Digital-asset custody licensing in Jersey

Operating a digital-asset custody business in Jersey without the correct regulatory authorisation exposes the entity to enforcement action, collapsed banking relationships and, increasingly, the loss of institutional counterparties who now perform their own licence-stack due diligence before connecting. Jersey has developed a considered and proportionate regime for virtual asset service providers (VASPs) – businesses that hold, transfer or arrange the safekeeping of digital assets on behalf of third parties – and that regime sits within a mature common-law financial-services environment that institutional operators recognise. The question is not whether to engage with the Jersey Financial Services Commission but how to structure the application so that licensing, banking and tax move as a single, coordinated mandate.

This page sets out the regulatory basis for digital-asset custody authorisation in Jersey, the practical application process, and the cross-border considerations that most inbound operators underestimate. It is written for the general counsel or founder who already understands the custody model and needs the legal decision points, not a primer on blockchain.

The regulatory regime governing digital-asset custody in Jersey

Digital-asset custody in Jersey is a regulated activity under the supervision of the Jersey Financial Services Commission (JFSC), the island's primary financial regulator, operating under the island's financial services legislation and its dedicated virtual assets framework. The JFSC has positioned Jersey as an early mover in VASP supervision – ahead of the full MiCA implementation across EU member states – and applies a risk-based licensing model that distinguishes between custody, exchange, transfer and advisory services. A business that holds private keys or otherwise exercises control over digital assets on a client's behalf will generally require a Class M (money service business) registration or, depending on the specific custody model, authorisation under the financial services legislation applicable to investment business, both administered by the JFSC.

The JFSC's virtual assets regime draws on the FATF Recommendations, including Recommendation 15, which applies the VASP framework to digital-asset businesses, and the Travel Rule obligation – the requirement to transmit originator and beneficiary information alongside virtual-asset transfers. Applicants must demonstrate that their AML/CFT policies meet or exceed those standards from day one of the application, not as an afterthought once authorisation is in hand.

Jersey is a Crown Dependency, not an EU member state, but its regulatory standards are recognised across the major institutional markets. For an inbound operator, that combination – common-law property law, English-language courts, political stability and a regulator with a developed understanding of digital-asset mechanics – is materially different from a shelf registration in a lower-cost offshore centre.

Who needs authorisation for digital-asset custody in Jersey?

Any entity carrying on a custody business in or from Jersey in relation to virtual assets requires regulatory authorisation from the JFSC. The perimeter is drawn by activity, not by the label the business applies to itself. The following profiles regularly trigger the requirement in our practice:

• Custodians holding client private keys or operating multi-party computation (MPC) arrangements where the operator retains a share of the key material.
• Prime brokers and fund administrators that maintain digital-asset positions on behalf of investment vehicles and exercise meaningful control over the underlying assets.
• Technology providers that, as a practical matter, hold withdrawal authority over a client's wallet – even if the contractual framing describes the service as software-only.
• Exchanges and trading platforms with a built-in wallet function where client assets are commingled or held in an omnibus structure.

The perimeter question is often the first and most consequential legal step. We regularly advise clients whose original technology design inadvertently crossed the custody threshold. Restructuring the key-management architecture before an application is materially cheaper than managing an enforcement inquiry after the fact.

Entities that operate a purely non-custodial model – where the user holds the private key at all times and the service provider never has withdrawal authority – typically fall outside the regulated perimeter, but that analysis must be documented and defensible, not assumed.

What does the JFSC application process look like?

The JFSC operates an engagement-first model: applicants are strongly encouraged to hold a pre-application meeting before submitting formal documentation, and the quality of that initial engagement typically determines the pace of the formal review. In our cross-border practice, the businesses that move fastest through Jersey authorisation are those that arrive at the pre-application stage with a complete corporate structure, a drafted AML/CFT policy suite and a clear technology description – not those that treat the pre-application as a first draft.

A typical Jersey custody licence application will require:

• A detailed business plan, including a description of the custody model, the key-management architecture and the intended client base.
• An AML/CFT compliance manual calibrated to the JFSC's published AML/CFT guidance and the FATF Recommendations applicable to VASPs.
• Travel Rule procedures demonstrating how originator and beneficiary data will be captured, stored and transmitted for each virtual-asset transfer.
• Governance documentation: the board composition, the compliance officer and MLRO appointments, and the internal control framework.
• Personal questionnaires and fitness-and-propriety assessments for all controllers and senior individuals.
• Technology and security documentation covering key-management procedures, custody architecture, disaster-recovery plans and, where relevant, insurance coverage.
• Financial projections and a capitalisation plan showing the entity can meet its operating and prudential obligations from the point of authorisation.

