Operating a digital-asset business without the right licence is not a calculated risk. It is an invitation to enforcement action, frozen payment rails and banking termination – sometimes all three at once. The question operators reach us with is rarely "do we need a licence?" It is "which licence, in which regime, for which activity – and does an offshore registration actually cover what we need it to cover?"
Offshore vs onshore crypto licensing is the central structural decision in any VASP (virtual asset service provider) build. Offshore regimes – most commonly the British Virgin Islands and the Cayman Islands – offer lighter-touch VASP registration frameworks calibrated to fund-like operators and private vehicles. Onshore regimes – the EU under MiCA (Markets in Crypto-Assets Regulation), the UAE under VARA (Virtual Assets Regulatory Authority), Singapore under the MAS Payment Services Act – confer regulatory authorisation that banks, institutional counterparties and retail-facing platforms genuinely require. The choice is not about prestige. It is about whether the licence you hold actually covers the activity you are running, in the markets you are serving, at the banking tier you need.
This page maps the trade-offs across five decision axes, sets out a situation-to-instrument matrix, and explains where the cross-border reality overrides the clean theoretical comparison.
What offshore regimes actually offer – and what they do not
Offshore VASP registration provides a compliance baseline, not a market-access passport. The BVI Financial Services Commission administers the Virtual Asset Service Providers Act 2022, which creates a registration track for VASPs operating from or within the BVI. The Cayman Islands Monetary Authority (CIMA) runs a parallel registration and licensing framework under its own VASP Act. Both regimes satisfy FATF Recommendation 15 at the registration level and impose AML/CFT obligations, including Travel Rule compliance obligations for covered transfers.
What they do not do is confer a right to solicit retail customers in the EU, the UK, Singapore or the UAE. A BVI-registered VASP serving European retail users is not sheltered by its BVI status – it is, under the applicable MiCA provisions, operating as an unauthorised CASP (crypto-asset service provider) from the perspective of any EU national competent authority. That distinction matters enormously when payment processors, correspondent banks and institutional partners conduct their own due diligence on your regulatory position.
In our practice, we regularly see operators who built their initial stack on an offshore registration and discovered – at the point of onboarding a payments partner or approaching an institutional LP – that the registration answered none of the counterparty's questions. The offshore credential confirmed AML oversight. It said nothing about capital adequacy, governance standards or client asset segregation at a level the counterparty required.
To map whether your current registration covers your actual activity profile, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis.
What onshore authorisation costs – and demands in return
Onshore licensing requirements are materially more demanding than offshore registration, but they deliver something offshore cannot: a recognised authorisation that opens institutional banking, EU passporting and – under MiCA – a single cross-border right to operate across the EEA.
Under MiCA, a CASP authorised in any EU member state may passport its authorisation to operate across all EU and EEA member states. That single passporting mechanism is, for a business targeting European retail or professional markets, the most powerful structural feature available in any licensing regime globally. Lithuania and Malta, both established EU entry points for digital-asset operators, are transitioning their prior VASP frameworks into the MiCA CASP authorisation track. The capital and governance requirements are set by the EU regime and applied by the national competent authority.
In Dubai, VARA issues activity-based licences across categories including exchange services, custody, lending, advisory and transfer/settlement. The VARA rulebooks impose specific requirements on each activity category. A VARA licence covers mainland Dubai operations; the DIFC financial free zone operates under its own framework, administered separately. For a business targeting the Gulf region, a VARA authorisation is the market-access credential that institutional and retail banking partners recognise.
Singapore's MAS administers the Payment Services Act, under which Digital Payment Token (DPT) service providers require a licence at one of three institutional tiers. Hong Kong's SFC operates a VATP (virtual-asset trading platform) licensing regime for exchanges. Both are demanding in terms of technical, governance and AML infrastructure, but both carry the institutional weight that offshore registrations do not.
The cost of onshore authorisation is real: compliance infrastructure, qualified personnel, local substance requirements, capital allocation and timeline. Timelines vary considerably by regime and by the complexity of the applicant's business model. We advise clients to treat the authorisation process as a multi-month operational project, not a form-filling exercise.
Five decision axes: structuring the comparison
No single jurisdiction is the right answer for every operator. The comparison turns on five axes, each of which may point in a different direction depending on the business.
Axis 1: The user base. Serving retail customers in regulated markets requires an onshore authorisation in or with passporting access to those markets. There is no offshore workaround that survives regulatory scrutiny in the EU, UAE or Singapore. Serving professional or institutional counterparties only – particularly in a fund or treasury management context – opens more structural options, including offshore vehicles with appropriate fund-level exemptions.
Axis 2: The activity set. Custody is a regulated activity in most flagship regimes; it requires its own authorisation in several jurisdictions even where exchange or brokerage is separately licensed. Lending, staking-as-a-service and transfer/settlement each carry distinct licensing requirements in onshore regimes. Offshore registration is typically activity-agnostic at a general level but does not confer specific activity rights recognised by third parties.
