When an audit finds gaps in evidence: what to do first
An audit gap in evidence means a step in your compliance file cannot be reconstructed: a missing source-of-funds record, an incomplete transfer message, or a customer check without a paper trail. The first move is not to explain the gap. Freeze the file, log the finding, and close it under a written timeline before the supervisor asks.
What the gap actually means
For a crypto-asset service provider, the evidence an audit tests traces back to two instruments. Regulation (EU) 2023/1114 (MiCA) sets the conduct, record-keeping and governance duties that apply once your firm is authorised as a crypto-asset service provider. Regulation (EU) 2023/1113 (TFR) sets the separate duty to attach originator and beneficiary information to a transfer of crypto-assets. In practice, an auditor checking your file is usually testing whether the TFR message that should have travelled with a transfer actually exists, and whether the underlying customer file that MiCA requires you to keep can support it.
A gap, then, is not one thing. It can sit in the customer due-diligence record, in the transfer message itself, or in the link between the two — a transaction your ledger shows but your file cannot explain.
What changes once the gap is logged
Before the finding is written down, the gap is an internal fact. Once it is logged — by an internal auditor, an external reviewer, or a supervisor — it becomes a fact your organisation is on notice of, and silence about it starts to look like a decision rather than an oversight. The practical effect is that any further transaction touching the same customer or the same corridor now carries the same open question, and closing the file after the fact does not remove that it was open when the transaction happened.
This is why the order of steps matters more than the speed of any single step. A file closed correctly but two weeks late reads better than a file patched overnight without a record of who patched it and why.
What to do, in order
- Freeze the finding as written. Compliance officer records the exact wording of the gap, the file it relates to, and the date it was identified — before anyone tries to fix it.
- Separate the customer file from the transfer message. Compliance team checks whether the missing piece is due diligence, the TFR-required originator or beneficiary data, or the link between them. These are fixed differently and by different people.
- Establish whether the underlying transaction is still open. Operations checks whether funds have settled or whether the transfer can still be held pending the missing information.
- Reconstruct from primary sources first. Where the customer or counterparty can supply the missing record directly, that is stronger evidence than an internal reconstruction.
- Write a remediation timeline with named owners. Senior management sets the date the gap will be closed and who is accountable for each remaining piece.
- Decide, in writing, whether the gap is reportable. Compliance officer, not the auditor, makes this call, and records the reasoning either way.
Who decides, and on what evidence
| Question | Who typically decides | What is assessed |
|---|---|---|
| Whether the gap is material | Compliance officer, with senior management sign-off | Whether the missing record affects a live transaction or a closed one |
| Whether the gap must be disclosed to the supervisor | The supervisory authority responsible for AML oversight in the firm's home member state, on the basis of the compliance officer's report | Pattern, repetition, and whether the gap touches a high-risk customer |
| Whether the transfer message can still be obtained | Operations, in contact with the counterparty crypto-asset service provider | Whether the counterparty's own record under the same transfer regime still exists |
None of these are decided by the auditor. An audit produces a finding; it does not produce the remediation decision or the disclosure decision, and treating the two as the same step is the most common error at this stage.
Depending on where the gap sits
If the gap surfaces during a passporting review of your authorisation into another member state, the missing record can stall the notification itself rather than only the file it came from — the mechanics of that stall are covered separately in When passporting is refused: what to do first.
If the missing evidence concerns crypto-assets that were pledged as collateral rather than transferred outright, the file gap is often a security-interest record rather than a transfer record, and the fix follows a different logic — see When a pledge over rights is enforced.
If the record was meant to come from a custody or verification supplier who now declines to backfill it under the contract's indemnity clause, the gap is a supplier dispute wearing a compliance label — the underlying mechanics are set out in When a supplier refuses an indemnity.
If the trail breaks at a reseller or distributor whose onboarding terms were never reviewed in full, the fix starts one layer above the audit file, in the contract itself — that situation is covered in When a reseller signs terms you never saw.
What this page does not solve
This page does not tell you whether a specific gap is reportable to your national supervisor — that depends on facts this page cannot see. It does not set out national procedural deadlines, since those sit outside the two regulations named above. It does not replace a file-by-file review by someone who has read the actual customer and transfer records.
Verified
Checked against the consolidated texts of Regulation (EU) 2023/1114 (MiCA) and Regulation (EU) 2023/1113 (TFR), both published via EUR-Lex. Both instruments apply from 30 December 2024.
Related publications
A related situation, often triggered by the same underlying gap, is covered in When a first supervisory questionnaire arrives.
FAQ
What is the first step when an audit finds gaps in evidence?
Record the finding exactly as written, before anyone attempts to fix it. The record of when the gap was identified matters as much as the fix itself.
Which deadline is already running?
The moment a finding is logged, the clock on your own remediation timeline starts — not a statutory clock, but the internal one your compliance officer must set and defend if asked later why it took as long as it did.
Who decides, and on what evidence?
The compliance officer decides materiality and disclosure, based on whether the gap touches a live transaction, a high-risk customer, or a pattern rather than a single instance. The auditor's role ends at the finding.