Businesses entering the Bahamas digital-asset market face an immediate legal decision. The Securities Commission of The Bahamas administers the Digital Assets and Registered Exchanges Act — commonly called the DARE Act — which establishes a mandatory registration and licensing regime for any entity conducting digital-asset business in or from The Bahamas. Operating outside that regime exposes a business to enforcement, account closure and reputational loss before a single client transaction clears. This page maps the regulatory basis, the registration process, the cross-border considerations that operators most frequently underestimate, and the practical decision points that determine whether a Bahamas structure is the right fit.
What is the regulatory basis for VASP licensing in The Bahamas?
The Digital Assets and Registered Exchanges Act (the DARE Act), administered by the Securities Commission of The Bahamas, is the primary instrument governing digital-asset business in the jurisdiction. It covers a wide perimeter: operating a digital-asset exchange, providing custody, facilitating the issuance or sale of digital assets, managing digital-asset portfolios, and providing related advisory services each fall within its scope. A business that touches any of those activities — whether it is domiciled in Nassau or simply solicits Bahamian clients from an offshore structure — needs to engage with the regime before it begins operations.
The DARE Act is not a passive filing exercise. The Securities Commission assesses fitness and propriety, governance structures, AML/CFT controls, technology risk management and capital adequacy. The regime sits alongside the country's Financial and Corporate Service Providers Act and its broader anti-money-laundering obligations, both of which align The Bahamas with FATF Recommendation 15 on virtual assets and with the Travel Rule requirement to pass originator and beneficiary data with qualifying transfers. In our practice, operators who treat the Bahamas as a lighter-touch option relative to the EU or Singapore often discover that the substantive compliance expectations are comparable; the difference lies in the cost model and the processing environment.
The DARE Act distinguishes between registration and licensing depending on the category of activity. Simpler activities can qualify for registration, while exchanges and custodians operating at scale typically require a full licence. The Commission has discretion to impose conditions on either instrument, and those conditions are increasingly granular as the global regulatory environment tightens.
For an inbound operator, the cross-border angle matters immediately. The DARE Act's territorial scope is broad. A business incorporated elsewhere that markets services to Bahamian residents or conducts clearing activity through a Bahamian entity is likely caught. Conversely, a Bahamas-licensed entity does not carry passporting rights the way a MiCA-authorised CASP does across the EU/EEA; each additional jurisdiction where the business serves clients requires its own regulatory analysis. That is a threshold point any founder needs to resolve before committing to the structure.
Who needs a VASP licence or registration under the DARE Act?
The DARE Act's regulated perimeter is activity-based, not entity-based. The licence or registration requirement turns on what the business does, not solely on where it is incorporated. An exchange, a custodian, a token issuer, a portfolio manager and an advisor dealing in digital assets each face potential obligations under the regime. A holding company that passively holds tokens on behalf of group entities and does not conduct business with third parties may fall outside the operative provisions, but that analysis is fact-specific and should not be assumed.
In our cross-border practice, the operators most frequently surprised by Bahamian scope are those running a head-office function in one jurisdiction with settlement infrastructure or a subsidiary in The Bahamas. The Commission's view on where the regulated activity is "conducted" has tracked international developments, and a purely nominal presence — a registered address without substantive activity — does not insulate a group from licensing requirements if real business flows through the Bahamian entity.
There is an important carve-out concept for businesses that deal exclusively in digital assets that qualify as securities under Bahamian law. Those businesses interact with the Securities Commission's securities regime as well as with the DARE Act, and the registration pathway diverges. Token classification — whether a given asset is a security, a payment instrument or a utility token — is therefore a threshold determination that must precede any licensing strategy. The principle, consistent across the leading regimes, is that substance governs: the rights the token confers, the economic expectations it generates and the manner of its issuance determine its classification, not the label in the white paper.
CTA #1
If you are assessing whether your business model falls within the DARE Act's scope, the analysis starts with the activity, the token classification and the user base. The process above describes the standard path. Your facts — the entity structure, the user base, the banking — change the analysis. Map your options with OBOLUS before the position crystallises.
