Cross-chain bridges sit at the intersection of every live regulatory frontier in digital assets. A cross-chain bridge (a protocol that locks assets on one blockchain and mints a synthetic representation on another) introduces custody risk, counterparty exposure and potential licensing triggers the moment a regulated entity touches it. For exchanges, custodians, token issuers and funds operating under MiCA, VARA, the Payment Services Act or any comparable regime, the legal question is not whether bridges create risk – it is which specific regulatory obligations are activated, and by whom.
This page sets out the regulated basis for that analysis, the practical process a regulated entity should follow before using or integrating a bridge, the cross-border dimension that most compliance teams underestimate, and the decision framework our practice applies when a client asks us to clear a bridge interaction for regulatory purposes.
Why Cross-Chain Bridges Create Regulatory Exposure for Regulated Entities
The core legal problem with bridges is that the act of locking an asset and receiving a wrapped representation can constitute a regulated activity – or several simultaneously – under the laws of multiple jurisdictions. Under MiCA, custody of crypto-assets is a regulated service, and a protocol that holds locked collateral in a smart contract may, depending on governance and control, meet the functional definition of custodial service even without a human custodian. VARA in Dubai and the FSRA in Abu Dhabi take a similar functional approach: if an entity controls, or effectively controls, assets transferred through a bridge, activity-based licensing obligations may attach.
There are three distinct layers of exposure. First, the bridge operator may be carrying on a regulated activity without a licence. Second, the regulated entity using the bridge may be delegating a regulated function – custody or transfer – to an unlicensed third party, breaching its own authorisation conditions. Third, the synthetic asset minted on the destination chain may itself trigger a separate classification analysis: is it an asset-referenced token under MiCA's ART regime, a security under a national securities law, or an e-money token? Each answer produces a different compliance obligation.
In our DeFi practice, we have seen compliance teams treat bridge interactions as an infrastructure question rather than a legal one. That framing routinely produces gaps. Regulators across the leading hubs increasingly expect a regulated entity to document the legal nature of every counterparty interaction, including protocol-level interactions where no corporate entity is visible.
The trigger for regulatory concern is not the technology – it is the functional effect on assets that a regulated entity holds, transfers or issues on behalf of clients.
For a scoped assessment of your bridge exposure, contact OBOLUS at info@oboluslaw.com. The process above describes the standard exposure map. Your entity type, your user base and the specific bridge architecture change the analysis materially.
How Token Classification Drives Bridge Risk
Token classification is the first analytical step before any bridge interaction: the legal character of the asset being bridged determines which regime applies at each end of the transfer. A utility label on a whitepaper does not settle the legal classification. Regulators assess classification against the substance of rights conferred on holders, not the marketing term the issuer chose.
Under MiCA, an asset-referenced token (one whose value references multiple assets or currencies) and an e-money token (referenced to a single fiat currency) carry distinct issuer-authorisation and reserve obligations. A wrapped version of either token, minted through a bridge on a secondary chain, may inherit those obligations – or create new ones – depending on whether the minting process constitutes a fresh issuance or merely a representation of an existing instrument.
The same logic applies under the SFC's VASP regime in Hong Kong and under MAS's Payment Services Act in Singapore, where a digital payment token that passes through a bridge and arrives denominated differently may re-trigger a payment service licensing analysis. Regulated entities that issue, hold or facilitate transfers of any token with a value-reference feature must perform that classification analysis before allowing the token to interact with a bridge, not after.
DeFi protocols that act as issuers of synthetic assets – even passively, through automated smart-contract logic – are not exempt from this analysis. The principle that substance governs over label is a consistent feature of regulatory guidance across the MiCA, VARA, MAS and FCA regimes. A smart contract (self-executing code deployed on a blockchain) does not by itself insulate an issuer or operator from obligations that attach to the activity the contract performs.
What Due Diligence Should a Regulated Entity Conduct Before a Bridge Integration?
A regulated entity considering a bridge integration should complete a structured pre-integration review across four dimensions before any assets move. The review is not optional under most regimes: MiCA's CASP authorisation conditions, VARA's activity-based rulebooks and the FSRA's ADGM framework all impose ongoing obligations to assess the regulated character of third-party arrangements and to ensure that outsourcing or delegation does not compromise regulatory compliance.
