Economic substance requirements have become one of the most consequential – and frequently misread – compliance obligations for licensed virtual asset service providers. A VASP (virtual asset service provider) that holds a regulatory authorisation in one jurisdiction while running its real operations from another is no longer a viable structure in most leading regimes. Regulators across Dubai, the EU, Singapore, the Cayman Islands and the BVI have converged on a common principle: the licence must follow the substance, not merely the registered address. Understanding how each regime defines and enforces that standard is now a first-order question for any operator building a cross-border digital-asset business.
This analysis compares the economic substance expectations attached to VASP registration and licensing across six flagship hubs. It maps the criteria, the enforcement posture and the practical build-out each profile demands. The discussion covers the EU under MiCA, VARA in Dubai, ADGM in Abu Dhabi, MAS in Singapore, CIMA in the Cayman Islands and the BVI FSC. Each section opens with a direct answer to the question the heading implies – designed for operator use and AI-overview extraction.
What Does Economic Substance Mean for a Licensed VASP?
Economic substance, in the VASP context, means that the licensed entity must conduct its core income-generating activities in the jurisdiction that issued the authorisation – not merely hold a company registration there. Regulators test for real presence: senior management resident and decision-making locally, staff proportionate to the regulated activity, operational infrastructure, and governance that functions where the licence sits. A shell company with a local director and a forwarding address satisfies none of these tests.
The principle draws from two reinforcing sources. First, tax authorities – led by the OECD Base Erosion and Profit Shifting project and the EU's anti-avoidance directives – require that profits are taxed where value is created. Second, financial regulators require that supervised entities are genuinely manageable and examinable by the licensor. For VASPs, these two bodies of law now arrive simultaneously at the application stage.
In our practice, operators frequently underestimate the management-and-control dimension. Placing a non-executive local director on the board while the founders run the business from a third country fails both tests. The regulatory file may look compliant. The substance does not hold on examination.
A common assumption is that economic substance is a tax issue only, separate from the licence process. In practice, the two are inseparable: most leading regulators now ask applicants to demonstrate their governance and staffing build-out as part of the authorisation review. Failure to satisfy the substance question can delay or defeat the application itself – before any tax authority becomes involved.
Under MiCA, What Substance Does a CASP Need in Its Home Member State?
A CASP (crypto-asset service provider) authorised under MiCA must establish genuine management, decision-making and operational capacity in the authorising EU or EEA member state. The regime, supervised by national competent authorities and overseen at EU level by ESMA, is explicit that a passporting right flows from a real home-state presence. An entity that obtains authorisation in one member state while conducting all management from outside the EU will face supervisory challenge from the home NCA and risk losing the passport.
The MiCA model requires that senior management – at minimum the persons effectively directing the business – are physically resident and active in the authorising jurisdiction. Governance documentation, board minutes and key decisions must evidentially originate there. IT and operational systems must be demonstrably under the control of the local entity, not outsourced to a group affiliate in a non-EU country in a way that removes the NCA's supervisory reach.
Lithuania has historically been a popular EU entry point, in part because of a relatively streamlined VASP registration process under the prior regime. Under the MiCA transition to CASP authorisation, the Bank of Lithuania applies the same substance standards as other NCAs. An operator that built a minimal Lithuania structure to capture the old registration will need to revisit that structure before MiCA authorisation is sought.
Malta presents a comparable picture. The MFSA's transition from the VFA framework to CASP authorisation under MiCA carries forward a strong emphasis on the fitness of local management and the adequacy of local governance. Operators using a VFA agent under the prior framework should expect the MFSA to scrutinise post-transition substance more carefully, not less.
The process transparency point is straightforward: ESMA's guidelines on the MiCA authorisation process identify the business-plan adequacy review, which includes assessment of operational and governance arrangements, as a core element of the file. Deficiencies here are cited as grounds for refusal, not merely post-authorisation remediation.
