Economic Substance for Licensed VASPs in Czech Republic

A virtual asset service provider (VASP) that registers in the Czech Republic to access the European Union's regulatory environment gains more than a stamp of approval. It assumes a continuing obligation to maintain genuine economic substance inside the jurisdiction – real people, real decisions, real accountability to the Czech National Bank (ČNB) and, increasingly, to the European Banking Authority as MiCA supervision matures. Operators who treat substance as a filing formality, rather than an operational reality, expose themselves to enforcement, loss of authorisation and, critically, the collapse of the EU-facing banking relationships that make the licence commercially valuable in the first place.

As the MiCA (Markets in Crypto-Assets Regulation) regime converges national VASP regimes across the EU, the Czech Republic's position is consolidating around a single coherent framework: CASP authorisation under MiCA, supervised at the national level by the ČNB. Substance requirements flow directly from the CASP regime and from the ČNB's broader expectations of locally authorised financial entities. This page sets out what substance means in practice for a VASP in the Czech Republic, how to build and document it correctly, and where the cross-border interaction with tax and banking creates additional obligations.

What Is Economic Substance, and Why Does It Matter for Czech-Registered VASPs?

Economic substance, in the context of a Czech VASP, means that the licensed entity genuinely conducts its regulated activities from within the Czech Republic – not that a nominal office address appears in the application. The ČNB assesses substance at the point of authorisation and on an ongoing supervisory basis under the applicable CASP provisions of MiCA.

In our cross-border licensing practice, we regularly advise operators who underestimate the gap between a registered address and the substance threshold the regulator actually requires. That gap matters for two reasons. First, it determines whether the ČNB grants and retains the authorisation. Second, it determines whether EU banking counterparties – correspondent banks, payment institutions, card networks – will maintain accounts for the entity. Banks conducting their own due diligence increasingly require evidence of operational reality, not just a regulatory certificate.

Substance is not binary. It sits on a spectrum anchored by the scale and complexity of the VASP's activities. A custody-only operation presents a different substance picture from an exchange running a full order book. The ČNB's assessment reflects that difference, but the minimum threshold is higher than many inbound operators expect.

What Does the ČNB Require in Practice?

The ČNB expects a Czech-authorised VASP to demonstrate genuine management presence, operational decision-making and compliance oversight within Czech territory. The following elements are consistently assessed, drawing on the applicable CASP authorisation provisions and the ČNB's supervisory practice.

Senior management location. At least one director or senior manager with decision-making authority must be present in the Czech Republic on a regular, demonstrable basis. Remote or travelling management arrangements that leave Czech operations effectively governed from another country will not satisfy the regulator. In our practice, we have seen applications stall where the CEO is based in a third country and no local officer holds meaningful authority.

Compliance and AML function. The Travel Rule (the obligation to pass originator and beneficiary data with a virtual-asset transfer) and broader AML/CFT obligations under the applicable Czech AML legislation require a locally accountable compliance officer. That officer must be reachable by the ČNB and must have the authority – and the information – to act. Outsourcing the function to a third-country provider without a local principal does not meet the standard.

Registered office and operational presence. The registered address must correspond to premises where the business can genuinely be supervised. A serviced office used only for mail will fail a site visit. The ČNB conducts on-site inspections of authorised entities, and the premises standard is taken seriously.

IT and data infrastructure. Systems used to provide regulated services – order management, custody, wallet infrastructure, transaction monitoring – must be subject to Czech and EU-level oversight. Where cloud infrastructure is used, the vendor must be subject to arrangements consistent with applicable regulatory expectations on outsourcing and data sovereignty.

Segregation of client assets. Where custody is provided, Czech-authorised entities must demonstrate that client asset segregation is implemented and auditable from within the jurisdiction. This is both a substance indicator and a standalone regulatory obligation under the CASP regime.

CTA #1: The requirements above describe the structural path. Your entity's profile – the number of officers you can locate in Prague, the complexity of your technology stack, the geography of your user base – changes the analysis materially. Map your options with a scoped assessment from the OBOLUS licensing team at info@oboluslaw.com.

How Does MiCA Change the Czech VASP Substance Picture?

MiCA's CASP authorisation regime raises the substance bar relative to the predecessor Czech VASP registration, because the authorisation now carries EU-wide passporting rights – and with those rights comes heightened supervisory scrutiny from both the ČNB and, for larger entities, ESMA. The MiCA transition is the single most important structural shift affecting Czech-registered digital-asset businesses in the current cycle.

Under the prior registration regime, the Czech Republic was attractive partly because the entry threshold was comparatively accessible. That threshold is rising. The MiCA CASP authorisation requires the entity to demonstrate capital adequacy, governance arrangements, conflict-of-interest management and substance – all to a standard materially higher than simple registration. Operators who obtained a Czech VASP registration during the transitional window must either upgrade to full CASP authorisation or cease carrying on regulated activities in the EU.

