VASP licensing in Liechtenstein: Legal Requirements for Businesses
Operating a digital-asset business without the correct authorisation in Liechtenstein exposes the enterprise to regulatory enforcement, banking termination and, in the worst case, personal liability for directors. Liechtenstein's Token and Trusted Technology Service Provider Act – known as the TVTG (Token- und VT-Dienstleister-Gesetz) – established one of the earliest comprehensive statutory regimes for token-economy businesses in Europe, placing VT service providers (virtual-asset service providers operating under the TVTG) under the supervision of the Financial Market Authority Liechtenstein (FMA). Any business planning to offer exchange, custody, token issuance or related services from or into Liechtenstein must resolve its authorisation position before going live. This page sets out the regulated perimeter, the application process, the cross-border interaction with EEA and Swiss regulatory regimes, and the decision point for an inbound operator.
What does the TVTG regulate and who must be licensed?
The TVTG regulates a defined list of token-economy services, and any business providing those services on a commercial basis requires authorisation from the FMA Liechtenstein before it may operate. The regime does not turn on the label an operator applies to its activity – it turns on the economic function the business performs on a blockchain or distributed-ledger system. A business that stores tokens on behalf of third parties, exchanges tokens against fiat or other digital assets, issues tokens to the public, or manages token-based portfolios falls squarely within the perimeter.
The TVTG identifies several categories of regulated VT service provider. These include the VT token issuer (an entity that publicly offers tokens it has created), the VT token generator (which creates tokens on behalf of others), the VT exchange service (which exchanges tokens against fiat or other assets), the VT custody service (which holds tokens or private keys for clients), and the VT portfolio manager (which manages token-based portfolios on a discretionary or advisory basis). The regime also captures VT price service providers and entities providing VT transfer services. Each category is assessed separately; a business conducting multiple activities requires authorisation across each applicable category.
The scope of the TVTG is deliberately broad. An operator incorporated outside Liechtenstein but directing services at Liechtenstein-based clients may trigger registration obligations in the same way a domestic entity would. In our practice, we regularly advise businesses that assume a foreign domicile insulates them from local authorisation requirements – it does not, and the FMA has made clear that the relevant question is where the economic activity occurs and who it reaches, not where the server or the holding entity sits.
How does the FMA authorisation process work?
Authorisation under the TVTG is a structured administrative process conducted by the FMA, and the quality of the application file is the primary variable that determines how smoothly it proceeds. The application must demonstrate that the business has adequate governance, appropriate substance in Liechtenstein or the EEA, fit-and-proper management, robust AML/CFT controls, and the technical capability to perform the regulated activity safely. Missing or poorly drafted components are the most common source of delay in the applications we have reviewed.
The core file typically includes a detailed business plan, constitutional documents, CVs and criminal-record certificates for all beneficial owners and directors, a full AML/CFT policy manual mapped to Liechtenstein's AML Act and the Travel Rule (the obligation under FATF Recommendation 15 to pass originator and beneficiary data with a token transfer), a technical description of the platform, and evidence of the minimum own-funds position applicable to the category sought. The FMA may request supplementary information during its review, and applicants should allow for that dialogue in their project timeline.
From a timeline perspective, the statutory review clock begins once the FMA accepts the application as complete. The time to completeness depends almost entirely on the quality of the initial submission. Applications with a clean file and Liechtenstein-qualified compliance officers in place tend to move through the process within a matter of weeks after acceptance; applications with substance gaps or incomplete AML documentation routinely require multiple rounds of supplementation and take considerably longer. We have seen the difference between a well-prepared and a poorly prepared file add months to the process.
A key process detail: the TVTG requires ongoing reporting and annual compliance obligations after authorisation. Obtaining the licence is the starting point, not the finish line. Operators must maintain the conditions of authorisation – including minimum own-funds, qualified management and a functioning AML programme – on a continuing basis, or they risk suspension or revocation.
For a scoped assessment of your authorisation position under the TVTG, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the target user base, the banking relationship – change the analysis. Map your options
How does a Liechtenstein licence interact with EEA and MiCA requirements?
