On-site inspection: stages and deadlines
An on-site inspection during authorisation and supervision follows four stages: notice and scope, on-site work, the findings letter, and closure. Once notice is served, the visit cannot be avoided, only prepared for. The file has to be ready before inspectors arrive, and the deadline for a written response after the findings letter is short and rarely extended.
How the procedure unfolds
The sequence below is the version most authorities apply when they inspect a digital-asset service provider. Local practice varies in detail, but the shape of the process rarely changes.
| Stage | What happens | Typical duration | Who acts |
|---|---|---|---|
| Notice and scope | The authority sends written notice naming the scope, the team, and the entry date | Short, fixed window before entry | Supervisory authority |
| Preparation | The entity assembles the requested file and briefs staff who may be interviewed | Runs alongside the notice period | Compliance function |
| On-site work | Inspectors review records, interview staff, and may request extra documents on the spot | Several working days, depending on scope | Inspection team |
| Findings letter | The authority sets out preliminary findings and invites a written response | Issued once on-site work closes | Supervisory authority |
| Response and closure | The entity replies, the authority reviews the reply and closes the file or opens a corrective track | Short response window, then a review period | Both sides |
What changes once notice is served
Before notice arrives, the entity controls the pace of preparation. After notice, the authority sets the pace. The entry date, once fixed, is rarely moved for scheduling reasons alone. Requests raised during the visit are typically expected to be answered on the day, not deferred to a later submission. A gap between what the file shows and what staff say in interview is the single most common trigger for a wider scope.
Preparing the file: what to do
- Compliance officer: assemble the licence file, register extracts, and the policies named in the licence conditions before the entry date.
- Operations lead: brief staff who may be interviewed on how the platform actually runs day to day, not how the manual describes it.
- Technology lead: flag any AI-driven component within scope early, since AI obligation mapping step by step follows a separate procedure that inspectors may ask about directly.
- Compliance officer: check whether any recordal is pending on trademarks tied to the platform brand, because Recordal of assignment step by step can slow document production if it is still open.
- Legal counsel: confirm ownership proof for in-house software is on file, particularly where the work sat with employees, as covered in Employee-created program ownership of results how it is proved.
- Records team: use the same channel already set up for tokenised rights filings, described in Electronic submission in tokenised rights, to send any additional documents the authority requests.
Who decides
The competent supervisory authority runs the inspection and decides on the outcome. This stage is administrative, not judicial. Findings are set out in writing, and the entity's written response becomes part of the file the authority reviews before closing the matter or moving it into a corrective track.
Common branches
If the inspection follows shortly after a licence grant, expect closer attention to whether day-to-day operations match the original application. If the inspection is triggered by a specific incident, expect a narrower scope focused on that incident and its immediate causes. If the entity operates across more than one Baltic jurisdiction, expect parallel or sequential visits rather than a single combined one.
What this page does not cover
This page describes the sequence of an inspection, not its substance. It does not set out fines, licence suspension criteria, or the standard inspectors use to judge a control adequate. It also does not cover appeal routes against findings, which follow a separate procedure.
Related procedures
Where an inspection moves into a corrective phase, the next step is usually covered by Remediation plan agreement step by step, which sets out how a remediation plan gets agreed once findings are open.
Verified
Checked 20 March 2025 against current supervisory practice for digital-asset service providers. Stage names and sequence reflect the standard inspection format. Specific deadlines are set by the authority conducting each inspection and are not restated here.
FAQ
How long does on-site inspection take in practice?
Duration depends on scope and on how many jurisdictions are involved. The stages above run in sequence, not in parallel, so a broader scope stretches the whole process rather than any single stage.
Which documents are needed to start?
At minimum: the licence file, register extracts, the policies named in the licence conditions, and an organisation chart showing who holds each control function. The authority usually lists the exact set in its notice.
What happens if the other side does not respond?
If the entity does not respond to the findings letter within the set window, the authority typically proceeds on the file as it stands and may draw an adverse inference from the silence. A late but substantive reply is usually better than none.