When outsourcing is challenged by the supervisor: what to do first
The first step is to freeze the outsourcing file and confirm, in writing, the deadline the supervisor has actually set. Do not answer through the outsourced provider, and do not treat the challenge as a request for general reassurance about the arrangement. Establish the exact function under review, the notification trail behind it, and who inside your organisation is authorised to respond. Everything that follows depends on that record being accurate before anything is sent.
The basis
For crypto-asset service providers, outsourcing sits inside the authorisation framework set out in Regulation (EU) 2023/1114 (MiCA). The regulation treats outsourcing as a matter that goes to the conditions of authorisation itself, not as a side arrangement the supervisor reviews once and forgets. Where the outsourced function touches a transfer of funds or crypto-assets, rather than custody or execution alone, the parallel reference is Regulation (EU) 2023/1113 (TFR). A challenge from the supervisor is, in substance, a request to demonstrate that the arrangement still meets the conditions on which the authorisation was granted, not a demand for a new justification built from scratch.
This distinction matters for the tone of the response. A file that shows continuity — the same governance, the same monitoring, the same exit rights the supervisor was originally told about — answers the challenge more directly than a fresh explanation of why the arrangement is sound in principle.
What changes for you
Once a supervisor raises a formal question about an outsourcing arrangement, an informal clock starts before any written deadline arrives. Internal escalation, evidence-gathering, and legal review compete for the same days, and each one shortens the time left to draft an accurate answer. Treat the first forty-eight hours as fact-finding, not drafting. A rushed answer that needs correction later costs more time overall than a delayed but accurate one, and it also signals to the supervisor that the file was not in order to begin with.
The practical consequence is rarely an immediate suspension. It is a narrowing of the supervisor's patience for a second round of the same question. Organisations that answer once, completely, tend to close the matter faster than organisations that answer quickly but partially.
What to do first
- Freeze the outsourcing file: the agreement in force, the service description, the audit and monitoring records tied to it.
- Identify which specific function the supervisor treats as critical or important, and on what basis it reached that view.
- Reconstruct the notification history — was the supervisor informed before the arrangement went live, or after.
- Name one internal signatory for all correspondence with the supervisor, distinct from the outsourced provider itself.
- Draft a response addressing governance, ongoing control, and exit rights — not only the event that triggered the question.
- Confirm the actual deadline in writing, rather than assuming a standard period that may not apply to this file.
The order matters more than the speed. A response drafted before the notification history is reconstructed tends to contradict the file the supervisor already holds, which turns a single question into a longer exchange.
| Step | Who acts | What gets recorded |
|---|---|---|
| Freeze the file | Compliance or operations lead | Version and date of the agreement currently in force |
| Classify the function | Compliance, with the business owner | Whether the function is critical or important, and on what basis |
| Reconstruct notification | Compliance | Date the supervisor was told, and by what channel |
| Draft the response | Named signatory, with legal input | Governance, control, and exit rights, in one document |
Who decides, and on what evidence
The decision rests with the national competent authority responsible for your authorisation under Regulation (EU) 2023/1114 (MiCA). It works from the file it already holds — the original notification, any prior correspondence, and whatever prompted the current question, whether that is a routine review or an incident report from elsewhere. A written, dated response that matches the file the authority already holds carries more weight than a broader account of why the arrangement is commercially sound.
Where the outsourced function involves a transfer of funds or crypto-assets, the authority may also test the response against the information trail required by Regulation (EU) 2023/1113 (TFR). A file that can show both — continuity of governance and continuity of the information that travels with the transfer — closes faster than a file that can only show one.
If your situation differs
If the trigger for the challenge is a security incident at the outsourced provider rather than a routine review, the sequence of first steps is different, and the clock starts earlier: see A vulnerability disclosure is published data protection.
If the outsourced function itself depends on a tokenised right whose registration status is unclear, the outsourcing question cannot be separated from the underlying right, and both need to be addressed in the same response: see The token refers to an unregistered right tokenised rights.
If the outsourced function includes a model or a data pipeline whose training material has no documented origin, the provenance gap is usually the real issue, and the outsourcing challenge is only its visible symptom: see The training corpus has no provenance ownership of results.
If the outsourced arrangement extends into physical goods bearing a mark, and customs rather than the financial supervisor is the first authority to intervene, a different procedure applies from the outset: see When customs stops counterfeit goods.
What this page does not cover
This page does not cover the substance of a shareholder or ownership change that itself requires prior approval — that has its own procedure and its own deadline, separate from an outsourcing review. It does not set out fees, the full timeline of an authorisation review, or the drafting of the outsourcing agreement itself. It does not replace the supervisor's own guidance on the format its correspondence expects. Where the challenge overlaps with a pending ownership change, the two files should be reconciled before either response is sent, not treated as unrelated.
Verified
Checked against the current text of Regulation (EU) 2023/1114 (MiCA) and Regulation (EU) 2023/1113 (TFR), both in force from 30 December 2024. Last checked: 12 May 2025.
Related publications
A related procedural question, on the same authorisation, often arrives from a different direction and on a different clock: see A shareholder change requires approval authorisation.
FAQ
What is the first step when outsourcing is challenged by the supervisor?
Freeze the outsourcing file and confirm, in writing, the deadline the supervisor has actually set. Do not answer through the outsourced provider, and do not draft before the notification history is reconstructed.
Which deadline is already running?
Usually more than one: an informal clock from the first contact, and a formal one once the supervisor puts its question in writing. Treat the earlier of the two as binding, not the one that is easier to meet.
Who decides, and on what evidence?
The national competent authority responsible for your authorisation under Regulation (EU) 2023/1114 (MiCA), working from the notification file it already holds and, where relevant, from the information trail required by Regulation (EU) 2023/1113 (TFR).