Governance and fit and proper review: stages and deadlines
Governance and fit and proper review checks whether the people who run and own a crypto-asset business meet the standard the supervisor expects: competence, integrity, and no conflict that undermines control. It happens inside the authorisation file, not after it. The review moves through completeness, substantive assessment, and decision — each stage has its own gatekeeper and its own point of no return.
How the review fits into authorisation
The competent authority folds the governance and fit and proper review into the wider authorisation process for crypto-asset service providers. It does not run as a separate track with its own file number. Every director, every qualifying shareholder, and every person who effectively directs the business sits inside the same check, whether the entity is applying for a licence or extending an existing one to a new service.
Nothing here is decided on a public timetable common to every applicant. The authority sets its own working method, checks completeness first, and only then moves to substance. If the file is incomplete, the clock for substantive assessment does not start; it starts once the missing piece lands on the case officer's desk.
What changes in your timeline and risk
For the file this means one weak link can stall the whole application. The authority does not authorise the entity while a single management body member fails the suitability standard. Delay at this stage does not reset the whole review, but it does hold the file exactly where the gap was found until the applicant closes it.
Risk concentrates around disclosure, not around paperwork volume. A file with fewer documents but full disclosure moves faster than a thick file with a gap the applicant hoped nobody would notice. Case officers read for consistency across the whole set, not for completeness of any single form.
Documents to prepare before you start
- Map every director, senior manager and qualifying shareholder before submission — the authority checks the register, not your organisational chart.
- Collect identity, criminal record, insolvency history and professional reference evidence for each person named in the file.
- Draft a governance narrative that explains reporting lines, conflict controls and who holds ultimate decision power.
- Where the business already reports incidents under a separate regime, align the governance file with that reporting line so the supervisor sees one consistent picture — see Incident notification procedure step by step.
- Submit the completeness package together, not person by person; a partial submission restarts the completeness check for the whole file.
- Assign one internal owner who answers supervisor queries within the same working day the query arrives.
Who decides and where authority sits
The competent authority for the jurisdiction where the applicant seeks authorisation runs the review. Inside the authority, the same case officer usually carries the file through completeness, substantive assessment and decision, though a separate committee signs off the final call on senior appointments.
The applicant does not choose the forum. The supervisory perimeter is set by where the licence is sought, and a parallel application in a second jurisdiction runs its own parallel review rather than sharing the outcome of the first.
| Stage | What is checked | What can pause it |
|---|---|---|
| Completeness | Every required document is present for every named person | A missing reference, an expired identity document |
| Substantive assessment | Competence, integrity, conflicts, ownership structure | An unresolved criminal record entry, an unclear ownership chain |
| Decision | Whether the file, as a whole, meets the standard | A single management body member who still fails the test |
Common branching scenarios
If your qualifying shareholder is a corporate entity rather than a person, the review looks through the ownership chain to the individuals who ultimately control it, and the same fit and proper standard applies to each of them.
If your application discloses a trading name or brand that overlaps with an existing sign nobody registered, resolve that exposure before submission — see When an earlier unregistered sign appears — because an active dispute over the name complicates the fit and proper picture.
If the file cites a proprietary database or scoring tool built by staff who have since left, settle who owns that database before you rely on it as governance evidence — see Database maker ownership of results explained.
If the licence covers tokenised rights alongside standard crypto-asset services, check how the current treatment applies to your structure before the review starts — see What changed in treatment of tokenised rights tokenised rights — because a shift in classification can change who counts as a qualifying shareholder.
What this page does not resolve
This page does not set a fixed number of days for the review, and it does not replace the authority's own published service standard, which differs between supervisors and between file types. It also does not cover the separate own funds evidence check, which runs on its own timeline and its own gatekeeper inside the same authorisation file.
It does not tell you whether a specific named individual will pass the standard. That answer depends on facts the authority holds and the applicant discloses, not on a general procedure page.
Related reading
The own funds evidence check runs alongside this review inside the same authorisation file, on its own clock — see Own funds evidence step by step.
Verified
Reviewed for consistency with current authorisation practice as we see it across our own client files. No case citation and no article number appears on this page, because governance and fit and proper review is a procedural question, not a citation question: the answer sits in the supervisor's own service standard, not in a paragraph number.
FAQ
How long does governance and fit and proper review take in practice?
The authority does not publish a single fixed period. The file moves through completeness, assessment and decision, and each stage can extend if information is missing. Treat the review as open until the authority confirms it is closed, not until a date you set yourself.
Which documents are needed to start?
You need identity and background evidence for every director, senior manager and qualifying shareholder, a governance narrative describing reporting lines and conflict controls, and confirmation of any reporting obligations the business already carries under other regimes.
What happens if the other side does not respond?
If a named individual does not provide the additional evidence the supervisor asked for, the file stays parked at that stage. The authority does not chase on the applicant's behalf and does not authorise around a gap; the applicant carries the responsibility to close it.