MiCAR authorisation: what supervisors look for in your AML framework

A MiCAR application is assessed as a whole, but the AML framework is one of the first areas supervisors test in depth. It shows whether the applicant understands its risks and has the substance to manage them.

Make the risk assessment specific to crypto

Generic templates stand out immediately. Supervisors expect a business-wide risk assessment that reflects your actual products, customer types, delivery channels and the specific risks of crypto-assets.

Show substance, not documents

Supervisors look for a named MLRO with real authority, a compliance team sized to your volumes, and controls that run in practice. They will ask who does what, and how you know it works.

Cover the travel rule and on-chain risk

Explain how you meet the EU’s transfer of funds rules for crypto-asset transfers, often called the travel rule, and how you use blockchain analytics to screen wallets and transactions.

Oversee what you outsource

If you outsource parts of compliance, show how you oversee the provider. Responsibility stays with you, so supervisors want to see contracts, reporting lines and oversight in place.