The four dimensions are as follows.
First, operator mapping. Identify who controls the bridge. For a centralised or semi-centralised bridge, there is typically an operator entity that may need to be licensed in the jurisdictions where it provides services. For a fully decentralised bridge governed by a DAO (decentralised autonomous organisation, a governance structure running on-chain), the regulated entity should assess whether DAO governance creates a functional equivalent of a corporate counterparty and whether any identifiable participant sits in a jurisdiction with VASP obligations.
Second, custody and control analysis. Determine where assets sit during transit. If the bridge holds locked collateral in a multisig or smart contract controlled by identifiable parties, the custody analysis under the applicable regime must address whether the regulated entity has effectively delegated custody. Custodial delegation to an unlicensed party can breach the regulated entity's own authorisation conditions under MiCA, VARA and comparable regimes.
Third, the synthetic asset classification. Classify the wrapped asset that will be minted on the destination chain under both the originating and destination jurisdiction's law. If the wrapped token meets the definition of an ART or EMT under MiCA, or a security token under the securities law of the destination jurisdiction, additional obligations attach before the minting event.
Fourth, AML/Travel-Rule mapping. Under FATF Recommendation 15 and the Travel Rule (the obligation to pass originator and beneficiary data with a virtual-asset transfer), bridge transfers may constitute virtual-asset transfers for the purposes of data-passing obligations. Most leading regimes have adopted the Travel Rule in some form. Whether a cross-chain bridge interaction triggers those obligations – and whether the bridge provides the technical infrastructure to comply with them – is a live compliance question in every major hub.
The Cross-Border Dimension of Bridge Legal Risk
A bridge, by definition, involves two chains and often two regulatory environments simultaneously. The cross-border dimension is not merely a compliance footnote – it is the core structural feature that separates bridge risk from single-chain DeFi risk. A regulated entity licensed in the EU under MiCA may find that the destination chain of its bridge interaction is subject to a different regime, creating an obligation stack that its EU compliance programme was not designed to address.
Jurisdictional attribution in DeFi is one of the most contested questions in digital-asset law. Where a bridge operator sits, where the smart contract is deployed, where the regulated entity's users are located, and where the synthetic asset is marketed or made available are all potential grounds on which a regulator may assert jurisdiction. In practice, the FCA, ESMA, the SEC and MAS have all signalled an expansive view of jurisdiction over digital-asset activities that affect users in their markets, regardless of where the operator is incorporated.
The implications for a regulated entity are concrete. A CASP licensed in Lithuania under MiCA that routes client assets through a bridge to a destination chain popular with US users may simultaneously engage FinCEN's BSA/AML obligations and the SEC's potential classification of the synthetic asset as a security. The licensing stack that cleared the EU leg of the operation does not clear the US leg.
In our cross-border practice, we regularly advise entities that have correctly licensed one jurisdictional layer of a bridge interaction while inadvertently creating a second layer of unlicensed activity on the destination side. The structural correction – whether that means an additional licence, an allied-counsel opinion in the relevant jurisdiction, or a redesign of the routing architecture – depends on which regimes are engaged and in what sequence.
For a regulated entity that is already active across multiple hubs, a bridge integration should be treated as a cross-jurisdictional structuring question from day one. Retrofitting compliance after assets have moved is considerably more expensive, and in some regimes creates disclosure obligations or triggers supervisory review.
If a prior bridge integration was implemented without full regulatory clearance, or if an account was closed following a bridge-related transaction, contact OBOLUS at info@oboluslaw.com. A second read can surface the structural reason and the route back to compliance.
Smart-Contract Liability and DAO Governance Risk for Regulated Entities
When a bridge exploit occurs, liability attribution depends on who had control, who made representations about security, and which legal regime governs the relationship between the regulated entity and the bridge. These three questions rarely have clean answers in the current regulatory environment, but they are not unanswerable.