Axis 3: The banking tier. This axis, more than any other, resolves the debate in practice. Tier-one and tier-two banks conducting their own AML and regulatory due diligence on crypto-business clients expect an onshore authorisation. BVI or Cayman registration opens crypto-friendly banking in a limited set of jurisdictions, but it does not open the correspondent banking relationships that scaling platforms require. Operators we advise routinely discover that the banking constraint drives the licensing decision more directly than any regulatory analysis.
Axis 4: The holding and IP structure. Offshore vehicles – BVI, Cayman – remain the dominant holding-company layer for institutional crypto funds, token-issuing vehicles and treasury structures. The distinction is between the operating entity (which typically needs the onshore licence) and the holding entity (which may rationally sit offshore). Conflating those two layers is one of the most common structural errors we encounter.
Axis 5: Regulatory trajectory. The FATF framework, the EU's MiCA model and the bilateral arrangements between major hubs are converging on higher standards. A jurisdiction that is lightly regulated today is not guaranteed to remain so. The cost of re-licensing a business that was built on an offshore-only structure – retrofitting governance, substance, capital and compliance infrastructure into an onshore authorisation – is substantially higher than building onshore from the start.
Situation-to-instrument matrix: which profile fits which structure
Different operator profiles translate into different licensing stacks. The matrix below identifies the primary configuration for four common profiles.
Profile A – Retail exchange targeting EU/EEA users. The primary instrument is a MiCA CASP authorisation in a member state with a developed CASP track. EU passporting then covers the EEA perimeter. The holding structure may sit offshore; the operating entity must hold the MiCA authorisation. Timeline is a matter of months per the applicable member state process. The key risk is underestimating the governance and AML infrastructure required at authorisation stage.
Profile B – Institutional-only OTC desk or prime broker. An onshore authorisation at a recognised hub – Singapore MAS (major payment institution tier), ADGM/FSRA, or UK FCA registration – is required to satisfy institutional counterparty due diligence. An offshore registration alone will not suffice for prime-brokerage relationships with regulated funds or banks. The timeline and capital commitment are higher, but the counterparty access is qualitatively different.
Profile C – Crypto fund or treasury vehicle. A Cayman or BVI vehicle remains the standard holding and fund structure. CIMA registration under the VASP Act satisfies the local regulatory obligation. The fund's investment manager or general partner may separately require an onshore licence in the relevant operating jurisdiction. The structural separation between the fund vehicle and the manager entity is critical; conflating them creates both regulatory and tax exposure.
Profile D – Token issuer planning a public offering into European markets. MiCA applies directly to public offers of crypto-assets in the EU, regardless of where the issuer is incorporated. An offshore-incorporated issuer offering tokens to EU retail investors is subject to the MiCA whitepaper and disclosure regime. The issuer either obtains CASP authorisation, relies on an applicable MiCA exemption where one exists, or excludes EU retail investors from the offer. Each path has material structural and compliance implications.
In each profile, the custody layer requires separate analysis. Custody is a discrete regulated activity in most onshore regimes and the assumption that exchange authorisation covers custody – or that offshore registration covers either – is a persistent and consequential error.
The cross-border reality: why the theoretical comparison rarely survives first contact
The clean binary of "offshore vs onshore" breaks down quickly when you introduce the actual operating variables: where the entity is incorporated, where its servers and staff sit, where its users are located, where it banks and where its counterparties are regulated.
A business incorporated in the Cayman Islands, operating technically from a Southeast Asian office, banking in a European country, and serving users across the EU and the Gulf is not a Cayman-regulated business for most practical purposes. It is a multi-jurisdictional business with a Cayman holding vehicle. Each of those jurisdictional touchpoints triggers its own regulatory analysis – and potentially its own licensing or registration obligation.
We have seen operators build their structures around a single offshore registration, only to face simultaneous inquiries from regulators in three or four jurisdictions, each asserting supervisory jurisdiction on the basis of a different factual connection to their territory. Managing that scenario reactively – after the inquiries arrive – is materially more expensive and more disruptive than managing it proactively through a structured licensing analysis.
ESMA and the EU national competent authorities have published guidance on the circumstances in which an entity incorporated outside the EU is nonetheless subject to MiCA requirements based on where it markets its services. VARA has similarly clarified the scope of its jurisdiction over entities with UAE nexus. The FCA applies its financial promotion rules to crypto marketing directed at UK persons, regardless of the issuer's incorporation.
The cross-border licensing question is not "which single licence do I need?" It is "which combination of authorisations, registrations and structural arrangements manages the full perimeter of my regulatory exposure?"
If a prior application stalled or an account was closed, a second structural read can surface the underlying reason and the route forward. Write to info@oboluslaw.com for a scoped assessment.
