When the file is incomplete on AML: what to do first
Notify the supervisor's case handler before the missing item is formally requested. Submit a short written completion plan with dates for each outstanding component. Do not wait for a deficiency letter to start acting — the informal clock is already running, and a plan in writing is the only thing that visibly shortens it. Treat the gap as a governance question inside your own file, not as paperwork to finish later.
Basis
For a crypto-asset service provider seeking authorisation, the AML-relevant parts of the file sit inside the wider authorisation dossier governed by Regulation (EU) 2023/1114 (MiCA). Where the missing item concerns information accompanying transfers of crypto-assets — the so-called travel rule data — the relevant obligation is set out in Regulation (EU) 2023/1113 (TFR). Both regulations apply directly; there is no national transposition step to check separately for the substance of these two obligations.
What changes for your timeline
An incomplete file does not automatically stop the clock. In most supervisory practice, the assessment period pauses only once the authority issues a formal request for additional information, not from the moment you notice the gap yourself. Waiting for that formal request wastes days you could use to prepare. If the missing item touches data shared between two group entities acting as joint controllers, and that When a joint controller relationship is denied status is itself contested, the AML file cannot be completed until that underlying question is resolved.
| Missing item | Why it stalls the file | Typical fix |
|---|---|---|
| Beneficial ownership chain | Supervisor cannot verify the controlling person | Full chart with each layer, dated and signed |
| AML/CFT policy not tailored to the licence | Reads as generic, not risk-based | Rewrite around the actual product and client base |
| No named AML compliance officer | No accountable person for the supervisor to address | Appoint and file the CV and mandate |
| Travel rule data flow not described | Gap against the TFR obligation for transfers | Add the data flow map for originator and beneficiary information |
| Source-of-funds evidence thin | Cannot support the risk assessment | Add documentary evidence, not a narrative summary |
What to do first
- The compliance officer lists every outstanding item against the original checklist, with a date for each.
- The applicant entity sends the list to the case handler as a voluntary completion plan, before any formal deficiency notice arrives.
- If a subsidiary prepared the underlying work but the parent entity is the applicant — a pattern close to A subsidiary paid for work the parent uses ownership — confirm in writing which entity holds the file and can respond authoritatively.
- Management approves the AML/CFT policy version that will be filed, dated and version-numbered.
- The compliance officer confirms the travel rule data flow map matches the actual payment and settlement architecture, not a template.
- Legal counsel checks that every substantive answer, once filed, closes the item rather than triggering a follow-up question.
Who decides
The national competent authority's case handler assesses completeness first, against an internal checklist that is not published in full. A formal deficiency letter, once issued, usually sets a fixed response window measured in weeks rather than days. The decision to treat the file as complete, and therefore to resume the substantive assessment period, sits with the same authority — there is no separate appeal step at this stage, because no refusal has been issued yet.
Forks
If the missing item is purely administrative — a missing signature page, an outdated CV — resubmit within days and ask the case handler to confirm receipt in writing.
If the missing item is substantive, such as the risk assessment itself, do not resubmit a thin version to hit a deadline; a rejected resubmission counts against you more than a late but complete one.
If the gap traces back to how the licence application itself was scoped — a fact pattern close to When the specification is too narrow for a new product line — the AML documentation cannot be finished until the scope question is settled first.
Limit
This page does not resolve a formal refusal once issued, and it does not draft your AML/CFT policy for you. It also does not extend to disputes over the underlying digital asset itself: if the gap in your file traces to a contested tokenisation event, that is a separate question, closer to The creator disputes the mint tokenised rights, and needs its own resolution before the AML file can be treated as final.
Verified
Checked against the current text of Regulation (EU) 2023/1114 (MiCA), in force from 30 December 2024, and Regulation (EU) 2023/1113 (TFR), in force from the same date. No national implementing measure is cited here because none is part of the current file for this situation.
Related publications
See also A group entity holds a different permission authorisation for the adjacent case where the gap sits at group level rather than inside a single file.
FAQ
What is the first step when the file is incomplete on AML?
List every outstanding item against the original checklist and send that list to the case handler as a voluntary completion plan, before a formal deficiency notice arrives.
Which deadline is already running?
The informal period between your own discovery of the gap and the authority's formal request is not protected time. The formal, fixed response window only starts once a deficiency letter is issued.
Who decides, and on what evidence?
The case handler at the national competent authority decides, based on the completed checklist items and any supporting evidence filed — beneficial ownership charts, the tailored AML/CFT policy, and the travel rule data flow map among them.