Management Competence under MICAR

For many crypto-asset service providers, MiCAR has primarily been an authorisation project over recent months. Business models had to be assessed from a regulatory perspective, organisational structures established, processes documented and extensive application materials prepared. However, obtaining authorisation does not mark the end of this process. Instead, the focus is now shifting from meeting formal authorisation requirements to ensuring that the organisation operates effectively in practice.

This also brings management competence into sharper focus. Senior managers must do more than oversee their company's commercial performance. They also need to understand the specific risks associated with crypto-assets, distributed ledger technologies and the crypto-asset services they provide, as well as how these risks can be effectively managed.

Management competence is an ongoing requirement

Article 68 of MiCAR requires members of the management body of a crypto-asset service provider to possess appropriate knowledge, skills and experience. These requirements apply both to individual members and to the management body as a whole.

Authorisation is only the first point at which these requirements are assessed. The joint EBA and ESMA guidelines on assessing the suitability of members of the management body make clear that suitability must be maintained on an ongoing basis, even after authorisation has been granted. A reassessment may be necessary, particularly if there are material changes to the business model, services offered, technologies used or risk profile.

For management, this means that a competence profile documented during the authorisation process may not remain sufficient as the company develops. The knowledge and skills required must evolve alongside the business, its technologies and supervisory expectations.

Not every member of the management body needs to be a technology specialist

Having sufficient crypto-asset expertise within the management body does not mean that every member needs to be able to programme smart contracts, manage cryptographic keys or explain every technical detail of a blockchain.

What matters first and foremost is the collective suitability of the management body. Different backgrounds and areas of expertise can complement one another within the management team. One member might bring specialist knowledge of regulation and compliance, while another has experience in technology, IT security or operational risk management.

However, this collective approach does not remove individual responsibility. Every member must have a sufficient understanding of the matters relevant to their role to critically assess information, make informed decisions and effectively oversee the functions for which they are responsible.

Management competence is therefore about more than familiarity with technical terminology. Above all, it means being able to ask the right questions, identify risks at an early stage and assess the quality of the answers received.

What should management understand?

The specific knowledge required depends on the CASP's business model. A crypto-asset custody provider faces a different risk profile from a trading platform or a company offering crypto-asset advice.

Nevertheless, several core areas of competence can be identified:

• The fundamental principles of crypto-assets and distributed ledger technologies
• The economic and legal characteristics of the crypto-assets and services offered
• Custody models, key management and transaction controls
• Operational risks, cyber risks and digital resilience
• Anti-money laundering, sanctions and transaction monitoring
• Conflicts of interest, market abuse and client protection
• Outsourcing and the oversight of external service providers
• Internal control functions and responsibilities
• Current regulatory and supervisory developments

These topics are not relevant only to operational specialists. They are directly linked to management's responsibility for strategy, organisational structures, risk appetite and effective oversight.

Continuing professional development as part of governance

ESMA has published detailed guidelines on the knowledge and competence required of staff who provide clients with information or advice on crypto-assets and crypto-asset services. For members of the management body, however, there are no comparable fixed annual training-hour requirements.

This does not mean that continuing professional development is unnecessary for senior management. Rather, its scope and content should be determined on a risk-based basis. As the complexity of the services offered, technologies used and outsourcing arrangements increases, so too does the level of knowledge generally required of management.

Structured professional development can serve several purposes. It establishes a shared knowledge base, supports discussions between management and specialist teams and helps the management body assess new regulatory or technological developments in good time.

Training is particularly effective when it is linked to specific management responsibilities. Rather than focusing exclusively on abstract regulatory requirements, it should address practical questions such as:

• What are the key risks arising from our specific business model?
• Which activities have been outsourced and how do we oversee their proper execution?
• What information does management need to receive regularly from Compliance, Risk, IT and AML functions?
• Which competencies must be available internally?
• What changes to our products or services would require a reassessment of management competence?
• How can we demonstrate that management and control functions are adequately taking regulatory developments into account?
•  

From one-off training to continuous competence development

Developing management competence does not have to be complicated. A practical approach can begin with a structured assessment of the current position:

1. Which crypto-asset services does the company provide?
2. What key risks and management decisions arise from these services?
3. What knowledge and expertise already exist within the management body?
4. Where are the individual or collective competence gaps?
5. Which training measures would be most effective in addressing these gaps?

The training undertaken and topics covered should then be appropriately documented. Material changes to the business model, new services or new technologies should also prompt a review of existing competence requirements.

This makes professional development an integral part of governance rather than a standalone HR initiative. It helps the management body fulfil its responsibilities on an informed basis and demonstrate to internal control functions, auditors and supervisory authorities how those responsibilities are being met.

Building a shared understanding

Management competence in the crypto-asset sector does not come exclusively from years of experience in banking, capital markets or technology companies. While this experience remains valuable, it needs to be complemented by an understanding of the specific characteristics of crypto-assets, crypto-asset services and MiCAR.

Once MiCAR authorisation has been granted, the next phase begins: demonstrating that governance structures, organisational arrangements and management competence are not simply documented on paper but work effectively in day-to-day operations.

A structured introduction to the market, technology and regulatory landscape can provide a common foundation. The Digital Assets & Blockchain Expert certificate programme at Frankfurt School of Finance & Management offers specialists and executives a solid grounding in crypto-assets, their economic significance and their regulatory treatment under MiCAR. Building on this foundation, companies can explore the management, competence and governance questions most relevant to their own business models in greater depth.