On-site inspection: documents to prepare
An on-site inspection checks whether a licensed entity operates as its authorisation describes. Before the visit, gather governance records, transaction logs, client files, data policies, and any documentation covering the review period. Missing files slow the process and invite follow-up questions later. The inspection team works from what is shown at the time, not from promises to produce it afterwards.
What changes once the inspection is confirmed
Once the authority confirms a visit, a review period is fixed. Announced inspections leave a short lead time to prepare; unannounced ones leave none. Either way, the review period usually covers the time since authorisation or since the last inspection. Files outside that window are rarely requested unless early findings point to a longer pattern. From this point, every document produced becomes part of the file, so accuracy matters more than speed.
What to do
- Name one internal contact, usually the compliance officer, to receive requests and coordinate access.
- Assemble governance records: board minutes, delegation of authority, and internal control policies for the review period.
- Pull client and transaction files matching the requested scope, including onboarding records and risk assessments.
- Confirm retention and access policies are current; see how retention periods are defined and evidenced in Retention data protection explained.
- Check ownership records for any proprietary software or registered rights used in the business, since disputed ownership complicates review, as in Photonics and instrumentation — when a contractor claims ownership.
- Brief staff who may be interviewed on the process, not on scripted answers.
Documents by category
The table below groups the files inspectors ask for most often, alongside the point where files typically fall short.
| Category | Typical documents | Where it usually breaks down |
|---|---|---|
| Governance | Board minutes, policies, delegation of authority | Policies exist but are not dated or version-controlled |
| Client and transaction records | Onboarding files, transaction logs, risk assessments | Logs cover the wrong period or the wrong entity within a group |
| Data and retention | Retention schedules, access logs | Retention periods are set but not evidenced — see Retention data protection explained |
| IP and licensing | Registered rights, licences, assignment records | An assignment is agreed but never recorded — see Recordal of assignment step by step |
| Client asset records | Custody logs, pledge and collateral registers | An on-chain pledge is undocumented off-chain — see When a right is pledged on-chain |
Who decides and how long it takes
The supervisory authority decides scope, timing, and outcome. Inspectors report to the authority's internal review function, which decides whether to close the file, request remediation, or open a formal enforcement track. There is no single fixed timeframe: duration depends on file size, the number of entities involved, and whether earlier findings extend the scope. The authority communicates its own timeline once the inspection is confirmed, and that timeline is the one to follow, not a general industry estimate.
If your situation differs
If the entity operates under one authorisation but passports services into other states, expect requests from more than one authority, and keep parallel files ready in each. If the visit follows a period of remediation, inspectors typically re-check the items that triggered the earlier finding before looking at anything new. If the inspection concerns record-keeping specifically rather than the business as a whole, prioritise the files an inspector would ask for first, not the full archive.
What this page does not cover
This page covers preparation for a scheduled or unscheduled on-site visit. It does not cover how a suspension is imposed or lifted, how a remediation plan is negotiated once findings are issued, or how an entity should respond once record-keeping specifically is challenged. Those are separate procedures with their own steps and their own decision points.
Verified
Last reviewed in the current publication cycle. This overview draws on the supervisory authority's published inspection guidance and on standard file-preparation practice reported across the sector. It does not replace the authority's own instructions issued for a specific inspection, which take precedence over any general description.
Related reading
For a closely related process, see Remediation plan agreement step by step.
Next steps
If a licence is already suspended pending review, the practical consequences differ from a routine inspection — see A licence is suspended pending review authorisation what it. If the inspection centres on record-keeping specifically, the first moves are covered in Record keeping is challenged in an inspection AML compliance.
Frequently asked questions
How long does on-site inspection take in practice?
There is no single fixed duration. It depends on the size of the file, the number of entities under review, and whether early findings widen the scope. The authority sets a timeline once the inspection date is confirmed, and that communicated timeline overrides any general estimate.
Which documents are needed to start?
At minimum: governance records for the review period, client and transaction files matching the requested scope, and current data-retention and access policies. Anything beyond that is usually added once the inspection team defines its focus.
What happens if the other side does not respond?
If the entity does not respond to a document request within the timeframe set by the authority, inspectors treat the gap as a finding on its own. Silence is read as a control failure, not as a neutral delay, and it usually triggers a formal follow-up request rather than a second informal one.