Economic Substance for Licensed VASPs: Where the Legal Lines Are Drawn

A virtual asset service provider (VASP) that holds a licence in one jurisdiction while conducting its real business from a laptop in another is increasingly the subject of regulatory scrutiny — and, in some cases, enforcement. Regulators across the major hubs now examine not only whether a licence exists, but whether the licensed entity genuinely occupies the jurisdiction it claims. The legal question that follows is precise: what level of local presence does economic substance law demand, and how does that interact with the obligations imposed by the underlying regulatory authorisation (the permission to carry on regulated virtual-asset activities)?

For operators running cross-border structures, the answer is rarely found in a single rulebook. Substance requirements emerge from corporate tax law, from VASP registration conditions, from AML supervisory expectations and — increasingly — from the exchange of information between regulators in different jurisdictions. Getting this wrong does not merely trigger a tax adjustment. It can unwind a licence, freeze banking and expose senior management to personal liability.

This analysis works through the key legal lines: the substance concept itself, how the leading licensing jurisdictions apply it, where the tension with cross-border operational models is sharpest, and what a well-structured operator should put in place before the question is asked by a regulator or a counter-party bank.

What Does Economic Substance Actually Mean for a Licensed VASP?

Economic substance, in the VASP context, means that the licensed entity genuinely conducts its core income-generating activities (CIGAs) in the jurisdiction where it is incorporated and licensed — not merely on paper. The concept originates in international tax standards, but its practical application for digital-asset operators runs deeper than tax. A substance-deficient structure risks challenge on at least three distinct fronts: tax residency, licence validity and AML supervisory standing.

From a tax perspective, a VASP that is incorporated in, say, a low-tax offshore centre but directs its business from a higher-tax jurisdiction may be treated as tax-resident in the latter under the place of effective management doctrine. That matters enormously when the operator is deciding where profits are booked. The OECD's base erosion and profit shifting (BEPS) standards — particularly the guidance on artificial arrangements — inform how tax authorities in the EU and in the major financial centres approach these structures.

From a licensing perspective, most flagship regulatory regimes now require that the licensed entity maintain a genuine local presence: a physical office, locally-based senior management, and material business decisions taken within the jurisdiction. Under MiCA, the EU's Markets in Crypto-Assets Regulation, a CASP authorisation (crypto-asset service provider authorisation) requires the applicant to have its registered office in the EU, with senior management that actually exercises their functions there. The ESMA-level supervisory convergence work makes clear that a brass-plate operation is not the intent of the regime.

In our cross-border practice, we regularly see structures designed around the licence-minimal approach — one offshore entity holding the regulated permission — that function adequately at inception but break down as the business scales, as banking relationships require CDD on beneficial owners, and as regulators begin coordination calls. The gap between legal and operational substance is where enforcement pressure concentrates.

Which Licensing Jurisdictions Apply a Formal Substance Test?

Formal economic substance legislation now applies in virtually every major offshore and mid-shore jurisdiction that is also a VASP licensing hub, meaning the two regulatory regimes — corporate substance law and financial services licensing — impose overlapping presence obligations on the same entity.

The BVI's economic substance regime, administered under the relevant domestic framework that responded to international pressure from the EU and OECD, requires entities conducting "relevant activities" — which include financing and leasing business and, on interpretive grounds, financial services activities — to demonstrate adequate local employment, physical premises and management. The BVI FSC, as the licensing authority under the VASP Act 2022, separately requires that VASP registrants have a qualifying presence. These two frameworks do not fully duplicate each other; they address different legal questions, but a deficiency under either creates a structural problem.

In the Cayman Islands, CIMA — the Cayman Islands Monetary Authority — supervises VASP registration and licensing under the Virtual Asset (Service Providers) Act. The separate economic substance regime requires in-scope entities to conduct CIGAs in Cayman. Funds and VASPs that rely on a Cayman registration while routing all substantive activity offshore through a management company face increasing scrutiny on this point.

Within the EU, the question is framed differently. There is no standalone "substance legislation" for VASPs. Instead, the CASP authorisation requirements under MiCA demand, structurally, the same result: the applicant must show that it is genuinely established in the member state, that its management body meets fit-and-proper standards and is based locally, and that the competent authority can exercise effective supervision. Member states such as Lithuania and Malta — historically attractive for their streamlined entry — are adapting their supervisory frameworks to MiCA's higher operational expectations, and their competent authorities are raising the bar on what a credible local presence looks like for an inbound applicant.

