When the supervisor publishes a measure: what to do first
A public supervisory measure starts a clock the day it appears, not the day you notice it. First, confirm exactly what was published and against which entity or product. Second, identify which deadline is already running before you draft any response. Third, decide who inside the organisation speaks to the supervisor, and stop everyone else from doing so.
The legal basis
A national competent authority supervising crypto-asset issuers and service providers acts under Regulation (EU) 2023/1114 (MiCA). The regulation gives the authority power to issue warnings, restrict activities, or withdraw authorisation, and to make the measure public. Publication itself is a supervisory tool, not a side effect of it.
The exact form of the notice, and the register in which it appears, is set by the authority's own procedure. This page describes the sequence that follows publication, not the article-by-article mechanics of the power itself.
What changes once the measure is public
Once a measure is public, three things change at once. Counterparties who monitor the register will see it, often before your own client-facing team does. Any ongoing negotiation, listing, or partner onboarding tied to the authorisation is now exposed to that fact. And any internal deadline to respond, object, or remedy starts running from the publication date, not from internal notice of it.
Treat the publication date as the trigger, even if the organisation only became aware of the measure later. Authorities do not usually extend a deadline because internal escalation was slow.
What to do first
- Save the published text exactly as it appears, with a screenshot or archived copy, including the date shown on the register.
- Identify the entity and product named in the measure, and confirm whether it matches your authorisation precisely or only in part.
- Locate the underlying file that led to the measure — a prior inspection, a complaint, or a reporting gap — and assemble every document already exchanged with the authority.
- Check whether a parallel process is running. If a client's own vendor due-diligence also raises certification questions at the same time, that follows a separate route, described here: When a vendor questionnaire asks about certification.
- Brief one internal contact point before any external communication goes out, including to counterparties who ask about the measure directly.
- Instruct counsel on the deadline named in the measure itself, not on an assumed statutory default.
Who decides
The competent authority that published the measure remains the decision-maker on any request to vary, suspend, or withdraw it. It decides on the file it holds, not on submissions made informally outside that file.
| Type of measure | Who decides | Deadline mechanism |
|---|---|---|
| Public warning | The competent authority that issued it | Runs from the date the notice is published |
| Restriction on specific activities | The same authority, on the open file | Set out in the text of the decision itself |
| Withdrawal of authorisation | The authority, following its own procedure | Confirmed only once the decision is issued, not before |
Where the measure concerns information accompanying a transfer of crypto-assets rather than authorisation status, the same authority applies Regulation (EU) 2023/1113 (TFR) to that specific finding, separately from the authorisation file.
If your situation is different
Not every published measure raises the same question. Three variations are common enough to name here.
If the underlying dispute traces back to a naming conflict rather than a supervisory finding, the authorisation measure is a symptom, not the cause: When a celebrity name blocks the filing.
If the authorisation itself is later withdrawn but tokens already issued under it remain in circulation, a further question arises that this page does not answer: A licence terminates but the token remains tokenised rights.
If your own application for a passport into another member state was refused around the same time, treat the two files as connected but separately staffed, since the deadlines rarely align.
What this page does not cover
This page covers the sequence that starts when a measure is already public. It does not cover the underlying inspection that led to it, nor any parallel obligation on information accompanying transfers under the TFR.
It also does not cover ownership disputes over marketing or design material produced before the authorisation was granted, which follow a different track entirely: A designer reuses a template from an earlier client.
Where the measure sits within a wider group structure spanning several member states, coordination between authorities is a separate question this page does not resolve.
Verified
Checked: 4 March 2025. Primary sources: Regulation (EU) 2023/1114 (MiCA); Regulation (EU) 2023/1113 (TFR). No case law is cited on this page.
Related situations
A refusal at the passporting stage often precedes a published measure at the home authority: Passporting is refused authorisation.
FAQ
What is the first step when the supervisor publishes a measure?
Save the exact published text with its date, and confirm which entity and product the measure names before drafting any response.
Which deadline is already running?
Any deadline stated in the measure runs from its publication date, not from the date the organisation noticed it.
Who decides, and on what evidence?
The authority that issued the measure decides, on the file it already holds, including any prior inspection or reporting record.