Operating a digital-asset custody business without the right regulatory authorisation exposes the enterprise to enforcement action, abrupt loss of banking relationships and, in cross-border deployments, the risk of secondary liability in the jurisdictions where clients actually sit. For businesses evaluating Seychelles as a custody domicile, the key question is not whether the islands offer a regime – they do – but whether that regime, paired with your entity structure and user base, is fit for purpose before the first custody wallet goes live.
Digital-asset custody licensing in Seychelles sits under the oversight of the Financial Services Authority of Seychelles (FSA Seychelles), which administers the Virtual Asset Service Providers Act (the VASP Act) and its subsidiary regulations. A VASP (virtual asset service provider) that holds or safeguards digital assets on behalf of third parties is required to obtain a dedicated authorisation before conducting custody activity from a Seychelles-incorporated entity. The regime is a full authorisation track, not a simple registration, and it carries AML/CFT obligations aligned to the FATF Recommendations – including those addressing virtual assets under Recommendation 15. This page sets out the regulated basis, the application process and timeline, the cross-border interaction with banking and tax, and the decision point an inbound operator faces.
Who Needs a Custody Authorisation in Seychelles?
Any legal entity incorporated in Seychelles that holds, safeguards or controls digital assets belonging to third parties requires a custody authorisation under the VASP Act. The trigger is functional: if your platform holds private keys, operates omnibus wallets or provides safeguarding infrastructure for client assets – regardless of how the product is marketed – custody regulation applies. A business that also operates an exchange, processes transfers or provides investment advice will need to map each discrete regulated activity against the available licence categories, since the FSA Seychelles uses an activity-based authorisation model rather than a single universal VASP licence.
Structures that attempt to recharacterise custody as a technology service, or that locate the entity offshore while operating the key-management infrastructure from Seychelles, are unlikely to survive regulatory scrutiny. The FSA Seychelles has published guidance indicating that substance requirements apply: directors, compliance function and meaningful operations must have a genuine connection to the jurisdiction.
The FSA Seychelles administers the VASP Act as the sole competent authority for virtual-asset business in the non-DIFC, non-ADGM territory of the Seychelles. This is distinct from Abu Dhabi or Dubai licensing regimes – an operator holding a VARA or FSRA authorisation in the UAE does not derive any passporting right into Seychelles. Each jurisdiction demands its own authorisation for locally connected custody activity.
The FATF Travel Rule – the obligation to pass originator and beneficiary data with a virtual-asset transfer – applies to licensed Seychelles VASPs. The precise de-minimis threshold for triggering Travel Rule data transfer requirements varies and should be confirmed against the current FSA Seychelles guidance, but operators should assume that routine custody-related transfers will fall within scope and build the compliance architecture accordingly before licence issuance.
CTA #1: The activity boundary between custody, exchange and transfer is not always obvious. If you are uncertain whether your product falls within the Seychelles VASP Act's custody perimeter, a scoped regulatory analysis before filing will surface the structural risks. Contact OBOLUS at info@oboluslaw.com or map your options.
What Is the Regulatory Basis for Digital-Asset Custody in Seychelles?
The VASP Act, together with the FSA Seychelles' subordinate rulebooks, establishes the legislative basis for digital-asset custody authorisation in Seychelles. The Act defines regulated virtual-asset activities and maps each activity type to an authorisation category. Custody – the holding or safeguarding of virtual assets or the means of access to them – is among the specifically enumerated activities requiring a licence before business commences.
Alongside the VASP Act, the Anti-Money Laundering Act and its associated regulations impose AML/CFT programme obligations on all licensed VASPs. The AML framework is calibrated to the FATF Recommendations, meaning a licensed Seychelles custodian must maintain a risk-based AML programme, appoint a compliance officer, conduct customer due diligence and enhanced due diligence for higher-risk relationships, file suspicious transaction reports and implement the Travel Rule for qualifying transfers. These are not aspirational expectations – they are licence conditions, and breach of them triggers supervisory intervention and potential revocation.
Token classification matters at the custody layer. The FSA Seychelles applies a substance-over-label approach: a token that functions as a security is treated under the securities regime regardless of the issuer's characterisation, which can affect whether a custody arrangement also triggers a capital-markets authorisation. In our cross-border practice, we routinely see custodians that begin with a straightforward custody mandate discover that their underlying assets – structured tokens, revenue-sharing instruments, tokenised securities – require a separate regulated permission. Mapping the asset universe before the application is therefore essential, not optional.
What Does the Seychelles VASP Licence Application Process Involve?
The FSA Seychelles' application process for a VASP custody authorisation follows a structured pre-filing and filing sequence. The application is submitted to the FSA Seychelles directly, and the authority conducts a fit-and-proper assessment of the entity, its beneficial owners, directors and the proposed compliance officer. All of these individuals are subject to background screening, and the authority will require documentation demonstrating professional competence in the custody and digital-asset domain.
