Operating a virtual asset service provider (VASP) – any entity providing crypto exchange, transfer, custody or related services – from Ireland requires more than a registration stamp from the Central Bank of Ireland. Regulators, tax authorities and correspondent banks all ask the same foundational question: does the business genuinely exist in Ireland, or is it a letterbox? The answer turns on economic substance – the degree to which qualified staff, decision-making and operational infrastructure are physically present in the jurisdiction. Get this wrong and the licence becomes unenforceable as a commercial tool, tax residency shifts to an unintended jurisdiction, and banking relationships collapse.
Ireland's VASP regime sits within the EU's anti-money-laundering framework, administered by the Central Bank of Ireland. As the EU transitions toward full MiCA (Markets in Crypto-Assets Regulation) authorisation supervised by ESMA and national competent authorities, Irish-registered VASPs must manage both the current AML-registration layer and the incoming CASP authorisation standard. Substance requirements are embedded in both regimes, and the bar is rising. This page maps the regulatory basis, the practical substance threshold, the cross-border interaction with tax and banking, and the decision point for inbound operators.
What Is Economic Substance and Why Does It Matter for Irish VASPs?
Economic substance is the factual demonstration that a regulated entity conducts its core income-generating activities in the country where it is registered and claims tax residency. For Irish VASPs, substance is not a single checkbox – it is an ongoing condition of licence validity, tax residency and banking access. The Central Bank of Ireland expects to see qualified senior management present in Ireland, board decisions made in Ireland, and operational functions – compliance, AML monitoring, risk management – performed by staff who are physically and contractually based there. A VASP that incorporates in Dublin but runs its day-to-day operations from another country is vulnerable on every front simultaneously.
The FATF Recommendations – including Recommendation 15 on virtual assets – require that VASP supervision be linked to the jurisdiction where the business genuinely operates. Ireland's transposition of successive EU AML directives reflects that principle. When substance is thin, the Central Bank may question whether the registration is valid; the Irish Revenue Commissioners may challenge corporate tax residency; and correspondent banks may restrict payment rails pending a substance review. In our cross-border practice, we have seen businesses discover the gap only after a banking termination notice or a regulatory letter – by which point the cost of remediation is multiples of what an upfront substance plan would have required.
For a scoped assessment of your Irish VASP structure, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. Map your options.
The Regulatory Basis in Ireland
The Central Bank of Ireland is the competent authority for VASP registration under Ireland's current AML-driven regime, and it will be the national competent authority under MiCA for CASP authorisation. Ireland has implemented the applicable EU AML directives, and the Central Bank applies fitness-and-probity standards to senior management as a condition of registration. Those standards are substance-facing: an individual who is a director on paper but who does not actively manage the Irish entity will not satisfy the requirement.
Under the incoming MiCA regime, CASP authorisation replaces the prior AML-only registration for most categories of virtual-asset service. The CASP authorisation standard raises the threshold materially: applicants must demonstrate that the head office is located in the member state of authorisation, that senior management and at least two directors are resident there, and that sufficient own funds are maintained. Ireland's transposition of MiCA will align with ESMA's guidelines on governance, which treat substance as an authorisation condition rather than a post-registration aspiration.
The Travel Rule – the obligation under applicable AML provisions to pass originator and beneficiary data with a virtual-asset transfer – also has a substance dimension. Compliance with the Travel Rule requires a functioning compliance function capable of screening, matching and escalating data in near-real time. That function must be resourced in Ireland for an Irish VASP; outsourcing it entirely to a foreign affiliate risks the Central Bank treating it as a substance deficiency.
What Level of Substance Does the Central Bank of Ireland Expect?
The Central Bank's published expectations for regulated entities require that an authorised firm's principal place of business be in Ireland, that it have adequate human and financial resources to meet its obligations, and that key management functions not be fully delegated abroad. For a VASP, this translates into a minimum of: at least one Ireland-based individual with effective executive authority; a compliance officer and a money-laundering reporting officer (MLRO) who are accessible to the Central Bank and actually perform their functions; a board that meets in Ireland at meaningful frequency; and records maintained in Ireland or accessible from Ireland within a reasonable response window.
In our practice, the question we are asked most frequently is: how many people, in what roles, at what seniority? The honest answer is that the Central Bank does not publish a headcount formula. What it does articulate – and what it tests at registration and during supervisory review – is whether the Irish entity can demonstrate independent operational capacity. A single nominal director with no staff support does not meet that standard. An operation with two qualified full-time employees in Ireland, properly resourced compliance and a genuinely active board has a defensible substance position. The gap between those two points is where most enforcement risk lives.