For operators considering a dual-layer structure — an EU CASP entity operating alongside an offshore holding company — the substance question is whether the EU entity truly runs its own regulated activities or whether it is effectively a front for a group decision-making centre located elsewhere.

Where Does an Offshore Licence Create Substance Risk?

A common assumption among operators is that obtaining a VASP registration in a low-requirement jurisdiction — and then serving customers globally from that base — satisfies regulatory requirements worldwide. That assumption is legally unsound, and its risks are material.

The first problem is jurisdictional reach. A VASP licence in jurisdiction A grants permission to carry on regulated activities under jurisdiction A's law. It does not grant permission to carry on regulated activities in jurisdiction B, C or D if those jurisdictions have their own licensing or registration requirements. VARA — Dubai's Virtual Assets Regulatory Authority — operates an activity-based licensing model: an entity wishing to offer virtual-asset services to customers located in or accessing services from Dubai requires a VARA licence, regardless of where the entity is domiciled. Operating without it triggers enforcement exposure under the Dubai regime.

The second problem is tax. A VASP licensed offshore whose management, systems, staff and decision-making are all located in a high-tax centre may be treated as tax-resident in that centre. The substance legislation in the offshore jurisdiction does not resolve this — it addresses whether the entity meets local substance requirements, not whether a foreign tax authority will assert residency. These are different questions answered by different legal standards.

The third problem is banking. Correspondent banks and payment infrastructure providers conducting their own due diligence on a VASP client will assess whether the regulated entity appears to be a genuine operating business. A registered-agent address, a single locally-appointed director and no local staff does not present as substance to a compliance officer at a major bank. In our practice, we regularly advise clients whose licence was valid in form but whose banking was terminated — or never opened — precisely because substance indicators were absent.

The fourth problem is supervisory coordination. Regulators in the major centres share information under the FATF Recommendations framework, bilateral MOUs and the emerging supervisory cooperation structures under MiCA. A substance-deficient VASP in jurisdiction A operating material business in jurisdiction B creates exposure in both — the offshore regulator for potential licence conditions breach, the onshore regulator for unlicensed activity.

For a scoped assessment of your current structure's substance exposure, contact OBOLUS at info@oboluslaw.com. The process above describes the standard risk pattern. Your facts — the entity, the user base, the banking, the management location — change the analysis materially. To map your options, Map your options.

How Does Economic Substance Interact With AML Supervisory Expectations?

AML supervisory requirements impose a parallel and reinforcing substance obligation on licensed VASPs — one that is often underestimated when operators focus on the corporate and tax dimensions alone.

Under the FATF Recommendations, including Recommendation 15 on virtual assets, VASPs are required to implement risk-based AML/CFT programmes. The practical implementation of those programmes requires a compliance function that is genuinely operational in the licensed entity. A CASP authorised in the EU must have a money-laundering reporting officer (MLRO) and senior management with genuine AML accountability within the EU entity. Outsourcing the entire compliance function to a service provider in another jurisdiction — without maintaining internal oversight and decision-making capacity locally — falls short of what supervisors in the major hubs now expect.

The Travel Rule — the obligation to pass originator and beneficiary data with a virtual-asset transfer — creates an additional operational substance requirement. Compliance with the Travel Rule demands technical integration, policy governance and counterparty due diligence. These are not functions that a brass-plate entity can credibly claim to perform. Supervisors in Singapore, where the Monetary Authority of Singapore (MAS) supervises licensed digital payment token (DPT) service providers under the Payment Services Act, have articulated detailed expectations about the local management of AML systems. Similar expectations apply under the MFSA's VFA framework, now transitioning to MiCA.

In a recent matter, we advised a custodian that had registered in a mid-shore jurisdiction while housing its compliance team and systems in a third country. When the regulator conducted a supervisory visit, it found that no AML decisions of substance were being made within the licensed entity. The resolution required a restructuring of the compliance function — local hires, local systems access, board-level AML accountability within the registered entity — before the licence conditions were confirmed as met. The cost and timeline of that remediation significantly exceeded what a correct initial structure would have required.

What Does a Defensible Substance Model Look Like for a Cross-Border VASP?

A defensible economic substance model for a licensed VASP is not a maximum-cost exercise. It is a proportionate structure that satisfies the applicable legal tests across the corporate, tax, licensing and AML dimensions simultaneously — and that can be demonstrated to a regulator, a bank or a tax authority on short notice.

