With major regulators tightening VASP (virtual asset service provider) supervision globally, choosing the wrong licence jurisdiction can stall your launch, freeze your banking and limit the client base you can legally serve. Lithuania and Hong Kong represent two distinct regulatory philosophies: one a low-cost EU gateway transitioning under MiCA (the Markets in Crypto-Assets Regulation), the other a high-standard Asia-Pacific hub under SFC (Securities and Futures Commission) VATP oversight. This page maps both regimes across the axes that matter to an operator – regulator posture, licence scope, timeline, substance requirements, AML obligations, tax and banking – and closes with a decision matrix by operator profile so you can identify which path fits your build before you spend a dollar on application fees.
Why Jurisdiction Selection Is a Strategic Decision
Choosing where to hold your primary licence is not an administrative detail. It determines which clients you can onboard, which banks will open accounts, which counterparties will trade with you, and what capital you must hold on day one. Operating without the right authorisation exposes the business to enforcement action, mandatory wind-down and, increasingly, personal liability for directors.
In our practice, we regularly advise operators who licensed opportunistically – picking the fastest or cheapest jurisdiction available at the time – only to find that the chosen licence provides no meaningful recognition in the markets they actually serve. The EU passport under MiCA is valuable precisely because it travels. An SFC-licensed VATP in Hong Kong signals institutional credibility across the Asia-Pacific corridor. Neither is a universal key, and neither is a formality.
The cross-border reality compounds this. Most digital-asset businesses hold entities in more than one jurisdiction: an operating company where the licence sits, a holding company in a tax-efficient seat, and potentially a separate custodian entity. The licence you obtain in Lithuania or Hong Kong feeds directly into that stack. Getting the sequencing wrong is expensive to unwind.
The Regulatory Regimes Side by Side
Lithuania's regime has historically offered one of the most accessible EU entry points for crypto businesses, and it remains relevant as the country transitions from its prior VASP registration model to full MiCA CASP (Crypto-Asset Service Provider) authorisation under ESMA and the Bank of Lithuania. Under MiCA, a CASP authorised in Lithuania may passport its activities across the entire EU and EEA without further local authorisation – a structural advantage that no offshore jurisdiction can replicate.
Hong Kong operates through a dual-track model. The SFC licenses VATPs (virtual asset trading platforms) under the securities-focused VASP regime, covering exchanges that deal in virtual assets, including those that may qualify as securities. The SFC's posture has shifted markedly in recent years: the regime now carries capital requirements, operational controls and investor-protection expectations that are broadly comparable to those applied to traditional financial intermediaries. This is not a light-touch offshore register. It is a substantive authorisation with ongoing supervisory engagement.
The two regimes are not competing for the same operator profile. Lithuania's MiCA track is built for businesses that need EU market access. Hong Kong's SFC regime is built for businesses targeting institutional and retail clients in Asia, with the credibility signal that comes from operating under a well-regarded common-law financial regulator.
What Activities Does Each Licence Cover?
Under MiCA, a CASP authorisation in Lithuania covers a defined list of crypto-asset services: operation of a trading platform, exchange of crypto-assets for funds or other crypto-assets, execution of orders, custody, portfolio management, advice and transfer services. The specific services authorised appear on the face of the licence, so scope matters at application stage.
The MiCA framework also distinguishes between the service licence and the token issuer regime. A business that issues an ART (asset-referenced token) or an EMT (e-money token) faces a separate authorisation track with reserve and redemption obligations. A business that issues "other" crypto-assets – utility tokens and the like – must publish a whitepaper but does not require authorisation as an issuer. That distinction has significant practical consequences for token issuers considering an EU base.
Hong Kong's SFC VATP licence covers the operation of a centralised trading platform for virtual assets. Custody of client assets – a key ancillary function for any exchange – is addressed within the VATP framework, but the SFC has distinct expectations around segregation, safeguarding and the appointment of licensed custodians. Businesses that wish to offer management, advice or dealing services in addition to exchange operations may need additional licences under the broader SFC regulatory structure, particularly where the assets in question have securities characteristics.
How Does the Application Process Compare?
Lithuania's MiCA CASP process runs through the Bank of Lithuania, which coordinates with ESMA on the broader transition timeline. The process involves a complete application dossier, a fit-and-proper assessment of directors and qualifying shareholders, an AML/CFT programme review, IT and security documentation, and capital verification. Under the MiCA transition provisions, operators previously registered under the prior VASP regime have a defined grandfathering window; new entrants apply directly for CASP authorisation. Timelines vary by application quality and regulator queue depth, and the Bank of Lithuania has historically processed applications more quickly than some of its EU counterparts – but we counsel clients to plan conservatively.