The JFSC expects applicants to have appointed a locally resident compliance officer or MLRO, or to have a credible plan to do so, before the licence is granted. Operators using managed-service arrangements for compliance staffing should confirm that structure is acceptable to the JFSC for their specific activity category ahead of submission.

Overall application timelines vary by the completeness of the file and the complexity of the business. Jersey is generally regarded as efficient by the standards of the major custodial licensing regimes. Operators we advise typically plan for a multi-month process from pre-application to authorisation, with the longest elapsed time attributable to fitness-and-propriety reviews of controllers rather than to technical review of the custody architecture.

For a scoped assessment of whether your custody model triggers the JFSC perimeter – and what an application file would require – contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the key-management model, the user base and the banking – change the analysis in ways that a general description cannot capture.

How does Jersey's AML/CFT and Travel Rule framework apply to custodians?

Jersey's AML/CFT regime for VASPs requires custodians to implement controls that meet the FATF standard as a condition of authorisation – not a post-licence compliance upgrade. The JFSC has published AML/CFT guidance specifically addressing virtual assets, and the JFSC will assess compliance-framework maturity as part of the licence review, not merely check that a policy document exists.

The Travel Rule – the obligation to pass originator and beneficiary identification data with each virtual-asset transfer above the applicable threshold – applies to Jersey-registered VASPs. Custodians must be able to demonstrate technical capability for Travel Rule compliance before authorisation is granted. In practice, that means having selected and onboarded a Travel Rule solution – whether a protocol such as TRISA or a commercial provider – and having tested it against the custodian's own transaction flow. Regulators in Jersey and across the other leading VASP hubs increasingly expect this infrastructure to be operational, not planned.

For custodians serving institutional clients across multiple jurisdictions, the Travel Rule creates a counterparty-identification challenge: transfers to or from wallets at unhosted addresses or at VASPs in non-FATF-compliant regimes require enhanced due diligence. Documenting that process – and building it into the onboarding workflow – is a live expectation at the point of application, not a matter for later policy development.

What are the cross-border tax and banking considerations for Jersey custodians?

A Jersey custody licence does not, by itself, resolve the cross-border regulatory position. An operator authorised in Jersey that serves clients in EU member states, the UK or the United States will face additional regulatory touchpoints in those markets. Under MiCA, EU-based clients receiving custody services from a third-country VASP – and Jersey, as a non-EU Crown Dependency, is a third country for MiCA purposes – will be subject to the reverse-solicitation rules and may require the custodian to seek separate CASP authorisation in an EU member state to actively market those services in the EU. The UK's FCA maintains its own cryptoasset registration regime under the Money Laundering Regulations, and the financial promotion rules add a further layer for any UK-facing activity.

On banking, Jersey benefits from a well-developed financial infrastructure and a number of banks with established digital-asset client programmes. That said, obtaining a corporate bank account for a newly licensed VASP in any jurisdiction requires advance preparation. Banks in Jersey – as elsewhere – will perform their own due diligence on the custody model, the AML/CFT framework and the ultimate beneficial owners. In our practice, we have seen account-opening timelines extend significantly where a custody client arrived at the banking stage without a completed compliance-framework document set. Preparing the bank's due-diligence package in parallel with the licence application, not after it, is among the most practical steps an inbound operator can take.

Jersey does not levy a general corporate tax on financial services income at the rates common to major onshore centres, but the precise tax treatment of custody fee income, staking rewards and token disposals requires specific advice calibrated to the entity's structure, the character of the income and any relevant tax-information-exchange arrangements applicable to its client base. Economic substance requirements also apply to Jersey-registered entities, and a custody licence holder must demonstrate genuine substance on the island – not a letterbox presence.

To map the licence, banking and tax stack for your custody build in Jersey, write to info@oboluslaw.com. If a prior application stalled or a banking relationship closed, a second read of the structure can surface the root cause and the route forward.

Does a Jersey-licensed custodian need to satisfy economic substance requirements?

Yes. Jersey's economic substance rules require entities carrying on relevant financial activities – which include the custody of digital assets – to maintain genuine substance on the island. Substance means, in practice: adequate physical presence, appropriately qualified staff, and key decision-making taking place in Jersey rather than being directed from offshore. A custody entity that routes its profits through Jersey while managing its operations entirely from another jurisdiction will not satisfy the substance test and risks adverse tax consequences and regulatory concern from the JFSC.

The substance requirement is a design consideration, not a box-ticking exercise. For smaller operators, a managed-service provider on the island can supply some of the staffing and premises infrastructure, but the compliance officer and key managerial decisions must still be genuinely local. We work through the substance analysis as part of the initial structuring mandate, before the entity is incorporated, because restructuring substance after the fact is both expensive and slow.