The core elements are consistent across the major frameworks. Management decisions must genuinely be made within the jurisdiction: board meetings held locally, with quorate attendance by directors who are physically present, and minutes that record substantive deliberation rather than ratification of decisions made elsewhere. The senior management of the regulated entity — CEO, CFO, MLRO — must be locally based or, at minimum, demonstrably exercising their functions within the jurisdiction. Physical premises must be real: a serviced office that is genuinely used, not a registered-agent address. Employees responsible for core income-generating activities must be locally employed or seconded under a documented arrangement that keeps control and oversight within the licensed entity.

The cross-border dimension adds complexity. Many VASPs operate across multiple markets from a group structure. The legal task is to allocate functions between the group entities in a way that places the right activity in the right place — not to concentrate everything in the highest-tax, highest-substance centre, but to ensure that each regulated entity genuinely performs the activities for which it holds its licence.

Consider two contrasting operator profiles.

An exchange operator licensed by VARA in Dubai, serving UAE-resident customers, should have its core trading operations managed from Dubai, with senior technical and commercial staff locally based. If the group also holds a CASP authorisation in an EU member state to serve EU customers, the EU entity must genuinely conduct EU-facing business, with its own management structure, its own AML programme and its own relationship with the national competent authority — not merely a sub-licence feeding revenue back to Dubai.

A custodian licensed under the ADGM framework and operating a technology centre in a different country faces a sharper question: does the custodianship activity — the safeguarding and administration of the assets — happen within the licensed entity, or is it effectively performed by the technology affiliate? The FSRA's expectations under the Abu Dhabi Global Market framework are clear that the regulated entity must retain genuine control of the regulated activity. Technology services can be outsourced; the regulated function cannot.

Decision Matrix: Substance Requirements by Operator Profile

Substance obligations are not uniform across VASP types. The applicable standard shifts with the activity, the jurisdiction and the client base. The following matrix captures the principal decision branches.

An exchange operator serving retail customers in multiple jurisdictions requires the most demanding substance posture: local management in each licensed market, AML functions genuinely resident in the licensed entity, and a governance structure that demonstrates that the licensed entity — not the parent — controls the regulated business. Timeline from initial structure design to a defensible model typically runs across several months; a retrofit on a live operation takes longer. The risk if substance is deficient: licence suspension, bank account closure, enforcement action in each market where customers are located.

A token issuer conducting a public offering under MiCA — with a crypto-asset whitepaper filed with an EU competent authority — does not always require a full CASP authorisation, but where one is obtained, the same local-presence requirements apply. The substance question for an issuer sharpens at the point of secondary-market listing: if the issuer is simultaneously operating a trading facility or a transfer service, additional licence categories — each carrying their own substance demands — come into play.

A fund vehicle holding digital assets for professional investors may sit in Cayman or BVI at the fund level, with an investment manager licensed by the relevant competent authority. Substance obligations attach to the manager entity, not the fund vehicle — but the manager must demonstrably be the entity making investment decisions, not an affiliate in a different jurisdiction with a different regulator.

A payments-focused VASP — perhaps a firm holding a major payment institution licence under Singapore's Payment Services Act — needs to demonstrate local management of its DPT services and Travel Rule compliance architecture within the MAS-licensed entity. Regional expansion into other jurisdictions requires either local licences or a careful analysis of whether the Singapore entity can lawfully service those markets.

If a prior licence application stalled — or banking was terminated — a second structural read can surface the root cause and map the route forward. Contact OBOLUS at info@oboluslaw.com. To map your options, Map your options.

What Are the Most Common Structural Mistakes That Create Substance Gaps?

Substance failures in VASP structures tend to cluster around a predictable set of mistakes — most of which could have been addressed at the design stage at a fraction of the cost of remediation.

The first and most common mistake is the nominee management layer: appointing locally-resident directors who are professional nominees with no genuine involvement in the business, while the actual management operates from a different jurisdiction. This fails the place-of-effective-management test for tax purposes and the fit-and-proper / local management requirements under every major licensing regime. Regulators are experienced at identifying it.

The second mistake is the outsourced compliance shell: contracting all compliance, KYC and AML functions to a third-party service provider and presenting this to the regulator as the licensed entity's compliance programme. A licensed VASP is responsible for its own compliance. It may use external support, but the decision-making function, the MLRO role and the board-level accountability must sit within the licensed entity. Supervisors conducting on-site visits test this directly.

The third mistake is licence-jurisdiction mismatch: running the licensed entity from one country while the banking, the technology, the staff and the customers are all in another. This is often the outcome of a licensing exercise that focused on the cheapest or fastest path to a licence, without integrating the tax, banking and operational requirements into the same design process. The licensed entity ends up a legal artefact with no operational reality.