A smart contract failure – whether through a coding vulnerability, an oracle manipulation or a governance attack – can expose a regulated entity to client claims, regulatory censure or both. Under MiCA's CASP regime, a licensed entity that routes client assets through an external protocol carries operational risk obligations that require it to assess and document the risks of third-party integrations. The regime does not accept "the smart contract failed" as a complete defence to a client complaint about asset loss.
DAO governance compounds the problem. A DAO structure (a governance model where protocol decisions are made by token holders voting on-chain) typically has no clearly identified legal person. When a bridge is governed by a DAO and an exploit or governance attack causes loss, the regulated entity that relied on the bridge must demonstrate that its due diligence was commensurate with the risk. In jurisdictions with robust consumer-protection or fiduciary obligations – the UK under the FCA regime, Hong Kong under the SFC, Singapore under MAS – that standard is meaningfully higher than a simple "best efforts" framing.
We have seen a pattern in recent bridge-related disputes: a regulated entity assumed that because a bridge was widely used it had been implicitly vetted by the market. Market adoption is not a regulatory due-diligence substitute. Operators we advise are routinely surprised to learn that their regulator's expectations for third-party risk assessments extend to protocol-level integrations, not just traditional vendor relationships.
The practical response is a documented risk assessment that covers: the bridge's audit history; the identity and jurisdiction of the development team or foundation; the DAO governance structure and whether any participant may be characterised as a controlling person under the applicable regime; the insurance or reserve arrangements, if any; and the regulated entity's contractual remedies, to the extent any exist. Where no contractual relationship exists – which is common in permissionless DeFi – the entity should document that fact and the risk-acceptance rationale explicitly.
Decision Matrix: Bridge Integration by Regulated-Entity Profile
Different regulated-entity profiles face materially different risk profiles when considering a bridge integration. The following analysis maps the most common profiles to the relevant compliance pathway.
Profile A – Licensed exchange under MiCA. An exchange authorised as a CASP under MiCA that wishes to integrate a bridge to offer multi-chain asset support faces the full four-dimension review outlined above. The primary regulatory question is whether the bridge constitutes an outsourcing arrangement under the CASP authorisation conditions. If so, the exchange must notify its national competent authority and maintain enhanced oversight of the arrangement. The timeline for a material outsourcing notification under MiCA varies by NCA; regulated entities should build that buffer into their integration roadmap. The key risk: the NCA may require the exchange to suspend the integration pending review.
Profile B – Custodian under VARA or ADGM/FSRA. A custody licensee in Dubai or Abu Dhabi that bridges client assets to access yield or liquidity on another chain faces a direct conflict with the segregation and safeguarding obligations embedded in the VARA and FSRA frameworks. The regulatory expectation is that client assets remain under the custodian's control at all times. A bridge interaction that temporarily places assets outside that control – even for seconds, in an automated flow – may breach that expectation. The practical pathway is to obtain a written legal opinion confirming that the specific bridge architecture does not trigger the safeguarding obligation, and to present that opinion to the regulator before the integration goes live. The timeline for that process is typically measured in weeks, not days.
Profile C – Token issuer preparing a multi-chain deployment. An issuer deploying a token on multiple chains through a canonical bridge faces the synthetic-asset classification issue most acutely. If the token is an EMT or ART under MiCA, the wrapped version on the secondary chain is not automatically covered by the issuer's MiCA authorisation. The issuer should obtain a legal opinion on whether the wrapped token constitutes a new issuance requiring a separate authorisation or whitepaper, and whether the bridge operator needs to be a licensed entity for the wrapping to be permissible. The key risk: an uncleared multi-chain deployment may constitute an unregistered offering in the secondary jurisdiction.
Profile D – Investment fund with DeFi exposure. A fund regulated under CIMA, BVI FSC or an equivalent fund regime that holds bridged assets in a portfolio needs to address valuation, disclosure and risk-management obligations. The wrapped asset on the destination chain may trade at a discount to the native asset during periods of bridge stress, creating a valuation gap that the fund's NAV policy must address. The fund's offering documents should disclose bridge-specific risk factors explicitly. The regulatory risk is not a licensing breach but a disclosure failure, which carries its own enforcement consequences.
What Are the Most Common Mistakes Regulated Entities Make with Bridge Integrations?