A common assumption: one offshore registration covers global operations
A common assumption among early-stage operators is that a single offshore VASP registration – BVI, Cayman, or a similar jurisdiction – provides sufficient regulatory cover for a business serving clients worldwide. It does not, and the consequences of operating on that assumption have become materially more serious as regulators in the EU, UAE, Singapore and Hong Kong have each increased their supervisory activity and their cross-border reach.
The offshore registration demonstrates compliance with that jurisdiction's AML and VASP framework. It does not confer authorisation to solicit or serve retail users in regulated markets. It does not satisfy the licensing requirements that institutional banking partners, payment processors and regulated-fund counterparties now apply as a baseline condition of engagement. And it does not insulate the business from enforcement action by a foreign regulator asserting jurisdiction on the basis of the business's connection to its territory.
The practical implication is that operators who built on an offshore-only structure and are now encountering banking and counterparty friction should assess whether the structural fix is an additional onshore authorisation, a re-domiciliation of the operating entity, or a restructuring of the service perimeter to match the registration they hold. Each path has different cost and timeline profiles. The analysis starts with a clear mapping of what the current registration actually covers – and what it does not.
When to engage counsel – and what the engagement looks like
The optimal point to engage counsel on the offshore/onshore question is before the entity is incorporated and before the banking relationships are established. Re-engineering a structure that has been built around the wrong licensing assumption is possible but expensive. The variables that need to be fixed – corporate domicile, director and officer residency, substance requirements, AML infrastructure, customer agreements – are substantially harder to change once a live business depends on them.
The engagement starts with a licensing perimeter analysis: mapping the activity set, the user geography, the banking tier and the counterparty profile against the applicable regimes. That analysis identifies which authorisations are required, which are optional but commercially useful, and which registrations can be deferred to a later growth stage. It produces a licence stack – not a single jurisdiction recommendation – that maps the operating, custody and payment layers separately.
In our cross-border practice, we map that stack across the applicable regimes, engage allied counsel in the relevant jurisdiction where local-law advice is required, and coordinate the application process across multiple timelines. The output is a structure that can actually be banked, that satisfies institutional due diligence and that holds up to the regulatory scrutiny that any scaling digital-asset business will eventually face.
We regularly advise operators who come to us after an initial structure produced unexpected regulatory friction – a banking relationship that could not be opened, an institutional LP that declined to invest, a payment processor that required a licence the operator did not hold. In each case, the solution begins with an honest analysis of the gap between the current structure and the structure the business actually needs.
Related at OBOLUS
- Licensing & Registration for Digital-Asset Businesses – the full scope of OBOLUS licensing advisory across 70+ jurisdictions
- Licence Renewal and Variation in Abu Dhabi Global Market (ADGM) – managing ongoing authorisation obligations under the FSRA regime
- Sanctions Screening for Crypto: Where the Legal Lines Are Drawn – compliance obligations that sit across every licensing structure
FAQ
How long does a crypto licence take to obtain?
Timeline varies materially by jurisdiction and by the complexity of the applicant's model. Offshore registration frameworks – BVI, Cayman – typically process applications in a matter of weeks once the file is complete. Onshore authorisations – MiCA CASP, VARA, MAS DPT – are multi-month processes that depend on regulatory capacity, the completeness of the application and whether queries are raised. We advise clients to build realistic timelines into their commercial plan from the outset and to engage counsel before the application is submitted, not after a first query is received.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction. The right answer depends on your activity set, your user geography, your banking requirements and your counterparty profile. A retail exchange targeting EU users needs a MiCA CASP authorisation. An institutional OTC desk needs an onshore authorisation at a recognised hub. A crypto fund vehicle may rationally sit in Cayman with a separately licensed manager. The starting point is a licensing perimeter analysis, not a jurisdiction ranking. We map the full stack before recommending a structure.
Do I need a separate custody licence?
In most onshore regimes – MiCA, VARA, MAS, SFC – custody of digital assets is a discrete regulated activity requiring its own authorisation or at minimum a specific activity permission within a broader licence. The assumption that exchange authorisation automatically covers custody is a common structural error. Offshore registration frameworks are generally less prescriptive on this distinction, but institutional counterparties and banks apply their own due diligence standards that effectively require custody to be covered. Custody licensing should be assessed as a standalone layer in any licensing stack analysis.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise crypto exchanges, custodians, token issuers and funds on licensing across more than seventy jurisdictions, on disputes and on-chain asset recovery across more than twenty-five forums, and on the tax, banking and compliance that sit around them. We map the licence, banking and custody stack before you commit to a structure – not after the first regulatory or banking friction emerges. Digital assets are the whole of our practice. To discuss your licensing structure, contact info@oboluslaw.com or message us via t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in cross-border VASP authorisation strategy and the offshore/onshore structural trade-offs facing digital-asset operators at every stage of growth.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.