VASP licensing in Ireland is governed by the Central Bank of Ireland under the European Union's anti-money-laundering transposition framework, with the country now moving toward full CASP (crypto-asset service provider) authorisation under MiCA (Markets in Crypto-Assets Regulation). Any business operating as a VASP (virtual asset service provider) – exchanging, transferring, safeguarding or administering virtual assets for customers in or from Ireland – must register with, and receive approval from, the Central Bank before it begins. Operating without that approval exposes the business to enforcement action, loss of banking relationships and potential criminal liability for the firm's directors.
This page maps the regulated perimeter, the current registration path, the imminent MiCA transition, and the cross-border tax and banking considerations that an inbound operator needs to resolve before committing to Ireland as its base.
Who needs a VASP registration in Ireland?
The Central Bank of Ireland supervises VASP registration under the Irish transposition of the EU's AML directives, and any entity providing virtual-asset services from an Irish establishment – or marketing actively into Ireland from abroad – must assess whether it falls within the regime. The registration obligation applies to exchange services (crypto-to-fiat and crypto-to-crypto), transfer services, custody and administration of virtual assets, and participation in or provision of financial services related to token offerings. A business that touches any of those activities from an Irish-incorporated entity or branch is inside the perimeter.
The analysis is not purely entity-based. Substance governs over corporate form: a shell registered in Ireland that actually directs activity from a third country may still trigger Irish registration obligations, while a third-country firm marketing directly into Irish residents may trigger the regime without a local entity at all. We regularly advise clients whose initial structure assumptions do not survive this first-principles review.
Wallet software providers and pure technology vendors without custody or transfer functions typically sit outside the perimeter – but the line is not always self-evident. Token issuers whose instruments are not excluded under the MiCA "utility token" carve-out also face whitepaper and disclosure obligations that layer on top of the registration analysis.
How does MiCA change the Irish registration regime?
MiCA's CASP authorisation regime replaces the prior VASP registration track for most business lines, and Ireland's national competent authority – the Central Bank of Ireland – is the authorising body for CASP applicants domiciled in the state. The transition means that a business which obtained a VASP registration before MiCA's full application will need to migrate to CASP authorisation within the transition window set by the applicable provisions. The Central Bank has been clear that it expects applications to reflect MiCA's substance requirements, not merely the prior AML-registration form.
MiCA introduces activity-specific authorisation categories: advice on crypto-assets, portfolio management, exchange against fiat and other crypto-assets, execution of orders, placement, operation of a trading platform, transfer services, and custody. A business providing more than one activity needs authorisation covering each. The whitepaper obligation for tokens other than ARTs (asset-referenced tokens) and EMTs (e-money tokens) must also be satisfied before marketing begins.
The MiCA passporting mechanism is the single most commercially significant feature of Irish authorisation. A CASP authorised in Ireland may passport services across the EU and EEA without seeking additional authorisation in each member state – a material advantage for a business targeting the continental European market from a single regulated base. In our practice, the passport question is often what drives the decision to anchor in an EU hub at all.
To map how MiCA authorisation integrates with your specific licence stack, contact OBOLUS at info@oboluslaw.com. The process above describes the standard migration path. Your facts – the entity, the user base, the activity mix – change the analysis materially.
What does the Irish VASP and CASP application process involve?
Applicants for VASP registration and, under MiCA, CASP authorisation must satisfy the Central Bank of Ireland across several distinct assessment dimensions: the fitness and probity of controllers and senior managers, the adequacy of AML/CFT policies and procedures, the soundness of the business model and financial projections, and the technical and operational safeguards for asset protection and business continuity. Each dimension requires structured written evidence, not assertions.
The practical sequence runs broadly as follows. The applicant submits a complete application file to the Central Bank, including business plan, ownership structure and group chart, AML/CFT policy manuals aligned to the Irish transposition of FATF Recommendation 15 and the Travel Rule (the obligation to transmit originator and beneficiary data with virtual-asset transfers), individual questionnaires for proposed controllers and board members, and technical documentation covering system architecture and custody arrangements where applicable.
The Central Bank then conducts its assessment period. The timeline varies by application complexity and the quality of the initial submission – incomplete files restart the clock. In our experience, a well-prepared first submission materially shortens the review cycle; applicants who submit before their AML policies are genuinely ready generate prolonged dialogue and avoidable requests for information. The assessment is sequential: the Bank will typically not begin substantive review until the file is considered complete on its face.
