When the application file is returned with questions: what to do first
A returned application file is not a rejection. It is a formal request for further information, and it resets the clock the competent authority uses to assess the file. Log the date, assign one owner, and route every question back through the same channel. Draft the substantive answers only after that step is done.
Basis: which framework the questions sit under
A crypto-asset service provider seeking authorisation is assessed under Regulation (EU) 2023/1114 (MiCA). The regulation sets out the authorisation procedure that a competent authority follows, including its power to request further information before it decides whether to grant, refuse, or extend its review of a licence. When a file comes back with questions, the questions are issued under that same procedure, not under a separate complaint or enforcement track.
A second framework surfaces in many files, particularly where the applicant's business model involves transfers of crypto-assets between providers. Regulation (EU) 2023/1113 (TFR) sets out the information that must accompany such transfers, including data about the originator and the beneficiary. Supervisors reviewing a file commonly test whether the policies described in the dossier already meet this standard, and questions about originator and beneficiary data typically trace back to this framework rather than to the authorisation procedure itself.
| Framework | What it checks in the file | Reference |
|---|---|---|
| Authorisation procedure | Completeness and quality of the application dossier before a licence decision | Regulation (EU) 2023/1114 (MiCA) |
| Transfer information rules | Whether originator and beneficiary data policies in the file meet the applicable standard | Regulation (EU) 2023/1113 (TFR) |
What changes once the questions land
Once the competent authority issues questions, the practical effect is procedural rather than substantive: the file does not move forward until the questions are answered. Many authorities treat the assessment period as paused for as long as the applicant takes to respond in full, so a slow or partial reply extends the entire timeline, not just the answer itself.
There is a secondary risk that has nothing to do with the substance of the questions. A letter that sits unassigned, or that reaches the wrong desk internally, produces a delay the authority never intended and the applicant never explains. Naming one owner on the day the letter arrives removes that risk before it becomes a pattern.
What to do first
- Have the compliance lead log the date the letter arrived and list every question separately.
- Have the compliance lead map each question to the file section and the policy document it targets.
- Have the legal team draft one answer per question, in the order the authority used.
- Have the original signatory review and sign the response before it leaves the building.
- Have the compliance lead send the answer through the same channel the authority used, and record the date sent.
Who decides, and on what evidence
The competent authority that received the original application also decides whether the answers close the outstanding questions. No court, ombudsman, or parallel regulator reviews the file at this stage; the decision sits entirely within the authority's own assessment process.
The evidence the authority weighs is the written record: the original application, the questions as issued, and the answers as submitted, including any supporting documents attached to the reply. Oral clarifications, where an authority allows them, do not replace the written file and are not treated as the decisive evidence.
Four ways the questions can branch
If the questions concern how customer or transaction data is secured, rather than how the business itself is structured, the issue often runs in parallel to the authorisation file rather than inside it. The approach to a first request of that kind, from a supervisor with a data protection mandate, is set out in A supervisory authority sends a first request data protection.
If the questions raise a naming or branding conflict spotted during the review, the underlying issue belongs to trade mark law, not authorisation law. The starting point for that separate question is When a similar mark is filed in your class.
If the questions concern who actually owns the code behind the platform described in the file, particularly where a contractor built part of it, the issue is one of ownership, not licensing. That situation is addressed separately in A contractor claims ownership of the code ownership of.
If the questions ask whether a token already described in the file carries authorisation granted somewhere else, the file needs to address that claim on its own terms before the wider application can proceed. The relevant starting point is A token claims to carry a licence tokenised rights.
What this page does not cover
This page does not cover how many rounds of questions a typical file takes, how the questions themselves are drafted, or what happens once authorisation is granted. It also does not set out the governance requirements a competent authority may be testing — only how to handle the request once it arrives. Where the questions extend into governance and internal control, that separate situation is addressed elsewhere on this site.
Related publications
A related situation, where the supervisor's questions concern governance and internal control arrangements rather than the dossier's completeness, is covered in When a supervisor asks about governance.
Verified
Checked against: Regulation (EU) 2023/1114 (MiCA); Regulation (EU) 2023/1113 (TFR). Reviewed: 2025.
Frequently asked questions
What is the first step when the application file is returned with questions?
Log the date the letter arrived, list every question separately, and assign one internal owner before anyone drafts a substantive answer. Treat the first step as procedural: assigning ownership matters more, at this stage, than the content of any single answer.
Which deadline is already running?
The competent authority's own assessment timetable starts running again from the date of the letter. The exact number of days it allows for a reply is set out in the letter itself and in the authority's published procedure, not as a fixed figure that applies to every file.
Who decides, and on what evidence?
The same competent authority that received the original application decides, based on the written record: the original file, the questions as issued, and the answers submitted in response. No other body reviews the file at this stage.