For a cross-border operator with users across multiple EU member states, the question is not only whether the home-state substance standard is met, but whether the passporting notification process is correctly executed and whether the host-state NCAs have any additional overlay. In our experience advising on EU entry structures, operators regularly underestimate the host-state notification burden and the speed at which host-state regulators can escalate concerns to the home NCA.
To map your MiCA authorisation structure and substance build-out, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the management locations, the banking – change the analysis materially.
How Does VARA in Dubai Assess Economic Substance for Licensed VASPs?
VARA – the Virtual Assets Regulatory Authority – applies an activity-based licensing model that embeds substance expectations directly into its rulebooks rather than leaving them to a separate tax overlay. An entity licensed by VARA for exchange, custody, broker-dealer or other virtual-asset activity must maintain its principal place of business in Dubai mainland (the VARA regime excludes the DIFC financial free zone, which operates separately). The management and operations of the licensed entity must be genuinely Dubai-based.
VARA's examination of substance is partly structural and partly behavioural. At the structural level, it expects senior officers – including the chief executive and the compliance function – to be present in Dubai, accessible to examiners and embedded in governance that operates locally. At the behavioural level, VARA's supervisory reviews examine whether real decisions are being made by the local management or whether the Dubai entity is executing instructions from a parent elsewhere.
Operators choosing Dubai also engage with the UAE's domestic economic substance regime under the Economic Substance Regulations. For regulated financial services – which encompass most VARA-licensed activities – the test requires relevant income to be generated in the UAE and the core income-generating activities to be carried out there. This is a parallel obligation to the VARA licensing requirement, administered by a different authority, but pointing to the same conclusion: the business must genuinely operate from Dubai.
In our cross-border practice, we regularly advise operators who want to use a Dubai VARA licence as the regional hub for Middle East and wider MENA markets while maintaining technology or product functions in another jurisdiction. That structure is legally possible, but the UAE substance analysis must be conducted for each layer – the licensed entity, any group services company and the technology arrangement. An allocation of functions that strips economic substance from the Dubai entity while leaving the VARA licence there is a recognised risk.
Does ADGM Under the FSRA Apply a Different Substance Standard?
ADGM and VARA operate in the same country but under distinct legal systems; the FSRA within ADGM applies a substance test that is closely integrated with the authorisation of regulated activities for virtual assets, and it expects a genuine financial-services presence within the free zone. ADGM is a common-law jurisdiction with its own court system, and the FSRA's supervisory approach reflects both FCA-lineage expectations and the Abu Dhabi regulatory environment.
The FSRA's framework recognises a list of "recognised" virtual assets and attaches activity-specific authorisation requirements to dealing, managing, arranging and custodying those assets. Substance is assessed against the proposition that a licensed entity should be capable of being genuinely supervised within the ADGM – meaning its books, its management and its governance must be reachable by the FSRA without recourse to a third-country affiliate.
For operators weighing a VARA versus ADGM structure, the substance implications differ in practice. VARA's footprint is Dubai mainland, with a regulatory perimeter that encompasses a broad range of retail and institutional activity. ADGM targets more institutional and professional-market business. The substance build for ADGM is likely to require a smaller headcount but a more sophisticated governance and risk-management overlay, reflecting the institutional profile of the activity. We address the VARA-versus-ADGM decision in more detail in a dedicated analysis.
What Substance Does MAS Require for a DPT Licence in Singapore?
MAS – the Monetary Authority of Singapore – requires that a holder of a Digital Payment Token (DPT) service licence under the Payment Services Act maintains effective management and control of its Singapore entity from within Singapore. The MAS supervisory model is demanding: it expects the locally incorporated or registered entity to have sufficient qualified personnel, a functioning local compliance and risk function, and board or equivalent oversight that exercises genuine authority over the licensed activity.
Singapore's corporate substance expectations sit within a broader framework. The Inland Revenue Authority of Singapore applies tax-residency rules that look to where the board meets, where decisions are made and where management control is exercised. An operator that licenses through Singapore but manages the business from a third country will face both a MAS supervisory concern and a Singapore corporate-tax-residency challenge.