Liechtenstein is a member of the European Economic Area and, through the EEA Agreement, incorporates EU financial regulation into its domestic law – which means the arrival of MiCA (the Markets in Crypto-Assets Regulation) has direct and immediate relevance for TVTG-authorised businesses. MiCA creates the CASP (crypto-asset service provider) authorisation framework across the EU and EEA, and Liechtenstein is obliged to implement it. The transition period and the interaction between the existing TVTG framework and the incoming MiCA CASP regime are consequential for any business that has built its regulatory position around the TVTG alone.
In practical terms, a TVTG-authorised business currently has Liechtenstein as its supervisory home. Under MiCA's passporting architecture, a CASP authorised in one EEA member state may provide services across the EEA without needing separate authorisations in each state – an outcome that is strategically significant for any business whose clients are distributed across Europe. The question for an inbound operator is whether to structure around the TVTG now and migrate to CASP authorisation as the transition completes, or to build directly for CASP authorisation from the outset.
The answer depends on the operator's timeline, existing corporate structure and the specific activities in scope. ESMA and the national competent authorities – including the FMA as Liechtenstein's NCA – are publishing transitional guidance on a rolling basis. In our cross-border practice, we map the transition risk for clients before they commit to a structure, because unwinding a suboptimal choice after authorisation is materially more expensive than selecting the right path at the outset.
One further cross-border dimension is Switzerland. Liechtenstein uses the Swiss franc and maintains a customs union with Switzerland, meaning that token businesses established in Liechtenstein often have Swiss banking relationships and Swiss-domiciled investors. The FINMA regime in Switzerland is a separate regulatory system with its own token taxonomy (payment, utility, and asset tokens under FINMA guidance), and a TVTG authorisation does not carry any deemed equivalence or passporting into Switzerland. A business operating across both jurisdictions needs to resolve its position under both regimes independently.
What are the AML and Travel Rule obligations for Liechtenstein VASPs?
Liechtenstein's AML framework applies to all TVTG-authorised entities and aligns with the FATF Recommendations, including Recommendation 15, which brings virtual asset service providers into the AML/CFT perimeter on the same basis as traditional financial intermediaries. The Travel Rule obligation – requiring the originator's VASP to collect, verify and transmit identifying information about the originator and beneficiary with each transfer above the applicable threshold – is a live compliance requirement, not a theoretical future obligation.
For exchange and transfer services in particular, implementing the Travel Rule involves a technical and operational layer that goes beyond policy documentation. The business must have a mechanism for receiving and transmitting Travel Rule data with counterpart VASPs, including non-EEA VASPs where data-sharing protocols may be less standardised. The FMA expects to see credible technical implementation documented in the authorisation file – a policy that says "we will comply with the Travel Rule" without a described technical solution is generally insufficient at the review stage.
Ongoing AML obligations include risk-based customer due diligence, enhanced due diligence for higher-risk relationships, transaction monitoring calibrated to the business's risk profile, and suspicious transaction reporting to the FMA. The FMA conducts supervisory reviews of TVTG entities on an ongoing basis, and deficiencies in AML controls are among the most commonly cited grounds for regulatory action across the major European virtual-asset supervisors.
How do banking and tax interact with a Liechtenstein VASP structure?
Banking access is the practical constraint that separates a functioning VASP licence from a piece of paper, and it deserves the same attention in the planning phase as the authorisation itself. Liechtenstein hosts a small number of private and commercial banks with an established appetite for digital-asset clients. Those banks conduct their own due diligence on prospective VASP clients that is in many respects as rigorous as the FMA authorisation process – they assess the AML programme, the beneficial ownership structure, the source of funds, the client base and the nature of the business model.
In our practice, we regularly advise businesses that obtained the licence but encountered banking difficulties because the regulatory and banking workstreams were run sequentially rather than in parallel. The correct approach is to engage the banking conversation – at the level of establishing viability in principle, not committing to a specific institution – before the authorisation application is submitted. A banking failure after authorisation is an operational crisis; discovering the banking path before submission is a planning exercise.
