When an authorisation is withdrawn: what to do first
A withdrawal ends the right to provide the regulated service from the date named in the decision, not from the date the underlying problem occurred. The first task is procedural, not commercial. Confirm that date, stop client-facing activity that depends on the licence, and preserve every record a supervisor might later ask for. None of this waits for a considered legal strategy to be ready.
Legal basis
Authorisation to provide crypto-asset services in the EU sits under Regulation (EU) 2023/1114 (MiCA), which has applied since 30 December 2024. A withdrawal decision issued by the national competent authority removes that authorisation with effect from the date it names in the decision itself. The grounds are drawn from the supervisory file already built up during ongoing oversight, not invented at the moment of the decision.
Where the authorised entity also carried reporting duties on transfers of crypto-assets, Regulation (EU) 2023/1113 (TFR) obligations attached to transactions already initiated typically continue until those transactions are settled or formally handed over. A withdrawal does not automatically erase duties tied to money that is already moving.
What changes in practice
The wind-down clock starts running immediately, even when no fixed statutory number appears anywhere in the decision itself. Client positions must be protected, open transfers settled or transferred with consent, and every communication with counterparties adjusted so nobody continues to rely on a licence that no longer exists.
Delay is what turns a supervisory matter into a liability one. A client who is told nothing, and later loses funds because activity continued under a withdrawn licence, has a claim that has nothing to do with the withdrawal decision itself — it has to do with silence after it.
What to do first
Work through the following in order, and assign each step to a named person the same day the decision arrives.
- Read the decision line by line and mark the effective date; this falls to whoever holds the compliance file.
- Notify the board or equivalent governing body immediately — delay at this stage is itself a governance failure.
- Stop onboarding new clients and freeze any marketing that still references the withdrawn authorisation.
- Instruct operations to list every open client position and every transfer currently in progress.
- Contact counsel before sending any written response to the authority; a single sentence in that letter can shape how the review reads later.
- Preserve records exactly as they stand — no reorganising files, no deleting draft correspondence, no tidying anything up.
Who decides, and on what evidence
The authority that granted the authorisation is, in nearly every case, the one that withdraws it. It acts on its own file: inspection notes, correspondence exchanged with the entity over time, and the entity's own submissions made during the procedure that led to the decision.
| Stage | Who acts | What is assessed |
|---|---|---|
| Decision issued | National competent authority | Grounds already documented in the supervisory file |
| Wind-down | The authorised entity, through counsel | Client exposure, open transfers, record integrity |
| Review or appeal | National competent authority or the competent court | Whether the stated grounds are contested, and on what evidence |
Nothing at this stage is negotiated informally over a phone call. Every submission the entity makes goes into the same file the authority, or a court, will use if the matter is reviewed later.
Which deadline is already running
Two clocks usually start at once, and they are easy to confuse. One is the wind-down period set out in the decision itself, covering how activity must be closed down. The other is any period allowed to request a review or an appeal of the decision, which runs from notification, not from the date the entity finally reads it carefully.
Neither period is fixed by a single rule that applies to every file the same way; the authority sets the wind-down terms case by case, within the decision it issues. Treat the shorter of the two clocks as the real deadline, and confirm both in writing with the authority rather than assuming.
If another issue surfaces at the same time
A withdrawal review sometimes exposes problems that have nothing to do with the licence itself. If the platform under review also processes data belonging to minors, that question runs on its own track — see When children's data appears in the product.
If the authority's decision touches the entity's branding, or a third party has separately argued that the branding is merely descriptive, that dispute is handled apart from the withdrawal — see When a mark is challenged as descriptive.
If a former employee has since launched a similar product using knowledge gained while the file was open, that is an ownership question rather than a supervisory one, described in A former employee launches a similar product ownership of.
If the withdrawn service relied on a token contract that cannot be amended once deployed, the wind-down itself becomes harder to execute cleanly — see The contract has no upgrade path tokenised rights.
What this page does not resolve
This page does not fix a defective token contract, decide a trade mark dispute, or resolve a data protection breach; each of those runs on its own procedure and its own clock, described elsewhere. It also does not predict the outcome of a review or an appeal against the withdrawal itself — no page can do that responsibly, and none should promise one.
It likewise does not set out national procedural detail for filing an appeal, since that detail depends on the specific competent authority involved and sits outside what can be confirmed here.
Verified
Checked against Regulation (EU) 2023/1114 (MiCA) and Regulation (EU) 2023/1113 (TFR), both published on EUR-Lex. Last reviewed: 20 January 2025. National procedure for issuing, reviewing, and appealing a withdrawal decision sits with each competent authority and falls outside the scope of what this entry confirms.
Related situations
The reasoning above assumes the authorisation existed and has now been taken away. A related but earlier situation is when the authority questions substance before granting anything at all — see The applicant is asked to prove substance authorisation.
Frequently asked questions
What is the first step when an authorisation is withdrawn?
Confirm the effective date stated in the decision, then stop any client-facing activity that depends on that licence from that date onward. Everything else follows once that date is fixed.
Which deadline is already running?
The wind-down period set out in the decision itself starts on notification, and any period to request a review or an appeal usually runs alongside it. Both are set case by case in the decision, not by a single fixed rule that applies to every file.
Who decides, and on what evidence?
The national competent authority that issued the withdrawal decides, drawing on its own supervisory file — inspection notes, prior correspondence, and the entity's own submissions made during the procedure.
A withdrawn authorisation is rarely the end of a file; it is the start of a different one, with a shorter clock and less room for error. If your team is inside that window now, get a second, careful read of the decision before anyone replies to it in writing.