Operating a crypto business without the right licence does not merely create a compliance gap. It exposes the business to enforcement action, frozen banking rails and a customer base that cannot legally be served. The question of where to licence – not merely whether to licence – is therefore one of the most consequential structural decisions a digital-asset operator makes. Two destinations dominate the conversation for a certain class of operator: the European Union under the MiCA (Markets in Crypto-Assets Regulation) regime, supervised by ESMA and national competent authorities, and the Cayman Islands, regulated by CIMA (the Cayman Islands Monetary Authority) under the Virtual Asset (Service Providers) Act. They are not interchangeable. They serve different operator profiles, different markets and different risk tolerances.
This comparison maps the two regimes across the axes that matter most to a general counsel or founder: regulatory scope, licence categories, substance requirements, AML posture, the cross-border reality of where users actually are, and the tax and banking environment around the licence. No blanket verdict is offered. The right answer depends on your entity type, your user geography and your roadmap.
What Kind of Regulatory Environment Are You Entering?
The EU and the Cayman Islands represent genuinely different philosophies of crypto oversight, and understanding that difference is the prerequisite for every other analysis. MiCA establishes a single, harmonised authorisation regime for CASPs (crypto-asset service providers) across all EU and EEA member states, supervised nationally but passportable across the bloc – a regime ESMA has been instrumental in designing and will continue to shape through binding technical standards. The Cayman Islands, by contrast, operates a registration and licensing model under CIMA that is comparatively lighter on ex-ante substance requirements, designed in part to accommodate investment funds, special-purpose vehicles and early-stage operators that do not yet have the organisational depth MiCA presupposes.
The practical implication is structural. A MiCA authorisation is a market-access credential. It tells EU retail and institutional clients, EU banks and EU payment processors that the business has been assessed against a comprehensive prudential and conduct regime. A Cayman VASP registration or licence signals regulatory presence in a reputable common-law offshore centre – but it does not, by itself, confer the right to serve EU customers, UK customers or most major retail markets directly. In our licensing practice, we regularly advise founders who conflate the two: they assume a Cayman registration is sufficient for a global rollout. It rarely is.
The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. For a scoped assessment of which regime fits your build, contact OBOLUS at info@oboluslaw.com.
How Are the Licence Categories Structured?
Both regimes use activity-based licence structures, but the granularity and the legal effect differ materially. Under MiCA, a CASP authorisation covers defined crypto-asset services – including exchange services, execution of orders, placing of crypto-assets, custody and administration, operation of a trading platform, reception and transmission of orders, portfolio management, and advice. Each service must be expressly covered by the authorisation. The regime also carves out token-specific obligations: issuers of ARTs (asset-referenced tokens) and EMTs (e-money tokens) face authorisation and whitepaper requirements that are distinct from, and in addition to, CASP authorisation.
The Cayman framework under the Virtual Asset (Service Providers) Act distinguishes between registration (for lower-risk activities) and full licensing (for higher-risk or higher-volume activities) tracks. CIMA's regime covers virtual asset trading platforms, custody services, virtual asset issuance and related activities. The Cayman fund ecosystem is mature and well-banked; a Cayman Islands structure is often the entity of choice for a digital-asset fund or a token treasury vehicle precisely because the Islands' existing fund law is comprehensive and the professional services infrastructure is deep.
The mismatch to watch: a business that issues a token under Cayman law still faces MiCA's ART or EMT authorisation requirements if that token is offered to EU persons. The legal entity's domicile does not determine the regulatory perimeter. Substance follows the customer.
What Does Each Jurisdiction Actually Require You to Build?
Substance requirements are where the two regimes diverge most sharply, and where the hidden cost of a MiCA authorisation often surprises founders who benchmark only on filing fees. MiCA mandates a genuine local presence: a registered office, fit-and-proper management, adequate own funds (calibrated to the class of services, with the minimum varying by category – the regulator publishes the scale), and organisational requirements covering governance, conflict-of-interest policies, complaints handling, outsourcing limits and business-continuity planning. National competent authorities have examined each of these in detail. A shell application does not pass.
The Cayman regime is less prescriptive on operational substance for most non-fund structures. CIMA expects fit-and-proper persons, AML compliance officer appointments and a coherent business model, but the governance and capital requirements for a registered (as opposed to licensed) VASP are lighter than MiCA's floor for most CASP categories. That lighter touch is a feature for a certain profile – a fund administrator, a custody vehicle, a DAO treasury entity – but it is not a substitute for EU market access requirements if EU clients are in scope.
In our cross-border practice, we have seen operators spend significant time and budget building a Cayman structure only to discover, at the point of seeking EU banking, that counterparties require evidence of an EU-supervised entity or at minimum a MiCA-authorised partner. The rebuild is expensive. Mapping the substance requirements against the target customer base before committing to a structure is not optional – it is the first analytical step.
