Annexes to the Article 60 MiCA notification: what a financial institution must submit to the NBS
Together with the notification form, on 24 August 2026 the NBS also published a checklist for the annexes to the notification. Its division into eleven articles follows Commission Delegated Regulation (EU) 2025/303, which, under Art. 60(13) of Regulation (EU) 2023/1114 (the “MiCA Regulation”), specifies the content of the notification.
Each checklist item has two columns. In the first, the entity states the location of the information (annex number, document name, part and page), a reference to a previous filing, or the reason why the item is not submitted. The second column is completed by the NBS. An unfilled item usually leads to a request to supplement and to an interruption of the 40-working-day period (Art. 60(8)).
The short answer
- Common core for every entity (Arts. 1–4 of the checklist): a three-year business plan, business continuity, AML/CFT, ICT and security (Art. 60(7)(a)–(c)).
- Service-specific annexes (Arts. 5–11 of the checklist): added with each service marked in Part V of the form.
- Banks and electronic money institutions: for the segregation of client funds they submit only part of the information (Art. 5(2) of Delegated Regulation 2025/303).
- Documents already submitted: identical information need not be resubmitted if the entity expressly states that it is still up to date (Art. 60(9)).
The eligible entities are covered in Part 1 and the notification form in Part 2 of the series.
Which annexes does every notifying entity submit?
Articles 1–4 of the checklist apply to every entity regardless of the scope of the notified services. They are based on Art. 60(7)(a)–(c) of the MiCA Regulation.
Article 1 — Three-year business plan (1A to 1N)
The most extensive part of the checklist. The NBS requires in particular:
- how the crypto-asset services fit the group strategy,
- a list of services and types of crypto-assets,
- target jurisdictions with the expected number of clients,
- domains and apps including language versions, and a marketing plan,
- human, financial and ICT resources and outsourcing under Art. 73,
- a projected financial plan including stress scenarios (1M),
- dealing in crypto-assets on own account, including interaction with decentralised finance applications (1N).
Article 2 — Business continuity (2A)
The business-continuity plan must not only be adopted but also maintained and tested. The checklist requires a description of the procedure on the failure of an external provider of a critical function (2A2) and on the death of a key person (2A3).
Article 3 — AML/CFT (3A to 3H)
Both inherent and residual risk are assessed by clients, services, distribution channels and geographical areas. Besides the policies, the checklist requires details of the identity and competence of the responsible person (3D), annual resources for training (3E) and a summary document on changes to the AML systems (3G). Compliance with Directive (EU) 2015/849 and Regulation (EU) 2023/1113 on information accompanying transfers is decisive.
Article 4 — ICT and security (4A to 4D)
Technical documentation of the ICT systems and any DLT infrastructure, the ICT risk-management framework under Regulation (EU) 2022/2554 (DORA) and a description of the contractual relationships with external ICT service providers are submitted. A description of the cyber-security audit with penetration tests (black box, grey box, white box) is submitted if available (4B). Item 4D requires a summary intelligible to a layperson.
Which annexes are added according to the notified services?
Each service marked in Part V of the form triggers the obligation to complete a further part of the checklist:
| Notified service | Checklist items beyond the common core | MiCA provision |
|---|---|---|
| custody and administration of crypto-assets on behalf of clients | Art. 5 (segregation of assets) and Art. 6 (custody and administration policy, model agreement, client summary) | Arts. 70 and 75 |
| operating a trading platform | Art. 7 (admission-to-trading rules, fees, settlement, market abuse, operating rules) | Art. 76 |
| exchange of crypto-assets for funds or other crypto-assets | Art. 8 (commercial policy, price-determination methodology) | Art. 77 |
| execution of orders on behalf of clients | Art. 9 (order-execution policy, venues, best result) | Art. 78 |
| placing of crypto-assets | item 1P (conflicts of interest) | Art. 79 |
| reception and transmission of orders | item 1O (procedures and arrangements) | Art. 80 |
| advice or portfolio management | Art. 10 (competence and training of persons) | Art. 81 |
| crypto-asset transfer services | Art. 11 (types of crypto-assets, risk management, any insurance) | Art. 82 |
When is Article 5 of the checklist (segregation of client assets) completed?
