When a group policy conflicts with local duties: what to do first
A group-wide policy that sets a lower standard than a Member State duty does not excuse the gap. Regulation (EU) 2023/1114 (MiCA) and Regulation (EU) 2023/1113 (TFR) bind a crypto-asset service provider in Lithuania or Estonia directly, regardless of internal group rules. Escalate the conflict in writing today, and keep meeting the local minimum while the group reviews an exception.
Basis
Regulation (EU) 2023/1114 (MiCA) sets the licensing, governance and conduct standard for a crypto-asset service provider established in an EU Member State. It has applied directly, without national transposition, since 30 December 2024. A group's internal manual cannot lower this standard for the licensed entity, whether that entity sits in Vilnius or in Tallinn.
Regulation (EU) 2023/1113 (TFR) sits alongside it and imposes an information-accompanying-transfer duty every time the entity moves funds or crypto-assets for a customer. Both regulations bind the local entity on their own terms. Neither reads down to match a group standard that was drafted for a different market and a different mix of risks.
A group with entities in several Member States, or with entities both inside and outside the EU, often writes one policy to cover all of them. That approach is efficient for the group. It is not a defence for the local entity if the shared policy falls short of what Regulation (EU) 2023/1114 (MiCA) or Regulation (EU) 2023/1113 (TFR) demands of that entity specifically.
Practical consequence
A conflict between a group policy and a local duty does not pause a running deadline. If Regulation (EU) 2023/1113 (TFR) requires a data field on an outbound transfer and the group's system does not capture that field, the duty is still due at the moment of the transfer, not at the end of a policy review.
The gap also tends to compound rather than sit still. A single transaction processed under the group's lower standard becomes a pattern once the group's system keeps producing the same shortfall on every transaction of that type. By the time the group finishes its internal review, the local entity may already have a run of transactions that fall short of the statutory minimum.
The same problem often travels through a group's shared systems. If the group policy routes customer due-diligence records through a common platform run by another group entity, a change to who processes that data raises a separate question — the one addressed when When personal data flows to a new subprocessor examines what to do first. Treat the two questions as parallel, not sequential.
What to do
Work the conflict as an operational problem with a clock attached, not as a policy debate to be settled before anyone acts. The sequence below assumes the local entity is authorised under Regulation (EU) 2023/1114 (MiCA) and is therefore the party the supervisor will hold to account.
| Step | Who acts | Deadline trigger |
|---|---|---|
| Flag the conflict in writing, naming the specific clause and the specific duty it falls short of | Local compliance officer | Same working day |
| Map the group clause against the text of Regulation (EU) 2023/1114 (MiCA) or Regulation (EU) 2023/1113 (TFR) | Legal counsel | Before the next transaction of the affected type |
| Request a written local carve-out from group compliance, with a proposed interim fix | Compliance officer, escalated to group | Within the same week |
| Continue meeting the stricter local duty while the carve-out is pending | Operations, under compliance instruction | Continuous, no pause |
| Record the decision trail: the flag, the mapping, the request, the interim instruction | Compliance officer | As each step occurs |
| If the group refuses the carve-out, escalate to the local management body | Management body | Before the deadline that is already running expires |
If the local function that would normally resolve this sits with a shared-service centre in another group entity, that arrangement is itself a form of delegation. Assess it the way a supervisor would assess any delegated function — the concern examined in Outsourcing is challenged by the supervisor authorisation applies with equal force to a group's internal shared services, even when no external vendor is involved.
Do not treat the group's silence as approval. A carve-out request that goes unanswered for a week is not a carve-out; it is an unresolved conflict that the local entity is still carrying on its own file.
Who decides
The authority that authorised the entity under Regulation (EU) 2023/1114 (MiCA) decides whether the local standard has been met. It looks at the entity's own file: the transaction records, the customer due-diligence file, and the paper trail showing when the conflict was flagged and how it was managed in the interim.
A written escalation dated before the transaction in question carries more weight than a policy that was updated afterwards. The supervisor is assessing the entity's conduct at the time, not the group's intentions in hindsight or the group's eventual policy fix.
Where the entity's own management body has the authority to instruct operations to override a group instruction, that decision belongs at management-body level, not with a single compliance officer acting alone. Keep the minute of that decision in the same file as the escalation.
Forks
If the group policy sets a higher bar than the local duty — a lower risk-acceptance threshold, for instance — apply the group policy. Regulation (EU) 2023/1114 (MiCA) and Regulation (EU) 2023/1113 (TFR) set a floor, not a ceiling, and a stricter internal standard is compatible with both.
If the group entity that governs the policy is itself going through a restructuring or an insolvency process in another Member State, the local entity's authorisation does not automatically follow the same fate. The question of what happens to a group arrangement in that scenario overlaps with the one worked through in When a licence survives insolvency, or does not, and the same discipline — check the specific instrument, do not assume — applies here.
If the conflict surfaces because the group is under commercial pressure to move fast — a competitor has just forced the group's hand, in the way described in When a rival launches an obvious workaround — resist the temptation to let commercial urgency override the local minimum. The statutory duty does not move to accommodate a launch date.
If the group instructs the local entity to ignore the local duty outright, rather than to work through a carve-out, that instruction is a governance failure at group level. It does not change what the local entity is required to do, and it does not protect the local management body from the consequences of following it.
Limit
This page sets out the order of action and the standard that governs. It does not draft the carve-out request, negotiate the group policy amendment, or set the specific figures a group risk-appetite table should use. Those depend on the group's structure and the entity's transaction profile, and they are worked out case by case.
It also does not cover a conflict that arises purely between two national laws with no EU instrument in play. That question depends on facts this page does not have and is handled separately.
Verified
Sources: Regulation (EU) 2023/1114 (MiCA); Regulation (EU) 2023/1113 (TFR). Both apply directly across the EU from 30 December 2024. Checked 10 March 2025.
Related publications
A group's records policy raises a parallel question during an inspection. See When record keeping is challenged in an inspection: what for what to do first there.
FAQ
What is the first step when a group policy conflicts with local duties?
Flag the conflict in writing, naming the group clause and the specific duty it falls short of. Continue meeting the stricter standard set by Regulation (EU) 2023/1114 (MiCA) or Regulation (EU) 2023/1113 (TFR) while the group reviews an exception. Do not wait for the group's answer before the next transaction.
Which deadline is already running?
The deadline attached to the underlying transaction, not the deadline of the group's internal review. A transfer-information duty under Regulation (EU) 2023/1113 (TFR) is due at the moment of the transfer, and it does not pause because a policy amendment is being drafted.
Who decides, and on what evidence?
The authority that authorised the entity under Regulation (EU) 2023/1114 (MiCA) decides, based on the entity's own transaction records, its customer due-diligence file, and the dated record of when the conflict was flagged and how it was handled in the meantime.
Next step
A conflict between a group policy and a local duty rarely resolves itself before the next transaction is due. Bring the specific clause and the specific duty to a call, and get a first read within minutes during working hours.