The fourth mistake is static substance review: building a substance model that satisfies requirements at application stage and then allowing it to decay as the business grows. A startup with two locally-based founders may satisfy substance at year one. The same entity with fifty employees, most working remotely from three countries, is a different legal and regulatory picture. Substance is not a one-time compliance exercise. It is an ongoing legal status that must be maintained and reviewed as the business evolves.

A Common Assumption: One Licence Covers Global Operations

A common assumption among early-stage operators is that a single VASP registration — obtained in a jurisdiction with a streamlined process — is sufficient to serve customers worldwide, either because the jurisdiction's law does not restrict outbound services or because the operator expects to rely on a "no active marketing" defence in other markets. This assumption regularly leads operators into difficulty.

The legal analysis has several layers. First, whether the operator is required to hold a licence in the customer's jurisdiction depends on that jurisdiction's law, not the operator's own. Most major markets with digital-asset regulatory regimes apply their licensing requirements to operators that serve their residents or that actively target their markets — regardless of where the operator is incorporated. The fact of offshore incorporation does not create a safe harbour.

Second, the "no active marketing" defence is narrower than operators expect. Maintaining a website accessible in a jurisdiction, processing transactions for users in that jurisdiction, or employing local sales staff will typically bring the operator within the scope of that jurisdiction's licensing requirements. In our practice, we have seen operators discover that activities they characterised as passive actually met the definition of a regulated activity in multiple additional jurisdictions.

Third, even where a genuine passive-service argument exists, it may not survive the scrutiny of a correspondent bank conducting its own due diligence, an institutional investor conducting pre-investment KYC, or a smart-contract counterparty requiring a legal opinion on the operator's regulatory standing. The commercial impact of a contested regulatory position can be as material as the legal risk itself.

The correct approach is a licence-stack analysis: mapping the jurisdictions in which the operator genuinely operates or plans to operate, identifying the applicable licensing requirements in each, and designing the corporate and operational structure to satisfy them efficiently. That exercise is not a one-size answer. It is a structured legal process, and its output looks different for every operator profile.

Related at OBOLUS

• Licensing and Registration for Digital-Asset Businesses – OBOLUS's full licensing and registration practice overview across major hubs
• CASP Authorisation Under MiCA in the Bahamas – jurisdiction-specific guidance on CASP authorisation and EU market access
• Stablecoin Issuance Authorisation in Poland – analysis of ART and EMT issuance requirements under MiCA in Poland

FAQ

How long does a crypto licence take to obtain?

Timelines vary significantly by jurisdiction and licence category. In the EU, a CASP authorisation under MiCA involves a formal review period that differs by national competent authority; pre-application engagement typically adds further time. Offshore registrations — BVI, Cayman — can be materially faster, but require concurrent substance structuring to be legally sound. We advise clients to plan for a process measured in months, not weeks, for any substantive regulated permission.

Which jurisdiction is best for licensing my crypto business?

There is no universally correct answer. The right jurisdiction depends on where your customers are located, what activities you intend to conduct, where your management and staff are based, your banking requirements and your tax position. A VARA licence is appropriate for UAE-market operations; MiCA CASP authorisation for EU market access; MAS DPT licensing for Singapore. Each carries different substance, capital and operational requirements. A licence-stack analysis is the starting point for any serious operator.

Do I need a separate custody licence?

In most flagship jurisdictions, the safeguarding and administration of client virtual assets is a regulated activity distinct from exchange or transfer services. Under MiCA, custody and administration of crypto-assets on behalf of clients is a separate CASP activity class. VARA's activity-based licensing model similarly treats custody as a standalone permission. A VASP that holds client assets without the applicable custody authorisation is operating outside its licence conditions, regardless of what other permissions it holds.

OBOLUS is an independent digital-asset law boutique acting exclusively for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than seventy jurisdictions, on disputes and on-chain asset recovery across more than twenty-five forums, and on the tax, banking and compliance structures that sit around them. Digital assets are the whole of our practice. We map the licence, substance and banking stack across operating, custody and payment layers before you commit — so that the structure holds up under regulatory, tax and banking scrutiny from day one. To discuss your situation, contact info@oboluslaw.com or message us via t.me/oboluslaw.

By Lydia Brennan, Tax & Structuring Analyst — specialising in cross-border corporate structuring, economic substance compliance and tax positioning for licensed virtual-asset service providers across the EU, offshore and Gulf hub jurisdictions.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.