Outsourcing notification: stages and deadlines
Outsourcing notification tells the competent authority that an authorised digital asset provider is delegating a critical function to a third party. The process runs through an internal assessment, a drafted notice, a review window the authority sets, and possible follow-up questions. The point of no return is the day the function goes live without a completed notice.
A missed or incomplete notification does not stop the outsourcing arrangement from working. It does stop the arrangement from being compliant. Supervisors treat an unnotified critical function as an open item during any inspection, and an open item slows down every later approval that depends on a clean file.
What counts as a notifiable outsourcing
Not every vendor contract triggers a notice. The question is whether the outsourced task is a critical or important function, not whether it is convenient to delegate. That classification sits with the provider's compliance function, and it needs to happen before any contract is signed, not after.
The classification decision is a judgement call, made against the provider's own risk profile. A cloud host running core trading infrastructure is a different case from a payroll processor. The provider carries the burden of getting this call right, and the authority reviews the outcome, not the reasoning path taken to reach it.
Stages of the notification
The table below sets out the order of stages. Timing is set by the authority once it receives the file, not by a fixed calendar.
| Stage | What happens | Timing | Who acts |
|---|---|---|---|
| Classification | Provider decides whether the function is critical, important, or neither | Before any contract is signed | Compliance function |
| Draft notice | Description of the function, the provider, and the risk assessment is prepared | Before the outsourcing starts | Compliance and business owner |
| Submission | Notice is sent to the competent authority | On or before go-live | Compliance function |
| Review | Authority may raise clarifying questions | Set by the authority on receipt | Competent authority |
| Closure | Authority acknowledges the notice or raises an objection | After review completes | Competent authority |
What to do
- Compliance function classifies the function as critical, important, or neither, before any contract is signed.
- Business owner and compliance function draft the notice together, covering the function, the provider, and the risk assessment.
- Legal team checks the draft against the authority's published notice format before it goes out.
- Compliance function submits the notice to the competent authority before the arrangement goes live.
- Compliance function tracks the authority's response and answers follow-up questions without delay.
- Business owner holds the go-live date until the file is closed, not merely submitted.
Who decides and how long it takes
The competent authority decides whether a notice is complete and whether the outsourced function needs closer supervision. The authority sets its own review period and communicates it once the file arrives. A closed file, not a submitted one, marks the end of the procedure.
Common forks
If the outsourced function sits outside the EU, the risk assessment has to cover how data leaves the region before the notice can go out. See Transfer mechanism assessment step by step for that separate check.
If the outsourcing partner also builds custom technology for a tokenised offering, ownership of that work needs its own answer before the notice is drafted. Preparatory design material ownership of results explained covers that question on its own terms.
If the outsourcing covers custody of tokenised assets, the metadata standard used for the token can change what the notice needs to describe. What changed in metadata standards tokenised rights sets out the current position.
If the authority reopens a closed file later, the objection functions like a formal review rather than a fresh submission, in the same way a registration can be reopened. Invalidity and revocation step by step shows how that kind of reopening runs in a different register.
What this page does not cover
This page describes the notification workflow, not the substantive test for what makes a function critical in a specific business model. It does not cover notices for other regulated activities, and it does not replace the authority's own published notice form. Where the file itself is disputed, the outcome depends on facts this page cannot anticipate.
Verified
Reviewed: current at time of publication. This material reflects supervisory practice for outsourcing notifications under the authorisation regime applicable to digital asset providers, based on the competent authority's own published procedural guidance rather than on any single legal provision cited here.
FAQ
How long does outsourcing notification take in practice?
The timeline depends on how quickly the file is complete and on the review period the authority sets once it receives the notice. A clean file with a clear risk assessment moves faster than one that needs follow-up questions answered first.
Which documents are needed to start?
A complete notice needs a description of the outsourced function, the identity of the provider, and a risk assessment covering continuity and data handling. Missing any one of these usually triggers a request for more information before review can continue.
What happens if the other side does not respond?
"The other side" here usually means the outsourcing provider, not the authority. If the provider cannot supply information for the risk assessment, the notice cannot go out, and the go-live date should wait until that gap is closed.
Related publications
A related authorisation procedure follows a similar shape. See Change of control approval step by step for how a change in ownership or control is reviewed.
If supervision already means an inspection is likely, read When an on-site inspection is announced before deciding on next steps.
If the outsourced function touches marketing of token products, review When marketing is treated as an offer to avoid running two procedures in parallel without realising it.