How does the DARE Act application process work?
The application process under the DARE Act is a multi-stage review, not a passive registration. The Securities Commission of The Bahamas conducts a substantive assessment of the applicant's fitness and propriety, the governance framework, the AML/CFT programme, the technology risk controls and, for exchange and custody applicants, the capital and financial resilience of the business. The Commission may request supplemental information at any stage, and the overall timeline varies by the complexity of the application and the completeness of the initial submission.
In practice, the process moves through broadly sequential phases. First, pre-application engagement: the Commission encourages early dialogue, and a pre-application meeting can surface structural issues before a formal filing is made. Operators who skip this step and submit cold applications frequently encounter requests for material amendments that restart elements of the review clock. Second, formal submission: the application package includes the business plan, corporate structure, AML/CFT policies, governance documents, audited or reviewed financials, and the technology risk assessment. Third, Commission review and query rounds: the Commission issues queries, and the applicant responds. The number of rounds depends on the application's quality. Fourth, conditional approval: the Commission may grant an approval subject to conditions, including capital maintenance, reporting, or operational restrictions. The business must satisfy those conditions before commencing regulated activity.
A point operators in our practice encounter consistently: the quality of the AML/CFT documentation is the most common friction point. The Securities Commission expects a programme that is genuinely tailored to the operator's risk profile — not a generic template. Policies must address the Travel Rule (the obligation to pass originator and beneficiary data with qualifying digital-asset transfers), customer due diligence procedures calibrated to the asset types and user types the business serves, and a clear framework for transaction monitoring and suspicious activity reporting. Where those documents are underdeveloped, the Commission's queries become extensive.
The overall authorisation timeline is best described as a matter of several months from a complete, well-prepared submission. Operators should not plan a market launch on the assumption that a Bahamas licence is a quick turnaround. In the current environment — as regulators globally increase their scrutiny of digital-asset applicants — even well-prepared applications move through a deliberate process.
What are the capital and governance requirements?
Capital and governance requirements under the DARE Act vary by the category of regulated activity. The regime does not set a uniform minimum capital figure across all licence types; instead, the Securities Commission calibrates its requirements to the nature and scale of the activity. Exchange operators and custodians face higher expectations than advisory or portfolio management businesses, reflecting the systemic risk that a failure in those functions would pose to clients.
On governance, the Commission expects a board or management structure with identifiable accountability for compliance, technology risk and financial controls. The fitness and propriety assessment covers directors, senior managers and significant shareholders. Beneficial ownership transparency is a hard requirement — structures designed to obscure ultimate ownership are not consistent with the regime's expectations, and the Commission has discretion to refuse an application where it cannot satisfy itself as to the identity and integrity of the persons in control.
For businesses that also hold client assets — whether that is cash collateral, digital assets in custody or both — segregation requirements apply. The principle that client assets must be held separately from the firm's own assets is consistent across the leading regimes, and The Bahamas is no exception. Operators who have previously run a commingled model will need to restructure those arrangements before an application proceeds.
How do tax and banking interact with a Bahamas structure?
The Bahamas offers a tax-neutral environment for businesses licensed and operating within the jurisdiction. There is no corporate income tax, no capital gains tax, and no withholding tax on dividends or interest in The Bahamas. For a digital-asset business that operates on thin margins or that moves significant capital in and out of the structure, that profile is materially attractive relative to mid-shore jurisdictions with more complex tax stacks.
The cross-border reality, however, is that the tax position of the Bahamas entity is only part of the picture. A business that has founders, employees, servers or clients in tax-transparent jurisdictions — the United States, the United Kingdom, the EU — faces the risk that the competent authority in those jurisdictions will assert a taxable presence regardless of the Bahamian domicile. Transfer pricing rules, permanent establishment concepts and controlled-foreign-corporation regimes can all reach into a nominally offshore structure if the substance is not genuinely located in The Bahamas. Tax-neutrality in the domicile is not tax-immunity for the enterprise.