Hong Kong's SFC VATP process is, by design, more intensive. The SFC conducts an in-depth review of the applicant's governance, technology infrastructure, cybersecurity controls, AML/CFT systems and financial resources. The vetting period is measured in months rather than weeks, and the SFC expects demonstrated operational readiness – not a plan for it. Pre-application engagement with the regulator is standard practice and is strongly recommended before lodging a formal submission.
In our cross-border practice, we have seen applications in both jurisdictions delayed not by regulatory complexity but by preparedness failures: incomplete beneficial ownership disclosures, AML programmes that describe policy without demonstrating implementation, and technology documentation that does not align with the actual system architecture. Both regulators have grown more sophisticated at identifying the gap between paper compliance and operational reality.
For a scoped assessment of your application readiness in Lithuania or Hong Kong, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the user base geography and the banking stack – change the analysis materially.
Substance Requirements: What Must You Have on the Ground?
Both Lithuania and Hong Kong require genuine operational substance – not a registered address and a nominee director. The Bank of Lithuania expects a locally established entity with a board that includes members capable of exercising effective oversight, an AML compliance officer with the requisite experience, and systems and controls that can be audited. The SFC in Hong Kong applies a similar logic with greater intensity: the responsible officers named in the application must be demonstrably qualified and active, and the platform's operations must be based in Hong Kong.
Substance has become a threshold issue across both jurisdictions as regulators share intelligence and as banking partners apply their own enhanced due diligence to crypto licensees. A shell entity with a licence but no operational reality will struggle to open accounts, attract institutional counterparties and maintain regulatory standing beyond the first supervisory review.
For operators building a multi-entity structure – common among businesses that separate the operating exchange, the custody function and the treasury – the substance question multiplies. Each regulated entity in each jurisdiction must satisfy the local regulator on its own terms. We map this at the outset of every licensing mandate, before the client commits capital to a structure that cannot be sustained.
AML, Travel Rule and Compliance Obligations
Both regimes apply the Travel Rule (the FATF obligation to pass originator and beneficiary data with a virtual asset transfer), but the implementation details vary by jurisdiction and by counterparty relationship. Under MiCA and the EU's Transfer of Funds Regulation as applied to crypto-assets, the Travel Rule applies to all transfers regardless of value; Lithuania as a MiCA jurisdiction follows this EU-level standard. Hong Kong's SFC and the relevant AML ordinances impose Travel Rule obligations on licensed VATPs, with the SFC guidance addressing both the technical implementation and the approach to unhosted wallets.
AML/CFT programme expectations in both jurisdictions go substantially beyond a written policy document. Regulators expect demonstrated transaction monitoring, screening against sanctions lists maintained by relevant authorities, enhanced due diligence for higher-risk customers and documented risk-based decision-making. In a recent compliance review matter, we identified that a client's automated transaction monitoring had been calibrated for fiat thresholds and was not adapted for the velocity and fragmentation patterns typical of on-chain activity. The gap was structural, not cosmetic, and required a full remediation before the client could proceed with its licence application.
Operators serving both EU and Hong Kong clients – a common configuration for exchanges targeting institutional flows – must satisfy both regimes simultaneously. The compliance architecture must be designed for dual-regime operation from the outset, not retrofitted after licensing.
Tax and Banking: The Real Cost of the Licence
The headline licence fee is rarely the significant cost in a crypto licensing project. The real costs are capital deployment, the ongoing compliance infrastructure, and the difficulty and expense of maintaining banking relationships. Both Lithuania and Hong Kong present distinct profiles on these axes.
Lithuania's corporate tax regime is EU-standard, with a competitive rate applicable to retained profits. More relevantly for most operators, Lithuania has historically offered a relatively accessible banking environment for early-stage crypto businesses within the EU – though the position has tightened as the Bank of Lithuania and major commercial banks have applied more rigorous scrutiny to VASP clients. Payment institutions and e-money institution licences, which Lithuania also offers, can in some configurations be stacked with a CASP authorisation to provide broader payment-layer functionality.
Hong Kong's corporate tax is territorial and applies only to profits arising in or derived from Hong Kong, at a rate that is competitive by developed-market standards. Banking for crypto businesses in Hong Kong has historically been challenging, mirroring the experience in most major financial centres, though the SFC's formal VATP regime has begun to provide a clearer compliance basis on which banks can conduct their own due diligence and make account-opening decisions. Operators licensed under the SFC are not guaranteed banking access, but the licence provides a credible framework that informal or offshore registrations cannot match.
If a prior application stalled or banking rails were closed after your initial structure was built, a second read can surface the structural cause and the route back. Write to OBOLUS at info@oboluslaw.com to discuss.
Decision Matrix: Which Profile Fits Which Jurisdiction?
