Operating a virtual asset service in the United Kingdom without satisfying the Financial Conduct Authority's substance expectations is one of the fastest routes to a frozen banking relationship, a stalled application, or a public censure notice. With economic substance (the requirement that a registered or authorised entity maintain genuine operational presence in its home jurisdiction) now a live enforcement concern across every regulated digital-asset hub, UK-registered VASPs (virtual asset service providers) face a sharply defined question: does the business actually live where its licence says it does?
The FCA's cryptoasset registration regime, operating under the Money Laundering Regulations, demands more than a postal address. Senior management must exercise real oversight from within the UK, compliance functions must be staffed and accessible, and the AML/CFT programme must reflect the actual risk profile of the UK-facing business. Where those conditions are not met, the FCA has demonstrated an appetite to refuse, cancel or impose requirements – and banking counterparties have begun conducting their own substance reviews before onboarding a registered VASP.
This page sets out the substance framework a UK-registered VASP must satisfy, how it interacts with the broader licence and tax stack, and the specific cross-border complications that arise when the beneficial owner, the customers or the banking relationship sit outside the UK.
What Does Economic Substance Mean for a UK-Registered VASP?
Economic substance, in the UK context, means that the entity carrying the FCA registration genuinely conducts and controls its cryptoasset activities from within Great Britain or Northern Ireland. The FCA does not publish a checklist, but its published guidance, supervisory correspondence and refusal decisions point to a consistent set of indicators: a UK-resident senior management team with real authority over risk and compliance decisions, a UK-based Money Laundering Reporting Officer accessible to the regulator, documented policies and procedures that reflect UK-specific risk, and an operational footprint – premises, staff, systems – proportionate to the volume and complexity of the business.
The threshold scales with the risk profile of the firm. A small peer-to-peer exchange operating exclusively in sterling with a few thousand customers carries a different substance expectation than a multilateral trading facility accepting institutional orders across multiple fiat currencies. The FCA applies a proportionality lens, but the floor – an MLRO (Money Laundering Reporting Officer) who is present, responsive and empowered to act – does not move.
For businesses structured with a parent entity offshore and a UK subsidiary holding the registration, the regulator scrutinises whether the UK entity genuinely controls the AML programme or whether it is simply a conduit for a group function managed elsewhere. Where the latter is found, refusals have followed. We have seen this pattern arise repeatedly for operators who assumed that delegating compliance upward to a group function satisfied UK requirements. It does not.
Book a scoped assessment of your substance position before the FCA does it for you. The process above captures the standard indicators, but the weight attached to each factor turns on your specific entity structure, the jurisdiction of your counterparties, and the profile of your user base. To map where your gaps sit, contact OBOLUS at info@oboluslaw.com.
The FCA Registration Process and Where Substance Is Tested
The FCA's cryptoasset registration process under the Money Laundering Regulations proceeds in distinct stages, and substance is tested at each of them. The application opens with a business model assessment: the FCA reviews what the firm does, who its customers are, where its revenues originate, and how its senior management is distributed. Applicants that cannot demonstrate UK-resident leadership with genuine decision-making authority routinely receive information requests or outright refusals at this stage.
Following the business model review, the regulator conducts an AML/CFT framework assessment. This is where the substance of the compliance operation is tested in detail. The FCA expects the firm to produce a documented risk appetite statement, a customer risk assessment methodology, a transaction monitoring policy and a sanctions screening programme – all of which must be calibrated to the firm's actual UK-facing risk. Template policies downloaded from a compliance vendor and not adapted to the specific business are a common source of delay.
Fit-and-proper assessments of senior managers and beneficial owners run in parallel. Each individual must demonstrate both competence and integrity: the FCA will review criminal records, regulatory history in other jurisdictions and, increasingly, whether a manager's primary place of business is genuinely in the UK. A director who appears in multiple offshore entities across multiple unrelated sectors attracts additional scrutiny.
Timeline from submission to a decision varies considerably and the FCA has not committed to a fixed determination window under the registration regime. In our practice, well-prepared applications with a clean substance profile and no prior regulatory history in contested jurisdictions tend to progress more quickly than those involving complex group structures or international beneficial ownership chains. Applications that generate multiple information requests can extend significantly beyond initial projections.
How Does UK Substance Interact With an Offshore Group Structure?
Many UK-registered VASPs are subsidiaries of holding structures domiciled in the BVI, Cayman Islands or another offshore centre. That parent-subsidiary relationship is not inherently a problem for the FCA, but it creates a set of structural tensions that must be addressed explicitly before and during the registration process.
The first tension is governance. If the UK entity's board decisions are effectively pre-ordained by a parent board meeting offshore, the FCA may conclude that the UK company is not in genuine control of its own risk and compliance. The solution is documented delegation – a formal matrix showing which decisions are reserved for the UK board, which are taken at group level, and how the UK MLRO's independence is protected from group commercial pressure.