Banking is the other friction point. Bahamian correspondent banking is available but selective. The global de-risking trend that has contracted banking access for digital-asset businesses affects The Bahamas as it does every offshore centre. In our experience, operators who secure banking before or concurrent with their licence application are in a materially stronger position than those who obtain the licence first and then discover that their preferred banking options are constrained. The banking strategy — which institutions to approach, in what sequence, with what account purpose narrative — should be part of the pre-application planning, not an afterthought.
For businesses that also operate in the EU, the interaction with MiCA is relevant. A Bahamas-licensed entity serving EU clients does not benefit from MiCA passporting and will require its own CASP authorisation in an EU/EEA member state, or will need to restrict its EU-facing activities to those that fall outside MiCA's territorial scope. That analysis is fact-specific and depends on the nature of the services, the manner in which EU clients are solicited, and the structure of any EU-facing entity in the group.
CTA #2
If a prior application stalled, a banking relationship was closed, or a group structure has created unresolved tax exposure, a second read can surface the structural reason and the route forward. Reach the OBOLUS licensing desk at Map your options or write directly to info@oboluslaw.com.
What AML and Travel Rule obligations apply?
AML and Travel Rule compliance under the DARE Act is not optional, and the Securities Commission treats it as a substantive regulatory requirement rather than a box-ticking exercise. The Bahamas implements FATF Recommendation 15 and the associated Travel Rule requirement, meaning that DARE Act licensees and registrants that process qualifying digital-asset transfers must collect, verify and transmit originator and beneficiary information. The de-minimis threshold at which the Travel Rule is triggered varies; operators should consult current Securities Commission guidance rather than assume a fixed figure.
In practical terms, compliance requires a technology solution capable of matching and transmitting the required data at transaction speed, as well as policies for handling transfers where the counterparty VASP cannot receive the data or where the data is incomplete. The so-called "sunrise problem" — the reality that not all VASPs in a transfer chain are yet compliant — remains an operational challenge that the Commission expects licensees to address in their AML framework rather than treat as an excuse for non-compliance.
Transaction monitoring is a parallel obligation. Licensees are expected to screen transactions against OFAC, UN and domestic sanctions lists, and to file suspicious activity reports with the Financial Intelligence Unit of The Bahamas. The frequency and sophistication of the monitoring expected scales with the volume and risk profile of the business. An exchange processing high volumes of peer-to-peer transactions will face a different monitoring expectation than an advisory firm processing a small number of institutional trades.
In a recent matter, a custody business preparing a DARE Act application came to us with an AML programme drafted for a different jurisdiction's regime. The programme was technically well-constructed but did not address the specific risk categories the Securities Commission prioritises, and it lacked a Travel Rule section entirely. We rebuilt the programme around the Bahamian supervisory expectations, added a Travel Rule policy and a technology vendor assessment, and the application proceeded without a major AML-related query round. The lesson is that jurisdictional specificity in the AML documentation is not a cosmetic difference.
Is The Bahamas the right licensing jurisdiction for your business?
The Bahamas is a credible, well-regulated jurisdiction for digital-asset businesses that can demonstrate substance, governance and AML maturity — but it is not the right choice for every operator profile.
Profile A — The regional exchange or custodian: A business serving clients primarily in the Caribbean, Latin America or across Atlantic markets, with genuine operational substance in Nassau, is well-suited to the DARE Act regime. The tax-neutral profile, the English common-law legal system and the Commission's established track record with digital-asset applicants make the jurisdiction an efficient choice. The key risk is banking: plan the correspondent-banking strategy before you file.
Profile B — The EU-facing operator: A business with significant EU client exposure needs a MiCA-compatible structure in addition to any Bahamas registration. The Bahamas licence does not substitute for a CASP authorisation under MiCA, and the compliance costs of running both structures in parallel require careful modelling before the domicile decision is made. In this profile, a single EU hub with a Bahamas holding structure may be more efficient than trying to serve EU clients from The Bahamas directly.