The core application package typically requires:
- A detailed business plan describing the custody model, the asset types to be held, the geographic markets to be served and the client types to be onboarded.
- A comprehensive AML/CFT policy and procedure manual, including the Travel Rule implementation plan.
- Evidence of the technology infrastructure – key management architecture, security audit results, custody system documentation.
- Organisational charts, beneficial ownership declarations and fit-and-proper forms for all relevant individuals.
- Evidence of minimum capitalisation meeting the FSA Seychelles' requirements for the custody category (the specific figure varies by licence class and should be confirmed with the authority at the time of application).
- A business continuity and disaster recovery plan for the custody infrastructure.
Timeline for FSA Seychelles VASP authorisations varies by the completeness of the filing and the authority's queue. Well-prepared applications with no material deficiencies progress materially faster than those requiring multiple rounds of supplementary information requests. Operators should plan for a process measured in months rather than weeks, and should not assume that a straightforward custody-only application will be treated with different priority than a more complex exchange application. In our practice, preparation quality – not speed of filing – is the single strongest predictor of authorisation timeline.
How Does the Cross-Border Reality Affect a Seychelles Custody Authorisation?
Seychelles sits in an important cross-border position: it is widely used as an offshore holding or operational entity jurisdiction, but it is not a passporting bloc and carries reputational considerations that differ materially from, say, a MiCA-passportable EU authorisation or an SFC-licensed Hong Kong platform. The regulatory authorisation from the FSA Seychelles gives the entity permission to operate from Seychelles – it does not give the entity permission to solicit, onboard or serve clients in jurisdictions that have their own VASP or custody licensing requirements.
This is the point at which the single-offshore-licence assumption collapses. A custodian licensed in Seychelles that onboards clients located in the European Union is providing services within the MiCA perimeter. A custodian serving clients in Singapore is operating within the MAS Payment Services Act regime. A custodian with US clients will encounter FinCEN, state money-transmitter licensing and, depending on the assets held, SEC or CFTC jurisdiction. None of those obligations are discharged by the Seychelles authorisation.
Operators we advise routinely structure multi-tier arrangements: a Seychelles entity for the holding and key-management layer, combined with operating entities or representative offices in the client-facing jurisdiction. The custody licence in Seychelles is then one piece of the stack, not the whole of it. The banking layer adds further complexity – Seychelles-licensed VASPs have access to correspondent banking relationships, but the quality and stability of those relationships depends heavily on the entity's AML infrastructure, the asset types in custody and the client jurisdiction mix. Operators entering with weak AML documentation find that banking access deteriorates even after authorisation is obtained.
Tax interaction also warrants early analysis. Seychelles offers a territorial tax regime that is attractive for certain holding structures, but income attribution, economic substance rules and the treaty position with the relevant client jurisdictions will determine whether the structure achieves the intended result. We map the licence, banking and tax stack together – not as sequential exercises – because choices made at the licensing stage constrain the tax options available later.
How Has a Real Seychelles Custody Matter Played Out?
In a recent custody authorisation matter, a digital-asset fund manager incorporated a Seychelles entity to hold custody over tokenised fund assets on behalf of institutional investors in multiple time zones. The initial structure assumed that the Seychelles VASP authorisation was the only licence required. On review, we identified that the investors included entities in two EU member states, triggering MiCA applicability for the custody function directed at those clients. We restructured the entity architecture before filing – the Seychelles entity retained the key-management and technology layer, while a CASP-authorised EU entity was introduced as the investor-facing custody vehicle. The FSA Seychelles application was filed for the infrastructure layer and proceeded without the complications that would have arisen had the original single-entity structure gone to market. The matter closed in the early part of a recent quarter, and the fund received its first institutional mandate within weeks of authorisation.
What AML and Travel Rule Obligations Apply to Seychelles Custodians?
The AML/CFT obligations on a licensed Seychelles custodian are substantive and continuous – they do not stop at the point of authorisation. The FSA Seychelles expects licensed VASPs to maintain an AML programme calibrated to the FATF Recommendations, which are the international standard the Seychelles has adopted. This means a risk-based approach to customer due diligence, with enhanced diligence for higher-risk clients, politically exposed persons and correspondent VASP relationships.
The Travel Rule – formalised in FATF Recommendation 15 – requires that a Seychelles-licensed custodian transmit originator and beneficiary information alongside virtual-asset transfers above the applicable threshold. This obligation applies to transfers made to or received from other VASPs, not solely to transfers between custodians. The practical implementation requires a technical solution – a Travel Rule messaging protocol compatible with counterparty VASPs – and a policy framework governing what happens when a counterparty cannot receive or transmit Travel Rule data. In our cross-border practice, we see Travel Rule compliance as a significant operational challenge for newly licensed custodians who have not built the protocol into their infrastructure before authorisation.
