A licensed VASP (virtual asset service provider) that exists on paper only is a liability, not an asset. Regulators across the major hubs – VARA in Dubai, the FSRA in Abu Dhabi, the MAS in Singapore and the national competent authorities implementing MiCA across the EU – increasingly require demonstrable economic substance before they issue, renew or passport a licence. Operating without that substance risks enforcement, frozen banking rails and, in the worst case, revocation. This analysis maps the structuring question that matters: not where you can incorporate cheapest, but where you can build substance fast enough to satisfy the regulator before your business needs to go live.
Economic substance for a VASP is the combination of genuine management decision-making, qualified personnel, operational infrastructure and regulatory capital that a licensor expects to find in the jurisdiction where authorisation is sought. The analysis turns on three variables: the legal regime, the activity scope, and the operator's existing group structure. Each combination produces a different substance threshold – and a different cost of getting it wrong.
What Does Economic Substance Actually Require for a VASP?
Economic substance is not a single universal test. It is a cluster of regulatory expectations that converge on one point: the licensor must be able to demonstrate to its own supervisory peers that the licensed entity is real. In our cross-border practice, we see regulators focus on four substance pillars: local management presence, staffed compliance and AML functions, IT infrastructure and data localisation, and adequate own-funds or capital. No pillar alone is sufficient. A well-capitalised shell with no local staff fails the same review as a local team operating on undercapitalised books.
The cross-border dimension sharpens the problem. A group may hold a MiCA CASP authorisation in one EU member state, a VARA exchange licence in Dubai and a Payment Services Act DPT licence in Singapore. Each regulator asks: does this entity direct its own affairs from here? Where a parent company in a third country holds the key contracts, employs the senior officers and controls the technology stack, the subsidiary's local presence may be purely formal. Regulators increasingly conduct substance reviews at renewal and – under MiCA's ongoing supervision model – at any time during the licence lifecycle. The risk is not merely administrative. Deficient substance is a revocation ground in most flagship regimes.
Substance review by the FSRA under the ADGM framework and ongoing supervision by VARA in Dubai both extend to the question of where real decisions are made – not just where the licence plaque is mounted.
Operators we advise routinely underestimate the difference between incorporation substance and regulatory substance. Incorporating in a jurisdiction satisfies a company-law test. Regulatory substance is a separate, higher bar. The two are not the same, and conflating them is the most common structural error we see in early-stage licensing mandates.
Why Does the Cross-Border Reality Change the Substance Calculus?
For a business operating across jurisdictions, substance in one place does not automatically satisfy regulators elsewhere. The cross-border VASP faces a layered substance problem: the licensing jurisdiction expects presence, the tax residence jurisdiction applies its own economic substance rules (particularly for common-law offshore structures), and the jurisdictions where end-users sit may impose their own regulatory perimeter requirements. All three run simultaneously.
In our practice, the cross-border substance question most commonly arises in three patterns. First, a European operator licenses under MiCA via a small-market member state with the intention of passporting across the EU, while keeping all real operations in a third country. Second, a Middle East exchange holds a VARA licence in Dubai but routes all treasury and technology through a BVI or Cayman holding company. Third, a Singapore DPT licensee has its customer support, compliance officers and matching engine hosted offshore, leaving the MAS licensee as a thin coordination entity. In each pattern, the regulator eventually asks the same question: where is the business actually run?
The FATF Recommendation 15 framework – which underpins VASP supervision in all major hubs – directs national supervisors to assess whether a VASP has effective AML controls in the jurisdiction. That assessment is substance-adjacent: a compliance function that exists only on an organogram, without operational reality, does not satisfy the recommendation. MiCA's CASP authorisation requirements make this explicit: the registered office and head office must both be in the authorising member state, and the regulator must be satisfied that effective management is conducted from there.
For a business sitting between a EU licensing hub and a Gulf operating hub, the legal question turns on which entity directs the business and where its key decisions are made. Getting that wrong creates a dual exposure: the EU regulator questions the licence, and the Gulf regulator questions why EU-regulated activities are being routed through a VARA entity.