The second tension is the Travel Rule (the FATF-derived obligation requiring originator and beneficiary data to accompany virtual asset transfers). The FCA applies the Travel Rule to UK-registered VASPs, meaning the UK entity must have the systems and counterparty relationships to receive and transmit the required data, regardless of where the group's core technology infrastructure sits. Where the technology is hosted offshore and administered by group personnel, the UK entity must demonstrate that it retains genuine oversight and can produce Travel Rule records on demand.
The third tension is banking. UK-based correspondent banks and e-money institutions conducting due diligence on a VASP client will examine the same substance indicators the FCA does, and in some cases will apply a stricter standard. A firm that satisfies the FCA's registration requirements but cannot demonstrate genuine UK operational presence to a banking compliance team may find itself without a settlement rail. We regularly advise on structuring the operational footprint to satisfy both regulatory and banking audiences simultaneously.
Cross-Border Complications: Tax, Beneficial Ownership and the Substance Stack
Economic substance in the regulatory sense and economic substance in the tax sense are distinct but increasingly convergent concepts for UK-registered VASPs. HMRC's position on corporate residence turns on where central management and control is exercised – a test that closely mirrors what the FCA examines for substance purposes. A firm that successfully argues to the FCA that its senior management exercises genuine UK control has, in substance, acknowledged that the entity is likely UK tax-resident. That consequence needs to be planned for, not discovered after registration.
For group structures where the UK entity is intended to be a limited-purpose registration vehicle managed from an offshore parent, the risk is that the substance required to satisfy the FCA tips the entity over the threshold into UK tax residence, bringing its worldwide income within the scope of UK corporation tax. We have seen operators encounter this outcome because the regulatory and tax workstreams were managed by separate advisers who did not communicate during the design phase.
Beneficial ownership disclosure adds a further layer. The UK's People with Significant Control register requires disclosure of ultimate beneficial owners above the applicable thresholds, and the FCA cross-references PSC filings in its fit-and-proper assessments. Offshore holding chains must be mapped and disclosed accurately. Discrepancies between PSC filings and information provided in the FCA application are a significant red flag and have contributed to refusals.
The interaction with VAT also deserves attention. Certain cryptoasset services are exempt from UK VAT, but others – particularly services involving intermediation or payment processing – may carry a VAT liability that depends on where the underlying supply is made and to whom. This determination affects how the UK entity's revenues are classified for both VAT and corporate tax purposes, and it is material to the business model presentation in an FCA application.
If your group structure was designed for a different regulatory environment and is now being adapted for UK registration, the fit-and-proper and tax-residence questions require a coordinated review. To pressure-test your structure before you commit, message us via t.me/oboluslaw.
What Does a Compliant UK Substance Footprint Look Like in Practice?
A compliant UK substance footprint for a VASP is one where the entity's AML/CFT governance, its senior management decision-making and its operational capability are all genuinely present in the UK and demonstrable on demand. The specific configuration will differ between a custody-only provider, a spot exchange and a fiat-on-ramp operator, but the common denominator is that the FCA must be able to identify a real person, in a real UK role, who owns each element of the compliance programme.
In practical terms this typically means a UK-resident MLRO who spends a material proportion of their working time on the UK entity's compliance affairs, board minutes that record substantive risk and compliance discussions rather than rubber-stamping group decisions, a UK office address from which the MLRO is genuinely accessible, and a transaction monitoring system either hosted in the UK or accessible in real time by UK staff with documented override authority.
Proportionality matters. A firm processing a modest volume of retail transactions does not need the same infrastructure as a firm serving institutional counterparties across jurisdictions. But proportionality is not a synonym for minimal. The FCA has refused applications from firms where the sole compliance resource was a part-time consultant engaged on a retainer with no documented authority to halt transactions or file suspicious activity reports independently.
A micro-matter from our cross-border practice illustrates how quickly the gap between paper structure and real substance becomes visible: in a recent licensing matter, a payment-focused VASP had engaged a UK-resident MLRO but had given that individual no system access, no authority to block transactions and no direct reporting line to the board. When the FCA's information request arrived, the firm could not produce a single board minute recording a risk or compliance decision. The application stalled for several months while the governance structure was rebuilt. The fix was achievable, but the delay cost the client a banking relationship it had secured contingent on timely registration.
Banking Access and the Substance Signal
Securing and maintaining a UK banking relationship is the operational test that substance requirements must ultimately pass. Banks conducting enhanced due diligence on VASP clients apply their own substance criteria, which often exceed the FCA's published threshold. A registered VASP that cannot demonstrate genuine UK operations to a bank's financial crime compliance team will be declined or offboarded regardless of its regulatory status.
