Operating a digital-asset business from Seychelles without the correct licence exposes the entity to enforcement action, collapsed banking relationships and – if the business touches European or GCC users – secondary regulatory consequences that no offshore structure fully deflects. Seychelles has positioned itself as an accessible entry point for virtual asset service providers (VASPs) – businesses that exchange, transfer, safeguard or administer digital assets on behalf of customers – but accessibility does not mean permissiveness. The regime carries real compliance obligations, and the gap between registering a Seychelles company and holding a valid VASP authorisation is wider than many operators expect.
Under the Virtual Asset Service Providers Act (the Seychelles VASP framework), any person carrying on a regulated virtual-asset activity from or within Seychelles must obtain authorisation from the Financial Services Authority of Seychelles (FSA). The FSA administers both licensing and ongoing supervision. For an inbound operator, the first question is not whether to use Seychelles, but whether the entity's intended activities fall within the regulated perimeter – and what a Seychelles authorisation does and does not cover once the business begins serving users in other jurisdictions.
This page maps the FSA's regulatory perimeter, explains who needs authorisation and in what form, addresses the cross-border reality that almost every Seychelles-licensed operator faces, and identifies the structural mistakes that most commonly stall applications or trigger post-authorisation problems.
The FSA and the Seychelles VASP Framework
The Financial Services Authority of Seychelles is the competent authority for virtual-asset regulation under the Seychelles VASP framework, which extended the FSA's existing non-bank financial services remit to cover digital-asset activities. The framework reflects the FATF Recommendation 15 standard – the international baseline requiring jurisdictions to license or register VASPs and impose anti-money-laundering obligations on them – and Seychelles has embedded AML/CFT requirements directly into the VASP authorisation regime.
The FSA operates a dual-track approach. Businesses carrying on lower-risk activities may be eligible for registration rather than a full licence; those carrying on higher-risk or higher-volume activities require a full VASP licence. The distinction matters operationally: a full licence imposes broader prudential and conduct obligations, but it also carries greater credibility with institutional counterparties and banking partners. In our practice, operators that arrive with a registration-track structure and then discover their banking partner requires a full licence face a material delay in going live.
Seychelles is not a member of the European Union and does not benefit from MiCA passporting, which means a Seychelles licence does not permit an operator to onboard EU-resident customers as of right. This is the single most important structural constraint an inbound operator must price in at the outset.
Which Activities Require Authorisation Under the Seychelles Regime?
Any business conducting a regulated virtual-asset activity from Seychelles – or marketing such services to persons in Seychelles – requires FSA authorisation before commencing operations. The regulated activities under the Seychelles VASP framework track the FATF VASP definition closely and include exchange between virtual assets and fiat currencies, exchange between one or more forms of virtual assets, transfer of virtual assets, safekeeping and administration of virtual assets or instruments enabling control over them, and participation in or provision of financial services related to a token offering.
The activity-based perimeter means that a business which only offers advisory services or technology infrastructure – without taking custody of client assets or executing transactions – may fall outside the VASP definition. However, the boundary is fact-specific. Regulators increasingly apply an economic substance analysis: if the business is functionally executing or facilitating transfers, the label "technology provider" does not alter the regulatory characterisation. We regularly advise clients on this boundary, and the safe assumption is always to seek a pre-application confirmation from the FSA rather than relying on a self-serving characterisation.
A common structural error is to incorporate a Seychelles holding company – widely used in digital-asset token issuance structures – and assume that the holding company itself requires VASP authorisation. A passive holding company that does not conduct regulated activities is generally outside the perimeter. The operating subsidiary that does conduct those activities is not.
The process above describes the standard perimeter analysis. Your facts – the entity, the activity, the user base, the banking – change the analysis materially. For a scoped assessment of whether your intended activities require FSA authorisation, contact OBOLUS at info@oboluslaw.com.
What Does the FSA Application Process Involve?
A Seychelles VASP authorisation application requires the FSA to be satisfied on several interlocking dimensions: the fitness and propriety of controllers and officers, the adequacy of the proposed AML/CFT programme, the soundness of governance and risk-management arrangements, and – for custody activities – the adequacy of safeguarding arrangements. These are substantive assessments, not box-ticking exercises.
The application package typically includes a detailed business plan covering the intended activities, target markets and projected transaction volumes; AML/CFT policies and procedures demonstrating compliance with the applicable FATF-aligned standards; a governance framework including the identity, experience and source-of-funds documentation for all controllers and beneficial owners; and, where custody is involved, a description of the technical safeguarding architecture. Timelines for FSA review vary by complexity and completeness of the submission; applications that arrive with gaps in the AML programme or incomplete UBO documentation are the most common cause of delay. In our experience, well-prepared submissions that address the FSA's known points of focus move materially faster than reactive submissions that amend after initial review.
