Legal Counsel for OTC Trading Desks: Legal Counsel for Crypto Firms

An over-the-counter trading desk (a principal or agency operation matching large block trades in digital assets outside a public order book) touches nearly every regulated category in digital-asset law at once: it holds client assets, moves value across borders, interfaces with banking rails and, in many products, crosses the line between spot and derivatives. The legal question is not whether the desk needs regulatory authorisation – it almost certainly does. The question is which licences, in which jurisdictions, and in what sequence. Operating without the right structure exposes the business to enforcement action, frozen correspondent banking and the loss of the institutional counterparties that make block-trading economics work.

This page maps the legal lifecycle of an OTC desk: formation and structuring, VASP registration (registration as a virtual asset service provider), regulatory authorisation under the major regimes, banking and counterparty compliance, and the dispute posture that protects the business when a trade goes wrong. We draw on our cross-border practice to set out where each risk bites and what a well-constructed legal stack looks like.

What Activities Actually Require a Licence?

An OTC desk almost always carries at least one regulated activity from its first trade. The specific licensing requirements depend on the activity profile, not just the label a business puts on itself. Exchanging crypto for fiat or crypto for crypto, holding client assets between legs of a trade, and settling across multiple wallets – each of these is a regulated activity under MiCA (the EU's Markets in Crypto-Assets Regulation, supervised by ESMA and national competent authorities) and under the equivalent regimes in Dubai (VARA, the Virtual Assets Regulatory Authority), Singapore (MAS under the Payment Services Act), Hong Kong (the SFC's VASP licensing regime) and elsewhere.

The classification question has real stakes. A desk that structures itself as a simple broker to avoid a custody licence but routinely holds client assets overnight is already operating outside its authorisation. Regulators in the leading hubs increasingly examine substance, not documentation. We regularly advise desks on activity mapping before the first counterparty agreement is signed – that early read sets the entire licence stack.

Derivatives add a further layer. Where a desk offers forward contracts, options or perpetuals, it enters territory regulated separately from spot in most jurisdictions. The FCA in the United Kingdom, the CFTC and SEC in the United States, and the SFC in Hong Kong each treat derivatives on digital assets as distinct regulated activities. A spot-only authorisation does not cover them.

How Should an OTC Desk Be Structured Before Licensing?

The entity structure chosen at formation determines the licensing path, the banking options and the tax profile – and it is expensive to reverse. Most desks we advise consider a two-entity model: a regulated operating entity in a licensing-friendly hub and a holding or treasury entity in a low-friction jurisdiction. The operating entity carries the licence; the holding entity owns IP and participates in profits under a group arrangement that must itself withstand substance-over-form scrutiny.

Jurisdiction selection at this stage is not only a licensing decision. Banking access is the operational bottleneck for OTC desks. The jurisdictions where a desk can obtain a crypto licence and where it can maintain correspondent banking relationships are not always the same set. In our cross-border practice, we have seen well-licensed desks stall for months because the entity's banking profile was not considered at formation. The regulator, the bank and the counterparty each perform independent due diligence; a structure that satisfies one often creates friction with another.

Beneficial ownership transparency requirements, substance requirements and economic nexus tests all apply at the formation stage. Under the AIFC/AFSA regime in Kazakhstan and the ADGM/FSRA regime in Abu Dhabi, for example, a licensed entity must maintain genuine operations and qualified personnel within the jurisdiction – a purely paper presence does not satisfy the authorisation conditions.

The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis substantially. For a scoped structuring review before you commit to a jurisdiction, contact OBOLUS at info@oboluslaw.com or Map your options.

Which Licences Does an OTC Desk Actually Need?

The answer depends on three variables: the desk's activity set, the jurisdictions where its counterparties sit, and where the entity is incorporated. Most OTC desks operating at institutional scale require at minimum a VASP registration or CASP authorisation (a Crypto-Asset Service Provider authorisation under MiCA) in their primary operating jurisdiction, plus an analysis of whether activities in other markets require local registration or licensing.

Under MiCA, a CASP authorised in one EU member state may passport its services across the EU and EEA without separate authorisation in each member state. This passporting right makes an EU authorisation – through Lithuania, Malta or another member state – commercially significant for desks serving European institutional clients. The trade-off is that MiCA imposes organisational, capital and governance requirements that are more demanding than legacy VASP registration regimes in some of those same states.

In Dubai, VARA operates an activity-based licensing model. An OTC desk would ordinarily seek authorisation under the broker-dealer and, if holding client assets, custody activity categories. The VARA rulebooks govern conduct, capital and operational requirements for each activity. DIFC-based operations fall under the ADGM/FSRA regime rather than VARA – an important structural distinction for desks considering the UAE market.

Singapore's MAS Payment Services Act creates a tiered licensing structure: a standard payment institution licence or a major payment institution licence applies depending on transaction volumes, with the major PI licence carrying more demanding requirements. Hong Kong's SFC VASP licensing regime, which covers virtual-asset trading platforms, has its own vetting and capital expectations. Where a desk serves Japanese clients or routes through Japanese banking, the FSA and JVCEA self-regulatory framework adds a further compliance layer.