The single most common mistake is treating a bridge integration as a technology decision rather than a regulated-activity decision. The second most common is assuming that a bridge that has been audited by a security firm has therefore been cleared from a regulatory standpoint. Audit and regulatory clearance are different processes with different outputs. A security audit addresses code vulnerabilities; it does not address whether the bridge operator is licensed, whether the wrapped asset is classified, or whether the Travel Rule obligations have been satisfied.
A common assumption is that a utility label on the bridge's native token – or the absence of any native token – means the bridge falls outside the regulated perimeter. It does not. The regulatory characterisation of bridge activity depends on the function performed, not on whether the bridge protocol has issued a token. An unlabelled bridge that holds client assets in a smart contract pending cross-chain transfer may nonetheless constitute a custodial service for regulatory purposes.
Further common errors we have observed:
- Failing to assess whether the bridge interaction constitutes a reportable transaction under the applicable AML framework.
- Not mapping the Travel Rule data obligations on both sides of the transfer before the integration goes live.
- Using a DAO-governed bridge without any legal analysis of whether identifiable DAO participants may create regulatory nexus in a supervised jurisdiction.
- Treating a bridge as a permanent integration without establishing a periodic review process as the bridge's governance or architecture evolves.
In a recent matter, a payments company with an EU CASP authorisation integrated a cross-chain bridge to support a multi-token product without performing a formal regulatory review of the bridge operator's status. The national competent authority identified the integration during a routine supervision cycle and required the company to produce documentation of its third-party risk assessment. Because no formal assessment had been conducted, the company faced a remediation programme that consumed several months of compliance resource. We assisted the company in reconstructing the assessment, engaging with the regulator and establishing a prospective governance framework for protocol-level integrations. The matter was resolved without formal enforcement action.
Related at OBOLUS
- DeFi, Tokenization and Smart-Contract Law – our core practice covering protocol-level legal analysis and on-chain structuring for digital-asset businesses.
- Oracle and Data-Feed Liability in the United States – federal and state MTL analysis for data-dependent DeFi protocols operating in US markets.
- Cross-Chain Bridge Legal Risk for Early-Stage Founders – the founder-stage companion to this regulated-entity analysis.
FAQ
Can a DeFi protocol be regulated?
Yes. Regulatory characterisation turns on function, not architecture. If a DeFi protocol performs an activity that constitutes a regulated service under the applicable regime – custody, exchange, transfer of value, issuance – then the protocol, and in some cases its developers, operators or governance participants, may fall within the regulated perimeter. ESMA under MiCA, VARA and MAS have each indicated a functional approach that does not exempt activity solely because it is performed through autonomous code.
What legal wrapper suits a DAO?
No single wrapper suits all DAOs. Common options include a foundation in Switzerland or the Cayman Islands, a limited liability company in a jurisdiction that has enacted DAO-specific legislation, or a hybrid structure that separates the on-chain governance layer from an off-chain entity that holds IP and enters contracts. The right choice depends on the DAO's activities, its token structure, and the jurisdictions of its key participants. We assess each DAO structure against the substance of its operations, not the label it adopts.
Who is liable when a smart contract fails?
Liability depends on who deployed the contract, what representations were made about it, what relationship exists between the deployer and the injured party, and which jurisdiction's law governs. Developers, issuers and regulated entities that rely on a contract all face different exposure profiles. A regulated entity that routes client assets through a failed contract will also face regulatory scrutiny of its due-diligence process, independent of any civil liability question. There is no automatic immunity from loss or liability because the code executed as written.
OBOLUS is an independent digital-asset law boutique acting exclusively for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than seventy jurisdictions, on disputes and on-chain asset recovery across more than twenty-five forums, and on the tax, banking and compliance obligations that sit around every digital-asset structure. Digital assets are the whole of our practice. We assess token classification against the substance of rights conferred, not the marketing label – and we advise on cross-chain bridge legal risk as an integrated regulatory, structuring and dispute-prevention question. To discuss your situation, contact info@oboluslaw.com or message us via t.me/oboluslaw.
By Roman Levitt, Technology and DeFi Counsel – specialist in smart-contract legal analysis, DAO governance structures, and cross-chain protocol risk for regulated digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.