Commission Delegated Regulation (EU) 2025/1140 of 27 February 2025 supplementing Regulation (EU) 2023/1114

Article 1

For the purposes of this Regulation, the following definitions shall apply:

Article 2

1. The records shall be retained in a medium that allows the storage of information in a way accessible for future reference by the competent authority, in such a form and manner that all of the following conditions are met:

2. Crypto-assets service providers shall keep the records listed in Section 1 of the Annex, depending upon the nature of their services and activities.

3. The obligation to keep the records listed in Section 1 of the Annex shall not affect any obligation to keep records set out in any other Union act.

Article 3

1. Crypto-asset service providers shall keep records of any policies and procedures they are required to maintain in writing under Regulation (EU) 2023/1114 and its implementing measures.

2. Crypto-asset service providers shall also keep the records of the assessment and periodical review, carried out by their management body, of the effectiveness of the policy arrangements, and procedures referred to in Articles 68(6) of Regulation (EU) 2023/1114, including of any deficiencies identified in relation to such policy arrangements and procedures and of any measures taken to address such deficiencies.

Article 4

1. Crypto-asset service providers shall keep the documents setting out their rights and obligations in relation to their provision of service, as well as those setting out the rights and obligations of their clients for a period of five years from the termination of the agreement to provide services.

2. At the request of a competent authority, made before the expiry of the five-year period referred to in paragraph 1, crypto-asset service providers shall keep the documents referred to in paragraph 1 for a period of up to seven years from the date of termination of the agreement to provide crypto-asset services.

Article 5

1. Crypto-asset service providers shall keep records enabling them to distinguish, at any time and without delay, crypto-assets and funds held for one client from crypto-assets and funds held for any other client and from their own assets.

2. Crypto-asset service providers shall maintain their records in a way that ensures that they may be used for auditing purposes as records.

3. Such records shall include the following:

Article 6

1. For every initial order received from a client and for every initial decision to deal taken, crypto-asset service providers shall record and keep the details set out in the second and third columns of Table 2 of Section 2 of the Annex and the details set out in Table 4 of Section 4 of that Annex, to the extent that such details concern the initial orders and those decisions to deal.

2. Where a competent authority requests any of the details referred to in paragraph 1 in accordance with Article 94(1), points (a) or (d), or Article 94(3), point (a), of Regulation (EU) 2023/1114, the crypto-assets service providers shall provide such details as set out in the fourth column of Table 2 of Section 2 of the Annex to this Regulation.

3. Where the details set out in Table 2 of Section 2 of the Annex to this Regulation are also required pursuant to Article 76 of Regulation (EU) 2023/1114 or to Articles 25 and 26 of Regulation (EU) No 600/2014, they shall be maintained according to the standards set out in those Regulations.

Article 7

1. Crypto-asset service providers shall, immediately after having undertaken a transaction, record the details set out in the second and third columns of Table 3 of Section 3 and Table 4 of Section 4 of the Annex.

2. Where competent authorities request any of the details referred to in paragraph 1 in accordance with Article 94(1), points (a) or (d), or Article 94(3), point (a), of Regulation (EU) 2023/1114, the operators of trading platforms for crypto-assets shall provide such details as set out in the fourth column of Table 3 of Section 3 of the Annex.

Article 8

1. Where a person or computer algorithm within a crypto-asset service provider makes the investment decision to acquire or dispose of a specific crypto-asset on behalf of the crypto-asset service provider or on behalf of a client in accordance with a discretionary mandate given by the client, that person or computer algorithm shall be identified and recorded as specified in Field 41 of Table 3 of Section 3 of the Annex.

2. Where a person and computer algorithm are both involved in taking the investment decision, or more than one person or algorithm are involved in taking that decision, the crypto-asset service provider shall record the person or computer algorithm with primary responsibility for that decision.

Article 9

1. A client who is a natural person shall be identified in the crypto-asset service provider’s records using the designation resulting from the concatenation of the ISO 3166-1 alpha-2 (2-letter country code) of the client’s nationality, followed by the national client identifier specified in Annex II to Delegated Regulation (EU) 2017/590, based on the client’s nationality.

2. The national client identifier referred to in paragraph 1 shall be assigned in accordance with the priority levels provided for in Annex II of Delegated Regulation (EU) 2017/590 using the highest priority identifier that a person has, regardless of whether that identifier is already known to the crypto-asset service provider.

3. For the purposes of identifying a natural person, if the person is a national of more than one European Economic Area (EEA) country, the country code of the first nationality when sorted alphabetically by its ISO 3166-1 alpha-2 code and the identifier of that nationality assigned in accordance with paragraph 2 shall be used.

4. Where a natural person has a non-EEA nationality, the highest priority identifier in accordance with the field referring to ‘all other countries’ provided in Annex II of Delegated Regulation (EU) 2017/590 shall be used. Where a natural person has EEA and non-EEA nationality, the country code of the EEA nationality and the highest priority identifier of that nationality assigned in accordance with paragraph 2 shall be used.

5. Where a client is a resident of a country other than the one of its nationality, crypto-asset service providers shall also identify that person based on the country of residence of the person as prescribed in Field 41 of Table 2 in the Annex.

