Holding a VASP licence (virtual asset service provider authorisation) is no longer the finish line. Across the major licensing hubs – from VARA in Dubai to the FSRA within ADGM to MAS in Singapore – regulators are pressing licensed entities on whether real economic activity sits behind the authorisation. A licence granted without genuine substance is increasingly treated as a licence at risk. For boards of licensed VASPs, the question is not whether substance requirements apply; it is whether the entity they govern can demonstrate compliance when the regulator's examination team arrives.
This analysis examines the substance expectations that licensed VASPs face across leading jurisdictions, the structural choices boards must make, and the enforcement consequences of getting it wrong. We address the cross-border reality – where the entity is licensed, where users are served, and where critical functions actually live – because regulators are asking exactly that question.
What Does Economic Substance Actually Mean for a Licensed VASP?
Economic substance, in the VASP context, means that a licensed entity must conduct its core income-generating activities in the jurisdiction where it holds its authorisation – not merely maintain a registered address and a nominee director. Regulators across the VARA, FSRA and MAS regimes have all signalled, through supervisory guidance and licence conditions, that substance is a condition of continued authorisation, not an optional feature. The specific threshold varies by regime and by activity class, but the underlying principle is uniform: the licence and the business must occupy the same jurisdiction in a meaningful way.
For a VASP, the substance analysis typically runs across four axes. First, qualified management: are the senior executives who direct the business physically present in the licensing jurisdiction? Second, adequate personnel: are the compliance, risk and technology functions staffed locally, or outsourced abroad? Third, decision-making: are material governance decisions – risk appetite, new-product approval, key commercial contracts – taken at board or management level within the jurisdiction? Fourth, operating expenditure: does the entity spend at a level commensurate with its activities in that jurisdiction?
None of these axes comes with a universal bright-line number. Each regulator applies its own calibration, and the calibration shifts as the business scales. A custody platform with a seven-figure client balance sheet faces a heavier substance burden than a small brokerage at the lighter end of the activity spectrum. Boards must therefore treat substance as a dynamic, scalable obligation – not a box checked at incorporation.
Why Are Substance Failures Accelerating Across Licensed VASPs?
Substance failures are accelerating because the early permissive phase of VASP licensing – when regulators were building regimes and accepting lighter structures – is over. VARA, the FSRA and MAS have each moved from authorisation-focused supervision to conduct- and substance-focused supervision. Meanwhile, international tax bodies, particularly the OECD and its network of participating jurisdictions, have embedded economic substance rules into the broader compliance infrastructure that VASPs must satisfy.
In our cross-border practice, we see three recurring structural patterns that expose boards to substance risk. The first is the shell-and-operate model: a licence is obtained in a low-cost jurisdiction, but the real trading engine, the technology stack and the senior team remain in a different country. The regulatory and the operational centre of gravity are misaligned from day one. The second is the passive-director problem: a local nominee director satisfies the formal requirement for a local officer but exercises no real authority. Regulators are now interviewing senior management directly to test whether local directors genuinely control the business. The third is the outsourced-compliance model: the AML officer, the compliance function and the risk framework are contracted to a third-party firm in another jurisdiction, with no substantive local oversight capacity.
Each of these patterns would have survived regulatory scrutiny five years ago. They do not survive it today. Operators who built their structures in the earlier licensing window and have not refreshed them are carrying hidden risk.
The process above describes the standard supervisory trajectory. Your facts – where your entity sits, where your senior team is based, how your compliance function is structured – change the analysis materially. For a scoped assessment of your current substance posture, contact OBOLUS at info@oboluslaw.com.
How Do Substance Expectations Differ Across the Major Licensing Hubs?
Substance expectations are broadly consistent in principle but differ substantially in their application across the four flagship VASP licensing hubs that OBOLUS clients most commonly consider. Understanding those differences is essential before a board commits to a structure.
Dubai under VARA operates an activity-based licensing model. Each licence category – exchange, custody, broker-dealer, advisory, lending, transfer and settlement – carries its own set of operational requirements, and substance expectations are embedded in those requirements. VARA expects a licensed entity to be genuinely managed and directed from within the Dubai mainland jurisdiction. Senior personnel responsible for the licensed activities must be locally present, and the compliance and risk infrastructure must be demonstrably under local governance. VARA has shown willingness to conduct operational site visits, so a substance filing that overstates local capacity is a direct enforcement risk.
