A crypto-asset service provider stuck on thirty questions from the AFM

By Tarik Binnekade · 10 September 2026 · MiCAR, CASP, AFM

Example case — not an existing client. This case was written to show how we work. The situation is assembled from patterns we encounter at comparable institutions; the organisation, the figures and the outcomes are illustrative and do not trace back to any client of ZandKade Compliance. The amounts match our published rates.

A crypto-asset service provider whose DNB registration had lapsed filed its own MiCAR application for six services. After the completeness check came thirty follow-up questions and the process stalled. We substantiated the classification of two tokens, cut the scope from six services to four, moved the AML/CFT framework from description to working set-up, and ran the question rounds centrally. The second round contained six questions.

Need help with this? In a free thirty-minute call we look at your situation with you. Book a call or ring +31 6 11 32 53 62.

The situation

The company had grown up under the old Dutch registration regime with DNB. That regime focused almost entirely on integrity and set few requirements on capital, governance, safeguarding client assets or disclosure. MiCAR ended it and replaced it with a full European licence, granted in the Netherlands by the AFM.

The company had prepared the application itself, with a law firm handling the legal documents. It applied for six of the ten crypto-asset services, including operating a trading platform. After the completeness check came a list of thirty follow-up questions. That is when the question reached us that we hear regularly: should we answer these thirty questions, or should we be doing something else?

What we found

We began with a readiness scan: reading the entire file as if we were the assessor, and laying the AFM's questions alongside the company's own documentation. Six findings shaped everything that followed.

• The classification of two tokens was not substantiated. Both functioned economically as a share in a return. If a token qualifies as a financial instrument it falls under MiFID II, not MiCAR, and the entire route changes. That question had been skipped.
• The AML/CFT framework was described, not implemented. The policy referred to monitoring scenarios still to be calibrated and to a risk classification not yet configured in the system. That is recognised as paper, and rightly so.
• The travel rule had no decision rule for self-hosted wallets. On transfers to or from an address with no intermediary there is no counterparty to supply data. What the company did in that case varied by analyst.
• Outsourced screening without demonstrable oversight. Onboarding and sanctions screening sat with an external provider. There was a contract, but no file showing that the company actually assessed, tested and could steer that provider.
• A director holding five positions. Suitability is not only knowledge and experience but also available time. Five roles on one CV raises exactly the question you do not want.
• Business plan and risk assessment contradicted each other. The forecast assumed rapid growth in two higher-risk markets; the risk assessment described the future client base as predominantly low risk. Each was defensible alone, not together.

Our approach

1. Classification first. A reasoned analysis for both tokens on whether they qualify as crypto-assets or as financial instruments, starting from their economic characteristics. One token turned out to belong outside the application; that product was withdrawn from the service offering before the application went further.
2. Scope revisited. See the next section — this was the decision with the greatest effect on the timeline.
3. AML track rebuilt. Risk assessment redone from the actual services, chains and tokens; risk classes configured in the system; monitoring scenarios calibrated against a test set; on-chain analysis of source and destination set up with the company's own thresholds instead of the vendor default.
4. Travel rule as a decision tree. Written out for missing data, incomplete data and self-hosted addresses, each path with a recorded outcome — execute, suspend or refuse — and a named decision maker.
5. Outsourcing file built. Not only the contract, but service standards, periodic assessment, test results and an exit scenario.
6. Question rounds run centrally. One owner, one answer log, and the rule that no answer goes out that contradicts an earlier one. That sounds bureaucratic and is in practice the single biggest accelerator.

The scope decision: from six services to four

The company applied for six services, one of which was operating a trading platform. That placed it in the heaviest capital class and the heaviest requirement set, while the platform was eighteen months from launch and had no process, staff or risk assessment behind it.

We advised removing the platform and one advisory service from the application. The reasoning: an applied-for service without a working set-up costs time rather than saving it, and extending later remains possible. That is a genuine trade-off, because extending later means another process. For this company it weighed more heavily to be operational within a year with the services that earned the money.