Not only for custody. Article 5 is completed whenever the entity is to hold clients’ crypto-assets, the means of access to them, or clients’ funds other than e-money tokens.
What special regime applies to banks and electronic money institutions?
Credit institutions and electronic money institutions submit only part of the information for Article 5 (Art. 5(2) of Delegated Regulation 2025/303). This is because Art. 70(2) and (3) of the MiCA Regulation on client funds do not apply to credit institutions, payment institutions and electronic money institutions (Art. 70(5)).
Which shortcomings in the annexes most often lead to a request to supplement?
- Unfilled items. If an item does not apply to the entity, this must be explained (e.g. “The entity does not notify the operation of a trading platform; Art. 7 of the checklist does not apply.”).
- Incorrect application of Art. 60(9). Identical documents the NBS already holds need not be resubmitted — but state when and in which filing they were submitted, and declare that they are still up to date.
- Unadapted existing policies. Item 3G requires a summary of changes to the AML systems in connection with crypto-asset services; the absence of any changes signals that the specific crypto-asset risks are not covered.
- An unquantified business plan. A three-year outlook with a target number of clients by jurisdiction and a financial plan with stress scenarios are a mandatory part.
- Insufficient DORA coverage. Without mapping the ICT services supporting critical functions and without contracts with ICT service providers, Article 4 of the checklist will not be complete.
- Inconsistent labelling of annexes. Each document should have a number, a name and a reference to a checklist item (e.g. “Annex 7 — Custody and administration policy, item 6B, p. 4”).
In practice: the NBS recommends contacting it before filing at crypto@nbs.sk. A preliminary consultation of the draft set of annexes can avoid an interruption of the period of up to 20 working days.
Assembling a set of annexes for the NBS?
STEINIGER | law firm maps which checklist items apply to your entity, prepares or revises the policies and procedures, and assembles the complete set of annexes to the Article 60 MiCA notification. Book a consultation →
Legislation and sources
- Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA) — Arts. 60, 70, 73, 75–82,
- Commission Delegated Regulation (EU) 2025/303 — Art. 5,
- Directive (EU) 2015/849 and Regulation (EU) 2023/1113,
- Regulation (EU) 2022/2554 (DORA),
- NBS: publication of the notification form and the annexes checklist, 24 August 2026.
MiCA Article 60 series: Part 1 — The notification regime (who without authorisation) · Part 2 — The NBS notification form · Part 3 — Annexes to the notification
Frequently asked questions
Which rule determines the content of the annexes to the Article 60 MiCA notification?
The basic scope is set by Art. 60(7) of the MiCA Regulation. The details are governed by Commission Delegated Regulation (EU) 2025/303, which the NBS reflected in the annexes checklist.
Is a cyber-security audit mandatory?
The NBS checklist requires a description of the cyber-security audit if available (item 4B). Technical documentation of the ICT systems and compliance with Regulation (EU) 2022/2554 (DORA), however, must always be demonstrated.
Must a bank complete the part on the segregation of client funds?
Only to a reduced extent. Credit institutions and electronic money institutions submit only part of the information under Art. 5(2) of Delegated Regulation 2025/303, as Art. 70(2) and (3) MiCA do not apply to them (Art. 70(5)).
Must documents the NBS already holds be resubmitted?
No, if they are identical. The entity, however, expressly states in the notification that the previously submitted information is still up to date (Art. 60(9)).
What are the consequences of an incomplete notification?
The NBS sets a period to supplement it, at most 20 working days, during which the 40-working-day period does not run. Until the notification is complete, the entity may not provide crypto-asset services (Art. 60(8)).