Governance and fit and proper review: costs drivers
A governance and fit and proper review checks whether the management body, key function holders and shareholders of a crypto-asset service provider meet the standard the competent authority expects before authorisation. Effort and duration rise with the number of people assessed, the number of jurisdictions involved and any unresolved supervisory history.
What changes once the review starts
Once the file enters review, the clock inside the wider authorisation procedure keeps running. A negative finding on one director does not close the file. It usually triggers a request for further evidence, or a replacement of that individual, which restarts document collection for that person alone. A pattern of gaps across several individuals signals that internal governance is not yet operational, and that finding carries more weight than a single missing certificate.
What drives the cost
The review itself is not priced separately from the authorisation file it sits inside. What moves the effort up or down is the shape of the group being assessed, not a fixed schedule.
| Driver | Effect on timeline | Effect on effort |
|---|---|---|
| Number of individuals assessed | Each additional director or key function holder adds a parallel document set | More questionnaires, certificates and interviews to coordinate |
| Number of jurisdictions | Certificates from more than one country add translation and legalisation steps | More correspondence with foreign registries |
| Existing supervisory history | A prior refusal or measure lengthens the review while the authority checks it in detail | Extra explanatory memoranda and remedial evidence |
| Outsourced functions | Custody or IT held by a third party adds a review of that party's own governance | An additional due diligence file for the outsourced provider |
What to do
- Map the governance structure and shareholder register, showing every person with qualifying influence — prepared by the compliance officer.
- Collect a fit and proper questionnaire, a CV and a declaration of interests from each director and key function holder — completed by each individual, checked by legal counsel.
- Obtain a clean criminal record extract and a solvency statement for each person named above — requested by the individual, filed by the applicant.
- Draft internal control policies covering conflicts of interest, escalation and reporting lines, and keep a record of processing that documents how personal data collected for the review is handled — drafted by the compliance function. See Record of processing data protection how it is proved for the standard of proof the authority expects from that record.
- Assemble the governance file into the main authorisation dossier and file it with the competent authority — submitted by the applicant's authorised representative.
- Track and answer supervisory requests for clarification inside the deadline the authority sets — coordinated by legal counsel.
Who decides
The national competent authority responsible for authorising the crypto-asset service provider decides on the governance and fit and proper file. It usually rules as part of the single authorisation decision, not as a separate ruling. The authority may ask a candidate director for an interview and may set its own internal timetable for the assessment. The applicant does not choose the forum; the authority that receives the primary application is the one that reviews governance.
Where the file forks
If custody of client assets is held by an external platform rather than the applicant, the fit and proper review extends to that platform's own governance and control structure, and the file grows accordingly. See When custody is held by a platform for what changes when that platform, not the applicant, controls the assets.
If a shareholder or director disputes a negative finding, resolving the disagreement without withdrawing the whole application follows a similar document logic to a formal settlement: a written concession, a revised declaration and a joint submission to the authority. See Opposition settlement step by step for the document sequence that pattern follows in another registry context.
If the file is incomplete on the filing date, the authority pauses its own clock rather than refusing outright, and the applicant loses the time between the request and the answer.
The limit of this page
This page does not set a price or a fixed duration for the review. It does not confirm whether a named person meets the standard, and it does not replace the authority's own assessment. Advice on a specific person's file is a separate, scoped piece of work.
Checked
Checked on 3 March 2025 against current supervisory practice for crypto-asset service provider authorisation and against internal procedural files maintained for this cluster. No statutory citation is used on this page; the applicable legal basis is confirmed separately for each jurisdiction before filing.
Related publications
A related procedural step covers the evidence needed for own funds. See Own funds evidence step by step for the document set the authority expects alongside the governance file.
Next step
If a related intellectual property question is holding up the same application, read When an agency keeps the design files for the first moves available to the applicant.
If the supervisor has already published a measure against a party connected to the application, read When the supervisor publishes a measure for what happens next.
Frequently asked questions
How long does governance and fit and proper review take in practice?
There is no fixed public duration for this specific stream. It runs inside the wider authorisation timetable and lengthens with the number of people assessed and any request for further information, which pauses the clock until answered.
Which documents are needed to start?
A governance structure chart, a shareholder register, a fit and proper questionnaire, a CV and a declaration of interests for every director and key function holder, plus a clean criminal record extract and a solvency statement for each person.
What happens if the person under review does not respond to a request for information?
The authority's clock pauses on a formal request for further information. If the person under review still does not respond inside the deadline set, the file can be treated as incomplete, and the part of the authorisation application that depends on that person is at risk of being returned or refused.