6. Where the identifier assigned in accordance with paragraph 2 is based on CONCAT, the client shall be identified by the crypto-asset service provider using the concatenation of the following elements in the following order:

7. For the purposes of paragraph 6, prefixes to names shall be excluded and first names and surnames shorter than five characters shall be appended by ‘#’ so as to ensure that references to names and surnames in accordance with paragraph 6 contain five characters. All characters shall be in upper case. No apostrophes, accents, hyphens, punctuation marks or spaces shall be used.

Article 10

1. Where a person or computer algorithm within the crypto-asset service provider which executes a transaction determines which trading platform for crypto-assets located outside the Union to access, which other crypto-asset service provider to transmit orders to or any conditions related to the execution of a transaction, that employee or computer algorithm shall be identified in Field 41 of Table 3 in Section 3 of the Annex.

2. Where a person within the crypto-asset service provider takes decisions determining the execution of the transaction, the crypto-asset service provider shall assign a designation for identifying that person in its transaction records in accordance with Article 9.

3. Where a computer algorithm operating under the control of the crypto-asset service provider takes decisions determining the execution of the transaction, that computer algorithm shall be identified in Field 43 of the Table in Section 3 of the Annex.

4. Where a person and computer algorithm are both involved in execution of the transaction, or more than one person or algorithm are involved, the crypto-asset service provider shall record the person or computer algorithm primarily responsible for the execution of the transaction in Field 43 of Table 3 in Section 3 of the Annex.

Article 11

1. Crypto-asset service providers that receive and transmit to another crypto-asset service provider an order for crypto-assets on behalf of clients as referred to in Article 1(3)(a) shall record the details of such orders as specified in Fields 1, 2, 10, 12, 14, 15, 16, 17, 19, 20, 21, 25, 37 of Table 2 of Section 2 of the Annex, if and to the extent that those fields are relevant for that order.

2. Where the order transmitted was received from a crypto-asset service provider who had previously transmitted that order, the fields provided pursuant to paragraph 1 shall be those identifying the transmitting crypto-asset service provider.

3. Where an order is transmitted more than one time, the order details referred to in paragraph 1 shall be those of the client of the crypto-asset service provider who first transmitted the order and shall be recorded by the crypto-asset service provider who transmitted the order for the first time.

4. Where orders are aggregated for more than one client, the order details referred to in paragraph 1 shall be recorded for each client.

Article 12

1. Where a crypto-asset service provider executes an order or a transaction on behalf of a client through a trading platform for crypto-assets or a service provider to which Regulation (EU) 2023/1114 does not apply, the crypto-asset service provider shall record the details of the order or transaction as if it had executed the order or transaction itself.

2. The crypto-asset service provider shall record the information referred to in paragraph 1 in the fields specified in Table 2 of Section 2 and in Table 3 of Section 3 of the Annex, where those fields are applicable to the order or transaction in question.

Article 13

1. Where a crypto-asset service provider transmits an order to an entity to which Regulation (EU) 2023/1114 does not apply, the crypto-asset service provider shall record the details of the transmitted order in the fields specified in Table 2 of Section 2 of the Annex, to the extent those fields are applicable to the order or transaction in question.

2. Where the order is aggregated for several clients, the information referred to in Article 9 and 14, as applicable, shall be recorded for each client.

Article 14

1. When providing to the competent authorities the information referred to in Articles 6 and 7, a crypto-asset service provider shall identify any clients that are legal entities by using a legal entity identifier code corresponding to those clients.

2. Crypto-asset service providers shall record the legal entity identifier codes that comply with the ISO 17442 standard and are included in the Global LEI database maintained by the Central Operating Unit appointed by the Legal Entity Identifier Regulatory Oversight Committee.

3. Where the client does not have a legal entity identifier compliant with the ISO 17442 standard, the crypto asset service provider shall obtain one for the client, or use an identifier defined at Union level which meets all of the following characteristics:

Article 15

When providing information to competent authorities under Articles 6 and 7, a crypto-asset service provider shall identify the crypto-assets that are the subject of the recorded order or transaction, or used as a means of payment, by using a digital token identifier that is compliant with the ISO 24165 standard or an equivalent unique identifier approved by ESMA at Union level, which meets all of the following characteristics:

Article 16

1. Where a crypto-asset service provider undertakes a transaction wholly or partly through its branch, it shall include in its transaction records, the ISO 3166 country code of such branch, in accordance with Fields 7, 16, 34, 42 or 44 of Table 3 in Section 3 of the Annex.

2. The crypto-asset service provider shall include in the transaction records the following information:

Article 17

1. Crypto-asset service providers that undertake orders or transactions which trigger the obligation to keep records shall ensure that they are identified in the records to be maintained pursuant to this Regulation with a correct legal entity identifier which complies with the ISO 17442 standard and is included in the Global LEI database maintained by the Central Operating Unit appointed by the Legal Entity Identifier Regulatory Oversight Committee.

2. Crypto-asset service providers shall ensure that the reference data related to their legal entity identifier is renewed in accordance with the terms of any of the accredited Local Operating Units of the Global Legal Entity Identifier System.

Article 18

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.