Operating an exchange without the right authorisation in a jurisdiction whose reach extends to your user base – not just your incorporation address – exposes the business to enforcement action, frozen payment rails and the sudden loss of banking relationships. The BVI VASP Act 2022 changed the compliance calculus for every crypto business using a BVI entity: registration is no longer optional, and the consequences of operating outside the regime are real. This page maps the regulated basis, the application process, and the cross-border questions every inbound operator must resolve before the first transaction settles.
The Regulated Basis: What the BVI VASP Act Covers
The BVI Financial Services Commission (FSC) administers the Virtual Asset Service Providers Act 2022, which imposes a registration requirement on any person carrying on virtual asset service activities from within or, in defined circumstances, into the British Virgin Islands. The regime does not operate on a single licence model. Instead, it defines specific regulated activities – including the operation of a virtual asset exchange, custody, transfer services and the issuance of virtual assets – and requires registration against each activity a business proposes to conduct.
The starting point for any inbound operator is activity mapping. A business that holds client assets, operates an order-matching engine and processes withdrawals may engage three distinct categories under the applicable regime. Each category carries its own registration obligation, fit-and-proper assessment and ongoing supervisory expectation. Identifying the full activity footprint before you file is not a formality – it is the analysis that shapes every subsequent step.
The BVI regime does not replace the regulatory analysis in the jurisdictions where your users sit. A BVI-registered entity serving customers in the EU is simultaneously subject to MiCA and the national competent authority in the relevant member state. A BVI entity with US-resident users faces the parallel jurisdiction of the SEC, CFTC and FinCEN. The FSC registration is one layer; the stack that sits above it is determined by your commercial footprint, not your registered address.
Who Needs to Register With the FSC?
Any person conducting virtual asset service activities as a business in or from within the BVI must hold FSC registration before commencing operations. The threshold question is whether the activity is conducted as a business – a standard that looks to the regularity, organisation and profit motive of the operations rather than to any particular legal structure. A company incorporated in the BVI that passively holds a wallet for its own account is unlikely to meet the threshold. A BVI company that matches buy and sell orders for third parties, holds client funds between settlement or charges fees for asset transfer is firmly within it.
A common misreading of the BVI regime is the assumption that incorporation in the BVI automatically confers regulatory status. It does not. Incorporation and registration under the VASP Act are entirely separate processes administered by separate authorities. A newly incorporated BVI company commencing exchange activities without first registering with the FSC is operating unlawfully, regardless of how recently it was formed or how straightforward its structure appears.
For businesses structured across multiple entities – a common pattern where an operating company, a custody vehicle and a treasury entity sit in different jurisdictions – the BVI analysis runs entity by entity. We regularly advise on structures where the BVI entity performs only one function in the group; the registration requirement applies only to the regulated activities that entity actually conducts.
To map which activities in your proposed structure require registration under the BVI VASP Act, contact OBOLUS at info@oboluslaw.com. The registration analysis changes materially depending on how the custody, matching and transfer functions are allocated across entities.
What Does the BVI Registration Process Involve?
Registration with the FSC under the BVI VASP Act proceeds through a formal application that covers the applicant's business plan, ownership and control structure, AML/CFT programme, technology and custody arrangements, and the fitness and propriety of its beneficial owners, directors and senior management. The completeness of the initial submission is the single most reliable predictor of how quickly the FSC moves the file.
The documentation set typically runs to several dozen pages. The core elements are a detailed description of the proposed virtual asset services, an organogram showing the full group structure and ultimate beneficial ownership, AML/CFT policies and procedures that meet FATF standards – including a compliant approach to the Travel Rule (the obligation to pass originator and beneficiary data with each transfer) – and audited or management financial statements demonstrating financial soundness. Where the applicant will hold client virtual assets, the FSC expects a custody framework addressing segregation, key management and business continuity.