How Do Regulators Test Substance in Practice?
Regulators test substance through a combination of application scrutiny, ongoing reporting obligations and supervisory visits. Understanding the mechanics of each test lets an operator design its structure to survive them.
At the application stage, most flagship regulators require a detailed business plan that identifies where senior managers are physically located, who holds the compliance officer role and whether that individual is employed locally or seconded from a parent entity. VARA's activity-specific rulebooks require fit-and-proper assessments of key personnel and expect those individuals to be present in Dubai. The FSRA within ADGM similarly assesses the proposed governance structure and will question an arrangement where all significant decisions are delegated upward to a non-ADGM entity. The MAS, under the Payment Services Act regime, requires that the CEO of a major payment institution ordinarily reside in Singapore.
At the ongoing supervision stage, regulators use a variety of tools. Annual returns, regulatory business returns and AML compliance reports all require attestation by locally approved individuals. A failure to maintain the approved persons roster – because the officer has relocated or resigned – triggers a mandatory notification and, in some regimes, a temporary operational restriction. In our experience, the gap between approval and the first renewal review is the window in which substance erosion most commonly occurs: the business grows internationally, staff gravitate to the operational hub and the licensed entity is left with diminished local management.
VARA, specifically, conducts market conduct supervision and can inspect licensed entities' premises and records. An inspection that finds a largely empty office with no substantive decision-making occurring locally is a supervisory failure on paper, regardless of how the corporate organogram reads.
The Travel Rule (the obligation to pass originator and beneficiary data with a virtual asset transfer) also has a substance angle: a VASP must be able to demonstrate that its Travel Rule compliance operates from its licensed jurisdiction, because a delegation to an affiliate in a non-cooperating jurisdiction raises a regulatory red flag at examination.
Decision Matrix: Which Substance Model Fits Which Operator Profile?
Not every operator faces the same substance challenge. The appropriate structuring response depends on the business model, the target markets and the group's existing footprint. The following profiles represent the scenarios we encounter most frequently.
Profile A – The EU-Focused Exchange. A crypto exchange seeking to passport MiCA CASP authorisation across the EEA needs a licensed entity in one member state with genuine management presence. The key risk is the "letter-box entity" test: the competent authority must be satisfied that the licensed entity is not merely a passporting vehicle for a third-country parent. The appropriate structure places at least two senior managers (including the compliance officer) physically in the licensing jurisdiction, holds the primary customer contracts in the licensed entity, and ensures that the technology infrastructure – or at least the data localisation – meets any member-state specific requirements. Timeline to authorisation varies by member state and the completeness of the application file; qualitatively, operators should plan for a multi-month process and maintain substance throughout.
Profile B – The Gulf Operating Group. A business with a VARA or FSRA licence operating across the Middle East and Africa typically runs its real operations from Dubai or Abu Dhabi. The substance challenge here is ensuring that the licensed entity – not an offshore holding company – holds the key assets, employs the compliance team and controls the client relationships. Where a BVI or Cayman holding company is in the structure for tax or investment reasons, the group must ensure that the licensed UAE entity has sufficient independent substance to satisfy VARA or the FSRA. A management services agreement that routes all remuneration and decision authority to the offshore entity will draw scrutiny.
Profile C – The Singapore DPT Licensee with Regional Ambitions. An operator holding a major payment institution licence under Singapore's Payment Services Act that wants to expand into Hong Kong, the UAE and Europe faces a multi-licence stack. Each jurisdiction will assess whether the Singapore entity is the actual operating entity or a front for a larger offshore group. The MAS expects the Singapore licensee to have adequate resources, a locally resident CEO and genuine AML controls. Adding regional licences does not diminish that expectation. In our cross-border practice, we structure these arrangements so that the Singapore entity has a clearly documented and operationally real role in the group – as the technology licensor, the treasury hub or the primary compliance overseer – so that its substance is evidenced by inter-company agreements and documented decision-making, not just the licence certificate.
