Vara licence application in Bahamas: Legal Requirements for Businesses

Operating a digital-asset business out of the Bahamas without the correct authorisation is not a calculated risk – it is an immediate operational liability. The Bahamas regulates virtual asset service providers (VASPs) under the Virtual Assets (Service Providers) Act (the VASPA), administered by the Securities Commission of the Bahamas (SCB). Any business carrying on virtual-asset activity from or within the Bahamas must obtain a VASP registration or licence before it launches. This page sets out the regulatory basis, the application process, the cross-border considerations that most operators underestimate, and the decision point at which external counsel adds clear value.

The VASPA creates a tiered authorisation regime that distinguishes between registered and licensed VASPs based on the nature and scale of the activity. The SCB has published detailed rules under the framework, and it operates as an active supervisory body – not a passive registry. Operators who treat Bahamas authorisation as a formality typically encounter the hardest problems at the banking and correspondent-account stage, not the application stage.

The Regulatory Regime: VASPA and the SCB

The Bahamas was among the first jurisdictions to enact a purpose-built virtual-asset statute, and the VASPA remains the governing instrument for all VASP activity in the jurisdiction. The Securities Commission of the Bahamas is the competent authority for both registration and licensing under the Act, for ongoing supervision, and for enforcement.

The VASPA distinguishes between VASP registration – available to businesses that fall within a lower-risk activity profile – and VASP licensing, which applies to exchange operators, custodians, and other higher-risk intermediaries. The distinction matters from day one: a licensed VASP faces more demanding prudential, operational, and governance requirements than a registered VASP, and the application process differs accordingly.

The SCB has also published a supplementary Digital Assets and Registered Exchanges (DARE) Act framework that addresses digital-asset exchanges specifically, with its own set of conduct-of-business requirements. Operators who run trading venues in the Bahamas must understand how the DARE Act and the VASPA interact – they are complementary, not alternatives.

The FATF Recommendations, including Recommendation 15 on virtual assets and the Travel Rule (the obligation to pass originator and beneficiary data with a transfer), apply in the Bahamas. The SCB expects licence applicants to demonstrate a Travel Rule compliance programme before authorisation is granted. Regulators in the leading hubs increasingly expect applicants to name their technical solution for Travel Rule compliance, not merely to acknowledge the obligation in a policy document.

In our cross-border practice, we regularly advise clients who assumed that the Bahamas regime is lighter-touch than the Gulf or EU frameworks. That assumption is only partially correct. The VASPA is less prescriptive on capital than some peer regimes, but the SCB's supervisory posture on AML/KYC, fit-and-proper assessments, and operational resilience is comparable to MiCA-aligned competent authorities in the EU. The risk of treating Bahamas authorisation as a low-effort exercise is a delayed application, a request for additional information that restarts the clock, or an outright refusal.

Who Needs a VASP Licence or Registration in the Bahamas?

Any person or entity that carries on a virtual-asset service as a business from or within the Bahamas must be authorised under the VASPA. The statute defines virtual-asset services broadly, and the SCB interprets the perimeter consistently with FATF guidance.

Covered activities include: operating a virtual-asset exchange or trading platform; providing custody or safekeeping of virtual assets on behalf of clients; executing or facilitating virtual-asset transfers; providing virtual-asset brokerage or advisory services; and participating in or providing financial services related to a token issuance.

A Bahamas-incorporated holding company that has no operational activity in virtual assets is not automatically in scope. However, if that entity enters into arrangements with clients, holds private keys, or routes transactions on behalf of third parties, the SCB will look through the corporate form to the substance of the activity. The question of whether a business is in scope turns on what it does, not where it is formally registered.

Businesses whose principal operations are abroad but whose management, technology, or decision-making is seated in the Bahamas also fall within the regulatory perimeter. In our practice, this is the configuration that most commonly catches founders by surprise – particularly those who incorporated in the Bahamas for tax reasons but direct day-to-day operations locally.

The SCB publishes guidance on activities that are excluded from the VASPA, including certain categories of peer-to-peer activity and in-application tokens with limited functionality. If there is any doubt about whether an activity is in scope, the conservative position – and the legally safer one – is to apply for a formal no-action determination from the SCB before commencing operations.

To map whether your business activity triggers VASP authorisation in the Bahamas, contact OBOLUS at info@oboluslaw.com. The process above describes the standard analytical path. Your corporate structure, user base, and the specific assets you handle will change the analysis. Map your options.

What Does the VASP Application Process Involve?

A VASP application to the SCB is a structured submission that addresses the business, its principals, its compliance infrastructure, and its operational arrangements – not merely a completed form. The SCB conducts a substantive review of every application, and it will raise queries if the submission does not meet its expectations in any of the key areas.

