Operating a digital-asset business without the correct regulatory authorisation is not a calculated risk – it is a structural vulnerability. Enforcement actions, frozen banking rails and blocked payment processors can arrive before a business has time to respond. The British Virgin Islands has built one of the offshore world's most pragmatic frameworks for VASP registration (virtual asset service provider registration), combining a recognisable common-law foundation with a purpose-built licensing regime under the Virtual Asset Service Providers Act 2022. For founders and general counsel evaluating offshore domicile, this page maps the regime in full.
The BVI Financial Services Commission supervises virtual asset businesses under the VASP Act 2022. Businesses conducting virtual asset activities must register or obtain a licence before commencing operations. The regime is structured to attract compliant operators while imposing meaningful AML/CFT, substance and reporting obligations. Understanding where the BVI sits in a broader multi-jurisdiction stack – alongside an operating entity, a custody vehicle or a token issuer – is the analytical work that precedes any application.
The Regulator and the Legal Foundation
The BVI Financial Services Commission (FSC) administers the territory's financial-services regulatory regime, including supervision of virtual asset businesses under the applicable VASP provisions. The FSC is an independent statutory body with broad supervisory, investigative and enforcement authority. It operates within a well-developed common-law legal order, which is one of the BVI's core commercial attractions for international business structuring.
The Virtual Asset Service Providers Act 2022 introduced a dedicated registration and licensing framework for entities conducting virtual asset activities from or within the BVI. Prior to that Act, digital-asset businesses operating through BVI companies relied primarily on the territory's commercial flexibility without a tailored prudential overlay. The 2022 Act changed that. It aligned the BVI with FATF Recommendation 15 (the international standard requiring states to regulate virtual asset service providers) and with the broader international expectation that offshore jurisdictions bring their digital-asset sectors into a supervised perimeter.
For an inbound operator, the practical significance is straightforward: if your entity is incorporated in the BVI and carries on virtual asset business, the VASP Act applies. Ignorance of that threshold is not a defence the FSC accepts.
Which Activities Require Registration or a Licence?
The VASP Act distinguishes between two tiers of regulatory authorisation: registration for lower-risk activities and licensing for higher-risk or higher-volume operations. The precise activity classification determines which track applies, and a BVI counsel assessment of the business model should precede any submission to the FSC.
Activities that typically fall within the VASP Act's perimeter include exchange services (spot and derivatives), transfer services, custody and administration of virtual assets, participation in and provision of financial services related to token offerings, and brokerage. Each of these maps to a defined category under the applicable regime. Businesses that combine several activities may need to satisfy requirements across multiple categories – a structural reality that catches operators who assume a single registration covers every revenue line.
Critically, the trigger for regulation is the nature of the activity, not the legal form of the entity. A BVI-incorporated holding company that takes on exchange or transfer functions – even informally, through related-party arrangements – may fall within the supervised perimeter. We regularly advise clients who did not anticipate that their holding structure had crossed a regulatory threshold, and the remediation path is materially more complex than getting the structure right at inception.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – how we map the full licence stack across jurisdictions before you commit
- Crypto Exchange Setup in Brazil – a comparison case study for exchange licensing in an emerging-market context
- Security Token Offering Structuring – token-offering analysis that intersects with BVI issuer structures
The process above describes the standard regulatory perimeter. Your facts – the entity type, the user base geography, the revenue model – change the analysis materially. For a scoped assessment of whether your BVI entity falls within the VASP Act's perimeter, contact OBOLUS at info@oboluslaw.com or map your options here.
How Does the BVI VASP Application Process Work?
The FSC application process follows a structured submission model: a completed application form, supporting corporate documentation, a detailed business plan, AML/CFT policies and procedures, fit-and-proper assessments of controllers and senior officers, and evidence of substance in the BVI. The FSC has discretion to request additional information at any point in the review process, and that discretion is exercised regularly.
