Operating a virtual asset service in Ireland without the correct registration exposes the business to enforcement action, account closure and the loss of banking relationships that took months to build. The Central Bank of Ireland, acting as the national anti-money laundering (AML) supervisor for virtual asset service providers (VASPs), has made clear that unregistered firms face both regulatory sanction and reputational harm in the EU market. This page maps the registration pathway, the cross-border considerations that most applicants underestimate, and the structural decision every inbound operator must make before committing capital to an Irish entity.
What is the legal basis for VASP registration in Ireland?
VASP registration in Ireland operates under the national transposition of the EU's Fifth Anti-Money Laundering Directive and the subsequent AML framework amendments that brought virtual asset service providers within the supervised perimeter. The Central Bank of Ireland is the designated competent authority for VASP registration under the applicable AML/CFT provisions. Registration is not a discretionary process: any entity providing covered VASP activities – exchange, transfer, custody, administration, or participation in token issuance – to Irish customers, or from an Irish-incorporated vehicle, must be registered before commencing those activities. The Central Bank applies a fitness and probity assessment to all proposed beneficial owners, directors and senior management, and it expects applicants to demonstrate AML/CFT systems, policies and controls that are proportionate to the business model. Operating without registration is a criminal offence under the relevant Irish criminal justice and money laundering legislation.
Ireland's position is notable for a second reason: it sits inside the European Union. MiCA (the Markets in Crypto-Assets Regulation, supervised at European level by ESMA and the national competent authorities) is now the dominant EU-wide regime for crypto-asset service providers. As MiCA's CASP authorisation requirements take full effect, the existing national AML-based VASP registration acts as a transitional reference point. Firms registered under the national regime must plan for a full CASP authorisation under MiCA to continue operating lawfully across the EU, including the Irish domestic market. That transition is not automatic. It requires a fresh authorisation process.
For any operator considering Ireland as a base, the strategic question is therefore not just "can we get registered?" but "what does full MiCA CASP authorisation add, and when do we need it?" We advise businesses on both the near-term registration and the medium-term MiCA pathway from the outset.
The process above describes the standard path. Your facts – the entity structure, the user base, the banking relationships and the services offered – change the analysis materially. For a scoped assessment of your situation, contact OBOLUS at info@oboluslaw.com.
Which businesses must register as a VASP in Ireland?
Any entity providing at least one of the FATF-defined VASP activities in or from Ireland falls within the Central Bank's registration requirement. The covered activities include exchanging virtual assets for fiat currencies or other virtual assets, transferring virtual assets on behalf of customers, providing custody or administration of virtual assets or instruments giving control over them, and participating in or providing financial services related to a token offering. The definition follows the FATF Recommendation 15 framework, which Ireland has implemented through its national AML/CFT legislation.
Foreign entities directing services at Irish residents are also exposed. A company incorporated in another jurisdiction but actively marketing to or onboarding Irish customers without an Irish registration may be operating in breach of the local regime. We regularly advise non-EU businesses on this point: the jurisdictional hook is the location of the customer, not merely the location of the entity. That exposure does not disappear because the operator is registered in a third country.
Certain activities sit at the margin. A software provider that never takes custody of customer assets and never executes transactions on behalf of clients occupies a different position from an exchange platform. A decentralised protocol with no identifiable service provider occupies a different position again. The Central Bank has not published exhaustive guidance on every edge case, so a legal opinion on whether a specific business model triggers registration is a prerequisite before launch – not an afterthought.
What does the VASP registration application involve?
The Central Bank's registration process is documentation-intensive and fitness-and-probity-focused, with no statutory guarantee of a fixed determination timeline. The application package typically includes a detailed business plan describing the services, the customer segments and the projected transaction volumes; an AML/CFT risk assessment specific to the business model and customer base; a full suite of AML/CFT policies and procedures, including a customer due diligence framework, a transaction monitoring policy, a suspicious transaction reporting procedure and a Travel Rule compliance protocol; and personal questionnaires and supporting materials for every person in scope of the fitness and probity assessment.
The Travel Rule (the obligation to pass originator and beneficiary identifying information with a virtual asset transfer, derived from FATF Recommendation 16 and now embedded in EU law through the Transfer of Funds Regulation as extended to crypto-asset transfers) deserves particular attention. The Central Bank expects applicants to demonstrate a credible technical solution for Travel Rule compliance at the point of registration, not as a future intention. For businesses without an existing solution, selecting and integrating a Travel Rule technology provider is a pre-application task.
