Why do regulators care so much about evidence quality under MiCA?

Why evidence quality matters under MiCA

Under MiCA, the regulator is not just asking whether a control exists, it is asking whether the firm can prove it was working when the decision was made. That means evidence has to be time-linked, complete enough to reconstruct the rationale, and consistent across teams and jurisdictions. Weak evidence turns a good control into an untestable assertion.

For firms operating across the EEA, this matters because supervisory expectations need to be applied in a consistent way, not interpreted differently office by office. The practical standard is whether a reviewer can trace the decision path, see what inputs were available, and understand why the outcome was reasonable at that moment.

evidence quality also matters because it is often the only way a regulator can separate a genuinely controlled process from one that merely produces the right answer after the fact. A policy, checklist, or approval record is useful only if it shows the actual state of the control at the point of decision, including exceptions, overrides, and the reason those exceptions were accepted.

What good evidence looks like in practice

Good evidence is contemporaneous, attributable, and specific. It should show who made the decision, what information they had, what standard they applied, and what changed as a result. If the evidence could be recreated later from memory or from a cleaned-up report, it is usually weaker than it appears.

The most useful records usually combine operational logs, approval trails, control outputs, and exception handling in one coherent chain. Regulators care less about volume than about coherence: the record should let an examiner follow the story without filling in gaps or guessing why a control outcome changed.

That is why evidential quality is not the same as document retention. Retention answers whether something still exists, while quality answers whether it can still be trusted as proof. A retained record that lacks context, timestamps, or decision logic often fails the supervisory test even if it is technically “on file.”

Why poor evidence creates regulatory friction

Poor evidence forces supervisors to infer intent, and inference is where disagreements begin. If the trail is incomplete, regulators may treat the control as unproven, which can lead to remediation demands, repeat testing, or a broader challenge to the firm’s governance maturity. In practice, that can turn a narrow review into a question about the reliability of the whole control environment.

It also creates inconsistency risk. If one team records exceptions in detail and another records only outcomes, the firm may appear stronger in one business line than another even when the underlying control strength is similar. Regulators do not want a patchwork of local evidential styles masking different levels of assurance.

Risk and Threat Considerations

Weak evidence is not just an audit nuisance. It can hide control failure, make remediation look complete before it really is, and leave the firm unable to demonstrate whether a requirement was actually satisfied at the time of decision.

Failure mechanism: The process produces a decision or approval, but the supporting record does not preserve the inputs, rationale, exception basis, or timestamped control result needed to verify that the decision was valid when taken.

Impact: Supervisors may treat the control as unreliable, require re-performance or remediation, and escalate findings because the firm cannot prove its governance was operating as claimed.

Practitioner Guidance

What to verify: Check that every material decision leaves behind a reconstructable trail: who approved, what data was reviewed, which exception path was used, and which control output supported the decision. If a reviewer cannot replay the decision without interviewing the original staff, the evidence is too weak.

What good looks like: The record set should let a supervisor trace the decision from input to outcome without relying on narrative cleanup after the event. Treat consistency across business units as a testable objective, not an aspiration, especially where the same MiCA obligation is being interpreted in multiple locations.

Practitioner takeaway: Under MiCA, evidence is itself a control because it is what allows regulators to distinguish an operating control from a claimed one; if the record cannot reconstruct the decision, the control is effectively unproven.

Related resources from NHI Mgmt Group

• Why do insurers care so much about control evidence instead of policy questionnaires?
• Why do audit teams care so much about repeatable evidence and training dates during an observation period?
• Why do auditors care so much about current compliance evidence?
• Why do regulators care so much about identity attribution in trading infrastructure?