The FSA also expects that the applicant has established – or will establish before going live – adequate operational substance in Seychelles. The degree of substance required is proportionate to the nature of the activities, but a pure brass-plate structure with no local director, no local compliance officer and no genuine decision-making in-jurisdiction is increasingly scrutinised. Operators we advise routinely structure at least a qualified local compliance function and a resident director with genuine authority before the application is filed.
AML, the Travel Rule, and Ongoing Supervisory Obligations
Seychelles-authorised VASPs are subject to AML/CFT obligations that align with the FATF framework, including the Travel Rule – the obligation to pass originator and beneficiary data with a virtual-asset transfer above the applicable threshold. The Travel Rule data threshold is set by the FSA in accordance with the FATF standard; the exact figure should be confirmed against current FSA guidance, as it is subject to revision.
Ongoing obligations include transaction monitoring, suspicious-activity reporting to the Financial Intelligence Unit of Seychelles (FIU), periodic risk assessments and record-keeping requirements calibrated to the FATF Recommendation 15 baseline. The FSA also exercises ongoing supervision rights, including the ability to request information, conduct on-site inspections and impose conditions on an authorisation. Failure to maintain compliance post-authorisation carries the same range of consequences as an unlicensed operator: licence suspension, revocation or referral to enforcement.
VASPs operating cross-border face a compounding obligation stack. A Seychelles-licensed operator serving users in Singapore, for example, must consider whether its activities bring it within the scope of the Monetary Authority of Singapore's Payment Services Act – the Singaporean digital payment token licensing regime – regardless of where the entity is incorporated. The principle that regulation follows the user, not the entity, is now embedded in every major licensing regime. This is not a hypothetical: we have seen operators build a structure around a single offshore authorisation, then discover that their primary user base is located in a jurisdiction that expects local registration or imposes restrictions on offshore providers.
Cross-Border Reality: What a Seychelles Licence Does Not Cover
A Seychelles VASP authorisation covers operations conducted from Seychelles and – to the extent the regime's territorial scope extends to marketing or provision of services to Seychelles-resident persons – activities directed at the local market. It does not, by itself, authorise the business to serve clients in the EU, the UK, the UAE, Singapore, Hong Kong or the United States.
For EU clients, a separate CASP (crypto-asset service provider) authorisation under MiCA – the EU's Markets in Crypto-Assets Regulation, supervised by national competent authorities coordinated by ESMA – is required for systematic onboarding of EU-resident users. For UAE clients, an operator must consider whether the Virtual Assets Regulatory Authority (VARA) in Dubai or the FSRA within ADGM in Abu Dhabi requires local authorisation. For UK users, the FCA cryptoasset registration under the Money Laundering Regulations is the minimum bar, with the financial promotions regime adding a further layer. Each of these regimes has its own substance, capital and conduct requirements.
This multi-layer reality drives the most consequential structuring decision an operator makes: whether to build a hub-and-spoke structure (a Seychelles entity for certain operational functions, with separately licensed entities in user-facing jurisdictions) or to concentrate licensing in a single MiCA-passport jurisdiction and use Seychelles for a holding or token-issuance function only. Neither approach is universally superior. The right answer depends on the operator's target markets, product mix, capital budget and banking relationships. We map this stack before clients commit to a jurisdiction.
If a prior application in another jurisdiction stalled or a banking relationship closed, a second structural read often surfaces the underlying issue and the path forward. Write to OBOLUS at info@oboluslaw.com to discuss your options.
How Does Seychelles Compare for an Inbound Operator?
Seychelles sits in a different tier from MiCA-passport jurisdictions such as Lithuania or Malta, or from the Gulf hubs with deep institutional ecosystems such as ADGM and DIFC. Its principal competitive advantages are cost of establishment, accessibility of the FSA authorisation process relative to some higher-capital regimes, and the established use of Seychelles corporate structures in digital-asset token issuance and fund formation. For an operator whose primary business is token issuance or whose user base is concentrated outside the major regulated markets, these advantages can be material.
Against those advantages, the operator must weigh two structural constraints. First, the absence of MiCA passporting means that EU market access requires a second licensing layer. Second, banking access for Seychelles-domiciled VASPs remains challenging: correspondent banking restrictions mean that a Seychelles-licensed entity often cannot open a traditional banking relationship in the EU, the UK or the United States without a local nexus in that banking jurisdiction. The banking problem is not unique to Seychelles – it affects offshore VASPs generally – but it is more acute here than in, say, Lithuania or Malta, where a MiCA-authorised entity can access SEPA clearing within the EU banking system.
The decision matrix, in broad terms, looks like this. An operator whose activities are primarily token issuance, fund administration or cross-border OTC services for non-EU, non-US sophisticated counterparties may find a Seychelles licence cost-effective and fit for purpose, provided banking is pre-arranged through a compliant third-country institution. An operator whose primary revenue comes from retail exchange services directed at EU, UK or UAE users needs a jurisdiction with a passportable or locally-recognised authorisation, and Seychelles will function at most as a supporting entity in that structure. A custodian serving institutional clients across multiple jurisdictions will almost certainly need a more capital-intensive regime – ADGM, Singapore under MAS, or a MiCA member state – with Seychelles in a sub-holding role, if at all.