In our practice, applications that arrive without a complete AML/CFT framework in place – policy documents, risk assessments, technology solutions – are returned or stalled at the pre-review stage. The Central Bank's review is substantive, not administrative. Gaps in the AML programme generate queries; each query round extends the overall timeline. Well-prepared applications move materially faster than incomplete ones. The practical timeline from submission to registration, where the application is complete, typically runs to a number of months, though the precise duration varies with case complexity and the regulator's workload. We do not state a fixed number of weeks because the Central Bank has not legislated one.
In a recent registration matter, a payments company incorporating in Ireland to serve European B2B clients submitted an initial application package that lacked a Travel Rule technology integration and had an incomplete sanctions-screening policy. We restructured the AML framework, sourced a compatible Travel Rule solution and resubmitted within eight weeks. The registration was granted in the following review cycle without further material queries.
How does MiCA change the picture for Irish VASPs?
MiCA's CASP authorisation regime represents a fundamental change in what it means to be a licensed crypto-asset business inside the EU. Under MiCA, a firm authorised as a CASP (crypto-asset service provider) in any EU member state may passport that authorisation across the entire EU and EEA, eliminating the need for entity-by-entity registration in each member state. Ireland, as an EU member state, is a valid CASP authorisation jurisdiction. An Irish CASP authorisation therefore carries EU-wide reach.
The MiCA regime introduces requirements that go beyond the current AML-focused VASP registration. Applicants must satisfy prudential capital requirements that vary by licence category, governance standards, conflict-of-interest policies, operational resilience obligations and, for certain token activities, reserve and redemption rules. The whitepaper disclosure obligations for crypto-asset issuers also apply. ESMA has published regulatory technical standards and guidelines that flesh out what competent authorities – including the Central Bank of Ireland – expect from authorisation applicants.
For businesses already registered under the national VASP regime, the transition to MiCA CASP authorisation is not a rollover. It is a full authorisation application, assessed against the MiCA standards. Planning for that application now – rather than at the point of the transitional deadline – is the operationally sound approach. The capital, governance and disclosure requirements take time to satisfy, and the Central Bank's review capacity is finite.
What are the cross-border tax and banking considerations?
An Irish VASP registration solves the regulatory question; it does not automatically solve the banking and tax questions that determine whether the business model is viable. These three layers interact, and operators who sequence them incorrectly often find that a registration is in hand but the business cannot operate.
On the banking side, Irish-incorporated VASPs face a market reality that is common across EU jurisdictions: domestic credit institutions are cautious about onboarding crypto businesses, and the willingness of a bank to provide accounts depends heavily on the quality of the applicant's AML/CFT framework, its beneficial ownership structure and the source of funds. A well-documented registration application is also, effectively, the bank's due diligence package. We have seen businesses obtain registration smoothly and then wait months for a banking relationship because the bank engagement was treated as a separate, subsequent process. The two processes should run in parallel.
On the tax side, Ireland offers a corporation tax environment that attracts holding and operating entities, though the applicable rate and reliefs depend on the nature and source of the income. Token classification matters for tax as much as for regulation: whether a token constitutes a financial instrument, a commodity or another asset class affects VAT treatment, gains characterisation and withholding obligations. Ireland has not published comprehensive bespoke guidance on the tax treatment of every token type, so a tax opinion forms part of the pre-launch workstream for most businesses. We map the licensing, banking and tax stack as a single mandate.
For businesses with an existing entity elsewhere – a BVI holding company, a UAE operating entity, a Singapore-domiciled fund – the Irish vehicle sits within that group structure. Transfer pricing, substance requirements and the interaction between the Irish tax residence rules and the group's existing structure require analysis before the Irish entity is incorporated. Incorporating first and asking these questions later is a sequencing error we see regularly in cross-border mandates.
If a prior application stalled, a banking relationship was refused, or a group structure was assembled without a full legal review, a second analysis can surface the structural issue and the route forward. Write to us at info@oboluslaw.com.
Which operator profiles benefit most from an Irish registration?
Ireland is a well-developed EU jurisdiction with a respected legal system, a common-law heritage, an English-language regulatory environment and a corporation tax position that matters to institutional operators. It is not the fastest EU entry point, nor does it carry the lower capital and fee profile of some other member states. The decision to base a VASP registration in Ireland should be driven by business logic, not by a general preference for the EU flag on the licence.