No jurisdiction is the right answer for every operator. The choice turns on the business model, the target client geography, the product set and the operator's appetite for ongoing regulatory engagement. The following profiles reflect the patterns we see most frequently in practice.
Profile A – EU-facing exchange or brokerage: A business whose primary user base is in Europe, or that requires passportable access to EU retail and institutional clients, should examine the MiCA CASP route through Lithuania or another EU member state. Lithuania offers a relatively efficient authorisation process by EU standards. The trade-off is a compliance infrastructure calibrated for EU-level AML obligations and ongoing ESMA supervisory expectations. Timeline: plan for a multi-month authorisation process after a complete dossier is filed. Key risk: underestimating the substance requirement and the ongoing compliance overhead.
Profile B – Asia-Pacific exchange or institutional platform: A business targeting Hong Kong and broader Asia-Pacific institutional flows, or one that needs the credibility signal of SFC oversight to attract prime brokers and fund counterparties, should prioritise the SFC VATP route. The timeline is longer and the substance expectation is higher, but the resulting licence carries a weight that few other Asian jurisdictions can match. Key risk: underestimating the depth of SFC vetting and entering the process without a fully operational system ready for review.
Profile C – Token issuer targeting EU distribution: A business issuing crypto-assets intended for EU users must engage with the MiCA whitepaper and, for ARTs or EMTs, the full issuer authorisation track. Lithuania provides a competent EU gateway for this purpose. Key risk: misclassifying the token and discovering mid-process that a full authorisation is required.
Profile D – Global operator seeking dual coverage: Some operators license in both jurisdictions – an EU entity for European operations and an SFC-licensed entity for Asian operations – with a holding company in a tax-efficient jurisdiction coordinating the two. This model works, but it requires the compliance architecture, the substance budget and the banking strategy to be designed as a unified whole from the outset. A piecemeal approach typically results in conflicting obligations and fragmented banking relationships.
A common assumption we encounter is that a single offshore licence – a BVI registration, a Cayman VASP registration, or a light-touch register in a smaller jurisdiction – is sufficient to operate globally without engaging the regulatory regimes of the jurisdictions where clients actually sit. This is not the case. MiCA imposes obligations on businesses that market to EU persons regardless of where the entity is incorporated. The SFC's VATP regime applies to platforms operating in Hong Kong or targeting Hong Kong users. An operator that relies on an offshore registration while serving EU or Hong Kong clients is taking a significant regulatory risk – one that typically surfaces only when enforcement, banking closure or counterparty due diligence forces a reckoning.
Related Practices at OBOLUS
Related at OBOLUS
- Licensing & Registration for Digital-Asset Businesses – end-to-end licensing counsel across 70+ jurisdictions, from first assessment to authorisation
- EU MiCA vs Kazakhstan AIFC: Where to License a Crypto Business – head-to-head analysis of two distinct regulatory regimes for operators weighing EU access against the AIFC common-law environment
- Airdrop Legal Structuring in Panama – structuring guidance for token distribution events in a jurisdiction outside the major licensing regimes
FAQ
How long does a crypto licence take to obtain?
Timelines vary significantly by jurisdiction, regulator queue depth and application quality. In Lithuania under the MiCA CASP regime, a well-prepared application typically takes a matter of months from filing to decision; the Bank of Lithuania has historically been among the more efficient EU NCAs. In Hong Kong, the SFC VATP process is more intensive and the vetting period is typically longer – measured in several months to a year or more depending on application complexity and the regulator's review load. Neither timeline is guaranteed; preparedness at filing is the primary controllable variable.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer, and any adviser who offers one without examining your facts is giving you incomplete guidance. The decision turns on your target client geography, product scope, entity structure, capital and the banking relationships you need to maintain. EU-facing operators generally benefit from a MiCA CASP authorisation in a member state such as Lithuania. Asia-Pacific operators targeting institutional flows typically need SFC oversight. Some businesses require both. We map the full licence stack – operating, custody and payment layers – before a client commits to a structure.
Do I need a separate custody licence?
It depends on the jurisdiction and the business model. Under MiCA, custody and administration of crypto-assets on behalf of clients is a separately authorised service that must appear on the CASP licence. Under the SFC VATP regime in Hong Kong, custody of client assets is addressed within the VATP framework but carries specific operational expectations around segregation and safeguarding; separate licensing considerations may apply if custody is offered as a standalone service. Bundling exchange and custody functions in a single entity without the correct authorisation scope is a common structural error that surfaces during the SFC review process or a MiCA supervisory examination.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – so the structure works end to end, not just on paper. We structure licensing, banking and tax as one mandate rather than three disconnected workstreams. To discuss your situation, contact info@oboluslaw.com or reach us via t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in multi-jurisdiction VASP authorisation, MiCA transition strategy and Asia-Pacific licensing across the SFC and MAS regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.