Profile D – The Early-Stage Issuer Seeking a First Licence. A token issuer seeking its first regulatory authorisation often has no pre-existing group structure. This is the optimal entry point for substance planning, because structure can be built correctly from day one. The most common mistake at this stage is to choose the jurisdiction purely on cost or speed, without mapping the substance requirements forward to year two and three when renewal and supervisory engagement intensify. Selecting a MiCA licensing hub that offers a streamlined application process but requires two locally resident senior managers creates a structural cost that compounds if the founders are based elsewhere.
For a scoped assessment of your current structure and its substance exposure across the relevant licensing jurisdictions, contact OBOLUS at info@oboluslaw.com. The process above describes the standard framework. Your entity structure, your user base and your banking relationships change the analysis materially.
What Are the Most Common Structuring Mistakes, and How Do They Surface?
The most common structuring mistakes share a pattern: they optimise for the application stage and ignore the ongoing supervision stage. A structure that passes initial scrutiny but erodes over the first eighteen months is not a successful structure. In our cross-border licensing practice, we see five categories of error with regularity.
The Secondment Trap. A parent entity seconds its compliance officer to the licensed entity without formalising the employment relationship locally. The secondee is listed on the regulatory application as the approved compliance officer. After authorisation, the secondee divides their time between the licensed entity and several other group entities. At the first renewal, the regulator asks whether the compliance function is genuinely local. The answer is ambiguous, and the operator faces a remediation requirement.
The Thin Capitalisation Bracket. An operator structures the licensed entity at the minimum capital threshold for its licence category, placing surplus capital in a holding company outside the licensed jurisdiction. The regulator's own-funds rules are technically satisfied at authorisation. When the business scales and transaction volumes increase, the licensed entity's capital adequacy may fall below the supervisory expectation for its actual risk profile. VARA and the FSRA both have ongoing capital adequacy monitoring obligations; the MAS imposes specific capital requirements on major payment institutions. Operating near the floor is a supervisory risk that is often underweighted at the structuring stage.
The Technology Delegation Problem. A licensed entity delegates all technology operation – including customer onboarding, wallet custody and transaction matching – to a third-party affiliate or vendor in a non-licensed jurisdiction. The licensed entity becomes, operationally, a regulatory shell. The regulator, on supervision, finds that the licensed entity has no independent capacity to operate, manage risk or respond to a supervisory direction. This is a revocation risk in most flagship regimes, including under MiCA's CASP outsourcing rules.
The Banking Rail Mismatch. An operator holds a licence in jurisdiction A but maintains all banking relationships in jurisdiction B. When the bank in jurisdiction B applies enhanced due diligence and identifies a mismatch between the entity's regulatory status and its transaction profile, the account is restricted. The licensed entity cannot operate. The structuring error is the failure to align the banking relationship with the licensed jurisdiction's regulatory identity. In our practice, we map the banking stack alongside the licence stack before the structure is finalised.
The Governance Paper Trail. Board minutes, investment committee resolutions and risk committee decisions are recorded in the holding company's jurisdiction, not in the licensed entity's jurisdiction. When a regulator requests documentation of key decisions made by the licensed entity's board, the file shows that the real decisions were made elsewhere. This is a substance failure that is difficult to remediate after the fact.
A micro-matter from our recent practice illustrates the Technology Delegation Problem in action. In a recent engagement, a licensed exchange operating under a Gulf regime had delegated its entire matching engine and customer wallet infrastructure to a wholly owned subsidiary incorporated offshore. Following a routine supervisory review, the regulator questioned whether the licensed entity had the operational independence required under the applicable rulebook. We were engaged to restructure the inter-company agreements, migrate the critical infrastructure back to the licensed entity's control, and produce a regulatory remediation plan. The matter was resolved without formal enforcement action, but the remediation timeline ran to several months – during which the operator's ability to onboard new institutional clients was constrained.
How Does Tax Structure Interact with Regulatory Substance?
Tax structuring and regulatory substance pull in different directions more often than operators expect. Tax advisors may recommend a holding company structure in a low-tax jurisdiction that holds the IP, employs the senior team and collects royalties from the licensed entities. Regulatory advisors require that the licensed entity retain genuine management, sufficient staff and operational independence. Reconciling these two objectives is a cross-border structuring problem that benefits from early, coordinated advice.