In our practice, the desks that encounter the most difficulty are those that expand geographically without reassessing their licence stack. A licence obtained for one market does not automatically cover activity in another, and the consequences of operating without authorisation – enforcement, fines, and reputational exposure with institutional counterparties – are not proportionate to the savings from delaying the application.

AML, the Travel Rule, and Counterparty Due Diligence

Every major jurisdiction where an OTC desk is likely to operate imposes AML/CFT (anti-money laundering and counter-terrorism financing) obligations drawn from the FATF Recommendations, including Recommendation 15 on virtual assets. The Travel Rule – the obligation to pass originator and beneficiary identifying information with a transfer – applies to VASP-to-VASP transactions across the FATF member base, including all of the hubs discussed above. The precise data threshold at which the Travel Rule is triggered varies by jurisdiction and is set by the applicable regime, not by a universal standard.

For an OTC desk, the Travel Rule creates an operational compliance obligation that interacts with counterparty onboarding. A desk that cannot demonstrate compliant Travel Rule infrastructure will be rejected by VASP counterparties operating in jurisdictions with rigorous enforcement. This is not a theoretical risk: in our cross-border practice, we have seen counterparty relationships terminated specifically because Travel Rule compliance documentation was incomplete at the time of a periodic review.

The AML programme itself must be tailored to the OTC profile. Block trades sourced from funds or family offices carry different risk indicators than retail flows. Counterparty due diligence for an institutional OTC desk covers the beneficial ownership chain, the source-of-funds analysis, and – increasingly – the on-chain transaction history of the wallets involved. Regulators under the VARA regime, the MAS regime and the FCA all expect this enhanced-diligence posture for high-value transactions.

If a prior application stalled or a banking relationship was closed, a compliance-structure review can surface the underlying reason and map the path forward. Write to info@oboluslaw.com or Map your options.

Why Is Banking the Hardest Problem for OTC Desks?

Banking access is the operational constraint that determines whether a licensed OTC desk can actually function. Many licensed desks carry full regulatory authorisation but hold a single banking relationship that can be terminated unilaterally by the bank. The risk is asymmetric: losing banking is an existential event for a desk that settles fiat legs; losing a licence takes considerably longer and usually involves process.

In our cross-border practice, we advise desks to approach banking as a legal and compliance project, not a commercial one. The bank's decision is driven by its own AML risk appetite and its correspondent banking relationships, which means the desk's compliance programme, its licence documentation and its beneficial ownership chain are all inputs to the bank's acceptance analysis. A desk that presents those materials in the format and depth that bank compliance teams expect stands materially better odds than one that presents a commercial pitch.

The jurisdictional interaction matters here. Desks licensed under VARA in Dubai or under the AIFC/AFSA framework in Kazakhstan benefit from regulatory environments where banking relationships for VASPs are more established than in some other hubs. That does not mean banking is easy – it means the due-diligence pathway is better understood. For desks with a multi-jurisdictional operating model, maintaining banking in two or more jurisdictions is prudent risk management, not redundancy.

Decision Matrix: Which Legal Structure Fits Which OTC Profile?

The right legal structure is a function of the desk's counterparty profile, its product set, its target jurisdictions and its existing corporate history. The following matrix sets out the principal decision branches we work through with clients.

Profile A – Emerging institutional desk, EU counterparty base, spot only. The natural licensing path is a CASP authorisation in an EU member state under MiCA, with passporting used to serve the broader EU/EEA market. The timeline for authorisation is a matter that varies by member state and regulator capacity; Lithuania and Malta have established MiCA transition pathways. The primary risk is underestimating the organisational and capital requirements that CASP authorisation carries relative to legacy VASP registration.

Profile B – Mid-market desk, UAE and Asian counterparties, spot and OTC derivatives. A dual-entity structure is usually warranted: a VARA-licensed broker-dealer entity in Dubai for the spot and UAE-side business, and a separately authorised entity in Hong Kong or Singapore for the derivatives and APAC flow. The legal question at this profile is whether the products qualify as securities or derivatives under the SFC or MAS frameworks – that classification drives the licence category and the capital requirement.

Profile C – Established desk, global counterparty base, considering US market access. US market access for an OTC desk brings federal-level obligations under FinCEN (money-services business registration), potential CFTC jurisdiction over derivatives, and state-level money-transmitter licensing in the states where counterparties are located. The NYDFS BitLicense is required for activity with New York counterparties. This profile requires the most extensive legal review and the longest pre-launch timeline.

Profile D – Early-stage desk, seeking the lightest compliant entry point. The BVI FSC VASP Act 2022 and the Cayman Islands CIMA VASP regime offer registration-track options with lower initial capital and compliance overhead than a full MiCA or VARA authorisation. These are appropriate for a desk that genuinely serves a limited counterparty base and has no near-term intention to expand into the major regulated markets. They are not a substitute for a licensing analysis: serving EU clients from a BVI-registered entity does not confer MiCA compliance.

What Happens When an OTC Trade Goes Wrong?

