate your exposure:

1. Determine your relevant annual turnover: This is typically the global consolidated annual turnover of the VASP or its parent company.
2. Apply potential percentages: For each identified risk, estimate the potential fine based on the severity category and the maximum percentages stipulated in the framework. This might look like:

    Potential_Fine = (Severity_Factor * Annual_Turnover) OR Fixed_Max_Fine

Where Severity_Factor is a percentage (e.g., 0.5% for minor, 2% for significant, 5% for severe). This is a hypothetical example and the actual percentages will be defined in the EBA's technical standards.

1. Consider aggravating and mitigating factors: The framework will outline factors that can increase or decrease a fine. These include:

• Aggravating: Repeated violations, intentional misconduct, lack of cooperation, duration of the breach, significant financial gain from the breach.
• Mitigating: Prompt remedial action, cooperation with authorities, reliable compliance programs, lack of prior infringements.

Step 4: Assess Non-Financial Penalties and Remedial Measures

Fines are not the only consequence. The MiCA Fines Framework also allows for other measures, such as:

• Public statements identifying the responsible VASP and the nature of the infringement.
• Orders to cease and desist from certain conduct.
• Orders to carry out specific remedial actions.
• Withdrawal or suspension of authorization.
• Temporary or permanent bans on individuals from managing VASPs.

Include the potential impact of these non-financial penalties in your overall exposure assessment, considering their effect on your operational continuity and reputation.

Step 5: Develop a Compliance Strategy

Based on your exposure calculation, develop and implement a reliable compliance strategy. This should include:

• Enhanced KYC (Know Your Customer) and KYB (Know Your Business) procedures: To ensure you're onboarding legitimate customers and businesses.
• Transaction Monitoring: To detect and report suspicious activity.
• Wallet Screening / KYT (Know Your Transaction): For ongoing monitoring of crypto-asset transactions.
• Reliable internal controls: To prevent unauthorized activities and ensure data integrity.
• Regular audits and training: To maintain an up-to-date and effective compliance program.

Key takeaways

• The EBA MiCA Fines Framework provides a structured approach to penalizing non-compliant VASPs within the EU.
• Fines will be proportionate, effective, and dissuasive, considering the severity, duration, and impact of violations.
• Calculating exposure involves identifying relevant MiCA requirements, conducting a thorough risk assessment, and quantifying potential financial and non-financial penalties.
• Aggravating and mitigating factors will influence the final penalty amount.
• Proactive compliance, including reliable identity verification and fraud prevention, is crucial to minimize exposure.

Frequently asked questions

What is the primary goal of the MiCA Fines Framework?

The primary goal is to ensure compliance with the MiCA Regulation, protect investors and market integrity, and deter non-compliant behavior by VASPs through proportionate and effective penalties.

How will the EBA ensure consistency in applying fines across EU member states?

The EBA will develop detailed regulatory technical standards (RTS) and guidelines that national competent authorities must follow, ensuring a harmonized approach to assessing and imposing penalties.

Can a VASP appeal a fine issued under the MiCA Fines Framework?

Yes, VASPs typically have the right to appeal administrative penalties through national judicial systems or administrative review processes, as outlined in relevant national laws and the MiCA Regulation itself.

What role does identity verification play in mitigating MiCA fines?

Reliable identity verification, encompassing KYC (Know Your Customer) for individuals and KYB (Know Your Business) for entities, is fundamental to MiCA compliance. It helps VASPs meet their AML/CTF obligations, prevent fraud, and ensure they are dealing with legitimate actors, thereby reducing the likelihood of regulatory breaches related to customer due diligence.

Are there specific fines for failing to implement adequate transaction monitoring?

While the MiCA Fines Framework will detail specific penalties, failures in transaction monitoring are likely to fall under significant or severe breaches due to their direct impact on AML/CTF compliance and market integrity, potentially incurring substantial fines.

---

Navigating the complexities of the MiCA Fines Framework requires a proactive and comprehensive approach to compliance. Didit provides infrastructure for identity and fraud that can significantly strengthen your VASP's compliance posture. Our single API integrates with 1,000+ data sources and offers an open marketplace of modules for User Verification / KYC, Business Verification / KYB, Transaction Monitoring, and Wallet Screening / KYT, covering the entire lifecycle from Authenticate to Verify to Monitor. With Didit, you can integrate in 5 minutes, ensuring fast verifications in the market while meeting stringent regulatory demands. We offer public pay-per-use pricing with no minimums, and you can get started with 500 free checks every month. A full identity verification starts from just $0.33.

Get started with Didit

Didit is infrastructure for identity and fraud. One API, public pay-per-use pricing, and 500 free verifications every month. Add User Verification to your flow and integrate in 5 minutes.

• User Verification: see how it works and what it costs.
• Read the documentation: API reference and integration guide.
• Start free: 500 verifications every month, no credit card required.