The MAS Payment Services Act provides for major payment institution licensing – the relevant tier for most exchange and DPT service operators – and a standard payment institution tier for lower-volume businesses. The substance expectations scale accordingly. A major payment institution is expected to demonstrate a more developed local infrastructure, with a compliance officer of adequate seniority, a risk framework aligned to the volume and nature of the activity, and governance documentation that evidences local decision-making.
Singapore has an additional dimension relevant to cross-border operators: the MAS has signalled, through public guidance and supervisory correspondence that the industry has observed, that it expects DPT service providers to maintain technology and operational resilience within Singapore or to demonstrate that outsourcing arrangements do not compromise supervisory access. Operators relying on technology infrastructure hosted entirely in another jurisdiction should map this expectation before applying.
If you are structuring a Singapore DPT licensing application and need to map the substance, compliance and banking layers, write to info@oboluslaw.com. If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back.
How Does CIMA in the Cayman Islands Approach VASP Substance?
The Cayman Islands Monetary Authority (CIMA) administers virtual-asset licensing under the Virtual Asset (Service Providers) Act, and the Cayman Islands separately imposes an economic substance regime under its Economic Substance Act that applies to entities carrying on relevant activities, including fund management and, depending on the activity, virtual-asset business. The interaction of these two bodies of law creates a compound obligation for a Cayman VASP: it must satisfy CIMA on the regulatory side and the Tax Information Authority on the substance side.
Cayman's economic substance test requires that the relevant activity is directed and managed in the Cayman Islands. This means the core decision-making functions must occur there, not merely be ratified by a local director. The standard adopted by Cayman is broadly aligned with the EU and OECD model, reflecting Cayman's commitment to the EU's list of cooperative jurisdictions and FATF standards.
In practice, Cayman is frequently used as a fund-vehicle jurisdiction rather than as the primary operating entity. A structure that uses a Cayman fund as the investment vehicle, with the management carried out by an entity in another jurisdiction, may well satisfy both CIMA and the substance regime – provided the management entity is properly licensed and the Cayman entity is not itself conducting the virtual-asset service. Where the Cayman entity is the VASP, however, the substance analysis must be undertaken with care.
Operators we advise who hold Cayman VASP registrations regularly ask whether minimal local presence is sufficient. The honest answer is that minimal presence – a registered agent and a local director – is not. The Act and the substance regime together require demonstrable, proportionate local activity. What "proportionate" means in a given case depends on the type and volume of virtual-asset service, but it consistently means more than a corporate address.
What Does the BVI VASP Act Require on Economic Substance?
The BVI Financial Services Commission administers the Virtual Asset Service Providers Act 2022, and the BVI's separate economic substance regime imposes obligations on BVI entities carrying on relevant activities – including, in most constructions, virtual-asset business. A BVI VASP that structures itself with a passive local presence while conducting operations offshore is exposed on both the regulatory and the substance fronts.
The BVI Economic Substance Act follows the OECD/EU-aligned model that Cayman and other offshore centres adopted in response to external compliance pressure. The test requires that the relevant activity is conducted in the BVI, that adequate employees and expenditure are maintained there, and that the entity is directed and managed locally. For a virtual-asset service – exchange, custody, transfer – the substance requirement maps closely to the VASP Act's fitness and operational expectations.
The BVI remains a favoured domicile for holding-company structures and for fund vehicles, and a BVI VASP registration can be a viable option for a business with a genuine BVI operational footprint. What it cannot sustain is a structure where the BVI company is the nominal VASP but the actual service is delivered from a third jurisdiction with no supervised presence. In our cross-border practice, we have seen this configuration scrutinised both by the FSC on renewal and by counterparty banks conducting enhanced due diligence on VASP clients.
Which Jurisdiction Fits Which Operator Profile?
The right licensing jurisdiction for a VASP depends on the operator's actual activity, the location of its management, the markets it serves and the banking relationships it needs – no single offshore registration is adequate for a globally active operator. A common assumption is that a single licence is sufficient for global operations. That assumption does not survive contact with the substance, passporting and regulatory-equivalence rules of most major regimes.