Abu Dhabi under the FSRA within ADGM takes a principles-based approach anchored in the concept of fit-and-proper governance. The FSRA requires that the persons responsible for the regulated activities are based within the ADGM jurisdiction and that key decision-making functions – including the chief compliance officer role – are exercised locally. ADGM's common-law framework, its proximity to sovereign institutional capital and its enforcement reputation make the FSRA a rigorous counterparty for any licensed entity. Boards that treat ADGM authorisation as a prestige badge without filling the substance requirements will face targeted supervisory engagement.
Singapore under MAS administers the Payment Services Act's digital payment token regime with a strong emphasis on fit-and-proper management, robust AML/CFT infrastructure and local senior presence. MAS has indicated publicly that it scrutinises both the local governance capacity of applicants and the ongoing operational commitment after licensing. Entities that apply from a Singapore entity but route technology and decision-making offshore consistently face additional information requests and, in some cases, application rejections.
The EU under MiCA introduces a passporting dimension that adds complexity. A CASP (crypto-asset service provider) authorised in one EU member state may passport its services across the single market. But that passport depends on the home-state authorisation being substantively sound. A CASP that obtains authorisation in a member state with lighter supervisory intensity – and then passports aggressively into larger markets – faces the risk that the home NCA, under pressure from ESMA and the larger-market NCAs, revisits the original authorisation on substance grounds. Boards planning a MiCA passport strategy must ensure the home-state entity is not a substance shell.
What Happens When the Licence Jurisdiction and the Operational Centre Are Different?
Cross-border misalignment is the single most common structural deficiency we encounter in licensed VASPs. The entity that holds the licence is domiciled in one country; the people running the business, the technology that executes the trades, and the banking relationships are in another. From a commercial standpoint this sometimes reflects genuine operational history – a team built in one city before the regulator of choice became the natural licensing home. From a regulatory standpoint it creates a fault line.
The legal consequence turns on how the licensing jurisdiction characterises the mismatch. In most regimes, if the senior management responsible for the licensed activities is not present in the licensing jurisdiction, the entity is in breach of its licence conditions from the date that condition attaches – regardless of whether the regulator has yet detected the breach. The practical consequences include licence suspension, additional conditions, a formal remediation programme imposed by the regulator, and, in the most serious cases, revocation.
There is also a secondary risk that operators frequently underestimate. When the operational centre diverges from the licensing jurisdiction, the entity may inadvertently be conducting regulated activities in the jurisdiction where the operations sit, without authorisation from the regulator in that jurisdiction. A Dubai-licensed VASP whose technology and compliance function are run from Singapore may be providing digital payment token services within Singapore under MAS's characterisation, without a Payment Services Act licence. Dual-jurisdiction exposure of that kind is not resolved by the Dubai licence.
A micro-matter from our recent practice illustrates the point. A mid-size exchange had held a VASP registration in a Gulf jurisdiction for roughly two years. The founding team – including the chief technology officer and the head of compliance – was based in a European city. When the regulator conducted a routine supervisory review, it found that no material decision had been taken by the local director in the preceding twelve months. OBOLUS was engaged to assess the structure. We identified that the compliance function needed to be relocated or substantively replicated in the licensing jurisdiction, that two senior hires were required before the next supervisory cycle, and that the entity was providing services in the EU jurisdiction where the team sat without an appropriate registration. We mapped a twelve-week remediation programme covering the internal governance rewrite, the personnel transition and a regulatory disclosure strategy. The operator completed the remediation and retained its licence.
How Should a Board Structure the Substance Decision?
Boards of licensed VASPs tend to approach substance as a compliance cost to be minimised. The better frame is that substance is a structural design decision with direct revenue consequences – a licence that is challenged or revoked destroys significantly more value than the investment required to sustain it.
The decision matrix for a board runs across three operator profiles.
