1. Applicant identity and scope
Legal entity, group structure, home member state, crypto-asset services requested, target customers, jurisdictions, passporting assumptions, and any Article 60 notification boundary if the applicant is already a financial entity.
2. Programme of operations
Business model, service flows, client onboarding, token/service perimeter, trading or transfer workflows if relevant, outsourcing, critical vendors, and continuity dependencies.
3. Governance and control owners
Management body accountability, ownership influence, conflicts, internal controls, policy ownership, compliance monitoring, financial-crime controls, operational-risk owners, and evidence refresh cadence.
4. Prudential-safeguard file
Article 67 own-funds basis, fixed-overhead logic where relevant, insurance or comparable-guarantee evaluation, cancellation/exclusion questions, and the rationale for any combined safeguard path.
5. Custody and client-asset evidence
Custody policy, wallet/key-control model, records of positions, segregation, asset-return procedure, access recovery, outsourcing, incident playbooks, and Article 75 loss-scenario ownership where custody or control is in scope.
6. ICT, complaints, and resilience
ICT systems, security controls, DORA-adjacent incident material, business continuity, complaints procedure, complaint register, root-cause analysis, client communication, and remediation evidence.