When the file is incomplete on AML: what it costs to be wrong
An incomplete AML file does not pause your application; it starts a clock. The competent authority issues a deficiency notice, sets a deadline for the missing evidence, and treats a non-response as a ground for refusal. Under Regulation (EU) 2023/1114 (MiCA), authorisation cannot proceed while AML/CFT governance arrangements remain unverified.
Basis
Regulation (EU) 2023/1114 (MiCA) sets governance and safeguarding requirements that a crypto-asset service provider must evidence before authorisation is granted. Regulation (EU) 2023/1113 (TFR) adds a parallel obligation: transfers of crypto-assets must carry originator and beneficiary information, and the provider must show it can capture and verify that information before the licence takes effect.
An AML file that omits either strand is not a stylistic gap. It is a missing precondition. The authority cannot approve what it cannot verify, and it will not guess on your behalf.
Practical consequence
Once the regulator flags the file as incomplete, the assessment clock does not reset — it pauses on your side and resumes only once every requested item lands. Firms lose weeks here for a narrow reason: KYC evidence was collected through a vendor, and nobody settled in writing who controls that data before submission.
The same dispute surfaces where When a joint controller relationship is denied is at issue, and the fix is identical: settle controllership before the file goes back, not after the regulator asks a second time.
| Gap category | What the authority asks for | Typical resubmission step |
|---|---|---|
| Business-wide risk assessment | Dated, version-controlled document | Reissue with revision history attached |
| Source-of-funds evidence | Traceable documentation per customer tier | Supplementary submission, same file reference |
| Travel-rule mechanism | Working originator/beneficiary capture under TFR | Technical evidence plus a live test log |
| Sanctions screening | Screening tool and escalation procedure | Procedure document with named responsible officer |
What to do
- The compliance officer audits the file against both regulations, item by item, before drafting a response.
- The MLRO rebuilds the business-wide risk assessment with dated version control, rather than patching the existing draft.
- Before resubmission, the compliance team reconciles the applicant's trading name against the trade mark register — a mid-application rebrand multiplies the paperwork in ways close to When a rebrand collides with an earlier right.
- The applicant confirms the travel-rule mechanism required under Regulation (EU) 2023/1113 (TFR) is live, tested, and documented, not merely designed.
- The file is resubmitted through the same channel, referencing the deficiency notice number issued by the authority.
Who decides
The competent authority of the home member state decides, and it decides on the resubmitted file alone. Reputation, history, or prior authorisations elsewhere carry no weight at this stage — only the evidence in front of the reviewer does.
Ownership of the compliance manual itself can complicate that review. When the AML procedures were drafted by a group subsidiary and invoiced to the parent, the authority may ask who holds the rights to that document before it accepts it as the applicant's own work — a question close to A subsidiary paid for work the parent uses ownership.
Forks
If the gap is limited to one missing risk assessment, closing it typically requires only a supplementary submission, not a fresh application.
If your group already circulates a token under a licence that is approaching expiry, the AML gap does not pause that circulation — the token keeps moving while the file is rebuilt, which is the situation examined in A licence terminates but the token remains tokenised rights.
If the file lacks a working travel-rule mechanism under Regulation (EU) 2023/1113 (TFR), the authority tends to treat the whole application as materially incomplete, and the review restarts rather than pauses.
Limits
This page does not set national processing deadlines, does not calculate any fee, and does not draft your risk assessment. It sets out the order of steps and the level at which the decision is made. The substance of your file is a separate exercise, done against the current text of both regulations.
Verified
Checked against Regulation (EU) 2023/1114 (MiCA) and Regulation (EU) 2023/1113 (TFR), both in force from 30 December 2024. Last checked in April 2025. No national implementing measure is cited on this page, in line with the review scope for this material.
Related situations
Group structures raise a related question when the licence itself, not the file, differs by entity: When a group entity holds a different permission.
FAQ
What is the first step when the file is incomplete on AML?
Line up the deficiency notice against the file, item by item, before drafting anything. The notice tells you exactly what the authority considers missing, and it is the only reliable checklist at this stage.
Which deadline is already running?
The deadline the authority set in its deficiency notice, not the original application timeline. That clock started the day the notice was issued, and it governs the resubmission window.
Who decides, and on what evidence?
The competent authority of the home member state decides, on the resubmitted file alone. It does not weigh prior authorisations held elsewhere in the group or the applicant's general standing.
Next step
An incomplete AML file rarely stays incomplete for one reason only. If a gap on your file touches governance, risk assessment, or the travel-rule mechanism, get the deficiency notice reviewed before you draft a response. Write to us with the notice attached, and we will confirm the fastest path back into the process.