The sequence is roughly as follows. First, the entity must be incorporated or registered in the BVI – the FSC does not accept applications from foreign entities seeking to passport in. Second, the business plan must accurately describe all virtual asset activities the entity will conduct, because scope creep after authorisation requires a variation application. Third, the fit-and-proper process scrutinises ultimate beneficial owners, directors and senior management. Financial crime history, regulatory sanctions in other jurisdictions and any history of insolvency are all assessed. Fourth, substance documentation must demonstrate that the entity has a genuine footprint in the BVI – not merely a registered agent address.
Timeline from submission to decision varies by the complexity of the application and the FSC's current workload. The FSC has published indicative processing windows, but in our experience operators should plan for a review period measured in months rather than weeks. Incomplete applications reset that clock. A well-prepared, complete submission is the single most effective way to reduce the timeline.
One practical element the FSC consistently scrutinises is the AML/CFT framework. The BVI aligns its supervisory expectations with FATF Recommendations, including the Travel Rule (the obligation to pass originator and beneficiary data with a virtual asset transfer). Applicants who submit AML policies that do not address Travel Rule compliance – or that address it only at the policy level without a credible technical implementation plan – are likely to receive a requisition rather than an approval.
What Are the Substance and Capital Requirements?
Substance and capital are the two areas where BVI VASP applicants most frequently underestimate the regime's expectations. Neither requirement is purely formal.
On substance: the BVI's approach reflects the international standard set by the EU and OECD economic-substance frameworks, adapted for its specific legal context. A VASP must demonstrate adequate physical presence, qualified personnel and genuine decision-making in the jurisdiction. The FSC does not prescribe a formula, but it applies a qualitative assessment. Entities where all genuine activity occurs offshore – and the BVI entity is a shell holding VASP registration for marketing purposes – do not satisfy the substance test. In our cross-border practice, we see this issue most acutely with groups that have an operating entity in one jurisdiction and attempt to run a VASP through a BVI holding company without staffing or infrastructure.
On capital: the VASP Act sets capital requirements that vary by licence category and by the volume and nature of activity. Specific thresholds are set by the FSC and are subject to revision; the applicable figures should be confirmed against current FSC guidance at the time of application. What is consistent across categories is the principle that capital must be unencumbered and verifiable. The FSC will scrutinise source-of-funds documentation for initial capital contributions.
Ongoing prudential requirements after authorisation include annual reporting, FSC notification of material changes (new activities, new controllers, new ownership), and audit obligations. The FSC's enforcement posture has become more assertive in recent years, reflecting global supervisory pressure on offshore financial centres to demonstrate effective oversight.
How Does BVI AML and the Travel Rule Apply to VASPs?
Every BVI VASP operates within a layered AML/CFT architecture. At the international level, FATF Recommendation 15 requires the BVI – as a member of the Caribbean FATF (CFATF) – to regulate VASPs and impose AML obligations consistent with the FATF standards. At the domestic level, the Anti-Money Laundering Regulations and associated guidance notes translate those obligations into operational requirements for BVI-registered VASPs.
The Travel Rule (the obligation to pass originator and beneficiary data with a virtual asset transfer) applies to BVI VASPs. Implementation requires a compliant technical solution capable of exchanging the required data with counterpart VASPs in other jurisdictions. The challenge is practical as much as legal: a BVI VASP transacting with a counterpart in a jurisdiction that has not yet implemented the Travel Rule must manage the resulting data gap in a way the FSC considers adequate. Policy provisions alone do not satisfy that expectation.
Customer due diligence standards under the BVI regime require risk-based KYC for all clients, enhanced due diligence for high-risk relationships (including politically exposed persons and clients in high-risk jurisdictions), and ongoing transaction monitoring. The FSC expects these obligations to be embedded in operational systems, not merely documented in a policy manual that no one reads.