The core components of a well-prepared application include:

• A detailed business plan describing the virtual-asset services to be provided, the target markets, projected transaction volumes, and the fee model.
• An AML/CFT programme that addresses customer due diligence, enhanced due diligence for higher-risk clients, sanctions screening, and transaction monitoring, with named technology solutions where applicable.
• A Travel Rule compliance programme, identifying the protocol or solution the applicant will use and how it interoperates with counterparty VASPs.
• Corporate and governance documentation: constitutional documents, beneficial ownership registers, board composition, and internal governance arrangements.
• Fit-and-proper submissions for all directors, senior management, and any person who will exercise significant influence over the business.
• A cybersecurity and operational resilience policy, including business continuity and disaster recovery arrangements.
• Evidence of a local physical presence in the Bahamas – the SCB has made clear that a registered address alone is insufficient.
• Proof of capital adequate to the category of licence or registration sought.

The SCB typically works through an application in stages. It will issue an initial acknowledgment, then a substantive review period, then queries or requests for additional information. Each query period extends the overall timeline. In our experience, the applications that move most quickly are those that arrive complete – every exhibit accounted for, every key person's fit-and-proper pack pre-assembled, and the AML programme reviewed by external counsel before submission.

A micro-matter illustrates the point. In a recent licensing matter, a digital-asset exchange sought VASP registration in the Bahamas to support an expansion into the Atlantic corridor. The initial application was complete at submission, but the SCB raised detailed queries about the applicant's Travel Rule protocol and its interoperability with a handful of counterparty exchanges not yet on the same messaging standard. We worked with the client and a forensic compliance partner to document the technical bridging arrangement and provide a written assurance programme. The SCB withdrew the query and the process resumed without a formal restart. The lesson: anticipate the technical compliance queries in the draft, not after the fact.

How Long Does the Process Take and What Capital Is Required?

The SCB does not publish a single binding statutory timeline for VASP applications. Processing times vary by activity category, application completeness, and the SCB's current caseload. In our cross-border practice, we advise clients to plan for a process measured in months, not weeks – and to consider a buffer for SCB queries, which are common and each of which pauses the statutory clock.

The capital requirement varies by licence category and activity type. The VASPA and SCB guidance set out minimum thresholds for different classes of VASP, but those thresholds should be confirmed against the current published rules before any application is submitted. The SCB has discretion to impose a higher capital requirement where the risk profile of the applicant warrants it – for example, a custody-heavy business or one with significant retail exposure may face a higher bar than a pure advisory operation.

Applicants should budget for both the statutory authorisation fee – which also varies by category – and the internal cost of preparing and managing the application. The latter frequently exceeds the former in complex applications. A business that self-prepares a first application, receives a substantive refusal, and then re-engages counsel for the second attempt will almost always spend more, and wait longer, than one that engaged counsel at the outset.

Businesses incorporating in the Bahamas from abroad should also account for the time required to establish a qualifying local presence, appoint compliant directors, and open operating accounts – tasks that, in our experience, run in parallel with the application but require lead time of their own.

How Does Bahamas Authorisation Interact with Other Jurisdictions?

A Bahamas VASP licence does not carry automatic passporting rights into any other jurisdiction. This is the most consequential planning error we see operators make. An operator authorised by the SCB can lawfully service Bahamian clients and operate from the Bahamas – but it cannot use that authorisation to serve EU clients under MiCA, to market to UK clients under the FCA's financial promotion rules, or to serve US clients without analysis of applicable US federal and state law.

The cross-border reality is that most digital-asset businesses have a multi-layered regulatory footprint: the jurisdiction where the entity sits, the jurisdictions where its users are located, and the jurisdictions where its banking and payment rails are domiciled. These three axes frequently point to different compliance obligations.

For a business with Bahamas as its primary hub but a user base that is meaningfully concentrated in the EU, a MiCA CASP authorisation (Crypto-Asset Service Provider, the EU's licence class under the Markets in Crypto-Assets Regulation) from an EU member state is a separate and necessary step. Under MiCA, ESMA and the relevant national competent authority supervise the passporting of CASP authorisations across the EU and EEA. The Bahamas authorisation and the CASP authorisation run in parallel and are not substitutes for each other.

Similarly, a business that intends to engage clients in the UK must ensure its marketing and solicitation comply with the FCA's financial promotion regime, regardless of where it is authorised. The FCA does not recognise Bahamas VASP status as an equivalent authorisation for UK purposes.

Tax is a further axis. The Bahamas is a low-tax jurisdiction, but the substance of operations – where staff are located, where decisions are made, where servers are hosted – will determine whether the jurisdiction's tax advantages are defensible. Where the Bahamas entity is part of a group structure, transfer pricing and controlled-foreign-corporation considerations in the group's home jurisdiction must be assessed separately from the VASP authorisation analysis.