In a recent structuring matter, an early-stage exchange operator incorporated in Seychelles and began onboarding users before completing its authorisation, assuming the registration process was a formality. The FSA's review identified gaps in the AML programme and raised substance questions. We assisted in rebuilding the compliance architecture and the substance arrangement, and the entity ultimately obtained its authorisation; the delay, however, cost several months of revenue and a banking relationship that the counterparty declined to hold open. The lesson is direct: authorisation first, operations second.
A Common Assumption: Why One Offshore Licence Is Not Enough
A common assumption among founders structuring a digital-asset business is that a single offshore authorisation – whether in Seychelles, the BVI or the Cayman Islands – is sufficient to serve clients globally, because the entity is incorporated offshore and is therefore outside the regulatory reach of user-facing jurisdictions. This assumption is incorrect and increasingly costly to hold.
The regulatory principle that has taken hold across every major market is that jurisdiction follows economic activity, not corporate domicile. An offshore entity that onboards EU retail clients is, in the eyes of MiCA and its national competent authorities, conducting regulated CASP activities in the EU. An offshore exchange that markets actively to UK users is, in the FCA's view, carrying on a regulated activity in the UK. The FCA has taken enforcement action against offshore operators for exactly this reason; ESMA and national competent authorities are calibrating their supervisory frameworks to reach the same result under MiCA.
The practical consequence is not that offshore structures are useless – they serve legitimate purposes in capital efficiency, tax optimisation and token issuance architecture – but that they must be built with accurate jurisdictional mapping. The offshore entity is one layer; the user-facing licensing is another; the banking and payment layer is a third. Operators we advise understand these three layers as separate problems that must each be solved, not as a single structure that one authorisation resolves.
Self-Assessment: Is Your Seychelles Structure Sound?
Before committing to a Seychelles domicile or filing an FSA application, operators should be able to answer the following questions affirmatively. First: does the intended activity fall within the FSA's regulated perimeter, and has that assessment been confirmed – not assumed? Second: is the entity's AML/CFT programme complete, documented and calibrated to the FATF Recommendation 15 standard? Third: does the entity have adequate operational substance in Seychelles – a resident compliance officer, a locally-empowered director and documented decision-making processes in-jurisdiction? Fourth: has the operator pre-arranged banking with a compliant institution that is willing to hold a Seychelles VASP account for the intended activity type? Fifth: has the operator mapped which other jurisdictions its target users sit in, and confirmed whether those jurisdictions require a local authorisation or impose restrictions on services provided by offshore entities?
A "no" or "not yet" on any of these questions is not a reason to abandon the structure. It is a reason to engage counsel before the application is filed rather than after the first regulatory query arrives.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – how we scope and execute VASP authorisation mandates across 70+ jurisdictions
- Crypto Regulation and Licensing in the UAE – VARA Dubai – the VARA regime for operators targeting the GCC market
- Airdrop Legal Structuring: What Recent Enforcement Tells Operators – structuring token distribution in light of enforcement trends
FAQ
How long does a crypto licence take to obtain?
Timelines vary significantly by jurisdiction and by the completeness of the application. In Seychelles, the FSA's review period depends on the complexity of the proposed activities and the quality of the submission. Well-prepared applications that address the FSA's core concerns – AML programme, governance and substance – move faster than incomplete submissions that require iterative clarification. Operators should plan for a process measured in weeks to several months, and build that window into their go-live timeline. We size the timeline at the scoping stage based on current FSA processing experience.
Which jurisdiction is best for licensing my crypto business?
There is no universally superior jurisdiction. The right choice depends on the operator's target user markets, activity type, capital budget and banking relationships. Seychelles suits certain offshore operational and issuance structures. MiCA-passport jurisdictions suit businesses targeting EU retail users. The UAE regimes suit operators targeting the GCC and institutional markets. A structuring analysis should map all three layers – operating licence, user-facing authorisation and banking – before a jurisdiction is selected. We conduct this analysis before clients commit.
Do I need a separate custody licence?
In most flagship regimes, custody of client virtual assets is a separately regulated activity or a distinct licence category within the VASP framework. In Seychelles, safekeeping and administration of virtual assets is a regulated activity under the VASP framework, and the FSA's authorisation process assesses the technical and operational safeguarding arrangements as part of the licence application. An operator that intends to hold client assets – even temporarily during transaction settlement – should assume custody regulation applies and structure the authorisation accordingly.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – and our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums when assets are at risk. To discuss your Seychelles structure or a cross-border licensing question, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP authorisation strategy and cross-border licence-stack mapping for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.