VASP licensing in Seychelles – the virtual asset service provider (VASP) registration regime – gives an inbound crypto business a recognized regulatory basis to operate, but the legal requirements demand precise structural preparation before a single document is filed. The Virtual Asset Service Providers Act 2020 (the VASP Act), administered by the Financial Services Authority of Seychelles (FSA), establishes the perimeter: any entity carrying on a virtual-asset business from or within Seychelles must hold FSA authorization or registration. Operators who skip that analysis and proceed on the assumption that a generic offshore company is sufficient expose themselves to enforcement action, disrupted banking and the reputational cost of a corrective restructure.
This page sets out the regulatory basis, the application process for an inbound operator, the cross-border tax and banking interaction, and the key decision points – including when the Seychelles structure fits and when a different jurisdiction is the better answer.
What activities require VASP authorization in Seychelles?
The FSA's licensing perimeter under the VASP Act is activity-based, not entity-based: the trigger is carrying on a virtual-asset service from or within Seychelles, regardless of where clients sit. The defined services cover exchange between virtual assets and fiat currencies, exchange between one or more forms of virtual asset, transfer of virtual assets, safekeeping and administration of virtual assets or instruments enabling control over them, and participation in and provision of financial services related to an issuer's offer or sale of a virtual asset. If an operation touches any of these activities and uses a Seychelles legal entity – or routes its infrastructure through Seychelles – the FSA expects authorization.
The practical implication is that a Seychelles International Business Company (IBC) used as a group holding vehicle or treasury entity may sit outside the perimeter if it carries on no direct virtual-asset services. Once it starts transacting with clients, holding keys on their behalf or placing orders, the analysis changes. In our practice, operators regularly underestimate the width of the "transfer" and "safekeeping" categories; both are drawn broadly, consistent with the FATF Recommendation 15 standard that the Seychelles regime tracks.
CTA #1 – for the reader encountering Seychelles for the first time: The perimeter analysis above describes the standard path. Your facts – the entity type, the user base, the transaction flows – change the answer materially. Map your options with an OBOLUS licensing analyst before you commit to a structure.
What licence categories does the FSA offer under the VASP Act?
The FSA administers two principal tracks under the VASP Act: registration, for lower-risk or smaller-scale operators, and licensing, for businesses carrying on higher-risk or higher-volume virtual-asset services. The distinction matters operationally: a licensed entity carries a more demanding set of ongoing obligations – prudential requirements, operational resilience standards, periodic reporting – whereas a registered entity faces a lighter supervisory load but a narrower permitted scope.
Exchange operations, custody services and any business that handles client assets will ordinarily fall into the licensing track. Advisory and certain intermediary roles may qualify for registration. The FSA has reserved discretion to determine the appropriate track at the point of application review; the regulator has shown willingness to require an upgrade from registration to full licensing where the actual business model exceeds the registration perimeter after the initial authorization is granted.
For an inbound operator assembling a multi-jurisdictional group structure, the key structural question is whether the Seychelles entity will be the primary regulated entity or a subsidiary/feeder vehicle beneath a licensed parent elsewhere. The answer drives both the track selection and the documentation package.
How does the VASP application process work at the FSA?
An FSA VASP application follows a sequential document-and-review process, and the preparation phase – before the form is submitted – is where most applications succeed or fail. The standard package includes an application form filed with the FSA, a comprehensive business plan covering proposed activities, target markets and revenue model, an AML/CFT compliance programme consistent with the FATF standards adopted under Seychelles law, a corporate governance framework, biographical and probity documentation for each controller, beneficial owner and proposed key person, and audited or management financial statements.
The FSA conducts a formal completeness review when it receives the submission. Incomplete applications are returned, resetting the clock. Substantive queries – which are common, particularly around AML programme adequacy and the source of capital – require timely, precise responses; protracted response cycles extend the authorization timeline materially. In our cross-border practice, we see applications with under-developed Travel Rule procedures most frequently attract substantive FSA queries, because the Travel Rule (the obligation to pass originator and beneficiary data with a virtual-asset transfer) is now a baseline supervisory expectation across every serious VASP regime.
Timeline to authorization varies by licence category and the quality of the initial submission. Applicants with clean probity profiles, a well-structured AML programme and clear documentation of the business model typically achieve the shorter end of the FSA's published processing range. Operators with complex group structures or prior enforcement history in other jurisdictions should expect a longer review cycle and should plan their go-live schedule accordingly.
What AML and Travel Rule obligations apply to licensed Seychelles VASPs?
Seychelles-licensed VASPs carry a full suite of AML/CFT obligations, calibrated to the FATF Recommendation 15 standard, as a condition of authorization and on an ongoing basis. The FSA has made AML programme adequacy a supervisory priority: applicants that present a generic policy manual rather than a programme tailored to their specific business model, risk profile and counterparty base consistently attract FSA queries or conditional approvals.