Profile A: The start-up VASP seeking its first licence in a flagship hub. This operator should design for substance from the outset. The founding senior team should include at least one qualified individual who will be physically based in the licensing jurisdiction and who can be named as the authorised representative or local officer. Compliance should be structured with a locally-based compliance officer, even if supported by external advisory input. The entity's bank accounts should be in the licensing jurisdiction or in a jurisdiction with a direct correspondent relationship. The risk: under-investing in local infrastructure at the start, then facing a costly retrofitting exercise eighteen months into the licence cycle when the regulator begins its first supervisory review.
Profile B: The established operator adding a second licence for market access. This operator must avoid treating the new jurisdiction as a branch that funnels clients back to the home entity. The second licence requires its own substance analysis – its own qualified local management, its own capital and its own governance. The risk: that the board approves the second licence application without approving the substance investment required to sustain it, creating a fragile structure that satisfies neither regulator.
Profile C: The MiCA passport player. This operator has obtained a CASP authorisation in an EU member state and intends to passport into the broader European market. The home-state entity must be a genuine operating centre, not a letter-box. The risk: ESMA coordination between NCAs, which means the home-state regulator may face direct pressure to verify substance when the operator activates a passport into a higher-scrutiny member state.
If a prior application stalled or a supervisory challenge has already been raised, a second structural read can surface the underlying cause and the route to resolution. Contact OBOLUS at info@oboluslaw.com to map your options.
How Do AML and Travel Rule Obligations Interact With Substance?
AML and Travel Rule compliance is not technically a subset of economic substance – but in practice regulators treat weak local compliance infrastructure as a leading indicator of a substance problem. The Travel Rule (the obligation to pass originator and beneficiary data with a virtual asset transfer) is enforced at the entity level, which means the AML officer and the compliance systems required to satisfy it must sit within the licensed entity's governance structure.
Under the FATF Recommendations – the international standard that VARA, the FSRA, MAS and the MiCA national competent authorities all reference – a licensed VASP is expected to maintain an AML/CFT programme commensurate with its risk profile. That programme must be managed and monitored by a person with genuine authority and with a genuine presence in the licensing jurisdiction. An AML officer who sits in a third country and has no direct supervisory relationship with the licensed entity does not satisfy that expectation.
The cross-border dimension adds further complexity. A VASP serving users in multiple jurisdictions may face Travel Rule obligations calibrated differently across those jurisdictions – the threshold above which counterparty data must travel with the transfer varies by regulator. An entity whose compliance function is centralised in the licensing hub but whose user base is distributed across six markets needs a compliance architecture that maps those multi-jurisdictional obligations onto the local framework. Boards should receive periodic reporting on how that mapping is functioning, not merely on whether the home-jurisdiction requirements are satisfied.
We regularly advise operators on building the compliance architecture that satisfies substance expectations across multiple licensing jurisdictions simultaneously. The technical design – the workflows, the data routing, the record-keeping – is inseparable from the legal structure.
A Common Assumption: "A Single Offshore Licence Covers Our Global Business"
A common assumption among VASP founders – particularly those who obtained an early registration in a lighter-touch offshore jurisdiction – is that a single licence is sufficient to serve a global client base, provided the entity is careful about marketing to excluded jurisdictions. This assumption is incorrect in most material respects, and it carries serious consequences for boards that rely on it.
The first problem is regulatory. A licence confers authority to conduct regulated activities within the scope and jurisdiction of the authorising regulator. It does not, by itself, confer authority to serve clients in any other jurisdiction. Where users are located, where funds are received, and where services are actively marketed all trigger independent regulatory analysis in the relevant territories. An offshore VASP serving European clients without a MiCA-compliant authorisation is providing unlicensed services under MiCA, regardless of its offshore registration.
The second problem is banking. Correspondent banks and e-money institution banking partners have their own substance filters. An entity that cannot demonstrate a genuine operating presence in a recognised licensing hub will find its banking options narrowing, its due-diligence questionnaires becoming more demanding, and its account stability more fragile. The offshore licence that satisfied the corporate secretary does not satisfy the compliance officer at the banking counterparty.