Banking is the third axis, and often the hardest. Correspondent banks serving Bahamas-licensed VASPs conduct their own enhanced due diligence on the authorised entity, and they are not bound by the SCB's assessment of the applicant's fitness. A VASP that is cleanly authorised by the SCB may still face account closures or refusals from institutional banks that have de-risked the sector. In our practice, we advise clients to map their banking relationships before, not after, the licensing process – because the banking story is part of the business plan the SCB will review, and because a gap in that story creates vulnerability at the licence renewal stage.

If your build spans the Bahamas and another major hub, OBOLUS can map the full licence, banking, and compliance stack. If a prior application stalled or an account was closed, a structural re-read can surface the root cause and a route forward. Write to info@oboluslaw.com or map your options.

AML, KYC, and the Travel Rule in Practice

AML and KYC compliance under the VASPA aligns with the FATF Recommendations, and the SCB expects full implementation – not a policy document alone, but an operational programme with evidence of training, testing, and senior management oversight. Gaps in AML substance are the most common cause of SCB queries and of post-authorisation supervisory action.

The Travel Rule – FATF Recommendation 15 as applied to virtual-asset transfers – requires that originator and beneficiary information accompanies virtual-asset transfers at or above the applicable threshold. The Bahamas has implemented the Travel Rule, and the SCB expects applicants to identify both the technical solution they will use and their approach to counterparty VASPs that are not yet compliant. This is not a theoretical issue: in any cross-border transfer, the sending VASP must confirm that the receiving VASP is capable of receiving Travel Rule data. Where it is not, the sending VASP must have a documented policy for that scenario.

Operators we advise routinely underestimate the operational complexity of Travel Rule compliance in a multi-chain, multi-custodian environment. The policy layer is straightforward. The technical integration – particularly where the business handles assets across blockchains that have different wallet-attribution characteristics – requires specific expertise and vendor relationships. The SCB is aware of this complexity and has shown a willingness to engage constructively on technical questions during the application process, but the applicant must come with a credible plan.

KYC expectations in the Bahamas follow a risk-based approach. Retail-facing VASPs face a higher baseline of due diligence obligations than institutional-only operators. Enhanced due diligence applies to politically exposed persons, high-risk geographies, and transactions above defined thresholds. The SCB may conduct on-site or remote inspections of the AML programme as part of its ongoing supervisory function.

What Mistakes Do Applicants Most Commonly Make?

The mistakes that most consistently delay or derail Bahamas VASP applications cluster around four themes. Each is avoidable with preparation.

First, inadequate local substance. The SCB does not accept a nominee director and a registered address as a qualifying Bahamian presence. It expects the business to have a real operational footprint – staff, decision-making, and systems – with a material connection to the jurisdiction. Applicants who build the local presence after receiving a query from the SCB will find themselves in a materially worse position than those who planned for it from the outset.

Second, incomplete fit-and-proper submissions for key persons. Every director, senior manager, and significant shareholder must submit a detailed personal disclosure pack. Regulators in the leading hubs, including the SCB, cross-reference these submissions against other regulators' databases, legal proceedings registers, and their own intelligence. An incomplete or inconsistent submission – even inadvertently so – triggers additional inquiry that extends the process considerably.

Third, a Travel Rule programme that is policy-only. As discussed above, the SCB expects a technical solution, not a written policy. Applicants who arrive with a policy document and a note that the technology is "to be determined" will receive a query. Identifying the solution before submission, even at a preliminary stage, is a meaningful time-saver.

Fourth, no banking plan. It is common for applicants to focus entirely on the regulatory authorisation and treat banking as a post-licence task. In practice, the two processes must run in parallel. A VASP that receives its SCB licence but cannot open a compliant operating account is commercially paralysed. Mapping the banking options – and, where necessary, engaging allied counsel in the relevant jurisdiction to support account-opening in a third-country bank – should begin during the application preparation phase.

The Decision Point: Is the Bahamas the Right Hub for Your Business?

The Bahamas is a credible and well-established digital-asset jurisdiction with a dedicated regulatory framework, a responsive competent authority, and a low-tax operating environment. It is well-suited to certain operator profiles – and less suited to others.

An exchange or custodian whose primary user base is in the Atlantic corridor and whose principal investors are institutional US or Latin American counterparties will find the Bahamas authorisation commercially meaningful. The SCB's track record – including its supervisory actions on prominent operators – gives its authorisation genuine credibility with institutional counterparties, even though it does not carry passporting rights elsewhere.

A business whose user base is predominantly in the EU or UK faces a more complex calculation. The Bahamas licence will not satisfy those jurisdictions' local authorisation requirements, and the cost of running a dual-stack – Bahamas plus a MiCA CASP or an FCA registration – must be weighed against the alternatives. For a business at an early stage with limited resources, a single EU or UK authorisation that permits EU/EEA passporting may be more efficient as the primary hub, with the Bahamas considered at a later stage for specific operational or structural purposes.