Disputes in OTC trading typically arise in one of three patterns: a counterparty defaults on settlement; funds are misappropriated after delivery of one leg; or a trade is challenged as falling outside the scope of an agreement. The legal remedies available depend critically on where the dispute arises, which law governs the trading agreement, and the speed of the response.

England and Wales remains the leading forum for crypto asset recovery in the common-law world. The courts have established that digital assets are property capable of being subject to a worldwide freezing order (an injunction freezing a defendant's assets globally), and disclosure orders under the Norwich Pharmacal and Bankers Trust principles have been used to compel exchanges to identify wallet holders. The CFAAR (Crypto Fraud and Asset Recovery network), launched in London in September 2021, coordinates cross-border recovery across multiple forums. The DIFC Courts in Dubai have also demonstrated willingness to issue freezing orders in support of foreign proceedings.

Recovery windows are short. After misappropriation, assets can move through multiple wallets and exchanges within hours. A well-prepared OTC desk maintains a response protocol that includes its forensic chain (on-chain tracing tools are available through specialist providers in the market), its legal counsel, and the internal documentation – transaction hashes, counterparty identifiers – that a court or an issuer freeze request will require.

In a recent recovery matter, a digital-asset trading firm discovered that a counterparty had failed to deliver the fiat leg of a multi-million-dollar block trade and had also moved the crypto leg through a series of intermediary wallets. Working across two jurisdictions, we secured a disclosure order from a common-law court and coordinated a freeze request to the relevant stablecoin issuer – Tether and Circle both hold contract-level blacklist authority over their issued tokens and generally act on a court order or a law-enforcement reference. The assets were located and restrained before the counterparty completed the withdrawal chain. The matter was resolved by negotiated settlement within weeks of the initial instruction.

A Common Assumption: One Offshore Licence Covers Global Operations

A common assumption among early-stage OTC desks is that a single offshore VASP registration – in the BVI, Cayman or a similar jurisdiction – is sufficient to serve clients anywhere in the world, provided the desk does not have a physical presence in a major regulated market. This assumption is wrong, and acting on it is one of the most consistent sources of enforcement exposure we see.

Regulatory reach is determined by where clients are located and where services are provided, not only by where the entity is incorporated. The EU's MiCA regime applies to any CASP offering services to EU residents, regardless of where the entity sits. VARA's jurisdiction in Dubai extends to activity targeting UAE residents. The FCA's financial-promotion regime in the UK applies to communications directed at UK persons from any location. Operating through a single offshore registration while serving clients in these jurisdictions does not create a compliance shield – it creates an unlicensed-activity exposure in every jurisdiction whose clients the desk serves.

The right answer is not necessarily to obtain a dozen licences simultaneously. It is to map the actual counterparty base, identify the jurisdictions that generate regulatory obligations, and build the licence and compliance stack in the sequence that reflects real commercial exposure. We map the licence, banking and tax stack for OTC desks before they commit to a structure.

Related at OBOLUS

• Licensing & Registration for Digital-Asset Businesses – the full VASP and CASP authorisation practice across 70+ jurisdictions
• UAE (VARA/Dubai) vs. Malta: Where to License a Crypto Business – a direct comparison of the two most popular EU and Gulf entry points
• Legal Counsel for Crypto Market Makers – the legal lifecycle for market-making operations and the specific risks at each stage

FAQ

How long does a crypto licence take to obtain?

Timelines vary materially by jurisdiction, licence category and regulator capacity at the time of application. A VASP registration in some offshore jurisdictions can be completed within weeks; a full CASP authorisation under MiCA or a VARA licence in Dubai typically takes a number of months from complete application submission. Pre-application preparation – entity structuring, AML programme documentation, governance policies – often takes as long as the formal review period and is where applicants most frequently underestimate the timeline.

Which jurisdiction is best for licensing my crypto business?

There is no universally best jurisdiction. The right choice depends on where your clients are, what products you offer, what banking you need and what your acceptable compliance overhead is. An EU CASP authorisation under MiCA delivers passporting across the EU/EEA but carries more demanding organisational requirements. VARA in Dubai suits businesses serving Middle East and international institutional flows. The optimal answer requires a multi-variable analysis of your specific operating profile, not a jurisdiction ranking.

Do I need a separate custody licence?

In most leading jurisdictions, custody of client digital assets is a regulated activity separate from trading or brokerage. Under MiCA, VARA, the MAS Payment Services Act and the SFC VASP regime, holding client assets requires specific authorisation or a custody component within your existing licence. An OTC desk that holds client assets between trade legs – even temporarily – should have its authorisation reviewed to confirm it covers custody. Operating custody activity outside a licensed scope is one of the most common compliance gaps we identify in desk reviews.

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers, trading desks and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around those activities. Digital assets are the entirety of our practice. We map the licence stack across operating, custody and payment layers before you commit to a structure – and we act only for businesses, not for retail clients or regulators. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.

By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in multi-jurisdictional VASP and CASP authorisation strategy for OTC desks, exchanges and custodians across the major regulatory hubs.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.