The FSC may issue clarification requests at any stage. Timelines vary by the complexity of the structure and the completeness of the file; applicants with straightforward single-activity structures and clean ownership chains move through the process more quickly than complex multi-activity groups or those with beneficial owners in higher-scrutiny jurisdictions. Writing qualitatively: the process typically takes a matter of months from a complete, well-prepared application. We have seen files move faster and significantly slower depending on the quality of the submission and the responsiveness of the applicant's team.
AML Obligations and the Travel Rule Under the BVI Regime
The BVI VASP framework is built on the FATF Recommendations, including Recommendation 15 on virtual assets and the Travel Rule obligation it incorporates. A registered VASP in the BVI must implement a customer due diligence programme, screen transactions against sanctions lists, apply enhanced due diligence to higher-risk counterparties and maintain records in a form accessible to the FSC on request.
Travel Rule compliance deserves specific attention. The obligation to transmit originator and beneficiary data with virtual asset transfers applies at a threshold that the FSC aligns with FATF guidance – and that threshold is a verify-before-you-file question, since it can be adjusted. More practically, the market for Travel Rule solutions has matured: purpose-built messaging protocols allow VASPs to exchange the required data with counterparty VASPs in real time. An applicant whose technology stack cannot support Travel Rule transmission at the point of registration is presenting the FSC with a gap that will delay or derail the application.
In our practice, the AML programme is the section of the application that most commonly draws FSC clarification requests. Generic templates sourced from non-BVI contexts often fail to address the specific risk profile of a virtual asset exchange – particularly the treatment of unhosted wallets, high-velocity retail accounts and the sanctions exposure that comes with servicing multiple geographies from a single BVI entity.
Cross-Border Banking and Tax: The Interaction Most Operators Miss
Securing FSC registration resolves the BVI regulatory question. It does not resolve banking. BVI entities operating crypto exchanges continue to face a banking environment where correspondent banks apply enhanced due diligence to virtual asset businesses, and where account approvals can take months or be declined without explanation. Operators who treat banking as a post-registration problem typically discover it is an eight-month problem, not an eight-week one.
The jurisdictions where BVI crypto businesses most reliably access settlement banking include a small number of specialist institutions in Europe, the Caribbean and the Gulf. Allied counsel in the relevant jurisdiction assist with the jurisdictional banking analysis. The practical point is that banking selection must happen in parallel with the FSC application, not after it.
On tax, a BVI entity pays no corporate income tax on profits, no capital gains tax and no withholding tax on distributions to non-resident shareholders – the BVI's tax-neutral status is one of the reasons it remains a structuring jurisdiction of choice. But tax neutrality in the BVI does not eliminate tax exposure in the jurisdictions where the business has economic substance. An operator whose key personnel, servers and decision-making are based outside the BVI should take independent tax advice on where the entity is treated as resident for tax purposes; in our cross-border practice, the disconnect between the entity's registered address and its economic substance is a recurring issue that creates unexpected tax exposure.
If your application is already in progress or your banking relationships have stalled, write to OBOLUS at info@oboluslaw.com. A second look at the structure and the banking stack can surface the reason and the path forward.
A Recent BVI Registration Matter
Earlier this year, we advised a digital-asset business that had incorporated a BVI entity for exchange operations but had not initiated VASP Act registration before soft-launching to a limited user base. The FSC had not yet acted, but the business faced a banking inquiry that required it to demonstrate regulatory status. We mapped the full activity footprint – the entity was conducting exchange, custody and transfer services simultaneously – filed a complete three-activity registration application within a defined timeline, and provided the bank with a written regulatory status letter setting out the pending application and the BVI legal framework. Registration was confirmed within the standard review period; the banking relationship was preserved. The matter is a useful illustration of why the regulatory and banking timelines need to run together, not sequentially.
Decision Matrix: Which Profile Fits the BVI?
Not every exchange operator should reach for a BVI structure as its primary licensed entity. The BVI VASP Act serves specific operator profiles well and others less so. The analysis below is a starting point, not a verdict.
