When a supervisor asks about governance: what it costs to be wrong
A supervisor's question about governance is rarely idle curiosity. It usually means a specific decision, a licence condition, or a file review has flagged a gap between the written governance framework and what the firm actually does. Answering it badly — late, vague, or with documents that contradict practice — turns a routine information request into a formal finding, a remedial deadline, and a mark against the authorisation file that outlasts the answer itself.
The basis for the question
For a crypto-asset service provider, the duty to maintain sound governance arrangements sits in Regulation (EU) 2023/1114 (MiCA). Authorisation under that regulation, and its continuation, depends on governance being demonstrable rather than merely documented: reporting lines, conflict-of-interest controls, and the persons who actually take decisions. A supervisor's question tests whether the file on record matches the entity that operates day to day.
Where the question also touches the movement of crypto-assets between providers, the parallel obligation sits in Regulation (EU) 2023/1113 (TFR), which governs the information that must travel with a transfer. Governance failures and transfer-information failures are examined on separate evidence, but a supervisor who has already opened one file tends to look at the other before closing either.
What changes once the question is on the table
Three things change immediately. First, the clock starts running from receipt, not from the day a reply is drafted; treating a supervisory question as a casual exchange erodes the goodwill that later shapes how a finding is worded. Second, the burden of proof shifts to the firm. It is no longer enough to show that a governance arrangement exists on paper; the firm must show that it works. Third, every later submission on the same file is read against the answer already given. Contradicting an earlier answer costs considerably more than the original gap would have cost on its own.
None of this means the question is already a finding. Most governance questions close at the informal stage, with a written answer and supporting records. The cost of being wrong sits almost entirely in the second and third round, when an inconsistent or incomplete first answer forces a formal notice that would otherwise not have been necessary.
| Signal from the supervisor | What it usually means | Typical next step |
|---|---|---|
| Informal question by letter or portal message | A discrepancy was noticed; no finding has been made yet | Written answer with supporting records, within the period stated |
| Request for the governance framework itself | The supervisor is testing whether the document matches actual practice | Send the current version in force; a redraft made for the occasion does more harm than good |
| Request for board or committee minutes | The supervisor doubts that decisions are taken where the framework says they are taken | Produce the actual minutes; gaps are noted honestly, not filled retroactively |
| Formal notice with a remedial deadline | The informal stage is over | A remedial plan with named owners and dates, agreed before the deadline falls due |
What to do, in order
- Locate the question in writing. Verbal or informal exchanges are re-confirmed in writing before anything else happens.
- Pull the governance document currently in force, not the draft still under internal discussion.
- Compare it, line by line, against the actual decision-making record: minutes, sign-offs, delegated authorities.
- Flag every point where practice has drifted from the document, before the supervisor finds it first.
- Where the gap concerns how an incident was handled rather than how a decision was taken — for example, When a breach is discovered by a customer — treat that thread separately and answer it on its own facts.
- Send one coordinated answer, on time, with named ownership for each remedial step.
Who decides, and on what evidence
The decision sits with the supervisor that issued the authorisation, not with any internal committee. It is taken on the written record: the governance document itself, the minutes that either support or contradict it, and the firm's own answer to the question. Internal assurances that "this is how we actually do it" carry no weight unless a document or a minute says the same thing. The timeframe for a response is stated in the supervisor's own letter or notice. There is no default period that can be assumed in its absence, and treating silence as permission to delay is itself a governance failure worth noting on the file.
Where the answer differs
If the governance question arose because a brand or mark is being used in a way that does not match what was registered, the governance file is not the right place to fix it — see When the mark is used differently from the registration for the separate track that question follows.
If the gap traces back to design or interface files that an outside agency still holds, the governance answer depends on facts that sit in a different dossier entirely — see An agency keeps the design files ownership of results.
If the question concerns a token whose underlying referenced work has since been taken down, the governance answer and the token's own status are two separate questions. They should not be merged into one submission — see The referenced work is removed tokenised rights what it.
What this page does not cover
This page does not set out the wording of a remedial plan, the content of a governance policy, or how such work is priced — that sits in the product layer of the site, not in this analysis. It also does not cover the separate obligations under Regulation (EU) 2023/1113 (TFR) for transfers already in progress; a governance question and a transfer-information question are examined on different evidence, even when the same supervisor raises both in the same file.
Checked
Primary texts referenced: Regulation (EU) 2023/1114 (MiCA), in force from 30 December 2024, and Regulation (EU) 2023/1113 (TFR), in force from the same date. Both remain subject to implementing measures at national level. A supervisor's own guidance and any national implementing act should be checked directly before relying on the general description above.
Related reading
A related situation, where the identity of the supervisor itself changes mid-project: The regulator changes during the project authorisation what it.
Frequently asked questions
What is the first step when a supervisor asks about governance?
Confirm the question in writing and pull the governance document currently in force, before drafting any answer.
Which deadline is already running?
The one stated in the supervisor's own letter or notice. There is no default period. The clock starts on receipt, not on the day a reply is drafted.
Who decides, and on what evidence?
The supervisor that issued the authorisation decides, on the written record: the governance document, the minutes, and the firm's own answer to the question itself.