File assembly and submission: stages and deadlines
Assembling and submitting an authorisation file for a digital-asset business runs through four fixed stages: internal preparation, dossier assembly, formal submission, and the supervisor's completeness check. Each stage carries its own deadline, and missing one resets the clock rather than pausing it. The point of no return sits at formal submission, not at internal sign-off.
How the file moves through the process
The file is not one document. It is a set of policies, evidence, and declarations that the supervisory authority reviews as a package. Nothing in the package is assessed in isolation: a gap in one section routinely triggers a question about a section that looked complete on its own.
Before submission, the file exists only internally. Draft policies circulate between compliance, technology, and management, and nothing filed at this stage carries a deadline against the authority. The deadline clock starts at the moment of formal submission, when the authority registers the file and opens a review file of its own.
From that moment, two things can happen. The authority can accept the file as complete and move to substantive review, or it can flag missing elements and return the file for completion. A returned file is not a rejection. It is a pause with a stated list of what is missing, and the applicant's deadline to respond runs from the date of that letter, not from the date it is read.
The four stages in order
| Stage | What happens | Who drives it |
|---|---|---|
| Internal preparation | Draft policies, governance structure, and technical description are written and reviewed internally | Applicant's team |
| Dossier assembly | Drafts are consolidated into the final file, cross-checked for consistency across sections | Applicant's team, usually with outside counsel |
| Formal submission | The file is lodged with the authority and a review file is opened | Applicant, filed with the authority |
| Completeness check | The authority confirms the file is complete or requests missing elements | Authority |
The completeness check is procedural, not substantive. The authority is not yet assessing whether the business model is sound; it is confirming that every required piece is present in a form it can review. Substantive assessment starts only after the file is declared complete.
Documents the file must contain
Three categories recur across every authorisation file of this type, regardless of the specific business line.
- Governance and ownership documents — corporate structure, beneficial ownership, and management fitness declarations.
- Operational policies — the security programme covering custody, access control, and incident handling. Deciding how far that programme needs to reach before submission is itself a distinct exercise: Scope assessment for security duties step by step walks through how the decision maker draws that line.
- Technical description — how the underlying technology functions in practice, including any automated mechanism that executes transfers or enforces conditions without manual intervention. Where the file describes such a mechanism, it needs to explain how it is verified rather than only how it is designed; the reasoning behind that distinction is set out in Smart contract in tokenised rights.
Authorship of the technical documentation itself is worth checking before submission, particularly where contractors or agencies wrote the underlying code or white paper. If the file needs to state who owns the rights to that material, the underlying question is answered in Work made for hire ownership of results explained.
What to do
- Assign one internal owner for the file before drafting starts, so cross-section consistency has a single point of accountability.
- Draft governance and ownership documents first — they rarely change once written and other sections reference them.
- Draft the security programme in parallel, using the scope decided at the outset rather than expanding it mid-draft.
- Consolidate all sections into one file and cross-check terminology, dates, and named individuals for consistency.
- Submit the complete file formally, keeping a dated record of the submission itself.
- Track the completeness-check deadline from the date of any return letter, not from the date it reaches the relevant inbox.
Who decides and how long it takes
The completeness check is carried out by the supervisory authority's intake function, separate from the team that later performs substantive review. The review period for the completeness check is set by the authority's internal procedure and communicated at the time of submission rather than fixed in advance.
If the authority raises supervisory questions during substantive review, the applicant faces a separate set of deadlines and a different rhythm of response. That stage is covered on its own: Responding to supervisory questions step by step.
Forks
If your file is complete on first submission, the process moves directly to substantive review and the completeness-check stage effectively closes within days.
If your file is returned as incomplete, the deadline to complete it runs from the date of the return letter, and a second incomplete response can lead the authority to treat the file as withdrawn.
If the trading name used in your marketing differs from the name or mark actually registered, that mismatch belongs in the governance section of the file, not in the technical description — and it deserves separate attention, since When the mark is used differently from the registration can affect deadlines that run independently of the authorisation timeline.
Related publications
For the stage that typically follows a completeness check — the authority's substantive questions — see Responding to supervisory questions step by step above.
Source and limit
This page describes the procedural mechanics of file assembly and submission as they play out in practice: stages, documents, and the deciding function at each point. It does not describe which activities require authorisation in the first place, and it does not set out the substantive criteria the authority applies once a file is complete — those questions belong to a different part of the site.
It also does not cover what happens after a refusal. If your file reaches that point, the next steps are procedural in a different sense, and they are covered separately.
Reviewed: February 2025. This description reflects observed practice in file handling by supervisory authorities in the region and is updated as procedures change.
FAQ
How long does file assembly and submission take in practice?
Internal preparation and dossier assembly typically take longer than the formal stages that follow, since they depend on how much of the governance and technical material already exists. The completeness check itself is usually the shortest stage, provided the file is submitted complete.
Which documents are needed to start?
Work can start with a draft governance structure and a description of the underlying technology. Everything else — security policy detail, final ownership declarations — can be refined while those two anchors stay fixed.
What happens if the other side does not respond?
In this procedure, the authority is the party whose response drives the timeline. If it does not act within its own stated review window, the applicant should follow up in writing and keep a dated record of that follow-up before escalating.
If your file has already been refused and you are past this stage, the next deadline is different in kind: When an appeal deadline follows a refusal sets out what to check first.