The passporting benefit is real. A CASP authorised by the ČNB may provide services across all EU and EEA member states without a separate local authorisation in each country. That benefit is the commercial rationale for the Czech route for many operators. It is also the reason the ČNB will apply substance scrutiny rigorously – it is effectively the home-state supervisor for EU-wide activity.

ESMA plays a coordination and convergence role. Where the ČNB's supervisory approach diverges materially from EBA or ESMA guidance, pressure to converge upward is applied. Operators relying on Czech registration as a low-cost EU gateway should model the supervisory environment as converging toward the EU-average standard, not remaining at its current level.

How Does Substance Interact with Tax Positioning and Banking?

Czech substance carries tax-residency implications that operators must model before they commit to the structure. A Czech-authorised VASP with genuine management and control in the Czech Republic will, in the ordinary analysis, be a Czech tax resident subject to Czech corporate income tax on its worldwide profits. That outcome is not automatically disadvantageous – the Czech Republic is a competitive EU jurisdiction on corporate tax – but it must be planned deliberately rather than discovered after the fact.

The more dangerous scenario is the hybrid: a Czech-registered VASP that claims, for tax purposes, to be managed and controlled from a lower-tax jurisdiction. Regulators and tax authorities in both countries may treat the arrangement differently. The ČNB may view management as Czech; the foreign tax authority may view it as absent. The result is regulatory exposure in the Czech Republic and potential double-taxation disputes elsewhere.

Banking is the practical chokepoint. Czech-licensed VASPs have access to the EU banking market in principle, but banking relationships for crypto entities require the same substance evidence that the ČNB requires. Payment banks and correspondent institutions conducting know-your-customer and AML checks on a VASP counterparty will look for the same indicators: local officers, auditable compliance function, real operations. An entity that passes the ČNB's substance test is substantially better positioned to open and maintain banking relationships than one that cannot.

In our practice, we have seen operators spend months on licence applications only to find that no EU bank will open an account because the entity lacks demonstrable local operations. Building substance correctly from the outset – not as a box-ticking exercise but as a genuine operational structure – is the prerequisite for the banking access that makes the licence commercially viable.

A Practical Illustration: Substance Gaps Identified Before Submission

In a recent licensing engagement, a payments technology group sought ČNB authorisation for a Czech entity that was intended to be the group's EU operating vehicle. The entity had a registered Prague address and a locally appointed director, but the director lacked meaningful authority: all operational and compliance decisions were routed to the group's third-country headquarters. We identified the substance gap during pre-submission diligence, restructured the authority and responsibility matrix, relocated the compliance function to Prague with a Czech-resident officer holding real authority, and documented the arrangement consistently for both ČNB submission and group tax purposes. The authorisation process proceeded without a formal information request on the substance point – which, without the prior restructuring, would have been the first line of the regulator's questions.

Which Operator Profile Should Choose the Czech VASP Route?

Not every operator seeking EU market access should route through the Czech Republic. The right answer depends on the operator's existing footprint, governance capacity and the activities it intends to carry on.

Profile A – EU-market-entry operator, no existing EU presence. An exchange or custody business based outside the EU, seeking EU CASP authorisation for the first time, can treat the Czech Republic as a viable home-state regulator. The ČNB is experienced with digital-asset supervision and the MiCA framework is well-implemented. The operator must commit to genuine local substance: at least one senior officer in Prague, a local compliance function, and operational infrastructure subject to Czech oversight. Timeline to authorisation is a matter that depends on application completeness and the regulator's queue; describe it as a process measured in months rather than weeks. Key risk: underestimating the ongoing substance maintenance cost.

Profile B – Transitional Czech VASP registrant. A business already holding a Czech VASP registration must assess whether it can meet the higher CASP authorisation standard before the transitional window closes. Where substance was minimal under the old regime – a registered address and a nominal director – the gap to CASP authorisation is significant. Key risk: missing the transition deadline without a compliant authorised structure in place, which removes EU market access entirely.

Profile C – Multi-hub EU operator. A group that already has CASP authorisation in another EU member state is not required to obtain a separate Czech authorisation to serve Czech users. The passporting mechanism under MiCA handles this. A Czech entity makes sense in this profile only where there is a genuine business reason – local staff, a Czech banking relationship, a Czech institutional client base. Key risk: creating a Czech entity for cosmetic reasons and generating regulatory and tax obligations without corresponding benefit.

What Are the Most Common Substance Mistakes Czech VASPs Make?

Operators entering the Czech market repeat a recognisable set of errors. Knowing them in advance reduces the likelihood of a costly correction mid-application or, worse, post-authorisation.

The most common error is nominating a local director who holds the title but receives no information and exercises no authority. The ČNB assesses substance through interviews, document reviews and on-site inspections. A director who cannot answer basic questions about the entity's operations, compliance programme or risk framework will prompt a formal supervisory action – and will likely cause the entity's banking partners to re-evaluate the relationship simultaneously.