Profile C — The token issuer: An issuer whose token does not qualify as a security under Bahamian law and who wants a respected offshore domicile for the issuance vehicle may find The Bahamas attractive. The DARE Act's token classification framework, combined with the jurisdiction's tax neutrality, is a workable combination. The cross-border analysis — particularly where the token is distributed to US persons — remains a separate and demanding exercise that the Bahamian licence does not resolve.
Profile D — The business seeking a quick, light-touch offshore registration: If the purpose is to create a nominal offshore shell with minimal compliance overhead, The Bahamas is the wrong choice. The Securities Commission conducts a substantive review. Operators who come with underdeveloped governance, template AML documents and no clear business plan will encounter a slow, costly process — or a refusal. For that profile, the right advice is to either invest in the substance required to support the application, or to reconsider the licensing strategy entirely.
What mistakes do businesses most commonly make in DARE Act applications?
The most consistent failure point in DARE Act applications is the assumption that an offshore licence in another jurisdiction transfers cleanly to The Bahamas. It does not. Each application is assessed on its own merits against Bahamian supervisory standards. A business that holds a Cayman VASP registration or a BVI FSC registration will still need to demonstrate independent compliance capability in the Bahamian context.
A second frequent mistake is treating the technology risk assessment as a formality. The Securities Commission's expectations on cybersecurity, key management, business continuity and disaster recovery have evolved alongside global standards. An application that presents a one-page technology overview against a regime that expects a substantive risk framework will generate a significant query round.
A third category involves corporate structure complexity. Groups with multi-layered holding structures, nominee arrangements or trusts as beneficial owners create disclosure challenges that the Commission will not ignore. Simplifying the ownership structure before the application — where that is commercially possible — materially reduces friction. Where structure complexity is necessary for legitimate commercial reasons, the documentation burden is higher and should be planned for accordingly.
A common assumption is that the Bahamas Commission is less demanding than the major hubs and will approve an application that would fail in Singapore or the UAE. That assumption is incorrect. The Commission operates under a mandate to protect the integrity of the jurisdiction, and it has refused applications and revoked registrations where the supervisory standards were not met. Operators who approach the process with that expectation will be unprepared for the level of engagement the Commission requires.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – end-to-end licence strategy across 70+ jurisdictions for exchanges, custodians and issuers
- Digital-asset licensing in the Seychelles – a parallel offshore licensing analysis for comparison with The Bahamas
- Enforcement of foreign judgments for digital-asset firms – cross-border recovery and enforcement counsel for licensed operators
FAQ
How long does a crypto licence take to obtain?
Under the DARE Act, the Securities Commission of The Bahamas conducts a substantive review of each application. A well-prepared, complete submission typically moves through the process in a matter of several months, though more complex applications or those requiring multiple query rounds may take longer. Preparation quality — particularly the AML programme and governance documentation — is the single greatest influence on timeline. No regulator in any leading jurisdiction processes digital-asset applications in a matter of days.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on the activity type, the client base, the existing entity structure, the banking strategy and the founder's tax position. The Bahamas suits operators with genuine Caribbean or Atlantic-facing substance and a tax-neutral requirement. Businesses with significant EU client exposure need a MiCA-compatible structure. Operators targeting institutional clients in Asia may find Singapore or Hong Kong more appropriate. The correct answer comes from a structured analysis of the full operating and compliance stack, not from selecting the lowest-cost option.
Do I need a separate custody licence?
Under the DARE Act, custody of digital assets is a regulated activity that may require its own registration or licence depending on how it is conducted and at what scale. A business that provides custody as an ancillary function within a broader exchange licence may be able to cover that activity within a single instrument, but the Commission's view will depend on the structure of the service. Operating custody without confirming the regulatory position is a risk no licensed business should accept. The analysis is activity-specific and should be confirmed before services are offered to clients.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around every licence. Digital assets are the entirety of our practice. We map the licence stack across operating, custody and payment layers before you commit, and we act only for businesses — not for individuals or retail claimants. To discuss your DARE Act application or broader licensing strategy, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst — specialist in offshore and mid-shore digital-asset licensing strategies, including DARE Act applications and Caribbean-facing regulatory structures.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.