How Long Does the Authorisation Process Take in Each Jurisdiction?
Timeline is one of the most heavily weighted factors for founders, and both regimes carry process risk that can extend the practical runway significantly beyond the regulatory baseline. Under MiCA, the national competent authority has a defined assessment period after receipt of a complete application file; the completeness check itself can extend the clock if documentation gaps are identified. In practice, across the EU member states we monitor, the end-to-end process from engagement to authorisation – including pre-application dialogue, document assembly, completeness review and assessment – typically runs across several months, with more demanding NCAs in larger member states sometimes taking longer. Lithuania and Malta, historically faster EU VASP entry points, are now operating under MiCA timelines that reflect the increased procedural depth the regulation demands.
The Cayman process is generally faster for a registration track and somewhat longer for a full licensing track, but the differential with MiCA varies considerably depending on the NCA chosen. CIMA is known in the market as a responsive regulator; pre-application engagement is available and productive. For a fund or special-purpose vehicle with a clear Cayman nexus, the Cayman path can be completed in a fraction of the time a MiCA CASP authorisation requires – with the important caveat that the Cayman credential does not open EU retail markets on its own.
The cross-border dimension matters here. Operators who need EU access and who are building from scratch face a genuine choice between (a) starting with a Cayman structure and layering an EU authorisation later, or (b) front-loading the EU process and accepting the longer pre-launch runway. Both paths are viable. Neither is obviously superior without knowing the operator's funding timeline and user geography.
AML, the Travel Rule and Cross-Border Compliance Obligations
Both jurisdictions require compliance with FATF-standard AML/CFT obligations, but the implementation detail differs and the enforcement intensity is not the same. Under MiCA and the EU's Transfer of Funds Regulation, the Travel Rule (the obligation to pass originator and beneficiary data with a virtual asset transfer) applies with a threshold that the regulation sets out; EU supervisors have been explicit that Travel Rule compliance is a core CASP obligation, not an aspiration. ESMA and the European Banking Authority have published joint guidelines on the interaction between MiCA and AML requirements, and national supervisors are examining Travel Rule readiness as part of authorisation assessments.
The Cayman Islands implemented FATF Recommendation 15 obligations through its VASP Act and accompanying AML regulations. CIMA expects a risk-based AML programme, a compliance officer of appropriate seniority, screening procedures and record-keeping. The Cayman framework is FATF-compliant at the structural level – the Islands are not on any FATF grey list – but the day-to-day supervisory intensity is calibrated to the offshore nature of the jurisdiction. For an operator whose primary supervisory relationship will be with an EU NCA, the AML gap between the two regimes in terms of supervisory expectation is material.
For a business structuring across both jurisdictions – a common model where a Cayman holding entity sits above an EU-licensed operating entity – the AML programme must be designed for the more demanding standard. Group AML policies, Travel Rule tooling and correspondent banking due diligence should all be built to MiCA-level expectations from day one, even if the Cayman entity is the current regulatory perch.
Tax and Banking: The Infrastructure Around the Licence
A licence without banking is a credential without commercial utility. This is not a theoretical risk: it is the operational reality that founders discover after authorisation. The Cayman Islands carry a well-established advantage in this respect for fund structures and holding entities. The Islands impose no corporate income tax, no capital gains tax and no withholding tax on fund distributions. For a token treasury or a digital-asset fund, the Cayman entity is frequently the most efficient holding layer. Cayman-domiciled funds also have access to established prime-brokerage and fund-administration banking relationships that are not available to newly-authorised EU CASPs.
The EU picture is more complex and more jurisdiction-specific. Corporate tax rates and regimes vary across member states; the choice of NCA therefore carries a tax dimension that the MiCA analysis itself does not resolve. Some EU member states have issued guidance on the tax treatment of staking rewards, token issuance proceeds and crypto-to-crypto disposals; others have not. VAT/GST treatment of crypto services remains an area of active development across the bloc.
Banking access for EU CASPs has improved since the early days of crypto licensing but remains uneven. Some EU banks are actively onboarding MiCA-authorised CASPs; others apply correspondent-bank de-risking policies that effectively exclude the sector. The practical result is that a MiCA authorisation does not guarantee a banking relationship. Operators we advise routinely plan for three to five banking approaches in parallel, with fiat-on/off-ramp solutions via payment institutions as a contingency.
If a recovery clock is running or a banking relationship has been unexpectedly closed, reach our disputes and structuring desk now at info@oboluslaw.com.
Which Operator Profile Should Choose Which Path?
No blanket verdict is appropriate here, and any adviser who offers one without knowing your facts is not doing the analysis. What follows is a profile-based decision framework drawn from the patterns we see in practice.