Ongoing supervisory obligations include: annual AML/CFT reporting to the FSA Seychelles, transaction monitoring with an audit trail, suspicious transaction reporting within the required timeframes, and maintenance of records for the period specified under the Anti-Money Laundering Act. Licence renewal – typically annual – requires evidence of continued compliance with all licence conditions, not merely payment of the renewal fee.
CTA #2: If a prior VASP application stalled or banking access was withdrawn after licensing, the cause is often structural – the AML programme or the entity architecture did not meet the expectations of the counterparty or the authority. A second-read analysis frequently surfaces the route to resolution. Write to OBOLUS at info@oboluslaw.com or map your options.
Is Seychelles the Right Custody Domicile for Your Business?
Seychelles is a viable custody domicile for a specific operator profile – not a universal solution. The decision turns on the entity's user geography, the asset types in custody, the banking relationships available and the longer-term regulatory trajectory the business wants to follow. The following profiles illustrate where the jurisdiction fits and where it does not.
Profile A – Infrastructure-layer custodian with institutional clients outside the EU: An operator running the key-management and technology layer for a fund or exchange, with institutional counterparties in non-MiCA, non-MAS jurisdictions, may find the Seychelles VASP authorisation fits the custody mandate well. The territorial tax position, the English-law-influenced legal system and the FSA Seychelles' activity-based licence model provide a workable foundation. Timeline for authorisation, assuming a well-prepared application, is a matter of several months. Key risk is banking – correspondent relationships require strong AML infrastructure from day one.
Profile B – Retail-facing custodian seeking EU market access: A custodian that intends to serve retail clients in EU member states cannot rely on a Seychelles authorisation alone. MiCA requires a CASP (crypto-asset service provider) authorisation from a national competent authority, with passporting across the EEA. Seychelles licensing is at best the infrastructure layer; a separate EU authorisation – in Lithuania, Malta or another MiCA-capable jurisdiction – is the client-facing instrument. Attempting to serve EU clients from a Seychelles entity without a CASP authorisation creates enforcement exposure in the client's home state.
Profile C – Exchange operator adding custody as an ancillary service: Exchange platforms seeking to add custody to their licensed Seychelles exchange activity should treat custody as a separate authorisation rather than an ancillary permission. The FSA Seychelles applies activity-based licensing: each material activity requires its own authorisation or a combined application covering each activity. An operator that launches custody under an exchange licence without a separate custody permission is operating outside the scope of its authorisation.
A common assumption we encounter is that securing any offshore licence removes ongoing compliance obligations in the jurisdictions where the business actually operates. It does not. The Seychelles VASP Act creates an obligation to the FSA Seychelles, not a permission to operate everywhere else. Mapping the regulatory exposure across user geographies before the licence is issued is the exercise that protects the business – not the licence alone.
Related at OBOLUS
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – our full licensing practice across 70+ jurisdictions, from initial scope to post-authorisation compliance.
- Digital-Asset Custody Authorisation in Abu Dhabi Global Market (ADGM) – the FSRA regime for custody within the ADGM free zone, a strong alternative for UAE-domiciled custody structures.
- NFT Project Legal Structuring in Lithuania – MiCA-transition analysis and CASP structuring for digital-asset projects seeking EU market access via Lithuania.
FAQ
How long does a crypto licence take to obtain?
Timeline varies materially by jurisdiction and by application quality. In Seychelles, a well-prepared FSA Seychelles VASP application for a custody authorisation typically proceeds over several months; the authority's supplementary information requests are the main source of delay. EU CASP authorisations under MiCA operate on a statutory assessment period that varies by member state. Jurisdictions such as Singapore and Hong Kong operate their own timelines under the MAS Payment Services Act and the SFC VASP regime respectively. A prepared application – complete documents, sound AML programme, appropriate capitalisation – is the most reliable accelerant.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on where your users are, what activities you conduct, which banking relationships you need and what your growth trajectory looks like. A Seychelles custody licence suits an infrastructure-layer operator with non-EU, non-MAS client exposure. MiCA-passportable EU licensing suits businesses targeting the European retail or institutional market. VARA, ADGM and Singapore sit between those poles. We map the licence stack – custody, exchange, payment, investment management – against the user geography and asset mix before advising on domicile.
Do I need a separate custody licence?
In most regulated jurisdictions, yes. Seychelles operates an activity-based licensing model under the VASP Act: custody is a defined regulated activity requiring its own authorisation, not a permission that flows automatically from an exchange or broker licence. The same principle applies under MiCA (CASP authorisation per activity category), the MAS Payment Services Act, and the SFC VASP regime in Hong Kong. Operators who assume that a single licence covers all digital-asset activities routinely find themselves operating outside their permitted scope. The safest approach is to map each activity line at the outset and confirm the required authorisation for each.
About OBOLUS: OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – and when questions arise mid-structure, we surface the route forward before it becomes a filing problem. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP authorisation strategy and cross-border custody structuring across offshore and emerging-market regulatory regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.