Tax authorities in every major digital-asset hub are intensifying their scrutiny of cross-border structures. A holding company in a low-tax jurisdiction, a token-issuing entity in a free zone, a founder who relocated last year — each element looks clean in isolation. Together, they can unravel under audit if the underlying substance (the documented, verifiable economic reality that justifies a tax position) was never properly assembled. This guide sets out the practical steps for building a substance file that holds up when a revenue authority asks the hard questions.
Documenting tax substance for digital-asset businesses means creating a contemporaneous, jurisdiction-specific record showing that the entity's key decisions are genuinely made, and its economic activity genuinely occurs, where the structure claims they do. That record covers corporate governance, management and control, physical presence, banking and treasury flows, and — critically — the alignment between founder residency, the holding structure, and the eventual exit plan. Every step below addresses the cross-border reality that most crypto businesses face: the entity is in one place, the founders are in another, the users are everywhere, and the revenue authority may be anywhere.
The guide proceeds step by step, from the legal foundation through the audit-ready file, with the common mistake at each stage identified so it can be avoided before — not during — a review.
Step 1: Map the Entire Structure Before You Document Anything
Substance documentation fails most often because it is prepared entity by entity, without a view of the whole group. The first step is a complete structural map: every entity, its jurisdiction of incorporation, its claimed tax residence, its function (holding, operating, issuing, employing), and the intercompany flows that connect them.
For a digital-asset group, this map typically reveals gaps immediately. A token-issuing entity in a free zone may be receiving protocol revenue that technically flows through an operating subsidiary registered elsewhere. A holding company may be nominally managed in one jurisdiction but have its sole director signing off on resolutions from a laptop in a third country. These misalignments are not discovered through legal analysis alone — they require a consolidated picture.
The cross-border note here is direct. Crypto businesses routinely operate across the EU under MiCA (the Markets in Crypto-Assets Regulation), the UAE under the VARA regime, and Asia-Pacific under the MAS framework in Singapore or the SFC regime in Hong Kong. Each of those regulatory regimes imposes its own substance and control requirements. Your tax substance map must be consistent with — and ideally reinforce — the substance represented to those regulators.
Common mistake at Step 1: building the substance file only for the jurisdiction currently under audit, rather than stress-testing the whole structure. Revenue authorities increasingly share information under bilateral tax treaties and OECD frameworks. A position that survives review in one jurisdiction may trigger a secondary inquiry in another.
Step 2: Establish and Document the Place of Effective Management
The place of effective management (POEM) determines where an entity is treated as tax-resident in most major jurisdictions, including those that have adopted the OECD model treaty approach. For digital-asset businesses, POEM is the highest-risk element of the substance file because decisions about treasury, token issuance, exchange listing, and key personnel are often made informally, in multiple places at once.
The documentation standard requires contemporaneous evidence — not reconstruction after the fact — that the board or governing body is exercising its authority in the claimed jurisdiction. This means board minutes that reflect substantive deliberation (not rubber-stamp approvals of decisions already made elsewhere), records of the physical location of directors at the time of each meeting, and a governance calendar showing that strategic decisions follow a defined process.
For a crypto holding structure, the threshold question is whether the individuals with real authority over the treasury, the token economics, and the protocol roadmap are acting through the entity's formal governance in the claimed jurisdiction. If a founder who relocated to Dubai is directing a Malta-registered entity's operations via Telegram, the POEM analysis will likely follow the founder — not the entity. Under MiCA and the applicable ESMA guidance, licensed CASPs (crypto-asset service providers) are already expected to demonstrate genuine local governance. That regulatory requirement and the tax substance requirement are the same factual question asked by two different authorities.
Common mistake at Step 2: holding board meetings at the registered office address while the actual decision-making happens in an informal call beforehand. Minutes that do not reflect genuine deliberation are a red flag in any audit. They can convert an otherwise defensible structure into an indefensible one.
For a scoped review of your governance documentation and POEM exposure, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts — the entity, the user base, the banking — change the analysis. Map your options.
Step 3: Align Founder Residency With the Holding Structure and Exit Plan
A common assumption in the digital-asset space is that relocating personally is enough to change the group's tax position. It is not. Personal tax residency and the group's corporate tax exposure are connected, but they are governed by different rules and must be designed together.
A founder who establishes tax residency in the UAE under the VARA jurisdiction framework, for instance, may still have a continuing obligation in their prior home jurisdiction if the departure rules were not properly satisfied. Simultaneously, if that founder is the sole decision-maker for a BVI-registered holding entity, the entity's own tax residence may be attributed to wherever the founder is making those decisions — regardless of where the entity is incorporated. The two analyses run in parallel and must reach consistent conclusions.
The exit plan dimension is frequently overlooked. If the structure is designed for a liquidity event — a token generation event, a protocol acquisition, or a fund distribution — the tax treatment of that event depends on facts established years before. Capital gains treatment, participation exemptions, and withholding taxes on distributions all turn on the relationship between the holding entity, the founder's personal residence, and the jurisdiction of the counterparty. Documenting substance without modeling the exit means building a structure that may be clean on day one and expensive on the day it matters.