Consider four operator profiles and the substance implications of each.
Profile A – EU-market exchange, management in the EU. The natural fit is a CASP authorisation in a member state with a manageable regulatory timeline and a credible supervisory body. Lithuania and Malta both offer EU passporting, but the operator must build genuine local management in the authorising state. The key risk is undercapitalised substance: a local office with one compliance officer and a remote management team fails the test. Timeline to authorisation under MiCA is qualitatively longer than the prior VASP registration route – operators should expect a process measured in months rather than weeks.
Profile B – Institutional crypto exchange, management in the GCC. A VARA licence for Dubai mainland or an ADGM authorisation under the FSRA are the primary options. Both require local management and a real operational presence. VARA covers a broader activity set at the retail and institutional levels; ADGM tends toward institutional and professional-market activity. Banking for either structure is achievable but requires early engagement with UAE correspondent networks.
Profile C – DeFi-adjacent payments platform, management in Asia. Singapore under the MAS Payment Services Act is the leading choice for Asia-Pacific institutional and semi-institutional operators. Substance must be genuine – a local compliance function, Singapore-based management participation in key decisions. Hong Kong under the SFC's VASP licensing regime is available for trading-platform operators, with a supervision model that emphasises investor protection and operational resilience. Both jurisdictions require real presence, not a representative office.
Profile D – Fund vehicle or holding structure, global investor base. Cayman and BVI remain viable for fund vehicles and holding companies, but the substance regime requires that any virtual-asset service activity conducted in the vehicle is proportionately staffed and directed locally. Using a Cayman or BVI entity as a pass-through for an unlicensed operating activity is not a compliant structure in any of these jurisdictions. Operators in this profile commonly pair a Cayman fund with an operating-level VASP licence in a supervised hub – Singapore, Dubai or the EU – and the substance analysis must be conducted at both levels.
A Practical Illustration: Substance Mismatch Identified at the Application Stage
In a recent licensing engagement, a digital-asset lending platform approached us after receiving a request for information from a leading EU member state's NCA during its CASP authorisation review. The regulator had noted that all board meetings were held outside the EU, that the chief risk officer was based in a non-EU jurisdiction and that operational systems were managed by a third-country affiliate under a group services agreement that gave the NCA no direct supervisory access. The application had passed initial completeness review but stalled at the substantive assessment.
We were retained to map the deficiencies and structure a remediation plan. Working alongside allied counsel in the relevant EU jurisdiction, we identified four changes: relocating the CRO function to the authorising state, amending the board composition to achieve a local majority for key risk decisions, restructuring the group services agreement to include a direct supervisory-access clause, and establishing a local technology-operations function with documented governance. The amended application was resubmitted and proceeded to the next stage without a further substantive objection. No monetary outcome is attributed to this matter; the value was in preserving the authorisation timeline.
How Do AML and the Travel Rule Interact With Substance Obligations?
The Travel Rule – the obligation under FATF Recommendation 15 to pass originator and beneficiary information with a virtual-asset transfer – must be implemented by the entity that holds the licence, and regulators use Travel Rule compliance as a proxy for whether the licensed entity is operationally real. A VASP that outsources its compliance function entirely to an affiliate in another jurisdiction, without any local oversight, typically cannot demonstrate credible Travel Rule compliance to its licensing authority.
FATF's framework, as implemented across the major licensing hubs, requires that the obliged entity – the licensed VASP – maintains direct responsibility for AML/CFT policy, risk assessment and transaction monitoring. Where the substance of those functions resides outside the licensor's jurisdiction, the regulator is entitled to ask whether the licensed entity is the true obligor or merely a contractual shell above the operating reality.
In our practice, AML and substance deficiencies frequently appear together. An entity that lacks genuine local management also tends to lack a functioning local compliance function, and its AML documentation reflects that – policies signed off remotely, a risk assessment that does not reflect the actual transaction book, and monitoring that is operationally disconnected from the licensed entity. Regulators in the EU, Singapore and Dubai have each publicly identified this pattern as a supervisory concern.