Fitness and probity vetting covers the proposed chairman, directors and senior managers. Each individual must satisfy the Central Bank's standards independently. For group structures, the Bank also looks through to ultimate beneficial owners and requires comfort on the group's wider regulatory history in other jurisdictions.
What are the AML and Travel Rule obligations for an Irish VASP?
Ireland's AML regime for VASPs incorporates FATF standards in full, and the Central Bank scrutinises AML compliance with the same intensity it applies to regulated financial firms. A VASP registered or authorised in Ireland must maintain a dedicated AML compliance officer, conduct customer due diligence at onboarding and at trigger thresholds, apply enhanced due diligence to higher-risk relationships, and report suspicious transactions to the Financial Intelligence Unit.
The Travel Rule applies to virtual-asset transfers above the applicable de-minimis threshold, requiring the originating institution to pass originator and beneficiary data to the receiving institution. The precise threshold is set by applicable Irish and EU provisions; we write it qualitatively because the operative figure must be verified against current legislation at the time of application. What is clear is that the Travel Rule infrastructure – technical capability, policy, counterparty agreements – must be operational before the business goes live, not after.
For cross-border transfers involving non-EU counterparties, the VASP must assess whether the receiving institution is itself subject to equivalent AML supervision. Where it is not, enhanced due diligence applies. This counterparty-mapping obligation is often underestimated by inbound applicants who assume their existing global compliance manual will transfer without adaptation.
How do tax and banking interact with an Irish VASP structure?
Ireland's corporate tax regime is a significant structural consideration for inbound operators, and the interaction between the VASP registration and the entity's tax residency must be resolved early. An Irish-incorporated and managed CASP benefits from the Irish corporate rate on profits sourced from its licensed activities. However, the tax position turns on substance: genuine management and control must sit in Ireland, which means resident directors with real decision-making authority, not nominal appointments.
For token issuers, the VAT treatment of token-related services in Ireland follows EU VAT principles. Whether a token transfer or exchange service attracts VAT, and at what rate, depends on the characterisation of the service – a question that is not resolved by the crypto label alone. We advise clients to obtain a specific tax position on their service model before launch, because an incorrect VAT assumption embedded in the product pricing is difficult and expensive to correct retrospectively.
Banking is the most practically difficult element of the Irish VASP build. Irish domestic banks have historically applied elevated scrutiny to crypto-related business, and several EU-passported payment institutions that have taken on VASP clients have themselves faced derisking pressure from their correspondent networks. The viable banking solution for most Irish-domiciled VASPs is a combination of an EU EMI (electronic money institution) as the primary payment rail and a backup arrangement through a jurisdiction with more established VASP-banking infrastructure. We regularly map this two-layer approach for clients before they commit to the Irish structure, because a licence without a banking solution is inoperable.
To map the licence, banking and tax stack for your Irish build, write to OBOLUS at info@oboluslaw.com. If a prior application stalled or an account was closed, a second review can identify the structural reason and the route to resolution.
What should an inbound operator weigh before choosing Ireland?
Ireland offers a credible EU CASP authorisation with full MiCA passporting rights, an established common-law legal system, a corporate tax environment that rewards genuine substance, and a Central Bank with a structured – if demanding – assessment process. Those are genuine advantages. But the decision is not one-dimensional, and for some operator profiles a different EU hub is the more efficient path.
An operator focused on speed to market faces a real tension. The Central Bank of Ireland expects a high-quality submission and will not shortcut the AML and fitness assessment. Operators with complex group structures, a history of regulatory dialogue in other jurisdictions, or novel business models face longer review cycles. For those operators, a hub with a more streamlined initial registration process – while still providing EU passporting – may serve the commercial timeline better.
An operator building for long-term EU institutional distribution is better served by Irish authorisation, precisely because the Central Bank's standards are credible with institutional counterparties and EU national regulators. A licence from a hub perceived as a light-touch jurisdiction can generate secondary friction with institutional clients and banking counterparties even after authorisation is granted.
A useful decision frame, in prose rather than a table: Profile A – a funded exchange or custodian targeting EU institutional and professional clients, with a management team that can establish genuine Irish substance – should strongly consider Irish CASP authorisation as its primary EU anchor. The timeline is longer than some alternatives, but the resulting licence is durable and carries institutional credibility. Profile B – a startup without established substance, seeking the fastest possible EU passportable registration ahead of a funding round – may find that a faster EU registration route, with a plan to establish Irish substance post-authorisation, is the more pragmatic sequencing. Both profiles should resolve the banking question before, not after, they file.