The offshore holding company model – common in crypto group structures because of its familiarity from traditional finance – creates substance tension at every VASP licensor. A Cayman or BVI holding company that holds the group's IP and employs its senior officers is structurally inconsistent with a VARA or FSRA requirement that key management reside and operate in the licensed jurisdiction. The practical resolution is a documented split of functions: the holding company holds investment assets and provides financing; the licensed entity employs its own regulated personnel, holds its own regulated assets and makes its own regulated decisions. The inter-company agreements must reflect this split, and the fee flows must be defensible under both transfer pricing rules and the regulator's outsourcing framework.
MiCA introduces an additional layer. The MiCA CASP authorisation framework requires that the registered office and head office both be in the authorising member state. A structure where the licensed entity's head office is in a member state but the parent employs all officers and directs all strategy from a third country does not satisfy this requirement. EU national competent authorities have signalled increasing scrutiny of structures that appear designed to use MiCA passporting rights while keeping operational reality outside the EU.
We regularly advise on the mapping of tax efficiency objectives against regulatory substance requirements. The workable structures are not exotic: they involve a genuine operational allocation of functions between the licensed entity and the holding entity, documented by agreements that can survive both a tax authority transfer pricing review and a regulator's outsourcing examination. The structures that fail are those designed without that dual test in mind.
A Common Assumption: One Offshore Licence Covers Global Operations
A common assumption among early-stage VASP operators is that a single licence – often from an offshore or small-market jurisdiction – is sufficient to serve clients globally, because digital assets are borderless. This assumption is wrong on multiple levels, and it is the one that most commonly brings enforcement risk to the door.
Regulators in the US, the EU, the UK, Singapore and Hong Kong all apply a territorial nexus test to regulated activity. Serving a customer in the UK using a crypto exchange does not become unregulated activity merely because the exchange is licensed in another jurisdiction. The FCA's financial promotion rules apply to communications directed at UK persons, regardless of where the promoter is licensed. MiCA's CASP authorisation covers services provided to EU retail clients, regardless of where the VASP is incorporated. The SFC's VASP licensing regime in Hong Kong covers services to Hong Kong investors.
The single-licence model also creates banking risk. A correspondent bank conducting enhanced due diligence on a payments institution will assess whether the entity's regulatory status is appropriate for its transaction profile and customer base. An exchange serving EU retail clients under a licence from a jurisdiction that has not implemented MiCA – and that is not passportable into the EU – presents a compliance profile that most correspondent banks will decline. The practical effect is that the single-licence model produces a business that is technically operating but functionally unable to bank.
The correct model for a multi-market VASP is a licence stack designed around the actual user base, the currencies handled and the activity scope. In our practice, we map that stack before the operator commits to its first jurisdiction, because the first licence choice constrains subsequent choices in ways that are expensive to unwind. A structure built around a MiCA passportable licence in a credible EU member state is a different business from one built around an offshore registration with no passporting rights. Both are legitimate; only one is scalable into the markets where institutional counterparties and banking relationships are available.
If a prior application stalled or a banking relationship was closed after a substance review, a second read of your structure can identify the root cause and the route forward. Write to OBOLUS at info@oboluslaw.com or message us at t.me/oboluslaw.
Self-Assessment: Does Your VASP Structure Have Adequate Substance?
Before committing to a licence structure – or before the next regulatory renewal cycle – an operator should work through the following substance markers. None of these is legal advice, and the analysis will differ by jurisdiction and activity scope. They are the indicators we assess in every licensing mandate.
First, local management. Does the licensed entity have at least two senior managers physically located in the licensing jurisdiction? Are those individuals employed by the licensed entity – not seconded from a parent – and do they have documented authority to bind the entity in day-to-day regulatory decisions?