Profile A – Early-stage exchange, non-US, non-EU user base, simple structure. The BVI is a cost-effective entry point. The registration process is manageable for a well-prepared single-activity applicant. The tax-neutral environment suits a bootstrapped operation. Key risk: banking access requires early planning, and the BVI registration alone will not satisfy regulators in jurisdictions where the users sit if those jurisdictions have their own VASP regimes.
Profile B – Mid-stage exchange seeking a passportable EU presence alongside a BVI holding structure. The BVI entity performs holding or treasury functions; a CASP (Crypto-Asset Service Provider) authorisation under MiCA in a member state handles the EU user base. The BVI and EU layers serve different purposes and are obtained in parallel. Key risk: MiCA authorisation has its own capital and operational requirements; the two processes must be scoped and sequenced carefully.
Profile C – Institutional exchange with custody of third-party assets as a core service. The BVI custody registration is available, but institutional counterparties – particularly prime brokers, fund administrators and regulated investors – increasingly require custodians to hold authorisation in a jurisdiction whose regime they recognise: Singapore's MAS, the ADGM's FSRA or the DIFC. The BVI registration may be part of the structure, but it is unlikely to be sufficient on its own for an institutional client base.
A Common Assumption Worth Examining
A common assumption among operators entering the BVI is that a single offshore registration is sufficient to serve clients globally. It is not. The BVI VASP Act regulates the activities of the BVI entity; it does not authorise that entity to conduct regulated virtual asset services in a jurisdiction that has its own VASP or CASP licensing requirement. An exchange registered with the FSC but serving EU retail clients without a MiCA authorisation is unlicensed in the EU. The same logic applies to the UK, Singapore, Hong Kong and any other jurisdiction where the user base generates a local regulatory nexus.
Regulators in the major hubs increasingly expect operators to demonstrate not just that they hold a licence somewhere, but that the licence they hold covers the activities they conduct in that regulator's jurisdiction. The "we're registered offshore" response to a regulatory inquiry in London or Singapore carries little weight. Operators we advise routinely discover that their user-facing regulatory exposure extends well beyond the jurisdiction of their primary entity, and that the gap between their current regulatory posture and their actual commercial footprint requires structured remediation.
Related at OBOLUS:
- Licensing and Registration for Digital-Asset Businesses – how we structure the full licence stack across operating, custody and payment layers.
- Licence Renewal and Variation: The Structuring Angle – managing material changes, scope extensions and cross-border variation.
- Worldwide Freezing Orders in UAE/VARA Dubai – asset recovery and injunctive relief under the DIFC Courts and VARA regime.
FAQ
How long does a crypto licence take to obtain?
Timeline varies by jurisdiction, activity category and the completeness of the application. In the BVI, a well-prepared single-activity registration typically progresses over a period of several months from submission of a complete file. Multi-activity applications, complex ownership structures or files requiring significant clarification take longer. The FSC's review pace is also affected by overall application volume at the time of filing. We provide realistic timeline guidance at the scoping stage.
Which jurisdiction is best for licensing my crypto business?
There is no single answer. The right jurisdiction depends on your user base, product type, target banking relationships, capital position and the regulatory regimes in the markets where you will actively operate. The BVI suits certain holding, exchange and custody structures. An EU user base typically requires a MiCA CASP authorisation. Institutional custody may require Singapore, Abu Dhabi or Hong Kong recognition. We map the full stack before you commit to a primary jurisdiction.
Do I need a separate custody licence?
Under the BVI VASP Act, custody of virtual assets on behalf of third parties is a distinct regulated activity requiring its own registration. If your exchange also holds client virtual assets – as most do between order matching and settlement – you are conducting custody activities and must register for that category. Separating exchange and custody into distinct legal entities is a structural option some operators adopt; each entity then registers only for the activities it conducts. The right approach depends on your group architecture.
About OBOLUS. OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence, banking and tax stack across operating, custody and payment layers before you commit – so the structure you build is the one that holds. We work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications when recovery matters arise. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in cross-border VASP registration, activity mapping and multi-layer licence structuring for digital-asset exchanges and custodians.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.