The second error is treating the compliance function as purely a documentation exercise. The AML/CFT (anti-money laundering and counter-terrorist financing) regime applicable to Czech VASPs – now reinforced by MiCA's CASP provisions and FATF Recommendation 15 on virtual assets – requires a compliance programme that actually functions: transaction monitoring that generates alerts, a Travel Rule implementation that transmits the required originator and beneficiary data, and a suspicious-transaction reporting process that is tested and documented.

The third error is inconsistency across the regulatory and tax filings. An entity that presents itself to the ČNB as fully managed from Prague, while presenting itself to a foreign tax authority as managed from elsewhere, creates a position that neither authority will accept. Consistency in the substance narrative – across regulatory filings, tax returns, banking KYC documentation and group intercompany agreements – is not optional.

A common assumption is that a single offshore VASP registration covers all EU client activity. It does not. MiCA makes clear that providing regulated crypto-asset services to EU clients requires either a CASP authorisation in an EU member state or a valid passporting notification from an authorised EU entity. Offshore structures without an EU authorised entity do not qualify for passporting. Operating EU-facing services from an offshore-only structure after the applicable MiCA deadlines exposes the business to enforcement by any EU national competent authority with jurisdiction over the affected clients.

CTA #2: If a prior Czech application stalled or a banking relationship was closed after an AML review, a fresh structural read can identify the root cause and the path back. Reach the OBOLUS licensing desk at info@oboluslaw.com or t.me/oboluslaw to discuss options. Map your options.

A Self-Assessment Checklist for Czech VASP Substance

Before submitting a CASP authorisation application to the ČNB, or before an annual substance review, operators should work through the following questions. A "no" or "uncertain" answer to any item signals a gap that needs to be addressed before the regulator identifies it first.

• Is at least one director or senior manager physically and regularly present in the Czech Republic, with documented decision-making authority over the entity's regulated activities?
• Does the compliance officer hold their role as a primary function – not as a part-time or third-country-outsourced arrangement – and can they be reached directly by the ČNB?
• Does the registered office correspond to premises where a supervisory inspection could be meaningfully conducted?
• Is the AML/CFT programme documented, tested and producing audit-trail evidence of operation – including Travel Rule transmissions and suspicious-transaction reports?
• Is the IT and custody infrastructure subject to oversight arrangements that the ČNB can assess, including any outsourced or cloud-based components?
• Is the substance narrative consistent across the regulatory application, the entity's tax position, banking KYC documentation and intercompany agreements within the group?
• Has the entity mapped which regulated activities it intends to carry on, and confirmed that each activity is covered by the scope of the authorisation sought?

An honest review of these questions – before the application, not during a supervisory visit – is the practical foundation of a defensible substance position.

Related at OBOLUS

• Licensing and registration for digital-asset businesses – the full scope of how OBOLUS maps the licence stack for exchanges, custodians and token issuers across operating jurisdictions.
• CASP authorisation under MiCA for regulated entities – the authorisation process, governance requirements and passporting mechanics for EU-market operators.
• Security token offering structuring in Panama – structuring considerations for issuers exploring non-EU routes alongside or instead of an EU authorised entity.

FAQ

How long does a crypto licence take to obtain?

The timeline for CASP authorisation under MiCA in the Czech Republic is measured in months rather than weeks. The ČNB's review process depends on application completeness, the complexity of the business model and the regulator's current supervisory queue. Operators who submit applications with well-documented substance, governance arrangements and AML programmes generally experience fewer information requests and shorter overall timelines. Building in adequate preparation time – before the submission, not after it – is the most effective way to manage the process.

Which jurisdiction is best for licensing my crypto business?

There is no universally correct answer. The right jurisdiction depends on your target users, the activities you intend to carry on, your governance capacity and your banking requirements. The Czech Republic offers EU CASP authorisation with passporting rights across the EU and EEA, which is commercially significant for operators serving European clients. Other EU member states, as well as hubs such as ADGM, VARA, MAS and the AIFC, suit different operator profiles. A structured assessment of the full licence, banking and tax stack is the starting point for any credible comparison.

Do I need a separate custody licence?

Under the MiCA CASP regime, custody and administration of crypto-assets on behalf of clients is a defined regulated activity. If your business provides custody – including holding private keys, managing wallets or administering tokens on behalf of third parties – you must ensure that activity is covered by the scope of your CASP authorisation. An authorisation that covers only exchange or brokerage activities will not cover custody. The Czech ČNB expects each regulated activity to be expressly within scope, and the substance and operational requirements for custody are assessed separately from those for trading or advisory activities.

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – because operating without the right structure risks enforcement, frozen rails and lost banking. To discuss your situation, contact info@oboluslaw.com.

By Aisha Tan, Licensing and Jurisdictions Analyst – specialising in EU CASP authorisation, MiCA transition strategies and inbound licensing assessments for digital-asset businesses across Central and Eastern Europe.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.