On tax, Liechtenstein operates a corporate income tax regime with a rate that is competitive relative to many EU member states. Holding and domiciliary companies have historically been attractive for structuring purposes. For a VASP, the relevant tax questions include the characterisation of token-related income (whether exchange revenue, custody fees or staking rewards are treated as trading income or capital receipts), the VAT position on digital-asset services (which is a live question under both domestic and EEA rules), and the substance requirements that must be met to support the chosen tax position. These questions are jurisdiction-specific and must be addressed with qualified local counsel before the structure is fixed.
Transfer pricing is also a consideration for groups that place a Liechtenstein VASP inside a multi-entity structure: intra-group service fees, IP licensing and the economic substance attributed to each entity must be documented and defensible under OECD standards, which Liechtenstein follows.
If a prior application stalled or banking access proved more difficult than expected, a structured review can identify the gap and map the route forward. Write to info@oboluslaw.com or Map your options via the contact page.
Who should seriously consider Liechtenstein, and what is the decision matrix?
Liechtenstein is a strong choice for a defined profile of digital-asset business. It is not the right choice for everyone, and the decision requires an honest mapping of the operator's activities, clients and timeline against what the jurisdiction can realistically deliver.
Profile A – EEA-oriented exchange or custody business: a business whose clients are primarily in the EEA, that wants a single supervisory home with a credible regulatory track record and a path to MiCA CASP passporting, and that has the governance and substance to satisfy the FMA's requirements, should look at Liechtenstein seriously. The TVTG is a mature framework. The FMA is an active, engaged supervisor. The EEA membership provides the passporting architecture that a business serving European clients needs. The timeline is manageable for a well-prepared applicant. The key risk is the MiCA transition: an operator that builds around the TVTG must plan for migration to CASP authorisation and should factor that cost into the business case.
Profile B – token issuer with an international investor base: an operator planning a public token offering or a structured issuance targeting EEA-based investors will need to assess the whitepaper and disclosure obligations under both the TVTG and, as the MiCA transition completes, the MiCA ART or EMT regime where applicable. Liechtenstein provides a well-understood legal basis for tokenisation under the TVTG's property-law provisions, which give tokens a recognised legal status. That is a material advantage for a token issuer seeking to operate with legal certainty. The cross-border question – specifically, whether the offering triggers securities regulation in the jurisdictions where investors are located – must be resolved separately and independently of the Liechtenstein authorisation.
Profile C – business building primarily for non-EEA markets: a business whose clients and banking relationships are centred outside Europe and that does not require EEA passporting may find that the cost and substance requirements of the TVTG/MiCA path are disproportionate relative to alternatives such as the AIFC in Kazakhstan, the BVI VASP Act, or the Cayman VASP regime, depending on the activity. Liechtenstein's advantages are specific to the EEA regulatory context; outside that context, other regimes may deliver a faster and less costly authorisation with a comparable level of regulatory credibility.
In recent months, we have seen a pronounced increase in enquiries from businesses that previously relied on a single offshore registration – the AUDIENCE_MYTH – and discovered that major EEA-based banking partners, payment processors and institutional counterparties required regulated EEA status before they would onboard. A Liechtenstein TVTG or CASP authorisation addresses that gap directly.
A cross-border TVTG application in practice
In a recent licensing matter, a fintech group incorporated in the British Virgin Islands sought to launch an exchange and custody service targeting retail and institutional clients across the EEA. The group had an existing offshore registration but found that several prospective EEA banking partners required a supervisory relationship with an EEA-competent authority before proceeding. We assessed the business model against the TVTG category list, identified that both the exchange-service and custody-service authorisations were required, and structured a Liechtenstein operating subsidiary with adequate governance and substance to satisfy FMA expectations. The authorisation application was submitted with a complete file – including a Travel Rule implementation plan covering counterpart VASP data exchange – and the FMA accepted the application without a request for supplementary information at the first review stage. The group's banking conversations, which we advised should run in parallel, advanced materially once the FMA acceptance letter was in hand. The outcome was a functioning regulatory and banking platform for EEA operations within a project timeline that was materially shorter than comparable exercises the management team had experienced in other jurisdictions.
What mistakes do operators most often make in a Liechtenstein VASP application?