Profile A – the EU-passporting operator: A non-EU business seeking a single EU authorisation from which to passport across the EU and EEA, and which has genuine operational substance to deploy in an EU jurisdiction, is a viable Ireland candidate. The quality of the Central Bank's supervision and Ireland's standing within the EU regulatory community are relevant factors. The timeline and cost of the process are realistic constraints. Indicative planning timeline from entity incorporation to registration: several months, with MiCA CASP authorisation taking longer. Key risk: underestimating the AML/CFT documentation requirement and the Central Bank's substantive review.
Profile B – the EU-based operator with existing Irish substance: A business with existing Irish operations – staff, management, customers – has a natural rationale for an Irish VASP registration. The substance argument is credible, the regulatory engagement is in the home market, and the cross-border group structure is simplified. Timeline and risk profile are broadly similar to Profile A. Key risk: failing to plan the MiCA CASP transition alongside the initial registration.
Profile C – the operator primarily serving non-EU markets: A business whose customer base and revenue are predominantly outside the EU has less to gain from an Irish registration specifically. A BVI, Cayman or ADGM vehicle may serve that profile better, with an Irish or other EU entity added when EU market access becomes a material objective. We advise this profile to map the full jurisdiction stack before committing to Ireland as the primary licence base.
The common mistake across all profiles is treating the registration as a standalone project. The licence, the banking, the tax structure and the MiCA transition plan are one connected workstream.
A common assumption: one offshore licence covers everything
A common assumption among operators building cross-border digital-asset businesses is that a single registration in a permissive offshore jurisdiction is sufficient to serve customers worldwide, including in the EU. That assumption is incorrect in the current regulatory environment. Under MiCA and the national AML regimes that preceded it, EU member state regulators – including the Central Bank of Ireland – take the position that directing services at EU residents requires authorisation in or recognition by an EU regime, regardless of where the operator is incorporated. A BVI VASP registration does not confer the right to serve Irish or other EU customers from a regulatory standpoint.
The same logic applies in reverse: an Irish or other EU CASP authorisation does not automatically permit the operator to serve customers in Singapore, Hong Kong, the UAE or the United States. Each of those markets has its own licensing regime. MAS in Singapore, the SFC in Hong Kong and VARA in Dubai each require separate authorisation or exemption analysis. A multi-market operator needs a multi-jurisdiction licence stack, and the Irish registration is one layer of that stack – not the whole answer.
In our cross-border practice, the businesses that encounter enforcement exposure most often are those that expanded geographically without updating their licence stack to match. The cost of a proactive multi-jurisdiction analysis is a fraction of the cost of an enforcement response.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – how OBOLUS structures the full licence, banking and compliance workstream
- ADGM vs AIFC: where to license a crypto business – a comparative analysis of two leading non-EU licensing hubs
- NFT project legal structuring in South Korea – jurisdiction-specific structuring for token and NFT projects in a regulated Asian market
FAQ
How long does a crypto licence take to obtain?
Timeline varies significantly by jurisdiction, business model and the completeness of the application. In Ireland, a well-prepared VASP registration application takes a number of months from submission to decision; the Central Bank conducts a substantive review and each round of queries extends the process. Under MiCA, a full CASP authorisation is a more involved process than a prior national registration. Across other leading hubs – Singapore, the UAE, Hong Kong – timelines similarly range from a few months to well over a year depending on the licence category and the regulator's workload. A realistic timeline assessment requires scoping the specific application before committing to a launch date.
Which jurisdiction is best for licensing my crypto business?
There is no universally correct answer. The optimal jurisdiction depends on where the business's customers are, where its management sits, what activities it intends to carry out, and what banking and tax environment it needs. Ireland suits EU-passporting strategies and operators with genuine Irish substance. ADGM and VARA suit businesses targeting the Gulf and global institutional markets. Singapore and Hong Kong suit Asia-Pacific-focused operators. A business serving multiple markets typically needs a primary jurisdiction plus one or more secondary registrations. We map the full stack before recommending a structure.
Do I need a separate custody licence?
In most leading jurisdictions, custody of virtual assets is a regulated activity that requires specific authorisation – it is not automatically covered by an exchange or transfer licence. Under MiCA, custody and administration of crypto-assets on behalf of clients is a distinct CASP service category requiring explicit authorisation. Ireland, the UAE, Singapore and Hong Kong each treat custody as a separately assessed activity. Operators providing both trading and custody services must ensure their authorisation expressly covers both. Combining custody with other activities also raises capital adequacy and operational resilience obligations that a trading-only licence does not.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – and we structure licensing, banking and tax as one mandate rather than three disconnected workstreams. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialises in VASP and CASP authorisation pathways across EU and non-EU hubs, with a focus on structuring inbound licence strategies for non-EU operators entering regulated markets.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.