The third problem is enforcement. When things go wrong – a client dispute, a regulatory referral, a law-enforcement inquiry – an entity with genuine substance in a recognised hub has access to its regulator as a credible counterparty, a local legal system it can use and that external parties can access, and a banking relationship that remains stable under pressure. An entity with a nominal offshore presence has none of those anchors. Recovery from a structural failure is dramatically harder when the structure was hollow to begin with.
We map the licence stack across the operating, custody and payment layers before any client commits to a structure. That mapping frequently reveals gaps that a simpler approach would leave open.
Self-Assessment: Is Your VASP's Substance Position Board-Ready?
Boards should be able to answer the following questions affirmatively before a supervisory engagement. If any answer is qualified or negative, the item represents an active substance risk that requires management action.
- Is at least one member of senior management – with genuine authority over the licensed activities – physically based in the licensing jurisdiction and available to regulators on short notice?
- Is the compliance officer (or money-laundering reporting officer, depending on jurisdiction) a local employee or an individual contractually and functionally accountable to the licensed entity, with a demonstrable local presence?
- Are the minutes of board and senior-management meetings consistent with decision-making occurring within the licensing jurisdiction, and are they complete enough to evidence this to a regulator?
- Does the entity's operating expenditure in the licensing jurisdiction reflect the scale of its activities – not merely the cost of a registered address?
- Has the entity mapped its user base against the regulatory perimeters of the jurisdictions in which those users are located, and does it have either a licence or a defensible analysis for each material jurisdiction?
- Are the AML and Travel Rule compliance systems maintained and overseen within the licensed entity's governance structure, with documented escalation paths to the locally-present compliance officer?
- Has the board received a substance review from external counsel in the previous twelve months?
This checklist is a starting framework. The specific requirements vary by jurisdiction, by licence category and by the entity's activity profile. A clean set of answers to these questions does not guarantee regulatory satisfaction – but an unclean set is a near-certain predictor of supervisory difficulty.
Related at OBOLUS
- Licensing and Registration for Digital Asset Businesses – the full OBOLUS licensing practice overview, covering 70+ jurisdictions
- ADGM vs Singapore: Where to License a Crypto Business – a direct comparison of two flagship licensing hubs for inbound operators
- Economic Substance for Licensed VASPs: Services for Established Operators – scoped substance review and remediation engagements
FAQ
How long does a crypto licence take to obtain?
Timelines vary materially by jurisdiction and licence category. In the flagship hubs – VARA in Dubai, the FSRA within ADGM, MAS in Singapore, and EU member states under MiCA – authorisation processes typically run from several months to over a year once a complete application is submitted. Preparation time before submission adds further weeks. Substance readiness, AML documentation quality and the complexity of the proposed activities are the primary variables affecting timeline. No regulator publishes a firm guarantee.
Which jurisdiction is best for licensing my crypto business?
There is no universally correct answer. The optimal licensing jurisdiction turns on the operator's activity profile, target user base, banking requirements, substance capacity and tax position. VARA suits operators targeting Gulf and international institutional clients. ADGM suits those who need a common-law framework and access to Abu Dhabi capital. MAS suits Asia-Pacific-facing businesses with strong compliance infrastructure. MiCA suits operators prioritising EU market access with passporting capability. A comparative analysis of these variables against your specific build is the right starting point.
Do I need a separate custody licence?
In most flagship jurisdictions, custody of virtual assets is a distinct regulated activity that requires its own authorisation or an explicit extension of an existing licence. Under VARA, custody is a separate activity class. Under MiCA's CASP regime, custody and administration of crypto-assets on behalf of clients is one of the regulated services requiring authorisation. MAS treats custody as a discrete activity under its payment services regime. Operators who conduct custody incidental to an exchange or brokerage function should obtain a specific assessment of whether their activity profile requires an explicit custody authorisation.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice, and we act only for businesses. We map the licence, banking and compliance stack across operating, custody and payment layers before any client commits to a structure – ensuring that the substance the regulator expects is built into the design from the outset. To discuss your situation, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – specialising in the intersection of regulatory authorisation, on-chain architecture and the substance requirements that licensed VASPs must satisfy across multiple jurisdictions.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.