A fund or treasury vehicle with no client-facing activity may find that it does not require VASP authorisation at all, or that a simpler registration rather than a full licence is available. The starting point is always an activity analysis – what the entity does, not what it is called.

Profile A: an institutional exchange with Atlantic corridor clients, no EU-facing marketing, and strong AML infrastructure. The Bahamas VASP licence is likely the primary hub. Timeline: plan for a process of several months for a complete application, with capital and substance requirements met at submission. Key risk: banking and correspondent access.

Profile B: a multi-market operator with EU retail exposure and a Bahamas holding entity. The Bahamas entity may be appropriate for specific functions, but a MiCA CASP authorisation from an EU member state is a necessary parallel step. Running a single Bahamas structure for EU users without local EU authorisation carries meaningful enforcement and reputational risk under the MiCA regime and creates exposure under ESMA's passporting framework.

Profile C: a token issuer with a global offering and a Bahamas incorporation. Whether the VASPA applies turns on whether the issuer is providing a virtual-asset service, not merely issuing a token. Where the issuer also provides custody, exchange, or transfer services, it falls within the VASP perimeter. Where it issues only, the whitepaper and disclosure obligations under the VASPA should be reviewed separately.

Related at OBOLUS

• Licensing and Registration for Digital-Asset Businesses – a complete overview of the VASP authorisation process across 70+ jurisdictions.
• Digital-Asset Licensing in South Korea – what inbound operators need to know about the Korean VASP regime and regulatory perimeter.
• VAT Treatment of Crypto Services in Switzerland – how FINMA-regulated businesses interact with Swiss VAT rules on digital-asset transactions.

A Common Assumption Worth Addressing

A common assumption among founders is that a single offshore licence is sufficient to serve clients globally. It is not. The VASPA authorises a Bahamas-seat business to conduct virtual-asset activity from the Bahamas. It does not authorise that business to solicit, onboard, or service clients in jurisdictions that have their own local VASP or CASP requirements – which now includes the EU under MiCA, the UK under the FCA's regime, Singapore under the Payment Services Act, Hong Kong under the SFC's VATP framework, and a growing number of other markets.

The practical consequence is that a VASP which uses a Bahamas licence as its sole authorisation but attracts clients in the EU, UK, or Singapore is operating without authorisation in those jurisdictions. The enforcement risk sits not only with the entity but, in many regimes, with the directors and senior managers personally. In our cross-border practice, we regularly advise clients who built their entire structure around a single offshore authorisation and then discovered, at the banking or institutional partnership stage, that the counterparty required evidence of local authorisation in the client's home market.

The solution is a licence stack built against the actual user base and the actual revenue model – not against the jurisdiction of incorporation. That analysis takes time and specific expertise, but it is materially cheaper than managing an enforcement investigation or a forced restructure after the fact.

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers, and funds on licensing across more than 70 jurisdictions, on disputes and on-chain asset recovery across more than 25 forums, and on the tax, banking, and compliance considerations that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody, and payment layers before you commit – and we work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications where recovery matters arise. To discuss your Bahamas VASP application or your broader licensing structure, contact info@oboluslaw.com or message us at t.me/oboluslaw.

By Aisha Tan, Licensing and Jurisdictions Analyst – specialising in VASP authorisation processes across Caribbean, Gulf, and Asia-Pacific hubs for exchange operators and custodians.

FAQ

How long does a crypto licence take to obtain?

Processing times vary by jurisdiction, activity category, and the completeness of the application at submission. In the Bahamas, the SCB conducts a substantive review and will raise queries if any element of the application is deficient – each query period extends the overall timeline. Operators should plan for a process measured in months rather than weeks, and should treat a well-prepared, complete submission as the most effective way to keep the process moving without interruption.

Which jurisdiction is best for licensing my crypto business?

There is no universally correct answer. The optimal jurisdiction turns on where the business's users are located, what activity it carries on, its banking requirements, and its capital and governance capacity. The Bahamas suits Atlantic-corridor operators with strong institutional profiles. An EU-facing business may find a MiCA CASP authorisation from a member state more commercially efficient as a primary hub. The right starting point is an activity and user-base analysis, not a jurisdiction comparison in the abstract.

Do I need a separate custody licence?

In the Bahamas, custody of virtual assets on behalf of clients is itself a virtual-asset service under the VASPA and triggers the authorisation requirement. An entity that provides both exchange and custody services must ensure its authorisation covers both activities – a licence granted for exchange activity does not automatically extend to custody. In other jurisdictions, such as the EU under MiCA and Singapore under the Payment Services Act, custody is a separately defined regulated activity with its own requirements. The correct answer is jurisdiction- and activity-specific.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.