Second, compliance function. Is the Money Laundering Reporting Officer (MLRO) or equivalent compliance officer employed locally, approved by the regulator, and operationally independent from the parent group's compliance function? Does the compliance function have a budget it controls, a reporting line that runs to the licensed entity's board, and a documented AML programme that reflects the licensed jurisdiction's applicable regime?
Third, operational infrastructure. Does the licensed entity hold its own technology systems, or has it delegated all operations to an affiliate? If it has delegated, are the outsourcing agreements documented in a way that satisfies the licensor's outsourcing rules, and does the licensed entity retain genuine oversight of the delegate?
Fourth, capital and banking. Does the licensed entity hold its regulated capital in accounts in the licensing jurisdiction? Are the banking relationships held in the entity's own name, not in the name of a parent or affiliate? Is the capital position monitored against the ongoing minimum requirement, not just the day-one threshold?
Fifth, governance records. Are the licensed entity's board decisions, risk committee minutes and investment decisions documented in a way that reflects genuine local decision-making? Would a regulator examining those records conclude that real governance happens at the licensed entity level?
Sixth, cross-border alignment. Is the substance position in the licensing jurisdiction consistent with the entity's tax residence position? Have the inter-company agreements been reviewed for consistency with both the regulator's outsourcing framework and the applicable transfer pricing rules?
Operators who can answer yes to all six indicators are well-positioned for supervisory scrutiny. Those who identify gaps should address them before – not during – a renewal examination or a supervisory visit. We map the licence, banking and tax stack for your build before you commit. To start that mapping, write to info@oboluslaw.com.
Related at OBOLUS
- Licensing and Registration for Digital Asset Businesses – the full OBOLUS practice overview for VASP licensing across major jurisdictions
- Crypto Exchange Setup in ADGM, Abu Dhabi – a jurisdiction-specific guide to FSRA authorisation and substance requirements in the ADGM free zone
- Economic Substance for Established VASP Operators – a service-level guide for operators reviewing or remediating their existing substance position
FAQ
How long does a crypto licence take to obtain?
Authorisation timelines vary significantly by jurisdiction, licence category and the completeness of the application file. In licensing hubs with streamlined processes, initial authorisation can take a matter of weeks for a registration-track application; full CASP authorisation under MiCA or a major payment institution licence under Singapore's Payment Services Act typically takes several months. Applications with incomplete substance documentation, unresolved fit-and-proper queries or novel business models run longer. We advise operators to plan conservatively and to pre-position substance before the application is submitted.
Which jurisdiction is best for licensing my crypto business?
There is no universally correct answer. The right jurisdiction depends on your target markets, your activity scope, your existing group structure and your banking relationships. A MiCA-passportable licence in an EU member state serves a business targeting European retail clients differently from a VARA licence serving a Middle East institutional base. The first licence choice constrains subsequent ones. We map the licence stack – including custody, payment and exchange layers – against the operator's specific profile before recommending an entry point.
Do I need a separate custody licence?
In most flagship regimes, custody of virtual assets is a regulated activity distinct from exchange or brokerage operations. MiCA treats crypto-asset custody as a standalone CASP service that requires separate authorisation. VARA's rulebooks treat custody as an activity-specific licence. Singapore's Payment Services Act includes a separate category for digital asset custody services. Whether you need a standalone custody licence depends on your business model: if you hold client assets in your own custody infrastructure, the answer is almost certainly yes in any major regulated jurisdiction.
OBOLUS is an independent digital-asset law boutique acting exclusively for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than seventy jurisdictions, on disputes and on-chain asset recovery across more than twenty-five forums, and on the tax, banking and compliance obligations that sit around them. Digital assets are the whole of our practice. We map the licence, banking and tax stack for your structure before you commit to any jurisdiction. Operators we advise include crypto exchanges building multi-market licence stacks, custodians remediating substance gaps ahead of renewal, and token issuers structuring their first regulatory authorisation. To discuss your situation, contact info@oboluslaw.com.
By Victor Olsen, Regulatory & Compliance Analyst – specialises in cross-border VASP licensing strategy and economic substance analysis for digital-asset businesses across the EU, Gulf and Asia-Pacific regions.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.