Confirming your own obligations first
Before evaluating any partner, a compliance officer should confirm exactly which MiCA obligations apply to their own institution: whether the institution itself will hold a CASP or e-money authorization, or whether it will rely entirely on a licensed partner's authorization, since the two paths carry different internal governance and reporting obligations.
This distinction also determines who is responsible for filing suspicious transaction reports and maintaining the travel rule data required for digital asset transfers, an allocation that should be written into the partner contract, not assumed.
What to check on any infrastructure partner
On any infrastructure partner, verify the home-state authorization directly against the national competent authority's public CASP register rather than relying on a claim in a pitch deck, confirm the specific licensed service scope covers what the partner is actually selling, and request evidence of client fund segregation, not just a description of the policy.
Ask, specifically, whether reserves or client funds are held with a banking partner separate from the infrastructure provider's own operating accounts, and whether that arrangement has been reviewed by the provider's own auditors, not only described in marketing material.
What to review on an ongoing basis, not just at onboarding
MiCA authorization is not a one-time check. A compliance officer should re-verify a partner's authorization status at a set interval, not only at onboarding, since authorizations can be varied, restricted or withdrawn, and a host-state notification filed for one market does not automatically extend to a new market entered later.
Building this recurring check into the institution's own vendor risk calendar, rather than treating MiCA compliance as a box ticked once during procurement, is what keeps a payment institution's own supervisory relationship clean regardless of what happens to any single infrastructure partner.