An established operator with an active VASP (virtual asset service provider) licence faces a compliance risk that grows quietly: the gap between the legal entity on the licence and the genuine economic activity the regulator expects to see there. As supervision across the leading hubs intensifies – VARA in Dubai, ESMA and national competent authorities enforcing MiCA (the EU's Markets in Crypto-Assets Regulation), the MAS regime in Singapore – regulators are no longer satisfied with a registered address and a compliance manual. They want substance. Staff on the ground. Decision-making in jurisdiction. Governance that matches the licence category. Missing that mark triggers licence suspension, enforcement proceedings and, in the worst cases, frozen banking relationships.
Economic substance for a licensed VASP is the set of operational, governance and staffing conditions that demonstrate to the licensing regulator that the authorised entity genuinely carries on the regulated activity from the jurisdiction on the licence. It is distinct from the initial authorisation process; it is the ongoing, live test the regulator applies at every supervisory review, every annual return and every on-site visit. For an established operator, the question is not whether to build substance – it is whether the substance already in place is the right kind, in the right place, and documented well enough to survive scrutiny.
This page sets out the regulatory basis for substance requirements, the common structural gaps we identify in practice, the cross-border complications that arise when an operator's technology, staff and users sit in different jurisdictions, and the process by which OBOLUS assists established operators in mapping and repairing those gaps.
What Regulators Mean by Economic Substance for a Licensed VASP
Substance requirements for a licensed VASP are not uniform across jurisdictions, but the underlying logic is consistent. The licensing regulator authorised the entity to carry on a regulated activity from its jurisdiction; it expects that activity to be directed, managed and, in significant part, executed from that jurisdiction. VARA in Dubai, the FSRA in Abu Dhabi's ADGM and ESMA-aligned national competent authorities under MiCA each specify substance expectations in their respective rulebooks or supervisory guidance. The common threads are: a qualifying management presence (board or senior management in jurisdiction), key functions not wholly outsourced abroad and adequate operational infrastructure to support the regulated activity.
In our practice, we see regulators apply substance tests along four axes. First, governance: are the directors and senior managers who take decisions about the regulated business physically and functionally present in the jurisdiction? Second, staffing: does the licensed entity employ – or contract with – sufficient qualified personnel to perform the core regulated functions, including the compliance and MLRO function? Third, operations: does the entity control its technology, data flows and customer-facing processes from the licensed jurisdiction, or is the reality that a parent or affiliate in another country runs everything? Fourth, financial substance: does the entity incur real operating costs in the jurisdiction proportionate to the scale of its business?
The test is qualitative and proportionate. A custody-only entity will face different expectations than a full-service exchange. What is non-negotiable, across every regime we work in, is that the regulator can trace a clear line from the licence category through to the actual conduct of the business.
Why Established Operators Face Heightened Risk of a Substance Finding
Established operators are disproportionately exposed to substance deficiencies because their structures evolved ahead of current regulatory expectations. A business that obtained a VASP registration in a lighter-touch regime several years ago – or secured a CASP authorisation in an EU member state during the pre-MiCA transition – may have built its technology and senior management in a different country entirely. The licence jurisdiction was chosen for speed or cost, not for its fit with where the business genuinely operates.
Regulators are aware of this history. The Bank of Lithuania, the MFSA under Malta's VFA framework transitioning to MiCA and the BVI FSC under the VASP Act 2022 have each signalled, through supervisory communications and on-site review programmes, that they will test the substance behind licences issued during earlier, less demanding periods. An operator that ignores this signal risks a supervisory finding that the entity is a shell, with consequences that range from a remediation direction to licence revocation.
The cross-border structure compounds the risk. Many established operators run a licensed entity in one jurisdiction, a technology subsidiary in another, and route customer contracts through a third. Each layer may individually appear compliant. Taken together, they can demonstrate to a regulator that the licensed entity does nothing that actually matters.
Operating an entity that fails a substance review can result in licence suspension, forced restructuring under regulatory direction and the loss of the banking relationships that depend on the licence being in good standing.
The process above describes the standard regulatory expectation. Your facts – your entity structure, your staff distribution, your technology arrangements – change the analysis materially. For a scoped assessment of where your substance gaps lie, contact OBOLUS at info@oboluslaw.com.
What Are the Most Common Substance Gaps in an Established VASP Structure?
The most common substance failure in an established VASP is a compliance and MLRO function that exists on paper in the licensed jurisdiction but is managed day-to-day from a group office in a different country. The regulator authorised the entity on the basis that it would have a qualified, independent compliance officer and a money-laundering reporting officer exercising genuine judgment. If those individuals report to a group compliance head abroad and have no real authority over the licensed entity's decisions, the substance claim collapses.
A second recurring gap is the board composition issue. Operators frequently appoint one local director to meet the letter of a residence requirement, then run governance through a board seated elsewhere. The local director attends meetings but does not direct the business. Under the substance frameworks applied by VARA, the FSRA and MiCA-aligned authorities, this is not a board with genuine management in jurisdiction – it is a formality. Regulators increasingly look at voting records, email chains and decision logs to determine where real control sits.
