When an on-site inspection is announced: what to do first
The first task after an on-site inspection notice is procedural, not substantive: confirm the scope, the legal basis stated in the notice, and the deadline it sets. Do this in writing, on the same day, before anyone touches a file the inspectors are likely to ask for. Everything that follows — freezing records, naming a contact, briefing staff — depends on getting this first step right.
What the notice is testing
An authorised crypto-asset service provider under Regulation (EU) 2023/1114 (MiCA), in force from 30 December 2024, remains subject to ongoing supervision by the authority that granted its authorisation. Where the inspection also covers transfers of crypto-assets, the reviewing team will test compliance with Regulation (EU) 2023/1113 (TFR), in force from the same date. Both regulations frame what an inspector is entitled to examine. Neither one fixes the timetable for the visit itself — that is set by the supervisor and stated in the notice you received.
What changes the moment the notice arrives
Once the notice lands, the clock the supervisor set starts running, whether or not you have acknowledged it. Staff named in the notice, or reasonably likely to be asked for by role, need to be available on the dates given. Any document that could fall within the announced scope should stop being edited, reorganised or deleted from that point forward, regardless of your normal retention practice. The business keeps operating, but every decision taken during the inspection window should assume it may later be reviewed.
What to do, in order
- Confirm scope in writing. The compliance officer restates the announced scope back to the supervisor on the same day, to fix what is and is not covered.
- Freeze the record set. The compliance officer instructs relevant staff not to delete, amend or reorganise any file that could fall within that scope.
- Name one point of contact. The chief executive or authorised representative designates a single person to receive instructions from the inspection team and to answer on the firm's behalf.
- Brief the staff who will be present. The compliance officer tells reception, IT and the relevant business teams what an inspector may ask directly and what is routed to the point of contact.
- Log every request on site. Whoever is designated as the point of contact keeps a running written record of what was asked, by whom, and what was handed over.
- Call counsel before the inspectors arrive, not after. Advice on scope and on what may be withheld is most useful before the first document changes hands.
Who decides, and on what timetable
The decisions that matter during an inspection sit with the supervisor, not with the inspection team on the day, though the two overlap in practice.
| Decision point | Who decides | Basis for the decision |
|---|---|---|
| Scope of the visit | Competent authority that granted the authorisation | The notice served on the provider |
| Whether a document falls within scope | Inspection team on site, confirmed by the supervisor | Categories stated in the notice |
| Outcome of the inspection | Competent authority, after the visit | Evidence gathered on site and in any follow-up correspondence |
If your situation is not the simple case
If the inspection coincides with a recent change to your processing chain — a new subprocessor handling client data or transaction records — say so at the outset rather than let the inspector find it later. A subprocessor is added mid-term data protection sets out what changes once a processor is added after the fact, and the same discipline about documentation applies here.
If the firm is mid-rebrand when the notice arrives, keep the registered name and the trading name that inspectors will check clearly separate in every answer you give. When a rebrand collides with an earlier right covers the wider risk of running a rebrand without clearing prior rights, a point some supervisors ask about directly.
If the team under review joined through an acquisition and still relies on tools or code built before the deal closed, flag that provenance before the inspector asks. An acquired team brings prior work ownership of results deals with the ownership question sitting behind that kind of disclosure.
If the inspection also touches a tokenised offering and the issuer no longer has practical control over the underlying smart contract, that fact belongs in the first meeting, not the closing one. The issuer loses control of the contract tokenised rights explains what changes once control is lost.
What this page does not cover
This page does not explain how the original authorisation was granted, what a follow-up review may involve, or how a group spanning several jurisdictions should structure its response — each depends on facts this page cannot see. It also does not replace advice on privilege: what an inspector may examine, and what stays protected, depends on the specific request in front of you, not on a general rule.
Verified
Checked on 4 March 2025. This page relies on Regulation (EU) 2023/1114 (MiCA) and Regulation (EU) 2023/1113 (TFR), both in force from 30 December 2024. Where a notice also cites national supervisory rules beyond these two regulations, that basis is confirmed case by case, since the relevant national implementing text falls outside the scope of this page.
Related situations
If the trigger for your inspection was a change earlier in the process — a new investor, a new market, a revised business plan — the sequencing question is different. When the business model changes mid-application covers what to do when the model shifts before authorisation is even granted.
FAQ
What is the first step when an on-site inspection is announced?
Confirm the scope and the legal basis stated in the notice, in writing, on the day it arrives. Everything else — freezing records, naming a contact, briefing staff — follows from that first confirmation.
Which deadline is already running?
The deadline stated in the notice itself starts on receipt, not on the day you reply. The supervisor sets that period and communicates it in writing; neither MiCA nor TFR fixes it in advance.
Who decides, and on what evidence?
The competent authority that granted the authorisation decides, based on what the inspection team gathers on site and in any follow-up correspondence. The provider's own submissions become part of that evidence once they are on file.
If the inspectors are already on site
Call before you answer a question you are unsure about. We respond within minutes during business hours, and a fee estimate for the specific engagement follows within one working day.