The Travel Rule applies to virtual-asset transfers above the applicable threshold. The Seychelles regime requires the originating VASP to obtain, verify and transmit specified originator and beneficiary information alongside a transfer; the beneficiary VASP must receive and screen the same data. The practical challenge for a licensed Seychelles operator is technical: achieving Travel Rule compliance requires either integration with a recognized VASP-to-VASP messaging solution or documented bilateral arrangements with counterparties. Regulators we advise clients alongside are increasingly examining the adequacy of these technical solutions at licence renewal and routine inspection.
Sanctions screening, transaction monitoring, suspicious-transaction reporting to the Seychelles Financial Intelligence Unit (FIU), and record-keeping obligations round out the compliance framework. For an entity that also interfaces with users in jurisdictions with their own AML supervisory regimes – the EU under MiCA, the UK under the FCA's money-laundering registration, Singapore under the MAS Payment Services Act – the Seychelles compliance programme must be calibrated to the highest common denominator across those touchpoints, not merely to the FSA's baseline.
How do tax and banking interact with a Seychelles VASP licence?
Seychelles offers a territorial tax system: a Seychelles IBC carrying on business outside Seychelles is generally not subject to corporate income tax in Seychelles, though the position turns on the substance of the entity's local operations and the application of the relevant Seychelles domestic rules. For a licensed VASP that maintains genuine operational substance in Seychelles – staff, management decisions, IT infrastructure – the tax position can be favorable relative to high-tax onshore domiciles. But substance is the operative word: a brass-plate structure without genuine local activity exposes the group to substance-and-management challenges in the beneficial owners' home jurisdictions and increasingly triggers adverse treatment under the OECD BEPS framework.
Banking is the operational pressure point for Seychelles-domiciled VASPs. Access to fiat correspondent banking – particularly USD and EUR clearing – is structurally difficult for crypto businesses domiciled in smaller offshore jurisdictions, including Seychelles. Most operators we advise secure their primary banking relationship in a different jurisdiction altogether: Malta, Lithuania, Switzerland, or a Gulf hub such as the UAE, where the combination of a domestic VASP or MiCA-compliant licence and a relationship with a crypto-friendly domestic bank provides a more stable rail. The Seychelles entity then sits at the group level, with the banking and client-facing payment infrastructure operated through a subsidiary or a licensed affiliate in a stronger banking jurisdiction.
This multi-entity architecture is not a workaround – it is the standard operating model for serious operators using Seychelles as a licensing or holding layer. The key is ensuring that the corporate and contractual relationships between the entities are documented cleanly, that transfer-pricing and thin-capitalization risks are managed, and that each entity in the chain holds the authorization appropriate to the activities it actually carries on.
CTA #2 – for the reader who has already tried and hit a wall: If a banking relationship was declined or a prior application stalled, a structural review can identify whether the entity architecture, the operating account jurisdiction or the compliance documentation is the root cause. Map your options with an OBOLUS licensing analyst.
Is a Seychelles VASP licence the right choice for your build?
Seychelles suits a specific operator profile – and materially less suited to others. A clear-eyed decision matrix keeps operators out of costly restructures twelve months after go-live.
Profile A – Group holding or treasury entity, no direct client services. A Seychelles IBC outside the VASP perimeter remains a cost-efficient, low-friction holding vehicle. No FSA authorization is required; the structure delivers flexible corporate governance and a favorable tax position provided genuine substance exists. This profile does not require the VASP Act at all.
Profile B – Exchange or brokerage targeting non-EU, non-UK, non-US retail or institutional clients. FSA licensing provides a recognized regulatory basis, a cost structure that is generally more accessible than a Singapore MAS major payment institution licence or a VARA Dubai licence, and a framework aligned to FATF standards. Banking must be solved separately. The absence of a MiCA passport means EU clients cannot lawfully be served from the Seychelles entity alone without a separate EU CASP authorization.
Profile C – Exchange or custodian targeting EU retail clients. Seychelles alone is insufficient. MiCA, administered by ESMA and the relevant national competent authority, requires a CASP authorization issued within the EU/EEA to access those clients. Seychelles can serve as the group holding or offshore-market layer, but an EU-authorized entity is non-negotiable for the EU-facing business.
Profile D – Token issuer seeking a recognized whitepaper and disclosure regime. Seychelles does not currently offer a whitepaper approval or token-offering authorization equivalent to MiCA's ART/EMT or the ADGM/FSRA's token recognition concept. An issuer targeting institutional investors with a structured token may find a UAE, EU or UK authorization more directly supportive of the target investor base's compliance expectations.
The honest answer for most inbound operators is that Seychelles works best as one layer of a multi-jurisdiction stack, not as a standalone regulatory home for a business with global ambitions.
