When outsourcing is challenged by the supervisor: what it costs to be wrong
A challenge to an outsourcing arrangement does not suspend the service. It starts a deadline set by the supervisor for producing oversight evidence: the outsourcing policy, the provider's due-diligence file, and records of ongoing monitoring. Under Regulation (EU) 2023/1114 (MiCA), the authorised entity keeps full responsibility for the outsourced function throughout, whatever the provider actually did.
Basis
Regulation (EU) 2023/1114 (MiCA) sets the framework under which a crypto-asset service provider may outsource operational functions without losing its authorisation. Outsourcing does not transfer regulatory responsibility. The authorised entity answers for the outsourced function as if it performed the task itself, and the supervisor addresses its questions to the authorised entity, not to the provider.
Where the outsourced function touches transfers of crypto-assets, Regulation (EU) 2023/1113 (TFR) adds its own information requirements on the parties involved in the transfer. A supervisor reviewing the arrangement checks compliance under both instruments together, not under either one in isolation. The provider's own compliance record does not substitute for the entity's own oversight file.
Practical consequence
A challenge changes the burden of proof. Before the challenge, keeping the file was enough. After it, the file has to be produced on the supervisor's schedule, in a form the supervisor accepts, covering the exact period named in the notice. The outsourcing agreement is then read line by line: audit rights, termination triggers, sub-outsourcing consent, data location, and the notification duty owed to the supervisor itself.
A gap in any of these clauses is treated as a gap in oversight, whatever the arrangement's actual track record has been. Silence in the file reads worse than an imperfect answer that arrives on time. If the outsourced function is IT security or infrastructure and the provider discloses a vulnerability during the review, a separate timeline runs in parallel. See When a vulnerability disclosure is published.
What to do
- Pull the outsourcing register entry for the challenged function immediately, before drafting any response.
- Assemble the provider's due-diligence file: selection criteria, financial standing, and the sub-outsourcing chain if one exists.
- Confirm the monitoring log covers the exact period the supervisor names, not a broader or narrower window.
- Check the agreement's audit and termination clauses against what the supervisor's notice is actually testing.
- Route the file through the compliance officer before submission, not around them, even under deadline pressure.
- Set an internal deadline earlier than the supervisor's, so a gap can still be closed before it is filed.
Who decides
| Actor | What it examines | What follows |
|---|---|---|
| Competent authority for the authorised entity | Outsourcing policy, agreement terms, provider risk profile | Written finding: no action, remediation order, or restriction on the function |
| Management body of the authorised entity | Internal escalation, sign-off on the remedial plan | Formal response filed within the deadline the supervisor's notice sets |
| Outsourced provider | Cooperation with the review, document production on request | Contractual consequence set by the outsourcing agreement itself, not by the supervisor |
The supervisor's finding is addressed to the authorised entity. The provider is not a party to the proceeding, even where its own conduct triggered the review.
Forks
If the outsourced function runs under a shared or co-branded name, the challenge often mirrors a branding dispute rather than a pure oversight gap. See When a coexistence agreement is proposed.
If the outsourced function includes data or model processing without a documented chain of custody, the supervisor asks questions of the same kind. See The training corpus has no provenance ownership of results.
If the outsourced provider also handles token issuance and a creator disputes the mint, the two matters often draw on the same record set. See The creator disputes the mint tokenised rights what it.
If none of these apply and the challenge concerns oversight alone, the file described above is the whole answer, and no adjacent dispute needs to be opened.
Limit
This page does not decide whether the outsourcing arrangement was compliant before the challenge began. That depends on the agreement's actual terms and on how monitoring was run in practice, neither of which this page can see.
It does not set a fee for assembling the file, and it does not replace a line-by-line review of the specific outsourcing agreement. A challenge that also touches a shareholder in the outsourced provider raises a separate approval question, addressed on its own terms elsewhere in this practice.
Verified
Checked: 18 March 2025. Primary sources: Regulation (EU) 2023/1114 (MiCA); Regulation (EU) 2023/1113 (TFR).
Related publications
A related question on the same practice: A shareholder change requires approval authorisation what it costs.
FAQ
What is the first step when outsourcing is challenged by the supervisor?
Pull the outsourcing register entry for the challenged function and confirm which supervisor sent the challenge. Everything else in the response depends on that entry matching the file already on record, not on a file built after the notice arrives.
Which deadline is already running?
The deadline set in the supervisor's notice for producing the oversight file: the outsourcing policy, the provider's due-diligence record, and the monitoring log for the named period. The clock starts on the date of the notice, not on the date the internal file review begins.
Who decides, and on what evidence?
The competent authority for the authorised entity decides, on the outsourcing agreement, the due-diligence file, and the monitoring records covering the disputed period. The management body signs off on the response before it is filed, and the outsourced provider is not itself a party to the finding.
First response from a partner arrives within minutes during business hours. An estimate for the review follows within one business day.