Profile A – EU-facing retail exchange or trading platform. The MiCA CASP authorisation is the correct instrument. A Cayman registration alone will not satisfy EU passporting requirements, EU-supervised banking expectations or the regulatory diligence that institutional counterparties and payment processors now require as standard. The timeline is longer, the substance requirements are real, and the capital requirements vary by service class. The EU authorisation is the price of EU market access – there is no structural workaround that survives regulatory scrutiny.
Profile B – Digital-asset fund or token treasury vehicle with a global or non-EU investor base. The Cayman Islands is the natural home. The fund law infrastructure, the tax neutrality, the established prime-brokerage relationships and the comparatively lighter VASP registration process all favour Cayman. If the fund later takes EU investors or launches a token marketed to EU persons, a parallel EU analysis is triggered – but the Cayman structure remains the efficient holding layer.
Profile C – Custodian serving institutional clients across multiple jurisdictions. This profile typically requires multiple licences. A MiCA CASP authorisation covers EU custody services; a Cayman registration or licence covers the offshore holding and sub-custody layer; and depending on where the clients are domiciled, Singapore MAS, Hong Kong SFC or ADGM/FSRA authorisations may also be in scope. The single-jurisdiction assumption is the most dangerous assumption a custodian can make. We map the licence, banking and tax stack before you commit – write to info@oboluslaw.com.
Profile D – Token issuer launching an ART or EMT. MiCA's token-specific regime applies if the token is offered to EU persons, regardless of where the issuer is incorporated. A Cayman issuer entity does not disappear from the MiCA perimeter. The issuer must either obtain MiCA authorisation or restructure the token offering to fall outside the ART/EMT definitions. This is a hard legal question with significant commercial consequences and it should be resolved before the token economics are finalised.
Addressing a Common Assumption: One Offshore Licence Is Enough
A common assumption among early-stage founders is that a single offshore registration – whether Cayman, BVI or another offshore centre – is sufficient to operate a crypto business globally. It is not, and regulators in the major retail markets have made that position unambiguous.
The logic that "we are incorporated offshore so EU rules do not apply to us" has been tested against MiCA's extraterritorial drafting and the conclusion is clear: the offering of crypto-asset services to EU persons by any entity, regardless of domicile, falls within the MiCA perimeter if the service is directed at EU customers. The same analysis applies under the FCA's UK financial-promotion regime, under MAS's Payment Services Act and under the SFC's VASP regime in Hong Kong. Each of these regulators assesses the location of the customer, not merely the location of the entity.
The practical consequence is that a multi-jurisdictional retail business needs a licence stack, not a single licence. The offshore entity may be the most efficient holding and treasury layer. It is rarely the correct operating entity for regulated services directed at customers in major markets. Understanding that distinction – and designing the corporate structure around it from the outset – is the difference between a clean regulatory posture and a costly retrofit.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – how we structure multi-jurisdiction licence stacks for exchanges, custodians and issuers
- VASP Licence Applications for Early-Stage Founders – scoped licensing support from entity formation through to authorisation
- Fiat On/Off-Ramp Banking in Kazakhstan (AIFC) – banking infrastructure options for operators in the AIFC environment
FAQ
How long does a crypto licence take to obtain?
Timeline varies materially by jurisdiction and licence category. A MiCA CASP authorisation in the EU typically takes several months from submission of a complete application file, with the clock paused during any completeness-check period; the most demanding national competent authorities can extend the process further. A Cayman VASP registration generally proceeds more quickly, particularly for lower-risk activity tracks, though a full CIMA licensing review takes longer. In all cases, pre-application preparation – entity structuring, governance documentation, AML framework build – adds time before the formal clock starts.
Which jurisdiction is best for licensing my crypto business?
There is no universally correct answer. The right jurisdiction depends on where your customers are, what services you offer, the maturity of your organisation, your banking requirements and your tax efficiency objectives. An EU-facing retail platform needs a MiCA CASP authorisation. A digital-asset fund with a global investor base will often be most efficiently structured in the Cayman Islands. A custodian serving institutional clients across multiple regions typically needs licences in several jurisdictions simultaneously. We map the full licence stack against your specific facts before recommending a path.
Do I need a separate custody licence?
Under MiCA, custody and administration of crypto-assets on behalf of clients is a defined crypto-asset service that must be expressly covered by a CASP authorisation; it is not automatically included in a trading-platform or exchange authorisation. Under the Cayman framework, custody services are a distinct regulated activity under CIMA's VASP regime. In other major jurisdictions – Singapore, Hong Kong, ADGM – custody is similarly a separately authorised activity. Operators that custody client assets as part of a broader service offering should assume that a custody-specific regulatory analysis is required in each relevant jurisdiction.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence, banking and tax stack across operating, custody and payment layers before you commit – so that structural decisions are made on a complete picture, not a partial one. We advise crypto exchanges, custodians, token issuers and funds across more than seventy licensing jurisdictions. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in multi-jurisdiction VASP and CASP authorisation strategy, with a focus on EU MiCA implementation and offshore structuring for digital-asset operators.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.