A recent cross-border licensing matter
In a recent licensing engagement, a derivatives and spot exchange operator sought to establish a Seychelles entity as its primary regulated vehicle while maintaining payment infrastructure in a Gulf jurisdiction. The initial structure routed all client onboarding through the Seychelles entity and all fiat clearing through an affiliated Gulf payment company. Review of the architecture identified that the Gulf entity was itself conducting virtual-asset exchange activity, bringing it within the VARA activity perimeter in Dubai and requiring a separate VARA licence for those operations. We restructured the inter-entity service agreement to reflect the actual activity split, prepared the FSA application with an AML programme addressing both jurisdictions' expectations, and coordinated the allied-counsel engagement in the UAE for the VARA component. The operator launched with two compliant regulatory bases rather than one, avoiding the enforcement exposure that would have followed from the original structure.
What are the most common mistakes in a Seychelles VASP application?
Incomplete AML programmes are the most consistent failure point. The FSA expects a programme that is risk-stratified, covers the specific virtual-asset services the applicant will carry on, and addresses the Travel Rule in technical detail. Generic programmes imported from another jurisdiction's application without adaptation to the Seychelles regulatory context – and to the specific product set – reliably attract substantive queries.
The second consistent mistake is mischaracterizing the activity perimeter. Applicants that describe their business as "consulting" or "advisory" to avoid the licensing track, but whose actual services involve order execution or asset holding, face FSA enforcement or a mandatory track upgrade after authorization. The FSA reviews the actual business model, not the label.
The third is the banking assumption: applicants that file an FSA application without a banking solution, expecting the licence itself to open correspondent accounts, routinely find that the licence is a necessary but not sufficient condition for a banking relationship. Banking must be architected in parallel, not after the fact.
A common assumption among first-time offshore applicants is that a single Seychelles licence is sufficient to serve clients in the EU, UK and US without further authorization. That assumption is incorrect. Each of those jurisdictions asserts jurisdiction over businesses serving its residents or citizens, regardless of where the operator is incorporated. The FSA authorization addresses Seychelles-law compliance; it does not confer permission to operate in any other regulatory perimeter.
When should an operator engage outside legal counsel for an FSA application?
The right time to engage is before the corporate structure is finalized, not after. The entity architecture – which entity holds the licence, which employs the key persons, which enters the client contracts, which holds the banking relationship – determines both the application strategy and the ongoing compliance obligations. Changes to that architecture after authorization require FSA notification and, in material cases, a fresh application.
Counsel adds direct value in four places: first, the perimeter analysis (is FSA authorization required at all, and at what track?); second, the AML programme (calibrating it to both the FSA's expectations and the cross-border AML touchpoints the business will encounter); third, the biographical and probity pack for controllers and key persons (a single undisclosed regulatory history in another jurisdiction can halt an otherwise complete application); and fourth, the ongoing compliance calendar (FSA-licensed VASPs carry reporting and renewal obligations that require systematic tracking).
Operators we advise routinely engage counsel at the structuring stage – typically two to three months before the intended FSA filing – to ensure the architecture, the compliance programme and the key-person documentation are submission-ready on the first attempt.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – end-to-end licence strategy across 70+ jurisdictions for exchanges, custodians and issuers.
- Digital-asset custody authorization in the Cayman Islands – CIMA registration process and custody-specific requirements for Cayman-domiciled operators.
- De-risking and account-closure defence in Liechtenstein – strategies for operators facing banking access challenges in a tightening compliance environment.
FAQ
How long does a crypto licence take to obtain?
Authorization timelines vary by jurisdiction and licence category. In Seychelles, the FSA's processing timeline depends on submission quality: a complete, well-structured application with a compliant AML programme typically progresses faster than one requiring multiple rounds of supplementary queries. Operators should plan for a process measured in months, not weeks, and factor in pre-filing preparation time of at least two to three months for structural and documentation work.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction. The right answer depends on your target markets, investor base, banking options, staff locations, and the regulatory expectations of the clients you intend to serve. Seychelles suits holding structures and certain exchange or brokerage operations targeting non-EU, non-UK, non-US clients. EU access requires a MiCA CASP authorization; institutional capital often expects a Singapore MAS, VARA Dubai or ADGM/FSRA basis. We map the full stack before recommending a domicile.
Do I need a separate custody licence?
In Seychelles, custody of virtual assets on behalf of clients is a regulated activity under the VASP Act, and operators carrying on that activity require FSA authorization covering safekeeping and administration services. Whether a standalone custody licence or a combined exchange-and-custody authorization is the appropriate structure depends on the business model. Many jurisdictions – including the Cayman Islands under CIMA and Singapore under the MAS Payment Services Act – treat custody as a distinct regulated activity requiring separate authorization.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence, custody and payment layers before you commit to a structure – so you build once, correctly. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums when recovery is needed. Digital assets are the whole of our practice. Contact us at info@oboluslaw.com or via t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specializing in VASP authorization strategy for inbound operators across offshore and mid-shore digital-asset regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.