MiCAR sets minimum own funds by class: € 50,000 for services such as advice and order handling, € 125,000 once you also hold or exchange assets, and € 150,000 for a trading platform. You hold whichever is higher: that amount, or a quarter of the previous year's fixed overheads. Scope is therefore also a capital question.

What was delivered

• A classification memo per token, usable as an annex to the application and as a reference for new products.
• A revised application file with a consistent document set and an index, so the assessor does not have to search.
• An AML/CFT framework that worked on the day of submission: risk classes configured, scenarios calibrated with test evidence, on-chain thresholds with justification.
• A travel rule decision tree with recorded outcomes and an owner per path.
• An outsourcing file with an assessment framework, test results and an exit scenario.
• A business plan and financial forecast consistent with the risk assessment rather than contradicting it.
• An answer log in which every answer given can be traced back to the underlying document.

The outcome

The second round of questions numbered six instead of thirty, and none of them touched the subjects on which the first round had stalled. The licence was granted for four services.

The scope decision saved an estimated four months. That is not an exact measurement — no such thing exists in a licensing process — but the trading platform required a capital justification, a market abuse framework and an operational file, none of which existed.

The AML framework was genuinely in use on day one of the licence. That is not a given: many firms deliver a framework for the application and only then begin implementing it, which means the first supervisory assessment after authorisation arrives before the process has proved itself.

What you can take from this

• Do not answer thirty questions without first asking why they exist. A long list is usually not a set of separate ambiguities but a symptom of two or three structural gaps.
• Apply for what you can demonstrate. For every service you should be able to point to who performs it, what risk attaches to it, how you control that and where it is recorded. If you cannot, leave the service out.
• MiCAR and the Wwft are two tracks assessed at the same time. A strong prudential file with a thin AML framework does not pass, and neither does the reverse. See what MiCAR does and does not regulate.
• Consistency is a criterion in its own right. Two documents that contradict each other cost more time than one document acknowledging that something is not finished.

Duration and investment

The readiness scan was a defined engagement of € 3,950 excluding VAT with a three-week turnaround. Full guidance of the process afterwards started at € 12,500 excluding VAT, quoted per phase once the scope was settled — which is exactly why the scan comes first: only after rescoping did we and the client know what we were talking about.

The eleven months break down roughly into three months of repair and rebuilding, one month of resubmission and preparation, and the formal assessment with its question rounds. The statutory periods — 25 working days for the completeness check and 40 working days for the substantive assessment — only start once the application has been declared complete.

Questions that come up in this kind of engagement

Can a stalled application be unblocked, or do you have to start again?

Usually it can be unblocked, but not by answering the questions one by one. The practical route is to establish which structural gaps sit behind the questions, close those, and then give a coherent set of answers referring to revised documents. Starting again is only necessary if the classification or the scope of services is fundamentally wrong.

Is it wise to apply for services you intend to offer later?

Only if you can substantiate them. A licence is granted for the services applied for and extending later requires another process, so applying ahead has value. But a service without a process, staff and risk assessment delays the whole application — including the services that earn money today.

Who is our supervisor: the AFM or DNB?

For a CASP the AFM grants the licence and supervises conduct as well as compliance with the Wwft and the Sanctions Act. DNB conducts prudential supervision and assesses qualifying holdings. Where crypto services are offered by a bank or an e-money institution, DNB remains the AML supervisor.

How much own funds does a CASP have to hold?

It depends on the services: € 50,000 for advice and order handling among others, € 125,000 once you also provide custody or exchange, and € 150,000 for a trading platform. You hold whichever is higher: that amount, or a quarter of the previous year's fixed overheads.

Sources

• CASP licence — AFM
• Annex to the Wwft and Sanctions Act guideline for CASPs (AFM)
• Regulation (EU) 2023/1114 (MiCAR) — EUR-Lex
• Regulation (EU) 2023/1113 (travel rule) — EUR-Lex

Read next

• MiCAR licensing for CASPs — our service
• What is MiCAR? The European crypto-asset regulation explained
• AML/CFT in the Netherlands: a guide
• Case: KYC remediation at a trust office

Recognise this? In a free thirty-minute call we look at your situation with you and say plainly whether we can help. Book a call or ring +31 6 11 32 53 62.