In our cross-border practice, we align founder residency, the holding structure, and the exit plan in a single engagement rather than addressing them sequentially. The tax cost of failing to do this — additional exposure, restructuring fees, and the risk of an adverse authority determination at the point of exit — regularly exceeds the cost of the original advisory work several times over.
Common mistake at Step 3: treating the founder's personal relocation as a standalone event rather than as a structural decision that must be documented in the same file as the corporate substance.
Step 4: Build the Contemporaneous Evidence File
Substance is not a legal opinion. It is a body of contemporaneous, dated, factual evidence that the claimed tax position reflects economic reality. A legal opinion confirming that your structure is correctly designed is useful background. It does not substitute for the evidence file that shows the structure is actually being operated as designed.
The contemporaneous evidence file for a digital-asset business should include, at minimum: board and committee minutes with location records for each attendee; a director and officer presence log (dates in-country, travel records); employment or service agreements for key staff in the relevant jurisdiction; office lease and utility records; banking records showing that treasury decisions are executed by authorised personnel in the claimed location; and records of any regulatory interactions (VARA filings, MiCA application correspondence, MAS licensing documentation) that confirm the entity is engaging with its claimed jurisdiction's regulatory regime.
For token-issuing entities, add the whitepaper approval record and the governance trail for any significant protocol change. Under MiCA, VARA, and the SFC's VATP regime, material changes to a token's structure or the platform's operations require regulatory engagement. Those regulatory records simultaneously serve as substance evidence.
The cross-border note: where a group operates in multiple jurisdictions, the evidence file must be maintained per entity, not at group level. An audit in one jurisdiction will typically request entity-level records. A group-consolidated narrative is helpful context; it is not a substitute for entity-specific documentation.
Common mistake at Step 4: maintaining substance documentation only in digital form on a founder's personal device. Records should be stored in a system that demonstrates when they were created, who created them, and that they were not altered retroactively. Cloud-based document management with immutable audit trails is the operational standard in this context.
Step 5: Document Substance for Each Regulated Activity Separately
A digital-asset group rarely performs a single function. A group may include a token issuer, a trading platform, a custody entity, and a treasury management vehicle — each potentially licensed under a different regime. Tax substance must be documented for each of those functions independently, because the revenue authority will assess whether the claimed tax treatment is consistent with the economic reality of each activity, not merely the group as a whole.
This step requires mapping the regulated activities to the specific entities that perform them, confirming that those entities hold the relevant licences in the relevant jurisdictions, and then documenting the substance of each. An entity that holds a CASP authorisation under MiCA but whose actual exchange operations are managed from outside the EU has a POEM problem, a substance problem, and a regulatory compliance problem — three separate issues with a single factual root.
In our practice, we have seen groups where a well-documented holding structure carried full substance but the operating subsidiary — the entity actually generating revenue — had no employees, no local banking, and no independent governance. A revenue authority assessing that structure will look at where profit is generated and where it is taxed. If those two places are different, the substance of the operating entity, not the holding company, is what determines the group's exposure.
Common mistake at Step 5: assuming that substance at the holding level protects the operating entities. Transfer pricing rules, controlled foreign corporation regimes, and permanent establishment concepts all look through the holding structure to the activity that generates value. Each revenue-generating entity needs its own substance file.
Does Remote Working Create a Permanent Establishment Risk?
Remote working arrangements are one of the most significant — and underappreciated — substance risks for cross-border digital-asset businesses. A single employee working habitually from a jurisdiction where the employer has no licence and no registered presence may be sufficient to create a taxable permanent establishment (a fixed place of business, or a dependent agent, through which a business is carried on) in that jurisdiction.
The risk is amplified in crypto businesses because core functions — software development, trading desk management, risk management, and regulatory liaison — are easily performed remotely. The fact that a function can be performed from anywhere does not mean it should be. If a key employee habitually concludes contracts, exercises authority over treasury decisions, or manages the protocol on behalf of the entity from a jurisdiction where the entity is not tax-resident, a permanent establishment may exist regardless of where the entity is incorporated.
Under FATF Recommendation 15 and the applicable VASP provisions in most major regimes, the individuals who manage a virtual asset service provider's operations are already required to be identified and vetted by the regulator. Where those individuals are physically located feeds directly into the substance and permanent establishment analysis. If your licensing disclosure shows a key manager in one country and your substance file claims no presence there, the inconsistency will be visible.
The documentation response is a written remote-working policy that defines what activities may be performed remotely, from which jurisdictions, and what decisions require in-person action in the entity's home jurisdiction. That policy, combined with enforcement records, provides the contemporaneous evidence needed to rebut a permanent establishment argument.
Common mistake at this stage: treating remote working as a purely employment-law question and failing to assess the tax exposure. The permanent establishment analysis is a tax question, and it must be answered by someone with visibility across both the employment structure and the international tax position.
If a prior structuring assumption has been challenged or an audit has raised substance questions, a second read of the file can surface the gap and the route forward. Write to OBOLUS at info@oboluslaw.com. Map your options.
