Remediation plan agreement: documents to prepare
A remediation plan agreement sets out how a digital-asset firm closes a compliance gap identified by its supervisor. The firm proposes actions and deadlines; the supervisor reviews and either accepts, requests changes, or rejects the plan. Preparation means gathering evidence of the gap, a root-cause note, and a governance-approved action list before the first exchange starts.
Why a remediation plan becomes necessary
Supervisors raise a remediation requirement after an inspection, an incident report, or a periodic review flags a shortfall against the firm's authorisation conditions. The finding rarely arrives as a surprise; it usually follows a request for information the firm has already answered once. What changes at this stage is the format: the supervisor now expects a written plan, not a further explanation.
The supervisor overseeing a digital-asset authorisation is not the same body as the one handling personal-data matters. Readers dealing with a data-protection finding rather than an authorisation finding should read Supervisory authority data protection explained instead of this page.
A plan is not a form to be filled in. It is a negotiated document, and the point of no return is the supervisor's written acceptance — not the date the firm submits it.
Documents to prepare
The table below lists the core file. Firms with more than one authorisation, or with a finding that touches technical systems, will add supporting material to most rows.
| Document | Purpose | Typically prepared by |
|---|---|---|
| Gap description note | States the finding in the firm's own words, cross-referenced to the supervisor's letter | Compliance lead |
| Root-cause analysis | Explains how the gap arose, not only what it is | Compliance lead with the relevant business owner |
| Corrective action list | Sets out each action, an owner, and a target date | Business owner, reviewed by compliance |
| Evidence trail | Shows the state of controls before and after the gap was found | Operations or technology team |
| Governance sign-off | Confirms senior management or the board approved the plan before it is sent | Board or senior management |
| Cover submission | The document actually sent to the supervisor, referencing the file above | Compliance lead |
The document logic here is not unusual: most regulated filings follow the same pattern of a description, an evidence set, and a sign-off, similar to the sequence in Conversion of an application step by step.
Practical consequence
Every day spent drafting without evidence in hand delays the clock, because the supervisor will not treat a plan as complete until the evidence trail supports each action. Silence from the supervisor after submission does not amount to acceptance. A firm that treats non-response as approval and proceeds on that basis takes on the risk itself.
Where a third party holds part of the evidence — a custody vendor keeping access logs, for example — the position is close to the one described in Photonics and instrumentation — when an agency keeps the design files: request the export early, because the vendor's own turnaround adds to the firm's timeline.
What to do
- Draft the gap description note in plain language, referencing the supervisor's own wording. Owner: compliance lead.
- Assemble the evidence trail covering the period before and after the finding. Owner: the team that runs the affected control.
- Write the corrective action list with named owners and target dates for each item. Owner: compliance lead, signed off by each business owner.
- Secure governance sign-off before the plan leaves the building. Owner: board or senior management, depending on the firm's structure.
- Submit the plan through the same channel the finding arrived on. Owner: compliance lead.
- Log the supervisor's response and any request for changes, and update the action list accordingly. Owner: compliance lead.
Who decides
The supervisor that issued the original finding decides whether the plan is accepted. The forum is written correspondence in almost every case; a meeting is the exception, usually reserved for findings the supervisor treats as serious. The supervisor typically confirms receipt without delay, but a substantive response — acceptance, a request for changes, or rejection — can take longer, and the firm should not assume a timetable the supervisor has not confirmed in writing.
Common forks
If the gap concerns governance documents only — a missing policy, an outdated procedure — the plan can often be a paper exercise: a revised policy plus evidence that the board approved it.
If the gap concerns a technical control, such as custody or wallet-access management, the plan will usually need vendor confirmation and, in most cases, a testing record showing the fix works, which extends the timeline described above.
If the same gap has already triggered a claim from a token holder, the remediation plan should cross-reference that file rather than restate it; the cost exposure of that separate track is covered in When enforcement is sought against a holder.
What this page does not cover
This page does not decide how much remediation work a given finding requires — that depends on the finding itself and on the firm's existing controls. It does not replace advice on the underlying compliance gap, and it does not cover coordination across more than one EU authorisation, which typically needs a separate, parallel file for each supervisor involved.
Verified
Reviewed against current supervisory practice for digital-asset authorisation holders and against our own file-preparation checklists. This page describes process, not legal basis, and cites no statute or regulation for that reason.
Related publications
Firms preparing a remediation plan often need a parallel file for ongoing obligations. See Regulatory reporting set-up step by step for that adjacent process.
Talk to us
If a supervisor has asked your firm for a remediation plan, get the compliance lead and the relevant business owner in the same room before drafting starts. We can review the plan before it goes out.
FAQ
How long does remediation plan agreement take in practice?
It rarely closes in a single exchange. Expect several weeks at minimum, and longer where the plan touches more than one system or more than one authorisation.
Which documents are needed to start?
At minimum, the gap description note and a first draft of the corrective action list. Everything else in the table above can follow once the supervisor has confirmed the shape of the plan it expects.
What happens if the other side does not respond?
Silence is not acceptance. Follow up in writing, keep the request specific, and continue implementing the actions your firm has already committed to internally — waiting idle for a response is its own risk.