A representative matter: structuring a custody authorisation for a multi-jurisdiction operator

In a recent engagement, a digital-asset custodian incorporated in a common-law offshore centre sought to migrate its primary regulatory authorisation to Jersey to access institutional counterparties and European banking that required a JFSC-supervised entity. The existing corporate structure held custody assets across three jurisdictions, and the key-management architecture had not been designed with a single-jurisdiction regulatory footprint in mind. We conducted a perimeter analysis across each operating entity, restructured the key-management model so that the Jersey entity held the regulated custody function without triggering a secondary licensing obligation in the operator's primary market, and built the AML/CFT and Travel Rule documentation set from the ground up. The file was submitted to the JFSC with a pre-application engagement complete, and the operator obtained its Jersey custody authorisation without material queries on the compliance framework – a materially cleaner outcome than had been achieved in two prior application attempts in other jurisdictions. The banking mandate followed shortly after authorisation, with the completed due-diligence pack already prepared.

Which operator profile should choose Jersey for digital-asset custody licensing?

Jersey is well-suited to certain operator profiles and less suited to others. The decision turns on the structure of the client base, the required counterparty relationships and the operator's capacity to maintain genuine substance on the island.

Institutional custodians and prime brokers targeting European family offices, regulated funds and corporate treasuries will find that a JFSC-supervised custodian carries immediate credibility with the institutional counterparties they are targeting. The regime's maturity and the island's legal infrastructure make it a natural choice for this segment.

Crypto-native exchanges adding custody as an ancillary service to an existing exchange licence in another jurisdiction should consider whether a Jersey custody authorisation adds material market access beyond what their primary licence provides – or whether a CASP authorisation in an EU member state is the more direct route to the European market they are actually targeting.

Technology infrastructure providers who hold a technical custody function but serve only regulated financial institutions should take specific advice on whether the Jersey perimeter applies to their model. The answer turns on the degree of control over the underlying assets, and that analysis is fact-specific.

Early-stage operators without existing institutional relationships, substantial compliance infrastructure or the capacity to resource genuine Jersey substance should be direct with themselves: a Jersey custody licence is a serious regulatory authorisation that requires material investment in compliance, governance and local presence. A lighter-touch registration in a different regime may be the appropriate first step, with a Jersey authorisation as the intended growth path.

A common assumption among operators we speak with is that a single offshore licence, registered in any jurisdiction willing to grant one, is sufficient to serve clients globally. It is not. Institutional counterparties, banks and major exchanges now require evidence of authorisation in a jurisdiction their own compliance teams recognise, and regulators in the EU, UK and Singapore are actively restricting inbound services from third-country VASPs without equivalent authorisation in their market. The licence stack – operating, custody, payment and, where relevant, exchange – must be mapped to the actual business model and the actual client base, not to an ideal that leaves gaps a bank or institutional counterparty will immediately identify.

Related at OBOLUS

• Licensing and registration for digital-asset businesses – the full practice overview covering VASP authorisation across 70+ jurisdictions.
• Economic substance for licensed VASPs – a practical guide for early-stage founders meeting substance requirements after authorisation.
• How to file a creditor claim in a crypto insolvency – what custody clients and creditors need to know when a licensed entity becomes insolvent.

FAQ

How long does a crypto licence take to obtain?

Timelines vary significantly by jurisdiction, licence category and the completeness of the application file. In Jersey, operators who arrive at the pre-application stage with a complete compliance-framework document set and a finalised corporate structure typically move faster through the JFSC review than those who submit iteratively. Across the major VASP hubs, a realistic planning range is several months from pre-application engagement to authorisation, with fitness-and-propriety reviews of key individuals often setting the pace rather than the technical review of the business model.

Which jurisdiction is best for licensing my crypto business?

There is no single answer. The right jurisdiction depends on the operator's client base, the custody or exchange model, the banking relationships required, the economic substance the operator can genuinely maintain, and the counterparty jurisdictions whose recognition matters most. Jersey is well-suited to institutional custody with European institutional clients. An EU member state CASP authorisation under MiCA is the direct route for operators actively marketing to EU clients. We map the licence stack to the actual business model before recommending a jurisdiction – not the other way around.

Do I need a separate custody licence?

In most leading jurisdictions, yes – custody is a regulated activity distinct from exchange, brokerage or advisory services, and a licence that covers one activity does not automatically cover custody. In Jersey, an entity holding client digital assets or controlling private keys will generally require specific authorisation from the JFSC for that activity, regardless of what other licences the group holds elsewhere. Whether your specific key-management model constitutes regulated custody is a perimeter question that requires legal analysis of the technical architecture, not a self-assessment.

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – and we structure licensing, banking and tax as one mandate rather than three disconnected workstreams. To discuss your situation, contact info@oboluslaw.com.

By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP authorisation strategy and multi-jurisdiction custody licence structuring for institutional operators.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.