How Does Substance Interact with Corporate Tax Residency in Ireland?
Ireland's corporate tax regime is a significant driver of inbound VASP licensing applications, but tax residency is not automatic upon incorporation. Under Irish and international tax rules, a company is treated as tax resident where it is managed and controlled – meaning where the directors make effective decisions. If directors are nominally appointed in Ireland but substantially all board decisions are taken by individuals in another country, the Irish Revenue Commissioners may conclude that the company is managed and controlled elsewhere, triggering tax residency in that other country.
For digital-asset businesses, the managed-and-controlled test has teeth. Token-related income, staking rewards, trading gains and custody fees are active income streams. Where those streams are generated depends partly on where decisions about the business are made. A VASP that cannot demonstrate Irish management and control risks both a challenge to its Irish tax residency and the loss of any benefit flowing from Ireland's corporate tax rate. The Irish Revenue Commissioners have shown increased attention to substance in financial-services contexts, and the digital-asset sector is not exempt from that scrutiny.
If a prior application stalled or a banking relationship was terminated, a second structural review can surface the substance gap and the route back. Write to info@oboluslaw.com or message us on Telegram. Map your options.
Cross-Border Substance: The Banking and Payments Dimension
Banking is the cross-border pressure point where substance deficiencies become immediately commercial. Irish and EU correspondent banks apply enhanced due diligence to VASP clients as a matter of policy. That due diligence consistently focuses on three substance proxies: where the VASP's management team is based, where its compliance function operates, and whether the entity has a demonstrable operational footprint in Ireland. A VASP that cannot answer those questions satisfactorily will find payment accounts closed or never opened.
The interaction between Ireland and the broader EU payment infrastructure adds a layer. An Irish-registered VASP seeking euro-denominated settlement rails must typically operate through an Irish or EU-regulated payment institution or bank. Those institutions run their own VASP-specific onboarding criteria, which often exceed the Central Bank's stated minimum. Operators we advise routinely encounter requests for organisational charts, employment contracts for Irish-based staff, office lease evidence and board minutes confirming decisions made in Ireland – all before a payment account is activated.
The MiCA passporting mechanism – under which a CASP authorised in one EU member state may passport across the EU and EEA – makes the Irish substance question even more consequential. If Ireland is chosen as the passporting hub, the strength of the Irish entity's substance position determines whether that passport is operationally credible across 30-plus markets. A thin Irish entity passporting into Germany, France or the Netherlands will face national-competent-authority scrutiny in those markets that goes directly to the Irish entity's substance. Getting the foundation right in Dublin protects the entire EU footprint.
What Are the Most Common Substance Mistakes Irish VASPs Make?
The most damaging substance errors we encounter in inbound mandates share a common structure: the founders understand that Ireland requires some presence, but they underestimate what "presence" means in practice.
The first error is the nominee-director structure. Appointing a professional director service as the Irish director, with no corresponding executive authority, does not create substance. The Central Bank's fitness-and-probity assessment will identify a director who cannot speak to the business's risk model or compliance framework. The result is a registration that is challenged or delayed, and a tax residency that is legally uncertain.
The second error is outsourcing the entire compliance and MLRO function to a third-party provider without retaining any in-house oversight. Outsourcing a compliance function is permissible in principle, but the Irish entity must retain the ability to oversee and direct that outsourced function. The individual designated as MLRO must be reachable by the Central Bank and must demonstrably perform substantive functions – not merely lend their name to a filing.
The third error is treating incorporation as the end of the substance exercise. Substance is a continuous condition. A VASP that builds a credible Irish operation at registration but then allows staff to relocate or functions to migrate to a parent entity abroad will erode its substance position over time. Annual supervisory reviews and banking-relationship renewals both probe whether substance has been maintained, not just established.
A Practical Illustration: Substance Remediation Before a Central Bank Review
In a recent licensing matter, a payments-adjacent crypto business had incorporated in Ireland and obtained a preliminary registration but had not built out its Irish team before a scheduled Central Bank supervisory engagement. The entity had a single director, no Ireland-based compliance staff and board minutes that reflected decisions made in a non-EU country. We were engaged in the weeks before the review. Working with the client, we structured a phased remediation: an Ireland-based compliance officer was retained and designated as MLRO, board governance was restructured so that at least a majority of board decisions were documented as made in Ireland, and a registered office with genuine operational access was secured. The Central Bank's engagement proceeded without a formal deficiency notice, and the banking onboarding – which had stalled pending the supervisory outcome – was completed shortly thereafter. The matter illustrated a point we see repeatedly: substance gaps are remediable, but the window to address them before regulatory consequence narrows quickly.