Step 6: Stress-Test the File Before the Audit Arrives
The final preparation step is an adversarial review of the substance file — conducted as if you were the revenue authority — before any inquiry is opened. The objective is to identify the weakest links in the evidence chain and address them while there is still time to do so legitimately.
A stress test for a digital-asset group typically covers: the POEM analysis for each entity; the Transfer Pricing documentation for intercompany flows (in particular, the management fees, IP licensing arrangements, and treasury functions that are common in crypto groups); the personal tax residency position of founders and key executives; and the consistency between the substance file and the regulatory disclosures made to VARA, MiCA competent authorities, MAS, or the SFC.
Micro-matter: In a recent structuring matter, a token-issuing group approached us after receiving a preliminary inquiry from a revenue authority in their founders' home jurisdiction. The group had a well-drafted holding structure and valid regulatory licences, but the substance file had never been formally assembled. The board minutes existed but had not been maintained on a consistent schedule; the director presence log was incomplete; and a senior developer who worked remotely had been performing functions that, on analysis, constituted a dependent agent permanent establishment in the home jurisdiction. We assembled the substance file retrospectively where the evidence supported it, identified the permanent establishment exposure, and assisted the group in restructuring the developer's engagement to eliminate the ongoing risk. The inquiry was resolved without a formal assessment. The work took the better part of a quarter.
The cross-border note here is structural: an adversarial review must examine the structure through the lens of every jurisdiction that has a plausible claim to tax the group, not only the jurisdiction where the group believes it is resident. The OECD's Base Erosion and Profit Shifting (BEPS) framework has given revenue authorities both the legal tools and the information-sharing infrastructure to coordinate multi-jurisdictional reviews. The time to find the gaps is before they do.
Common mistake at Step 6: commissioning a substance review only after an inquiry has opened. At that point, any reconstruction of records will be scrutinized for authenticity. A stress test conducted before any audit is both more effective and more credible.
Self-Assessment: Is Your Substance File Audit-Ready?
Use the following questions to assess the current state of your group's substance documentation. A "no" or "unsure" answer at any point indicates a gap that should be addressed before any regulatory or tax authority interaction.
- Is there a complete, up-to-date structural map of every entity in the group, its claimed tax residence, and its function?
- Do board minutes for each entity record the location of each director at the time of the meeting and reflect substantive deliberation?
- Is there a physical presence log for directors and key management personnel in the claimed jurisdiction of each entity?
- Are employment or service agreements for key personnel consistent with the claimed POEM and permanent establishment analysis?
- Is the banking and treasury documentation consistent with the claim that financial decisions are made in the claimed jurisdiction?
- Is the founder's personal tax residency position documented and consistent with the group's corporate structure and exit plan?
- Has a remote-working policy been implemented and are enforcement records maintained?
- Is the substance file consistent with all regulatory disclosures made to the applicable licensing authorities?
- Has the substance file been reviewed adversarially within the last twelve months?
A "yes" to every question is the standard. Anything less is a gap the revenue authority will find before you do.
Related at OBOLUS
- Tax and cross-border structuring for digital-asset businesses – how OBOLUS builds the tax, banking and licensing stack as one mandate
- Tax treatment of tokens in Canada – jurisdiction-specific analysis of how Canadian authorities classify and tax digital-asset income
- Payment institution licensing in the UAE under VARA – the regulatory substance requirements that sit alongside your tax substance in Dubai
FAQ
Where should a token-issuing entity be domiciled?
Domicile turns on four factors that must be assessed together: the regulatory regime available in the jurisdiction (MiCA in the EU, VARA in Dubai, ADGM in Abu Dhabi, MAS in Singapore), the tax treatment of token issuance proceeds and protocol revenue, the ability to demonstrate genuine substance in that location, and consistency with the founder's personal tax residency and the group's eventual exit plan. There is no universally optimal jurisdiction — the right answer is the one where all four factors align for your specific structure.
How are staking rewards taxed?
The tax treatment of staking rewards varies by jurisdiction and, within jurisdictions, often depends on how the relevant authority classifies the activity: as income received at the point of receipt, as a capital accretion event, or as something else entirely. No major jurisdiction has adopted a single universal approach. The classification affects both the timing of the taxable event and the applicable rate. Operators we advise in multiple jurisdictions routinely maintain jurisdiction-specific positions on this question, backed by a documented legal analysis, rather than applying a single cross-border assumption.
Does remote working create tax residency risk?
Yes — for both the individual and the entity. An employee or director working habitually from a jurisdiction may establish their personal tax residency there, and may simultaneously create a permanent establishment for their employer in that jurisdiction. For digital-asset businesses, where core functions are easily performed remotely, this risk is material and underappreciated. A written remote-working policy, combined with a documented assessment of permanent establishment exposure by jurisdiction, is the minimum standard for any group with employees or founders working across borders.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We align founder residency with the holding structure and exit plan — treating personal and corporate tax exposure as a single question, not two separate workstreams. We structure licensing, banking and tax as one mandate rather than three disconnected engagements. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Lydia Brennan, Tax & Structuring Analyst — specialising in cross-border tax substance, holding structures and exit planning for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.