In a recent instructive matter, a payments-adjacent business operating through a BVI entity was referred to us after the FSC issued a notice requiring remediation of its AML framework. The AML policy existed on paper but lacked the transaction-monitoring triggers and escalation procedures the FSC expected. We worked through a structured remediation plan that addressed the technical and procedural gaps, and the entity avoided enforcement proceedings. The lesson: AML compliance is an operational discipline, not a documentation exercise.
What Is the Tax Position for a BVI VASP?
The BVI imposes no corporate income tax, no capital gains tax and no withholding tax on dividends paid to shareholders outside the territory. This is one of the structural reasons the BVI is used as a holding and structuring jurisdiction for digital-asset businesses. However, the tax position of the BVI entity is only part of the picture.
The more important tax analysis concerns the jurisdictions where economic substance is actually located – where the operating team works, where servers are, where clients are, and where profit is realised. A BVI entity that is tax-neutral domestically may still generate taxable income in a founder's home jurisdiction (through controlled-foreign-company rules), in the jurisdiction where the operating platform is run (through permanent establishment principles), or in the jurisdiction where users are located (through digital services or similar taxes). The cross-border tax analysis is not resolved by incorporating in the BVI.
Lydia Brennan, our Tax and Structuring Analyst, regularly advises on structuring the BVI layer within a broader group in a way that is coherent across corporate tax, VAT/GST, and founder-level income tax. The BVI can be an effective holding jurisdiction; it works best when the substance, the licensing and the tax analysis are designed as an integrated stack, not assembled piecemeal.
If a prior structure did not account for controlled-foreign-company rules or economic substance expectations, a second read can identify the exposure and map the restructuring options. Write to us at info@oboluslaw.com or map your options here.
Who Should Consider the BVI for Crypto Licensing?
The BVI is not the right answer for every digital-asset business, but it suits a defined set of operator profiles well. Understanding which profile you occupy is the prerequisite for a defensible jurisdictional decision.
Profile A – The offshore holding layer: A group with an operating exchange or custody business in a regulated hub (Singapore, Dubai, the EU) that needs a clean offshore holding entity for investment and structuring purposes. The BVI entity holds equity in the operating subsidiaries, does not itself conduct VASP activities, and falls outside the VASP Act's perimeter. This is the most common use case. The legal risk here is inadvertent scope creep – the holding entity must be watched for activity that crosses the regulated threshold.
Profile B – The fund or DAO treasury vehicle: A digital-asset fund or decentralised-organisation treasury that is structured in the BVI and whose manager needs VASP registration to conduct the relevant investment or transfer activities. The BVI's fund law and its VASP regime can be layered together, but the interaction requires careful mapping. Timeline for a combined fund-registration and VASP-authorisation process is typically measured in months.
Profile C – The token issuer: A project issuing tokens from a BVI entity. Whether the issuance requires VASP registration depends on whether the issuer conducts post-issuance services – exchanges, transfers, custody – or merely issues into the market and steps back. Issuers who engage in secondary market activity through the same BVI entity will need to assess registration. The cross-border question here is acute: the issuer's BVI registration does not authorise the tokens to be offered to retail investors in jurisdictions with their own financial promotion or token-offer regimes.
Profile D – The standalone offshore VASP: A business that genuinely intends to operate a virtual asset exchange, broker or transfer service from the BVI, serving an international client base. This profile carries the heaviest regulatory expectations: full VASP licensing, substance, AML, Travel Rule compliance and ongoing FSC engagement. It also carries the greatest risk if the offshore registration is not matched by equivalent regulatory coverage in the jurisdictions where clients are actually located. A single BVI licence does not authorise the business to serve clients in the EU, Singapore or the United States.
That last point is the most common misconception we encounter. A common assumption is that a BVI VASP registration provides a global operating licence. It does not. The BVI authorisation permits the business to operate from the BVI, subject to FSC supervision. Each jurisdiction where clients are served may independently require its own regulatory authorisation – whether under MiCA for the EU, under the Payment Services Act for Singapore, or under applicable state and federal law in the United States. The cross-border compliance stack must be built jurisdiction by jurisdiction.