The substance signals that banks weigh most heavily include: the physical location of the MLRO and compliance team; the origin of transaction volume (a UK-registered firm with 95% of its volume from non-UK users raises immediate questions); the source of funds used to capitalise the UK entity; and the identity and reputation of the beneficial ownership chain. Each of these maps directly onto the substance work done for the FCA application, which is why the two processes should be run as a single workstream rather than sequentially.
E-money institutions and payment service providers that serve VASPs as banking alternatives apply similar diligence. In our practice, we regularly map the substance documentation produced for the FCA application directly onto the due diligence questionnaire format required by the EMI or PSP, reducing the duplication of effort and ensuring that the narrative presented to the bank is consistent with the regulatory record.
For operators whose primary customer base sits outside the UK, the banking conversation also involves demonstrating that the UK entity is the genuine originator and beneficiary of the relevant payment flows – not a pass-through for transactions economically connected to an offshore parent. Where that distinction cannot be clearly drawn, some banks will decline even a fully registered firm.
Decision Matrix: Which Operators Should Prioritize UK Substance?
Not every VASP needs to hold a UK registration, and not every firm that holds one needs the same depth of UK substance. The decision turns on four factors: the location of the customer base, the nature of the services provided, the group's banking and payment requirements, and the regulatory relationships already in place in other jurisdictions.
Profile A is a firm serving UK retail customers with exchange or custody services. This firm has no choice: serving UK users without FCA registration exposes it to enforcement under the Money Laundering Regulations, potential criminal liability for the principals and certain account closure by any UK-regulated bank or payment provider. The substance requirement here is non-negotiable, and the depth of infrastructure required is material. Timeline to a compliant position, starting from an unregistered state with a clean ownership structure, is a matter of months in the best case.
Profile B is a firm incorporated in an EU member state under a MiCA CASP authorisation that wishes to access UK institutional counterparties. MiCA passporting does not extend to the UK post-Brexit. The firm must either establish a UK entity and obtain FCA registration, or route UK-facing activity through an affiliated entity that holds the registration. The substance question for the UK entity is the same as for Profile A, but the timeline may be shorter if the group already has documented AML infrastructure that can be adapted rather than built from scratch.
Profile C is an offshore-domiciled firm with no UK customers that holds a UK registration for banking access purposes only. This is the profile most exposed to the FCA's substance scrutiny. A firm that cannot demonstrate any genuine UK-facing activity has limited basis for the registration and faces the risk that a supervisory review will result in cancellation. Allied counsel in the relevant jurisdiction can help assess whether the banking objective can be achieved through a different structural route.
Each profile carries a different risk-to-cost ratio, and the right answer for a given operator depends on facts that a generic analysis cannot resolve. We map the licence, banking and tax stack for each client before any application is filed.
FAQ
How long does a crypto licence take to obtain?
Timeline under the FCA's cryptoasset registration regime varies with the complexity of the application and the FCA's supervisory workload. A straightforward application from a UK-incorporated entity with a clean ownership structure and a well-documented AML programme will typically take longer than several weeks; complex group structures or international beneficial ownership chains can extend the process considerably. Well-prepared applications with no prior regulatory history in contested jurisdictions progress more quickly. We advise clients to plan for a multi-month process and to secure provisional banking relationships subject to registration before filing.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on where your customers are, what services you offer, your banking requirements, your tax position and the regulatory relationships you already hold. The UK suits operators needing access to sterling rails and UK institutional counterparties. The EU's MiCA CASP regime suits firms serving EU retail customers across member states. VARA in Dubai and the AIFC in Kazakhstan serve different operator profiles again. We map the full licence, banking and tax stack before recommending a jurisdiction, because a licence obtained in the wrong jurisdiction creates more cost than it saves.
Do I need a separate custody licence?
Under the current FCA regime, custody of cryptoassets is a regulated activity if it involves safeguarding and administering cryptoassets on behalf of clients. Whether a separate authorisation is required, or whether custody can be included within an existing registration or authorisation, depends on the nature of the custody arrangement and the FCA's current supervisory position on the relevant activity. As the UK moves toward a more comprehensive cryptoasset regulatory regime, custody requirements are expected to become more explicitly defined. Operators providing custody alongside exchange or payment services should obtain a current legal assessment rather than relying on generic guidance.
Related at OBOLUS
- Licensing and Registration for Digital Asset Businesses – how we map the full licence stack across jurisdictions and operator profiles
- CASP Authorisation Under MiCA in Panama – EU passportable authorisation for operators with a Latin American or offshore parent structure
- Token Issuance and Offering Rules in Singapore – MAS framework for token offerings and the cross-border interaction with UK financial promotion rules
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before clients commit to a structure, and our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in FCA cryptoasset registration, substance structuring and cross-border licence stack design for VASP operators entering UK and EU regulated markets.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.