In a recent engagement, a custodian building out an EU CASP structure approached us after an initial banking application stalled mid-way through the VASP registration process. We reviewed the entity structure, identified that the AML policy had not been adapted for the Irish supervisory template and that the proposed EMI banking partner had its own derisking constraints. We restructured the banking layer, revised the compliance documentation and resubmitted to the Central Bank; the registration was completed in the following review cycle. The client now operates as a registered VASP pending its MiCA transition application.
Is an existing offshore licence sufficient to serve Irish or EU clients?
A common assumption among inbound operators is that a single offshore VASP registration – from a BVI, Cayman, or even a non-EU jurisdiction with a credible crypto regime – is sufficient to serve clients anywhere, including Ireland and the wider EU. That assumption is incorrect, and acting on it is one of the more costly mistakes we see in this practice area.
EU residents accessing a VASP's services trigger EU regulatory analysis regardless of where the VASP is incorporated. Under MiCA, an entity providing crypto-asset services to EU clients without CASP authorisation risks enforcement action by any national competent authority in the relevant member states – including the Central Bank of Ireland. The reverse solicitation exemption under MiCA is narrow and fact-specific; it cannot be used as a structural solution for systematic EU market access.
Offshore structures remain useful for specific purposes: fund vehicle domiciliation, token issuance vehicles in jurisdictions with a defined legal status for tokens, and treasury management. They do not substitute for EU authorisation where the business model involves ongoing service to EU clients. We map the licence stack across operating, custody and payment layers before clients commit, precisely because the interaction between an offshore holding structure and the EU regulatory perimeter is where the most avoidable enforcement risk concentrates.
Self-assessment: before you apply for Irish VASP or CASP authorisation
The following questions surface the structural issues that most commonly delay or derail an Irish application. Answering them before submission – rather than during the Central Bank's review – materially improves the process.
- Does the entity genuinely conduct its business from Ireland, with resident directors holding real decision-making authority and regular board meetings held in-country?
- Has each proposed controller, director and senior manager completed an individual fitness and probity assessment, and have any past regulatory interactions in other jurisdictions been identified and documented?
- Is the AML/CFT policy manual tailored to the Central Bank of Ireland's supervisory expectations, the Irish transposition of the relevant AML provisions, and the Travel Rule obligations applicable to the business's transfer activities?
- Has a dedicated AML compliance officer been appointed with appropriate seniority and independence from commercial functions?
- Has the business obtained a tax opinion on the Irish corporate tax position, VAT treatment and the substance requirements for treaty access?
- Has a banking solution – primary and backup – been identified and provisionally engaged before the application is filed?
- For MiCA applicants: has each activity requiring CASP authorisation been identified, and has the whitepaper obligation been assessed for any tokens the business issues or facilitates?
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – end-to-end VASP and CASP licensing advisory across 70+ jurisdictions
- VASP Licence Application in the Czech Republic – comparative EU licensing path for operators weighing alternative hub options
- On-Chain Asset Tracing in the Czech Republic – forensic tracing and disclosure strategies in a CEE common-law adjacent forum
FAQ
How long does a crypto licence take to obtain?
The timeline for a VASP registration or CASP authorisation in Ireland varies by application quality, business model complexity and the volume of applications before the Central Bank at any given time. A complete, well-prepared submission shortens the process materially. Applicants with complex group structures, novel business models or incomplete compliance documentation should expect a longer review. We describe timelines as a range of weeks to several months because the operative figure depends on factors specific to each file.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction: the right choice depends on the operator's target market, substance capacity, commercial timeline and banking position. Ireland suits operators seeking a credible EU CASP authorisation with passporting rights and genuine institutional credibility. An operator needing faster EU market access with lower initial substance requirements may find a different EU hub more practical. We map the decision against each client's specific profile before recommending a structure.
Do I need a separate custody licence?
Under MiCA, custody and administration of crypto-assets is a distinct CASP activity requiring explicit authorisation. A business authorised only for exchange or transfer services that also holds client assets – even temporarily – is providing custody without authorisation. The activity-by-activity structure of MiCA means that adding a service line after initial authorisation requires a variation application. We assess the full activity perimeter at the outset to avoid mid-operation variation filings.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before clients commit – which means the structural risks surface before the application is filed, not during a regulator's review. Digital assets are the whole of our practice. To discuss your Irish VASP or CASP structure, contact info@oboluslaw.com or reach us via t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP and CASP authorisation across EU and offshore hubs, with a focus on Irish, Maltese and AIFC licensing structures for inbound operators.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.