The cross-border dimension adds complexity. A VASP serving users in one jurisdiction, licensed in another and processing payments through a third-country banking arrangement must implement the Travel Rule under the standards of its licensing jurisdiction – and potentially under the standards of the jurisdiction where its users sit. Where those standards differ, the more demanding standard typically governs the transaction that crosses into that jurisdiction.
Addressing the Single-Licence Assumption
A common assumption among early-stage operators is that a single offshore licence – a BVI or Cayman registration, or an older-generation EU VASP registration – is sufficient to serve clients globally without further regulatory exposure. This assumption is incorrect in the large majority of commercial scenarios.
The reasons are structural. First, most retail-facing digital-asset activity is regulated at the point of service delivery, not only at the point of incorporation. An operator serving EU retail clients is subject to MiCA regardless of where it is incorporated. Second, the substance regimes of every major licensing hub now require real local activity – a nominal registration in a low-cost offshore jurisdiction does not satisfy the substance test of a more demanding hub where the clients or the management actually sit. Third, banking counterparties conduct their own regulatory-equivalence analysis. A VASP holding a single registration in a jurisdiction whose supervision is not recognised as equivalent by the relevant correspondent bank will find its banking access restricted or closed.
The practical result is that a globally active VASP typically requires a layered licence stack: a primary regulated authorisation in its principal operating market, potentially a secondary authorisation in a major offshore or regional hub, and a clear analysis of the jurisdictions where it may not operate without local authorisation. That analysis is jurisdiction-specific and should be completed before the business model is fixed, not after the first enforcement letter arrives.
Operators we advise routinely arrive at this conclusion after a market-entry review rather than after an enforcement event. The earlier the review, the lower the cost of structural adjustment.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – the full practice overview covering 70+ jurisdictions and VASP authorisation pathways
- VARA vs ADGM – Two Routes Into the UAE – a comparative analysis of Dubai and Abu Dhabi licensing structures for digital-asset operators
- Economic Substance for Licensed VASPs – Established Operators – a service-level guide to auditing and remediating substance arrangements for operating businesses
FAQ
How long does a crypto licence take to obtain?
Authorisation timelines vary significantly by jurisdiction, licence type and the completeness of the application file. Processes under MiCA's CASP regime, VARA in Dubai and MAS in Singapore are typically measured in months rather than weeks, reflecting the substantive review of business plans, governance structures and substance arrangements. A well-prepared application with genuine local substance consistently processes faster than a deficient one that triggers multiple information requests. Qualitative planning for a six-month-plus process is prudent for most leading hubs.
Which jurisdiction is best for licensing my crypto business?
There is no universally correct answer. The relevant factors are the operator's activity type, the location of its management and users, its banking requirements and its tax position. EU-market operators should examine CASP authorisation under MiCA. GCC-facing businesses face a VARA-versus-ADGM choice. Asia-Pacific operators look primarily to MAS in Singapore or the SFC in Hong Kong. Each decision requires a substance analysis that maps the real operational footprint against the jurisdiction's regulatory requirements. A comparative assessment before commitment is strongly recommended.
Do I need a separate custody licence?
In most leading regimes, custody of virtual assets is treated as a distinct regulated activity requiring its own authorisation or an explicit extension of an existing licence. Under MiCA, providing custody and administration of crypto-assets on behalf of clients is a defined CASP service. VARA, the FSRA and MAS each recognise custody as a separately licensed or authorised activity. An exchange that also holds client assets is, in most frameworks, conducting custody and must ensure its authorisation specifically covers that activity. Operating custody without the required authorisation is a material regulatory breach in all major hubs.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – so structural decisions rest on a complete regulatory picture, not a partial one. To discuss your situation, contact info@oboluslaw.com.
By Lydia Brennan, Tax & Structuring Analyst – specialising in cross-border VASP licensing structures, economic substance analysis and the tax implications of digital-asset entity design across the EU, GCC and Asia-Pacific hubs.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.