When a complaint triggers a review: what to do first
When a competent authority opens a review after receiving a complaint, the first task is procedural, not substantive. Confirm what was filed, when the clock started, and which authorisation file the authority is looking at. Answer inside the stated period, in writing, before you assess the complaint on its merits.
Basis
Authorisation of a crypto-asset service provider, and the supervision that follows it, sits under Regulation (EU) 2023/1114 (MiCA). Where the complaint concerns information accompanying a transfer of crypto-assets, Regulation (EU) 2023/1113 (TFR) applies as well. Neither regulation sets out a single complaints procedure. The procedure comes from the authority that granted the authorisation, and it can differ between authorities.
What changes once the review opens
A review that starts with a complaint does not suspend an existing authorisation by itself. It opens a period during which the authority can request documents, interview staff, or ask for a remediation plan. Nothing in the file needs to be conceded at this stage.
If the conduct behind the complaint also touches users in another member state, the file often widens into a cross-border matter, and coordination between authorities follows its own timetable. When an incident touches several countries sets out how that coordination usually runs, and where it slows things down.
What to do
- Identify precisely which authorisation the complaint concerns, and pull the file reference from the acknowledgement letter.
- Record the date the authority registered the complaint, not the date its letter reached you. The response clock usually runs from registration.
- Assign one internal owner for the file. The authority expects one contact, not several people answering separately.
- Collect the operational records the complaint refers to — transaction logs, client communications, onboarding checks — before drafting any response.
- Draft a written response confined to facts and documents. Do not dispute or admit wrongdoing before the authority states its findings.
- Keep a log of every contact with the authority, by date and by name, for the rest of the review.
Who decides
| Stage | Who acts | What is decided |
|---|---|---|
| Registration | The authority's intake unit | Whether the file is opened at all |
| Review | Supervisory division of the same authority | Whether to request documents or open formal proceedings |
| Outcome | The authority, jointly with a peer authority if the conduct is cross-border | Whether the authorisation is varied, suspended, or unaffected |
If the facts differ
If the complaint concerns who actually holds the rights behind a tokenised asset, rather than how the service is run, the review can sit next to a separate ownership dispute. The buyer of a token is not the rights looks at that situation on its own terms.
If the complaint arrives alongside a separate enforcement step against the same brand — for instance, When a trade fair seizure is threatened — treat the two files as connected, but answer them separately. The authority reviewing the authorisation is not the body deciding a trade mark matter.
If the dispute reaches back to who owns the design files behind the platform or the token's visual identity, that question sits outside supervision entirely. The client wants the design files, not just the covers what to check before assuming ownership follows from payment.
What this page does not cover
This page does not tell you how long a given review will take, or what evidence tips the outcome. Both depend on the file and on the authority's internal procedure, and neither is published in a form this page can cite with certainty. It also does not cover appealing a decision once the review has closed — that is a separate procedure, with its own forum and its own clock.
Verified
Checked against the current text of Regulation (EU) 2023/1114 (MiCA) and Regulation (EU) 2023/1113 (TFR). Neither regulation sets a fixed complaint-response period; that detail sits in the practice of the authority handling the file, not in the regulation itself.
Related situations
A review that starts with a complaint often sits next to a different kind of authorisation problem. The application file is returned with questions authorisation what looks at the file-return stage many providers face before any complaint appears.
FAQ
What is the first step when a complaint triggers a review?
Confirm the file reference, the date of registration, and which authorisation the complaint concerns. Do this before drafting any substantive response.
Which deadline is already running?
The response period starts on the date the competent authority registers the complaint, not the date its letter reaches you. The exact length of that period is set by the authority and stated in its acknowledgement letter. Treat the registration date as the trigger, regardless of postal delay.
Who decides, and on what evidence?
The authority that granted the authorisation decides, based on the documents and records it requests during the review. Where the conduct affects users in another member state, that authority coordinates with its counterpart before reaching an outcome.
We handle authorisation reviews as part of ongoing supervision work for crypto-asset service providers. If a complaint has already been registered against your authorisation, write to us with the file reference and the registration date. A partner responds within minutes during business hours, and a fixed quote for handling the response follows within one working day.