The most common and most costly mistake is treating the AML/CFT documentation as a compliance afterthought rather than a core component of the authorisation case. The FMA expects to see a risk-based AML programme that is specific to the business model – not a generic policy imported from another jurisdiction. A custody business and an exchange service have materially different risk profiles, and the AML manual must reflect that.
A second persistent mistake is underestimating the substance requirement. The FMA expects that the key decision-making function for the regulated activity is genuinely located in Liechtenstein or within the EEA – not delegated in full to a parent or affiliate outside the jurisdiction. Applications that propose to run the regulated business from abroad with a nominal local presence regularly encounter resistance. Building real substance means qualified people, in-jurisdiction, with genuine authority over the regulated activity.
A third mistake, as noted above, is sequencing banking after licensing. By the time an authorisation is in hand, the operator has already committed to a cost base and a go-live timeline. Discovering a banking problem at that stage causes real commercial damage. The banking conversation should begin at the same time as the regulatory planning.
A fourth mistake is failing to account for the MiCA transition. A business authorised under the TVTG today must plan for migration to the CASP framework as the transition completes. That migration involves additional costs, filings and potentially additional supervisory review. Operators that build the transition cost into their business case from the start manage it without disruption; those that treat the TVTG as a permanent final answer face a surprise.
A common assumption: does an offshore licence cover EEA operations?
A common assumption among operators approaching the EEA market for the first time is that a well-regarded offshore licence – from the BVI, Cayman or a similar jurisdiction – provides sufficient regulatory cover for EEA business. It does not. The EEA's digital-asset regime, anchored in MiCA and implemented through national competent authorities including the FMA, requires a CASP authorisation with an EEA supervisory home for any operator genuinely serving EEA clients on a commercial basis. An offshore registration may satisfy certain anti-money-laundering filing obligations in the home jurisdiction, but it does not give the operator regulated status in the EEA, and it will not satisfy the due-diligence requirements of EEA-based banks, exchanges or institutional counterparties who ask for proof of regulated status. We work through this assumption with almost every operator we advise at the point of EEA market entry.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – the full practice overview across 70+ jurisdictions, from CASP to VASP to MTL stacks
- VASP Licensing in the United States: Federal and State MTL – comparative view of US federal and state money-transmitter obligations alongside international structures
- DAO Legal Wrapper for Established Operators – structuring options for decentralised protocols that intersect with regulated token-economy activity
FAQ
How long does a crypto licence take to obtain?
The timeline depends on the jurisdiction and the quality of the application file. Under the TVTG in Liechtenstein, the FMA's statutory review clock begins once it accepts the application as complete. A well-prepared file with correct AML documentation, qualified management and adequate substance in place can progress through the review within a matter of weeks from acceptance. A file that requires multiple supplementation rounds will take considerably longer. In our experience, preparation quality is the dominant variable – more so than the formal statutory deadline.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on where your clients are, the activities you intend to carry out, your banking requirements, your timeline and your appetite for ongoing compliance cost. Liechtenstein is well-suited to EEA-oriented businesses that need a supervisory home with passporting potential under MiCA. Businesses targeting non-EEA markets may find that other regimes – the AIFC, BVI, Cayman or Singapore – better fit their profile. We map the licence stack against the specific business model before recommending a path, because the wrong jurisdiction creates cost and delay rather than certainty.
Do I need a separate custody licence?
Under the TVTG, custody of tokens on behalf of third parties is a separately defined regulated activity, and a business carrying out both exchange and custody functions requires authorisation for each category. The same principle applies under MiCA: CASP authorisation is activity-specific, and custody is a distinct regulated service. A business that holds client assets – private keys, wallet infrastructure, or tokens in an omnibus account – should assume that a custody authorisation is required and test that assumption against the specific facts of the business model, rather than assuming that a single-activity licence covers related functions.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit – because the cost of unwinding a misfiled structure is always greater than the cost of getting it right at the start. Digital assets are the whole of our practice. To discuss your Liechtenstein authorisation or a broader cross-border licensing question, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP and CASP authorisation across EEA, Gulf and offshore jurisdictions, with a focus on inbound operators building their first regulated platform.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.