When an on-site inspection is announced: what it costs to be wrong
An announced on-site inspection tests whether your authorisation still matches how you operate. Getting it wrong rarely means a fixed fine. It means lost time: missing records, unavailable staff, or unclear answers extend the visit, invite follow-up requests, and can produce a formal finding. That finding is slower to unwind than the visit was to prepare for.
What the inspection is testing
Authorisation under Regulation (EU) 2023/1114 (MiCA) carries an ongoing duty to operate as described in the application. MiCA has applied since 30 December 2024. An on-site inspection is how a supervisory authority checks that duty in person, and not solely from the file submitted at authorisation. Where your service also moves crypto-asset transfers, Regulation (EU) 2023/1113 (TFR) sits alongside MiCA. Inspectors typically review both regimes in the same visit, not in two separate ones.
What changes once the notice arrives
The notice starts a clock. Records requested in the letter must be produced within the stated window. Staff named for interview must be available on the day. If part of your operation runs through a subprocessor, the review often extends to that arrangement too. The separate question of When a subprocessor is added mid-term is decided outside this notice, but inspectors will still ask about it if it touches the scope named in the letter.
| Stage | What typically happens | What you do |
|---|---|---|
| Notice received | Scope, date, and legal basis stated in writing | Confirm scope and date with the named contact |
| Before the visit | Records requested in advance | Assemble and index the requested records |
| On site | Interviews and document review | Route interpretation questions through legal counsel |
| After the visit | Findings letter with a response deadline | Respond in writing within the stated deadline |
What to do, in order
- Confirm the scope, date, and legal basis stated in the notice with the contact person named in it — compliance officer.
- Assemble the requested records and index them against the letter, item by item — compliance team.
- Brief every staff member who may be interviewed on the factual scope only, not on legal argument — management.
- Arrange for legal counsel to be present or reachable throughout the visit — appointed adviser.
- Log every document handed over and every question asked, with a timestamp — compliance officer.
- Escalate the notice to your legal adviser before the first day of the visit, not after — management.
Who decides, and by when
Your national competent authority for crypto-asset service provider authorisation decides whether the findings support a formal measure. It weighs what was produced on site — records, statements, and documents — against the conditions attached to your authorisation. The deadline for your written response runs from receipt of the findings letter, not from the date of the visit itself.
If your situation branches
Not every inspection follows the same path once specific facts surface. Three branches recur.
If your team joined through an acquisition, inspectors sometimes ask about the background work that came with it. That question runs on its own track, covered separately in An acquired team brings prior work ownership of results, and an inspection does not resolve it.
If your token structure refers to a right that is not itself registered anywhere, the mismatch can surface in the same review. That analysis sits apart from the inspection and is addressed in The token refers to an unregistered right tokenised rights.
If marketing material reviewed during the visit connects to a third party's brand, that sits outside the authorisation question itself, covered in When a domain mirrors your brand.
What this page does not cover
This page does not decide whether a specific finding is correct, and it does not fix a defect in the authorisation itself. It does not resolve intellectual property, domain, or trade mark questions that surface incidentally during a visit. Those follow their own procedure, on their own timeline. It also does not set the inspection's scope: that is fixed by the notice and by the authority conducting it.
Related situations
A related authorisation scenario, covered in What it costs to be wrong in this situation, looks at what happens when the business model changes while an application is still pending.
Verified
Checked against Regulation (EU) 2023/1114 (MiCA) and Regulation (EU) 2023/1113 (TFR). Reviewed on 12 June 2025.
Frequently asked questions
What is the first step when an on-site inspection is announced?
Confirm the scope, date, and legal basis stated in the notice with the named contact. Then assemble the requested records against that scope before the visit begins.
Which deadline is already running?
The window for producing requested records runs from the date of the notice. A second deadline starts later, for your written response to the findings letter, counted from receipt.
Who decides, and on what evidence?
Your national competent authority decides. It weighs the records, statements, and documents produced during the visit against the conditions attached to your authorisation.