Because authorization is a point-in-time assessment, while supervision tests whether the operating model still works in production. A CASP can satisfy an application and still fail later if screening, approvals and monitoring no longer produce coherent evidence. The risk is not just non-compliance, but a broken governance loop that supervisors can expose quickly.
Why supervision changes the meaning of MiCA approval
MiCA licensing answers one question: can this CASP operate under the rules on paper and at the moment of authorisation? Post-authorisation scrutiny answers a different one: does the firm still run the controls, evidence and oversight needed to stay safe once real volumes, staff turnover, outsourced functions and product changes start to accumulate?
The distinction matters because governance is not static. Screening, approvals, segregation of duties and monitoring can all look sound during licensing and then drift under production pressure. Supervisors are looking for whether the control model still produces coherent, repeatable evidence, not just whether it once existed in a policy pack.
A useful way to think about this is that authorisation is a threshold, while supervision is an operating test. The first checks readiness; the second checks whether the firm can still demonstrate control effectiveness when the business, technology stack and customer base change. That is why a CASP can be licensed and still face supervisory findings soon after if the operating model is not maintained.
Where the control loop usually breaks
The most common failure is not an obvious breach of rules, but a disconnect between policy and execution. Screening may not keep pace with new counterparties, approvals may become routine rather than risk-based, and monitoring may generate logs without producing decisions. Once those pieces stop aligning, the firm may still appear compliant in isolation, but the overall control loop no longer tells a coherent story.
That loss of coherence is especially important for firms that rely on multiple teams or vendors to execute the same governance process. When ownership is fragmented, it becomes harder to prove who reviewed what, on what basis, and whether exceptions were closed. The result is a supervision problem as much as a compliance problem, because evidence quality becomes an operational signal in its own right.
For a practitioner, the key issue is whether controls still behave like a system. If approvals are detached from screening outcomes, or monitoring cannot reconcile alerts to action, supervisors will see a process that exists in name but not in practice. IAM and IGA Basics is useful here because it frames the difference between access decisions and the governance layer that keeps those decisions reviewable over time.
What supervision is really testing after go-live
Post-authorisation scrutiny is not just about checking whether the firm still meets a list of conditions. It is testing whether the operating model remains credible under change, whether evidence is timely and complete, and whether control owners can explain exceptions without improvising. In practice, that means supervisors often focus on the consistency between policy, records and actual behaviour.
This is where lifecycle discipline matters. If a firm cannot show that its review, escalation and remediation processes are still active, it will struggle to defend the claim that its governance is durable rather than ceremonial. Authorisation Models Guide is relevant because many of the same principles apply to supervisory control design: policy decisions only matter if they are enforced, logged and attributable.
That same logic is why ongoing auditability matters more than a one-time approval event. A good licensing file may prove that controls existed at launch, but post-authorisation scrutiny asks whether the firm can still produce evidence that those controls are functioning today. If the answer is slow, inconsistent or partial, the supervision issue is already material even before any customer harm appears.
Risk and Threat Considerations
When post-authorisation controls drift, the risk is not limited to regulatory findings. Weak supervision can hide access abuse, unmanaged exceptions, and broken escalation paths until the firm is already operating outside its intended risk appetite. The threat is often administrative rather than dramatic, but it can still create fast supervisory exposure because the gap between stated and actual control is easy to demonstrate.
Failure mechanism: The control model decays after launch, so screening, approvals and monitoring stop reinforcing each other and no longer produce trustworthy evidence.
Impact: The firm can retain the appearance of compliance while losing the ability to prove effective governance, which increases enforcement, remediation and business continuity risk.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OV-01 — Oversight of Cybersecurity Risk Management | Post-authorisation scrutiny is continuous oversight of operating controls. |
| ID.IM-01 — Improvements are Identified and Implemented | Supervision exposes control drift that should trigger remediation. | |
| Recommendation — Maintain ongoing oversight that validates controls still operate as designed. Track supervisory findings and implement control improvements promptly. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | The question turns on whether monitoring and evidence still support decisions. |
| CA-7 — Continuous Monitoring | Post-authorisation scrutiny is continuous assessment of control effectiveness. | |
| Recommendation — Review audit outputs regularly and act on anomalies and exceptions. Continuously assess controls after go-live and update risk decisions from results. | ||
| ISO/IEC 27001:2022 | A.5.35 — Independent review of information security | Ongoing scrutiny depends on independent review of operating controls. |
| Recommendation — Schedule independent reviews that test whether controls still work in practice. | ||
Practitioner Guidance
What to verify: Treat post-authorisation scrutiny as an evidence test, not a document review. Verify that screening outputs, approval records, monitoring alerts and exception handling can be reconciled for the same period, same population and same control owner.
What good looks like: A supervisor should be able to trace a control event from input to decision to closure without relying on manual explanation. If that trace breaks at any point, the governance loop is already weaker than the licence file suggests.
Practitioner takeaway: MiCA licensing establishes permission to operate, but only ongoing scrutiny proves the firm can still govern itself once the operating environment starts changing.