How Does the BVI Compare to Competing Offshore Jurisdictions?
The BVI sits in a competitive field. The Cayman Islands, Mauritius, the AIFC in Kazakhstan and, for EU-passportable licensing, EU member states such as Lithuania and Malta, all compete for the same class of digital-asset business. The analytical question is not which jurisdiction is "best" in the abstract, but which jurisdiction is best for a specific business profile.
Against the Cayman Islands: both jurisdictions operate common-law regimes with no direct corporate tax. The Cayman's VASP regime under its own Virtual Asset Service Providers Act is comparable in structure. The Cayman has a stronger established reputation in fund structuring, which may be relevant for digital-asset funds. The BVI has a larger volume of corporate entities and is often marginally faster and less expensive for pure holding-company work. Neither jurisdiction offers EU market access.
Against Lithuania and Malta: EU-based CASP authorisation (under MiCA, the Markets in Crypto-Assets Regulation) provides passporting across the EU/EEA. That is a decisive advantage for businesses whose client base is primarily European. The BVI offers no passporting equivalent. A business choosing the BVI over Lithuania or Malta is choosing offshore flexibility over EU market access. These are not interchangeable.
Against the AIFC: the Astana Financial Services Authority (AFSA) within the AIFC offers a common-law regime, a dedicated digital-asset framework and access to Central Asian markets. For businesses with a Middle Eastern or Central Asian focus, the AIFC is a credible alternative. For businesses needing international investor recognition and banking access, the BVI's established reputation may be preferable.
In our practice, the most effective approach is not to treat jurisdiction selection as a binary choice. Many well-structured digital-asset groups operate a BVI holding entity alongside one or more regulated operating subsidiaries in EU or Gulf jurisdictions. The BVI layer handles equity structuring, IP holding and investor relations; the regulated subsidiary handles the licensed VASP activity. That stack requires both the BVI counsel work and the operating-jurisdiction licensing work to be coordinated from the outset.
FAQ
How long does a crypto licence take to obtain?
Timeline varies by jurisdiction and by the complexity of the application. In the BVI, operators should plan for a review period measured in months from submission of a complete application. Incomplete submissions – missing fit-and-proper documentation, inadequate AML policies or absent substance evidence – extend that timeline materially. In other major hubs, timelines range from a matter of weeks (for some registration regimes) to over a year (for full licensing in highly scrutinised markets). The most reliable accelerant is a complete, well-structured application prepared with regulatory counsel before submission.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction turns on where your clients are, what activities you conduct, what banking you need, and what your investor base expects. A BVI registration suits offshore holding structures and certain fund vehicles. EU authorisation under MiCA suits businesses serving European retail or institutional clients. Singapore's Payment Services Act suits businesses with an Asia-Pacific focus. We map the licence, banking and tax stack across your specific operating profile before advising on a jurisdictional choice – the decision should follow the analysis, not precede it.
Do I need a separate custody licence?
In most regulated jurisdictions, custody of virtual assets is a regulated activity that requires its own authorisation or a specific endorsement of an existing licence. In the BVI, custody falls within the VASP Act's perimeter and must be covered by the entity's registration or licence. A business that combines exchange and custody functions must ensure both activities are within scope of its authorisation. Offering custody through an entity whose authorisation does not cover it is a regulatory breach, regardless of whether clients are aware of the distinction.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – and where a prior application has stalled or a banking relationship has closed, we identify the structural reason and map the route forward. We also work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
To pressure-test your BVI structure or map the full licence and tax stack before you commit, write to us at info@oboluslaw.com or map your options here.
By Aisha Tan, Licensing and Jurisdictions Analyst – specialising in offshore and multi-hub VASP licensing structures across the BVI, Cayman, AIFC and Gulf jurisdictions.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.