Technology and custody arrangements generate a third category of gap. An operator whose technology infrastructure is entirely operated by an affiliate in a different jurisdiction has a real argument to answer when the regulator asks who actually carries on the regulated activity. The licensed entity may sign the contracts and hold the customer assets on its ledger, but if the systems, the keys and the operational decisions all sit elsewhere, the substance case is weak.
In a recent matter, we acted for an exchange that had held a licence in an EU member state for several years. A supervisory review identified that all senior decision-makers were based in a third country and that the local entity had no staff with authority to commit the business. We worked through a governance restructure – relocating two senior appointments, revising the delegation-of-authority framework and implementing a documented decision-making protocol – and the entity resolved the supervisory concern ahead of its annual renewal. The process took a matter of months and was completed without enforcement action.
How Does the Substance Analysis Work in Practice?
A substance review for an established operator begins with a mapping exercise: every regulated function the licence requires is set against where that function is actually performed, who performs it and how it is documented. The output is a gap register – a prioritised list of the functions that do not satisfy the applicable standard, ranked by the severity of regulatory exposure they create.
The mapping exercise draws on the specific rulebook or supervisory guidance applicable to the licence. Under MiCA and the ESMA guidelines addressed to national competent authorities, the expectations for a CASP – a crypto-asset service provider – authorised in an EU member state are materially more prescriptive than the earlier national VASP registration regimes that MiCA is replacing. An operator that mapped its substance three years ago and has not revisited it since the MiCA transition is working from an outdated picture.
The remediation that follows the mapping exercise is bespoke. Some gaps require governance changes: board appointments, local committee mandates, revised terms of reference. Others require staffing changes: recruiting or relocating qualifying personnel, adjusting reporting lines, creating a local senior management function with genuine authority. Technology gaps may require a renegotiation of outsourcing or intra-group service agreements, so that the licensed entity's rights of oversight and direction over its infrastructure are contractually clear and operationally real.
Throughout the process, documentation is as important as the underlying changes. A regulator conducting a supervisory review will ask to see evidence of the substance that is claimed. Minutes, staffing records, financial accounts, outsourcing registers, decision logs and correspondence with the MLRO must collectively tell a coherent story. We assist operators in building and maintaining that evidentiary record as a standing compliance asset, not a one-time exercise assembled for an audit.
How Does a Multi-Jurisdiction Structure Affect the Substance Analysis?
The cross-border reality of digital-asset businesses makes substance management significantly more complex than a single-jurisdiction read of the rulebook suggests. A licensed entity in one hub, a technology subsidiary in a second country and a principal market in a third is the standard structure for a mid-sized operator – and each of those relationships has substance implications for the licensed entity.
The first complication is the outsourcing risk. When the licensed entity outsources a material function – technology operation, custody infrastructure, AML screening – to an affiliate or third party in another jurisdiction, most regimes require that arrangement to be governed by a written agreement that preserves the licensed entity's oversight rights, the regulator's access rights and the ability to exit the arrangement. If the outsourcing agreement does not reflect those requirements, the licensed entity is simultaneously failing its substance obligations and its outsourcing obligations.
The second complication is the employment and tax interaction. Relocating a senior manager to the licensed jurisdiction to build substance may trigger employment law, social security and personal tax consequences in both the origin and destination jurisdictions. In our practice, we coordinate with allied counsel in the relevant jurisdictions to ensure that a substance solution does not inadvertently create a new compliance problem in the territory the manager is leaving.
A third complication arises when the operator serves clients in jurisdictions where it does not hold a local licence. A licensed entity in an EU member state passporting under MiCA across the EEA has a defensible basis for cross-border service delivery; a licensed entity using a BVI or Cayman registration to serve retail clients in jurisdictions with their own VASP regimes does not. The substance of the licence does not resolve a market-access problem – and conflating the two leads operators into a category of exposure that a substance remediation alone cannot address.
We map the licence, banking and technology stack together, because substance in isolation answers only one of the three structural questions an established operator faces. To map the full structure before your next supervisory review, write to info@oboluslaw.com.
Decision Matrix: Substance by Operator Profile
The right substance strategy depends on the operator's actual profile. The following outlines how the analysis typically differs across three common configurations.
Profile A – the EU-licensed exchange seeking MiCA continuity. An exchange authorised under a prior national VASP regime in an EU member state that is transitioning to MiCA CASP status faces an authorisation review in which the national competent authority will assess whether the entity meets the MiCA standards for the activity it performs. Substance is tested at that review. Operators in this position should complete a gap mapping exercise before the review window opens, because remediation takes time and a regulator that identifies substance failures at the review stage may impose conditions rather than granting clean authorisation.
Profile B – the offshore-registered group entering a regulated hub. An operator that holds a BVI or Cayman registration and is now applying for a VARA licence in Dubai or a CASP authorisation in an EU member state will need to demonstrate from the outset that the new regulated entity has genuine substance. A paper entity with a local address and a nominee director will not satisfy VARA's activity-based licensing requirements or the MiCA authorisation standard. The substance framework must be built before the application is filed, not assembled afterward.
