Compliance and AML for obliged entities: the decisions this practice answers
This hub covers compliance and anti-money-laundering work for entities already obliged to register, report, or respond to a supervisor because of a digital-asset activity. It routes each question to the page that carries the operational answer: authorisation, licensing structures, technology contracts, or a live supervisory contact. Sources and their dates are stated below.
What sits inside this practice
Obligations under EU crypto-asset rules attach the moment a firm issues tokens, runs a trading venue, a custody service, or an exchange, or advises on these activities inside the Union. Regulation (EU) 2023/1114 (MiCA) sets the licensing and conduct framework and applies from 30 December 2024. Regulation (EU) 2023/1113 (TFR) sets the information that must travel with a transfer of funds or crypto-assets, and applies from the same date.
Compliance and AML sit on top of that licence: monitoring, reporting, and answering a supervisor are ongoing duties, not a one-time filing. This hub does not repeat the licensing test itself — that lives on the Authorisation and supervision overview in practice page.
Which question belongs to which page
| Your question | Where it is answered |
|---|---|
| Are we structuring a licence, a transfer, or the intellectual-property rights behind a token or platform? | Licensing, transfers and IP structures |
| Is a competitor infringing a patent attached to our technology, or do we need to defend one? | Patent protection, disputes and recovery |
| Are we onboarding a technology vendor, or moving a compliance function to an outside provider? | Technology contracts and outsourcing |
What changes once a supervisor makes contact
Contact from a supervisor starts a clock. A questionnaire, an information request, or a site visit each carries its own deadline, stated in the letter itself. Missing that deadline is treated as non-cooperation, independent of whether the underlying answer would have satisfied the supervisor.
What to do first
- Log the date the letter or call arrived, and the name of the office that sent it.
- Route the request to whoever holds the compliance function internally before drafting a reply.
- Collect the records the request names — do not send more than asked.
- Send us the letter itself, not a summary, before the reply goes out.
Who decides, and how fast we answer
The competent supervisory authority in your country of authorisation decides what the questionnaire means and whether the reply is sufficient. We do not decide that on your behalf; we draft the reply and negotiate scope where the request is broader than the rule requires.
A partner reads a first message and answers within minutes during business hours. A fee estimate for the specific work follows within one business day, once we know how many jurisdictions and registries are involved.
Common forks
- If the letter names a deadline shorter than five working days, tell us before drafting anything — the reply strategy changes.
- If the request touches a transfer of funds or crypto-assets rather than the licence itself, the TFR framework governs what data must already exist on file.
- If a second authority in another member state sends a parallel request, treat the two as linked, not separate — say so to us immediately.
What this hub does not answer
This page does not tell you whether a specific token needs a licence, what a patent dispute costs, or which outsourcing clause a specific vendor should sign. Each of those questions has its own page, listed above and in the table. A live supervisory contact, once it exists, is handled on the situational page linked below.
Verified
Verified: 10 March 2025. Regulation (EU) 2023/1114 (MiCA), official text via the EU's legislation portal. Regulation (EU) 2023/1113 (TFR), same source. Both apply from 30 December 2024.
Related reading
A first supervisory letter rarely waits for a convenient moment. If one has already arrived, read When a first supervisory questionnaire arrives: what to do before drafting a reply.
Questions we hear before the first call
What does this change in practice?
It moves compliance from a policy document to an active duty: monitoring, reporting, and answering a named authority on a schedule that authority sets, not one you choose.
Which deadline applies?
The deadline stated in the letter or notice you received. No general deadline covers every situation; extensions, where available, are requested from the same authority before that date passes.
What do you need from us to start?
The letter or notice itself, the name of the entity it was addressed to, and a note of what activity — issuance, custody, exchange, or transfer — the entity carries out.