Governance and fit and proper review: what the decision maker looks at

A fit and proper review checks who actually controls the applicant, not only who signs the form. The decision maker looks at the management body, qualifying shareholders, and the people who effectively direct the business. It reviews their experience, integrity, and financial soundness against the licence sought. A weak governance file is the single most common reason a digital asset authorisation stalls, regardless of how strong the business plan looks.

What the decision maker actually examines

The review sits on three pillars: composition of the management body, suitability of each individual, and the internal governance arrangements that surround them. Composition means whether the board has enough independent oversight for the size and risk profile of the business. Suitability means each director's and each qualifying shareholder's reputation, experience, and absence of disqualifying history. Governance arrangements mean whether policies, reporting lines, and risk functions exist on paper and in practice, not only in a slide deck prepared for the file.

None of these three pillars is assessed in isolation. A management body with strong individual profiles but no functioning risk committee will still draw follow-up questions. A single director with a thin track record can be accepted if the rest of the body compensates and the file explains why.

Practical effect on your authorisation timeline

Governance and fit and proper assessment is usually the slowest part of the whole authorisation file, because it depends on documents that sit with third parties: police certificates, prior regulator references, source of wealth evidence. A file with all governance documents ready on day one moves through review noticeably faster than a file where they arrive piecemeal.

The clock the applicant experiences is not one continuous countdown. It runs, stops for a request for further information, and restarts once the response lands. Every stop adds real weeks, not administrative delay. Once authorisation is granted, governance duties continue in a different form: the same management body later becomes responsible for ongoing operational obligations, including the Incident notification procedure step by step, which follows a similarly staged logic.

What to do to keep the file moving

Where the file also touches intellectual property assets held by the business, cost transparency for that adjacent track follows a comparable publication logic to Fee schedules in ownership of results, and the same discipline of preparing everything before submission applies here.

List every person who is a director, a person effectively directing the business, or a qualifying shareholder, before drafting anything else.
Instruct each of them to gather their own identity, criminal record, and source of wealth documents in parallel, not sequentially.
Draft the governance narrative — reporting lines, committees, risk function — as a standalone document, not as an appendix to the business plan.
Have internal counsel or the compliance officer review the narrative against the actual organisational chart, not the aspirational one.
Submit the governance section as a complete package rather than in stages, even if other parts of the file are still being finished.
Keep a single point of contact for follow-up questions from the decision maker, so responses do not fragment across the team.

Who decides, and how long it takes

Stage	What happens	Typical driver of delay
Initial completeness check	Decision maker confirms the file contains all required governance documents	Missing certificates from individual directors
Substantive review	Suitability of each person and the governance arrangements as a whole are assessed	Thin experience profile without compensating structure
Request for further information	Clock stops until the applicant responds in full	Partial or delayed responses
Decision	Authorisation, authorisation with conditions, or refusal	Not applicable once reached

The decision maker is the competent authority responsible for authorisation in the relevant jurisdiction. It communicates in writing, and every substantive step — the completeness check, the request for further information, the decision itself — is documented in the file. There is no informal channel that shortens this sequence.

Common scenarios

If one qualifying shareholder has a prior regulatory sanction elsewhere, the file is not automatically refused. The decision maker weighs severity, recency, and remediation, and the applicant should address it directly rather than omit it and hope it goes unnoticed.

If the management body is thin — for example, two directors covering all functions — expect a request to add an independent function or to explain, in writing, why the size is adequate for the scale of the intended business.

If a shareholder disputes the outcome of an internal governance decision during the review, escalation inside the file follows a structured route, similar in principle to the Opposition settlement step by step used in other registry procedures, though the forum and rules differ.

What this page does not cover

This page describes the review mechanism, not the specific documentary thresholds, monetary requirements, or statutory deadlines that apply in a given jurisdiction — those depend on the applicable regulatory framework and are confirmed on a case-by-case basis. It also does not cover own funds calculation, which is a distinct workstream within the same authorisation file.

Verified

This page reflects the general review mechanism applied by competent authorities to management body and shareholder suitability under the current digital asset authorisation framework. It does not cite specific statutory provisions, since procedural mechanics are confirmed jurisdiction by jurisdiction rather than generalised across the network. Where a governance review sits inside a broader due diligence file, the underlying report layer explains what a Transaction in Estonia report can establish for the same counterparty. Last checked: current publication cycle.

Frequently asked questions

How long does governance and fit and proper review take in practice?

There is no fixed calendar length. A complete file with responsive individuals typically clears substantive review faster than a file that arrives with gaps, because every request for further information stops the clock until the applicant answers in full.

Which documents are needed to start?

At minimum: identity documents for each director and qualifying shareholder, criminal record certificates, source of wealth statements, curricula vitae, the organisational chart, and a written governance narrative covering reporting lines and risk functions.

What happens if the applicant does not respond to a request for further information?

The review clock simply stops. It does not restart until a full response is filed. Prolonged silence can lead the decision maker to treat the application as withdrawn or to move towards refusal on the basis of the incomplete file.

For a related situation involving a token rather than a licence file, see When the buyer of a token is not the rights owner, and what to do first.

— Aleks Vaher, AURELIS