Profile C – the Singapore or Hong Kong operator with group functions abroad. An entity licensed under the MAS Payment Services Act or the SFC VASP regime in Hong Kong, with its technology, product and risk functions sitting in a third country, will face scrutiny of those outsourcing arrangements at every supervisory touchpoint. The remediation path is typically contractual – strengthening the outsourcing agreements and the licensed entity's documented oversight – combined with selective local hiring in the functions MAS or the SFC regard as most critical to the regulated activity.
A Common Assumption About Substance That Creates Risk
A common assumption among established operators is that a single offshore licence – issued by a lighter-touch regime – provides sufficient regulatory cover to serve clients across multiple markets, provided the operator complies with the conditions of that licence. This assumption is incorrect in two related ways.
First, the offshore licence only authorises the activity the issuing regulator can regulate. It does not grant permission to carry on regulated activity in jurisdictions with their own VASP or CASP regimes. Operators who serve clients in the EU, the UK, Singapore or Hong Kong from a BVI or Cayman entity are exposed to enforcement in each of those jurisdictions regardless of how strong their substance in the offshore location is. The substance work done for the offshore licence does not transfer to a market-access analysis.
Second, the lighter-touch offshore regimes are themselves developing substance expectations. The CIMA and the BVI FSC have both updated their VASP frameworks, and supervisory capacity in those jurisdictions has grown. An operator that has not reviewed its offshore substance posture in the last two years is likely working from assumptions about those regimes that no longer hold.
The correct frame for an established operator is not "does our licence cover our activity?" but "does our substance in every jurisdiction we operate in match the regulatory expectation in that jurisdiction for the activity we carry on there?" Those are different questions, and confusing them is the most common reason an established operator arrives at a supervisory review under-prepared.
Self-Assessment: Is Your VASP Substance Likely to Withstand Scrutiny?
Established operators can use the following markers as a preliminary self-assessment. Where the answer to any item is uncertain, that uncertainty is itself a finding – a regulator will find the same uncertainty, and the consequences of that discovery are worse than the cost of resolving it proactively.
- Can the licensed entity demonstrate that its board meetings are substantively conducted in the licensed jurisdiction, with attendance records and minutes that reflect genuine deliberation?
- Does the compliance officer and MLRO have genuine authority within the licensed entity, documented terms of reference, and a direct reporting line to the board – not to a group compliance function in another country?
- Are the licensed entity's material outsourcing arrangements governed by written agreements that give the regulator access rights and the entity exit rights?
- Does the licensed entity employ or contract with sufficient qualified staff in the licensed jurisdiction to perform the core regulated functions, including customer onboarding, transaction monitoring and complaints handling?
- Does the licensed entity incur real operating expenditure in the licensed jurisdiction at a level proportionate to the scale of the regulated business it conducts?
- Is the documentation supporting all of the above current, organised and capable of being produced to a regulator within the response window of a supervisory request?
If the answer to two or more of these questions is "no" or "uncertain," the operator's substance position requires review before the next regulatory contact.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – the full practice overview across 70+ licensing jurisdictions and activity types
- VASP Licence Application in Ireland – the Irish CBI regime, application process and substance expectations under MiCA transition
- MLRO and Compliance Officer Function – what recent enforcement signals about the standard regulators expect from senior compliance roles
FAQ
How long does a crypto licence take to obtain?
Timelines vary materially by jurisdiction and licence category. In our experience, straightforward VASP registrations in lighter-touch regimes can be completed in a matter of weeks; full CASP authorisations under MiCA or activity-based licences under VARA typically take several months and depend heavily on application completeness and the regulator's current workload. Substance preparation – which must precede or accompany the application – adds to the total timeline and is the most common cause of delay in established-operator applications.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction. The right choice depends on where your users are, where your banking sits, what activity the licence needs to cover and what substance your business can genuinely maintain in the licensed location. An EU CASP under MiCA provides passporting across the EEA; VARA in Dubai suits businesses with a genuine UAE operational presence; the MAS regime suits operators targeting Southeast Asian institutional clients. We map these factors against your structure before recommending a jurisdiction, because the wrong choice creates both a substance problem and a market-access problem simultaneously.
Do I need a separate custody licence?
In most flagship regimes, custody of client digital assets is a regulated activity distinct from exchange or brokerage activity. Under MiCA, custody and administration of crypto-assets on behalf of clients is a standalone CASP service requiring specific authorisation. VARA in Dubai and the MAS regime in Singapore treat custody similarly. An operator that holds client assets – whether directly or through a sub-custody arrangement – without the applicable authorisation is carrying on a regulated activity outside its licence scope, regardless of the other licences it holds.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit – so that a substance gap is identified and closed before the regulator finds it, not after. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums when recovery matters demand urgency. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP and CASP authorisation processes and economic substance compliance for established digital-asset operators across multiple regulatory regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.