The Decision Matrix: Which Operator Profile Suits Ireland?
Ireland is not the right choice for every VASP. The decision to use Ireland as a licensing and substance hub should be driven by a clear profile match.
An operator whose primary market is the EU – and who intends to use MiCA passporting to serve EU retail or institutional clients – is a strong candidate for an Irish substance build. The combination of EU membership, a well-developed common-law legal tradition, an established financial-services regulatory environment and Ireland's position as a gateway jurisdiction for US-headquartered groups makes it operationally coherent. For that profile, the cost of building genuine Irish substance is justified by the passporting reach and the banking infrastructure available.
An operator whose user base is primarily outside the EU, and who does not need a MiCA passport, may find that the substance investment required for an Irish VASP registration exceeds the benefit. In that case, jurisdictions with lighter substance requirements – such as BVI under the VASP Act 2022 or the Cayman regime under CIMA – may produce a better cost-to-regulatory-output ratio, though they do not carry EU passporting rights.
An operator building a multi-jurisdictional stack – Irish entity for EU access, an offshore entity for non-EU activities, and a custody vehicle in a specialist custody jurisdiction – can use Ireland as one node in a structure rather than the sole platform. We regularly advise on structures of exactly this kind, mapping the licence, banking and tax implications of each layer before the client commits capital to the build.
A Common Assumption: One Offshore Licence Is Enough
A common assumption among early-stage operators is that a single offshore licence – obtained in a jurisdiction with minimal substance requirements – is sufficient to serve clients globally, including EU clients. That assumption is incorrect and increasingly costly to hold. MiCA specifically targets this structure: an entity that is not authorised as a CASP in an EU member state may not solicit or serve EU retail clients for virtual-asset services. Member-state competent authorities – including the Central Bank of Ireland – have enforcement powers against unauthorised cross-border provision of services.
The argument that a non-EU licence "covers" EU activities because the service is provided online has been progressively rejected by EU regulators and is explicitly addressed in MiCA's third-country provisions. For an operator with meaningful EU exposure, the choice is binary: either build a genuine EU-authorised entity with real substance, or exit the EU market. The cost of a substance-deficient Irish entity that attempts to blur this line is not just regulatory – it is reputational and banking-operational. Correspondent banks in Ireland and across the EU have become more precise in identifying entities that hold an EU registration without the operational reality to support it.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – end-to-end counsel on VASP and CASP licensing across 70+ jurisdictions
- VASP Licence Application in El Salvador – a jurisdiction-specific guide to El Salvador's VASP licensing process
- DeFi, Tokenization and Smart Contract Law – legal structuring for token issuance, DeFi protocols and smart-contract risk
FAQ
How long does a crypto licence take to obtain?
Timeline varies by jurisdiction and licence category. Under Ireland's current AML-registration regime, the Central Bank's review period has typically run to several months, though complex applications or substance deficiencies extend that window. Under MiCA, the CASP authorisation process is expected to take longer than a simple registration, given the expanded governance and own-funds review. Operators should plan for a minimum of several months from a complete application submission in any substantive jurisdiction, and should not begin commercial operations that require authorisation before the licence is confirmed.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction. The right choice turns on the business's target markets, product type, substance capacity and banking strategy. An EU-facing business with the capacity to build genuine Irish presence is well-served by Ireland's MiCA passporting access. A business focused on non-EU markets may find a cost-efficient fit in BVI, Cayman or another offshore regime. A multi-product business – exchange plus custody plus payments – may need a multi-jurisdictional stack. We map the full licence, banking and tax interaction before any client commits to a single jurisdiction.
Do I need a separate custody licence?
In most regulated jurisdictions, custody of virtual assets on behalf of third parties is a separately regulated activity that requires either a standalone custody authorisation or a specific licence category that includes custody. Under MiCA, custody and administration of crypto-assets on behalf of clients is a defined CASP service requiring authorisation. An exchange licence does not automatically cover custody. Operators who hold client assets – even as a component of an exchange or payments service – should obtain specific legal advice on whether their activities require a custody authorisation in each relevant jurisdiction.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit – identifying substance gaps, banking dependencies and cross-border authorisation requirements at the design stage, not after the first regulatory letter. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialist in inbound licensing strategy, VASP and CASP authorisation processes, and substance structuring for EU and cross-border digital-asset operators.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.