Are AIFMs allowed to delegate portfolio or risk management to non-supervised undertakings established outside of the EU?

Are internally managed AIFs and self-managed UCITS investment companies required to maintain initial capital and additional own funds, respectively, pursuant to Article 9 of AIFMD and Articles 7 and 29 of the UCITS Directive, that are kept separate from the collective investment undertaking’s assets, meaning that the initial capital and the additional own fund should not be included in the fund’s net asset value (NAV)?

What happens to an entity providing crypto-asset services in accordance with applicable law before 30 December 2024 that has not applied for authorisation as a CASP, or whose application for authorisation as a CASP has been refused by the end of the transition period?

Where an entity providing crypto-asset services in accordance with applicable law before 30 December 2024 has applied for but has not been granted or refused authorisation by the end of the transition period, can this entity continue providing services until it is granted or refused authorisation?

QUESTION 1: Internal Audit Frequency for Microenterprises and financial entities subject to the simplified risk management framework
Recital 43 of DORA states that microenterprises and financial entities (FEs) referred to in Article 16(1) of DORA are not required to conduct regular internal audits of their ICT risk management framework (RMF). Does it conflict with Article 28, paragraph 5 of Commission Delegated Regulation (EU) 2024/1774 (RTS) that mandates an internal audit on the ICT RMF in line with the FE’s audit plan?

QUESTION 2: ICT Testing Requirements for Microenterprises and Financial Entities – Cyber-attack scenarios
Article 11.6 of DORA excludes microenterprises from the requirement to include cyber-attack scenarios in their ICT business continuity and recovery plan testing. Does it conflict with Article 39, paragraph 1 of the Commission Delegated Regulation (EU) 2024/1774 (RTS), which mandates the inclusion of cyber-attack scenarios in the testing plans for financial entities referred to in Article 16(1) of DORA?

QUESTION 3: Recital 43 of DORA specifies that microenterprises and financial entities referred to in Article 16(1) of DORA are not required to regularly conduct risk analyses on legacy ICT systems. Does it conflict with Article 34, paragraph 1, point (e) of the Commission Delegated Regulation (EU) 2024/1774 (RTS) which mandates that financial entities referred to in Article 16(1) of Regulation (EU) 2022/2554 must manage the risks related to outdated or unsupported and legacy ICT assets?