Authorisation variation: documents to prepare
A variation to an existing digital-assets authorisation is triggered by a change the regulator did not review at the initial grant: new services, a different ownership structure, a new outsourcing chain, or a materially different risk model. The file you submit mirrors the original application, but scoped only to what has changed. Nothing already on file is resubmitted.
What counts as a variation
Not every internal change requires a filing. A variation is required when the fact pattern the regulator relied on to grant the original authorisation no longer holds. Four events cover most cases in practice: a change of controlling shareholders or directors, the addition of a new licensed activity, a change to a material outsourcing arrangement, and a change of registered office or branch network.
Outsourcing changes deserve particular care when the new provider processes client data on your behalf. The variation file then needs to show who controls that data and who merely processes it, because the two roles carry different obligations and different evidence. Processor data protection how it is proved explained sets out how that distinction is documented once the arrangement changes.
A change of scope that adds tokenised instruments to your service line is treated as a new activity, not a technical update. The regulator will ask what right the token represents before it accepts the amended scope. When the token refers to an unregistered right explains why that classification step comes before the variation file is even drafted.
Practical consequence
A variation resets the regulator's clock only on the parts of the file that changed. A well-scoped filing keeps the review narrow and the business running under the existing authorisation while the change is assessed. A poorly scoped filing invites a full-scope review, because the regulator cannot separate what changed from what did not.
| Trigger | Core documents | Typical review depth |
|---|---|---|
| Change of controller or shareholder | updated fit-and-propriety file, ownership chart, source-of-funds statement | full suitability review |
| New crypto-asset service added | service description, updated risk assessment, updated safeguarding arrangements | scoped review of the new service only |
| Change of outsourcing or IT provider | outsourcing agreement, due-diligence file on the provider, business continuity plan | review of operational resilience |
| Change of registered office or branch | updated governance chart, evidence of local presence | administrative check, shorter timeline |
The scoping decision is made before drafting starts, not after. Getting it wrong is the single most common cause of delay in this procedure.
What to do
- Map the change against the original authorisation file. The compliance officer identifies which annex or condition is affected.
- Draft the variation notice. Legal counsel prepares a short cover letter naming the trigger and the exact scope of the change.
- Assemble the supporting file. Operations gathers updated policies, contracts and risk assessments tied only to what changed, not the full original file.
- Obtain sign-off from the management body. The board or equivalent approves the package before it leaves the building.
- Submit through the same channel used for the original application. The compliance officer files the notice and confirms receipt.
- Respond to follow-up questions within the deadline the regulator sets. Legal counsel coordinates the reply and keeps a single point of contact.
Assembling that supporting file follows the same discipline as any evidence-heavy filing: only material tied directly to the disputed or changed fact belongs in it. Evidence of acquired distinctiveness step by step walks through that discipline in a different registry, and the logic of what to include and what to leave out transfers directly.
Who decides
The same authority that granted the original authorisation reviews and decides the variation. It does not need to be a different department or a fresh application process. The authority acknowledges receipt, checks the file against the trigger stated in the cover letter, and either approves, requests further information, or opens a full-scope review if the scoping was inadequate. Its own supervisory handbook sets the indicative timeline, and that timeline is published rather than fixed by statute at the level this page can verify.
Forks
If the change adds a new licensed activity, expect a full-scope review rather than a light-touch one, because the regulator has no prior assessment of that activity to rely on.
If the change is a purely internal reorganisation with no new activity and no new counterparty, the regulator may accept an abbreviated file built around the governance chart alone.
If the change follows from a technology provider switch and that provider owns the design or specification files behind your platform, ownership of those files becomes part of the due-diligence pack, not a side issue. B2B software and SaaS — when an agency keeps covers exactly this gap between who built the system and who is entitled to hand it over.
If the variation follows an enforcement finding rather than a business decision, the timeline is set by the corrective plan agreed with the regulator, not by the applicant's own schedule.
Limit
This page covers the documents and stages of a variation. It does not fix the fee charged by the regulator, which is set in its own tariff and varies by activity and jurisdiction. It does not cover what happens when the authorisation is given up entirely rather than amended — that is a different procedure with a different exit file. It also does not replace a scoping conversation with the authority before drafting begins; regulators differ on how much informal pre-engagement they allow, and that detail sits outside what this page can verify.
Related reading
A variation and a surrender start from the same file but end in opposite places. Surrender of a permission step by step sets out the exit version of this same procedure, for cases where the business is winding down the licensed activity rather than changing it.
Verified
This page was checked against current supervisory practice for digital-assets authorisations in early 2025. No article numbers or regulation citations appear on this page by design: this is a procedural walkthrough, and the specific statutory deadlines and fee tariffs referenced above sit with each national supervisor's own published guidance, which we have not cross-checked line by line for every jurisdiction.
FAQ
How long does authorisation variation take in practice?
It depends on scope. A narrowly scoped, well-documented change is typically acknowledged quickly and decided within the regulator's published indicative window. A change that triggers a full-scope review runs on the same timeline as a new application.
Which documents are needed to start?
At minimum: a cover letter naming the trigger, the updated section of the original file that the change affects, and sign-off from the management body. Everything else in the table above depends on which trigger applies.
What happens if the other side does not respond?
If the regulator does not respond within its own published timeline, the correct step is a formal status enquiry through the same channel used for submission, not a resubmission. A silent file is not an approved file, and operating outside the existing authorisation before a decision is issued carries its own risk.