Withdrawal procedure: what the decision maker looks at
A withdrawal procedure removes an authorisation before its natural term. The decision maker looks at three things: whether a ground for withdrawal exists, whether the file still supports the licence, and whether the entity can cure the defect within a set window. Miss the cure window, and the decision becomes final.
How the procedure unfolds
The procedure runs in stages, not in one sitting. Each stage produces a document, and each document starts a clock. A supervisor who opens a withdrawal file rarely closes it in a single letter; the file grows through requests, responses, and at least one internal review before a decision leaves the building.
| Stage | What happens | Typical duration |
|---|---|---|
| Trigger identified | Supervisor flags a breach, a gap in reporting, or a failed condition | Days to weeks |
| Notice to the entity | Written notice states the ground and invites a response | Set response window |
| Response and evidence | Entity submits documents, explanations, remediation plan | Weeks |
| Internal review | Supervisor's decision unit assesses the file | Weeks to months |
| Decision issued | Withdrawal, partial withdrawal, or closure of the file | Single act |
The stage that decides outcomes is the third one. A supervisor rarely withdraws on the strength of the original trigger alone; it withdraws when the response fails to answer the trigger.
What the file must contain
The entity's response file needs to answer the exact ground raised, not the ground the entity would prefer to answer. A generic compliance statement without underlying records reads as an admission, not a defence. Where the ground touches client data — who held it, who could access it, and for how long — the file should mirror the discipline used in Access request handling step by step: a clear record of what was requested, by whom, and what was produced.
Three elements recur across withdrawal files that survive review:
- A timeline of the breach, built from the entity's own records rather than reconstructed after the notice.
- A remediation step already taken, not merely promised.
- A named person inside the entity who owns the response and can answer follow-up questions without delay.
Evidence the decision maker weighs
The decision maker weighs evidence the way any registration authority weighs a contested claim: documents dated at the time of the event outrank documents produced for the procedure. The standard resembles the one applied when an applicant must show genuine use rather than assert it — see Proof of use step by step for the same logic applied in a registration context. A remediation plan without a completion date carries little weight. A remediation plan with a completed step and a dated record carries considerably more.
Who decides, and by when
The withdrawal decision sits with the supervisory authority's decision-making unit, not with the case officer who issued the first notice. That separation exists precisely so the entity's response reaches someone who has not already formed a view. The unit issues a written decision; it does not decide informally, and it does not decide by silence.
Deadlines inside the procedure are set by notice, not by habit — one entity's response window is not another's. Where a related time limit runs in parallel, for instance a filing tied to a separate right or registration, the logic of counting and extending those limits follows the same pattern described in Time limits in ownership of results. Missing one deadline inside a withdrawal file rarely ends the matter on its own; missing two usually does.
Developments to watch
Two moments deserve attention because they are easy to miss under time pressure.
If the notice cites a single isolated incident
Respond to that incident specifically. A broad compliance overview reads as avoidance when the notice names one event.
If the notice cites a pattern
Address the pattern with a structural fix, not a one-off correction. Reviewers read a single fix against a cited pattern as incomplete.
If the entity disputes the ground entirely
State the dispute clearly and early, with the contrary evidence attached to the first response. A dispute raised only after the decision is issued moves into a different track — an appeal — which carries its own procedure.
The point of no return
Every withdrawal procedure has a moment after which cure is no longer possible: usually the point where the decision unit closes the file for review. Submissions filed after that moment are not read as part of the withdrawal record; they are read, if at all, as material for a later appeal. Knowing that moment before it arrives is the single most useful piece of information in the entire procedure.
What this page does not decide
This page describes the procedure and the decision maker's approach to evidence. It does not state which specific ground applies to a given entity, and it does not calculate a specific deadline for a specific file — those depend on the notice actually received. It also does not cover the separate track that opens once a decision is issued and the entity wants to contest it.
Related publications
Where withdrawal is contested after the fact rather than answered during the procedure, the relevant next step is Appeal against a supervisory measure step by step.
Verified
This overview reflects the withdrawal procedure as published by supervisory authorities handling digital asset authorisations, cross-checked against public guidance on decision-making practice. Reviewed in the current cycle; procedures and internal deadlines are set by notice and can vary between authorities.
FAQ
How long does the withdrawal procedure take from notice to decision?
There is no fixed total. The response window is set by notice; the internal review that follows typically runs several weeks to a few months, depending on the complexity of the file and whether the entity requests an extension.
Which documents does the entity need to start its response?
At minimum: the notice itself, internal records covering the period in question, evidence of any remediation already taken, and a named contact person for follow-up. Incomplete files invite further requests, which extend the timeline.
What happens if the entity does not respond to the notice?
Silence is treated as no defence. The decision unit proceeds on the trigger and the material already on file, and the resulting decision is issued without the entity's version of events on record.
Before the decision is final
Entities that discover a pledge or a security interest attached to a right mid-procedure often ask a different, more urgent question first — see When a right is pledged on-chain for the immediate steps before that question overlaps with a withdrawal file.