When a partner distributes the token: what to do first
When a partner starts distributing your token, treat that moment as the trigger for your own AML and travel-rule duties, not the partner's problem. Confirm when distribution began, secure the counterparty data the partner holds, and route the file to whoever owns AML sign-off. Delay, not distribution, is the risk.
Basis
Two EU regulations set the frame for this situation. Regulation (EU) 2023/1114 (MiCA) governs the issuance and trading of the token itself, including the duties that attach once a third party places it with the public rather than the issuer doing so directly. Regulation (EU) 2023/1113 (TFR) governs the data that must travel with a crypto-asset transfer, including transfers your distribution partner initiates on its own systems.
Neither regulation names your partner's local licence, its beneficial owner, or the jurisdiction its onboarding runs through. Those questions sit outside the scope of a single EU-anchored basis and are addressed separately, below.
Practical consequence
Two clocks start the moment distribution begins, and neither waits for you to notice. Your own transaction-monitoring obligation starts on the transfer itself, not on the date your compliance team becomes aware of it. Your data-collection obligation under the travel-rule regime starts the same moment, because the receiving side needs originator and beneficiary information already attached to the transfer.
Waiting for the partner's own report before you act creates a gap between the transfer and your record of it. A regulator reviewing the file later reads that gap as a control failure on your side, not as reasonable reliance on a partner's process. The gap itself, once created, cannot be closed retroactively by better paperwork.
What to do
- Compliance lead confirms the exact timestamp distribution started, taken from the partner's own transfer log, not from an internal notification email.
- Compliance lead requests the counterparty and transaction data the partner already holds under Regulation (EU) 2023/1113 (TFR), in writing, with a copy retained.
- Owner of the token file opens a separate internal AML record for the distribution event, distinct from the original issuance record.
- Compliance lead checks the distribution contract for an automatic travel-rule data feed; if none exists, the request from step two becomes the substitute.
- Designated AML officer signs off on the file within the same working day the gap between transfer and record is identified.
- If the partner delays or refuses the data, the compliance lead escalates to the partner's own compliance contact and logs the refusal with a date.
Who decides
Your own AML officer or designated compliance function decides whether the file is complete, using the counterparty and transaction data as the evidence base. That decision does not depend on the partner's assessment of its own compliance.
If the token also trades on a regulated venue once distributed, that venue's compliance team decides independently, on its own copy of the same underlying data. Neither party's sign-off substitutes for the other's, and a gap in one file is not cured by a clean file on the other side.
Forks
| Scenario | What changes | Who decides |
|---|---|---|
| Partner is itself an authorised crypto-asset service provider | The travel-rule data flow is largely automated between the two entities' systems, reducing manual follow-up. | Your compliance officer verifies the automated feed rather than requesting data manually each time. |
| Partner is an unlicensed reseller or informal distributor | No automated travel-rule feed exists; the data trail has to be built manually, transfer by transfer. | Your compliance officer decides whether to pause further distribution until that trail is in place. |
| Distribution already reached end holders before you learned of it | The gap between transfer and record becomes the first thing a regulator examines. | Your AML officer documents the gap and the remedial steps taken, each dated. |
What this page does not decide
This page does not establish who your partner actually is, what its documents show, or which regime its licence sits under. Where the partner is based in the United Arab Emirates, three separate checks matter before you rely on the data it sends you. Counterparty in United Arab Emirates and its limits sets out what can be established about the entity itself, and what stays unverifiable at that layer.
A second, separate check addresses paperwork rather than the entity: Document in United Arab Emirates and its limits covers what can be confirmed about the documents the partner produces, and where confirmation stops.
A third check addresses the regime the partner operates under, rather than the partner or its paperwork: Jurisdiction in United Arab Emirates and its limits sets out what the local regime confirms, and what it is silent on.
This page also does not cover a separate clock: the deadline your own onboarding vendor runs when local delivery partners are involved. That is addressed in Subprocessors, including local delivery partners and the deadline, and it runs independently of the steps above.
Verified
Checked against Regulation (EU) 2023/1114 (MiCA) and Regulation (EU) 2023/1113 (TFR), both in force from 30 December 2024. This page describes the obligation structure and does not substitute for a review of your specific distribution agreement.
Related
A neighbouring situation covers the opposite trigger: see When the issue is paused mid-sale: what to do, which addresses a stalled sale rather than a distribution event taken over by a partner.
FAQ
What is the first step when a partner distributes the token?
Confirm the exact moment distribution began, using the partner's own transfer log rather than an internal notice. The timestamp anchors every deadline that follows, and getting it wrong shifts every later step.
Which deadline is already running?
Your own transaction-monitoring and travel-rule data-collection duties start the moment the partner moves the token, not when your compliance team learns about it. The regulation does not pause for internal reporting delays, however reasonable those delays feel at the time.
Who decides, and on what evidence?
Your designated AML officer decides whether the file is complete, based on the counterparty and transaction data collected under the travel-rule regime. If the token also trades on a regulated venue, that venue's compliance function decides separately, on its own copy of the same evidence.
If you are inside this situation now, our team gives a first response within minutes during working hours, and a scoped answer on cost within one working day. We look at the transfer log, the distribution contract, and the partner's jurisdiction before we suggest a next step.