When an outsourced compliance function is questioned: what to do first
When a regulator, an auditor, or a counterparty questions an outsourced compliance function, the entity that holds the licence remains accountable, not the provider carrying out the task. Locate the outsourcing agreement first. Confirm which deadline the query has already started. Notify the provider in writing, in parallel, and freeze the record set before anything is amended.
Basis
Regulation (EU) 2023/1114 (MiCA) places outsourcing arrangements under the governance duties of the crypto-asset service provider itself. A provider performing screening, monitoring, or reporting on the entity's behalf does not take on the entity's regulatory duty; it only performs a task the entity remains answerable for. Regulation (EU) 2023/1113 (TFR) sets out the information that must accompany a transfer of crypto-assets, a duty most obliged entities delegate to the same outsourced function that is now being questioned.
Neither regulation names a specific complaint or investigation procedure. Both confirm the same point: delegation of the task does not delegate the duty.
Practical consequence
A question about an outsourced function shifts the burden of proof back onto the entity, not onto the provider. The entity must show that the arrangement was adequate when it was set up and that it has been supervised since. An indemnity clause in the outsourcing contract may cover the financial loss later. It does not answer the regulator's question now, and it does not stop the clock on any deadline already running.
What to do first
- Compliance officer: retrieve the outsourcing agreement, the current service level terms, and the last review of the provider's performance.
- Legal counsel: read the query for a stated deadline and calendar it before doing anything else.
- Management board: notify the provider in writing and request their file on the same matter, in parallel, not after the entity has replied.
- Compliance officer: freeze the record set as it stood on the date the query was received; do not correct or supplement it yet.
- Legal counsel: draft a response that separates the entity's own decisions from decisions the provider made on delegated authority.
- Management board: decide whether an internal review of the compliance file runs alongside the response, or only after it is sent.
Who decides
Three distinct questions sit inside one query, and each is decided by a different forum, on different evidence.
| Question | Who answers it | On what evidence |
|---|---|---|
| Was the outsourcing arrangement adequate | The supervisory authority reviewing the entity's file | The outsourcing agreement, the governance record, the provider's own regulatory standing |
| Is the underlying AML file itself deficient | The same authority, as a separate finding | Transaction records, screening output, and any transfer information kept under the TFR |
| Is the provider liable to the entity for the shortfall | A civil court, not the regulator | The indemnity and liability terms of the outsourcing contract |
These three findings do not arrive together, and a favourable outcome on one does not settle the other two.
Forks
If the query follows a refusal or a restriction issued during an authorisation review, a separate appeal deadline may already be running against that earlier decision — see When an appeal deadline follows a refusal in practice.
If the outsourced function depends on screening software whose source code sits with the vendor, and the vendor is asked to release it as part of the review, the escrow terms decide what the entity is entitled to inspect — see When source code escrow is demanded.
If due diligence on the vendor during onboarding turns up rights in that software that were never validly transferred to the vendor, the compliance file built on it may need to be revisited before the query is answered — see When the deal transfers rights that were never owned.
If the provider's own tooling is itself the subject of a third-party infringement claim, continuity of the outsourced function is at risk independently of the current query — see When a supplier is accused of infringing a third.
Limit
This page does not decide whether the outsourcing contract's indemnity clause covers the regulator's specific finding; that reading needs the actual contract, not a general rule. It does not replace an internal investigation into the compliance file itself, and it does not state a deadline for any particular authority, because no two queries state the same one.
Verified
Checked against the current text of Regulation (EU) 2023/1114 (MiCA) and Regulation (EU) 2023/1113 (TFR), both in force from 30 December 2024. State as of 10 January 2025. No court finding is cited on this page; none met the confirmed-status threshold this material applies.
Related publications
A question about the outsourced function often begins with a narrower one, about the output it produces — see When screening produces constant false positives: what to do.
FAQ
What is the first step when an outsourced compliance function is questioned?
Retrieve the outsourcing agreement and identify any deadline stated in the query, before responding or amending any record.
Which deadline is already running?
The deadline stated in the query itself. If the query follows an earlier refusal or restriction, a second, separate appeal deadline may be running against that decision.
Who decides, and on what evidence?
The supervisory authority decides whether the arrangement and the underlying file were adequate, on the outsourcing agreement and the transaction records. A civil court, not the regulator, decides whether the provider is liable to the entity for any shortfall.