Economic Substance for Licensed VASPs for Institutional Clients

Operating a licensed VASP (virtual asset service provider) without genuine economic substance exposes the business to regulatory sanction, banking withdrawal and – for institutional clients specifically – the loss of counterparty confidence that underpins the entire revenue model. Regulators across every leading hub have moved from treating substance as a background expectation to treating it as a front-of-queue licence condition. The question is no longer whether substance matters; it is whether your current setup meets the standard that a prudent supervisor, an institutional due-diligence team and a correspondent bank would each independently accept. This page sets out the regulated basis for that standard, the process of building a compliant substance profile and the structural mistakes that most commonly derail institutional VASPs at the point of licence renewal or counterparty onboarding.

Why Does Economic Substance Matter for Institutional VASPs Specifically?

Institutional clients impose a higher substance threshold than any regulator. A sovereign wealth fund, a prime broker or a tier-one custodian running counterparty due diligence will look past the licence certificate and into the corporate record – board composition, local headcount, decision-making audit trail, and the physical or demonstrable operational presence behind the authorisation. A VASP that holds a valid licence but cannot evidence that its management and control genuinely reside in the licensed jurisdiction will fail that due diligence, regardless of what its constitutional documents say.

Substance failures for institutional VASPs cluster into three patterns. First, the "letterbox" entity: a licensed company with a nominal registered address, a single local director who also serves on dozens of other boards, and no staff who could answer a regulator's question about day-to-day operations. Second, the "licence-as-label" error: treating the authorisation as a marketing credential while running all real activity from an unlicensed parent in a third country. Third, the "static snapshot" problem: building adequate substance at authorisation and then allowing it to erode as the business scales and real decision-making migrates back to the headquarters jurisdiction. Each pattern creates a different enforcement vector; together they form the landscape of risk that sophisticated institutional counterparties are specifically trained to identify.

In our practice, we regularly advise licensed VASPs that have already lost – or are in imminent danger of losing – a key banking relationship precisely because their substance profile did not survive a correspondent's enhanced due-diligence review. The relationship between regulatory authorisation and institutional business development is direct: substance is the infrastructure on which both depend.

Operating without genuine substance in a licensed VASP structure is not merely a regulatory risk. It is a commercial disqualifier in the institutional segment of the market. Regulators from ESMA to VARA to MAS have each stated in published guidance that authorisation does not in itself confer legitimacy where real management and control cannot be demonstrated.

To map the substance requirements applicable to your entity structure and licensing jurisdiction, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your entity, your investor base and your banking relationships change the analysis in ways a general guide cannot capture.

What Is the Regulatory Basis for Substance Requirements in VASP Licensing?

Economic substance in the VASP context draws from four converging sources: the licensing conditions of the authorising regulator, international FATF (Financial Action Task Force) standards on effective supervision, corporate tax substance regimes in the licensed jurisdiction and the de facto counterparty standards applied by institutional clients and their compliance programmes. No single statute creates the complete picture, which is precisely why businesses that approach substance as a regulatory-checklist exercise – rather than an integrated legal and operational design – consistently fall short.

Under the MiCA regime, the ESMA framework requires CASP (crypto-asset service provider) applicants to demonstrate that their management body meets fit-and-proper criteria and that the governing mind of the entity is genuinely situated in the authorising member state. National competent authorities have consistently interpreted this to mean active board meetings in-jurisdiction, directors who can demonstrate relevant day-to-day engagement with the business and a physical operational address that is more than a mail-handling facility. The MiCA passporting mechanism – which permits a CASP authorised in one EU member state to provide services across the EEA – means that substance failures in the home member state can carry cross-border regulatory consequences.

Under the VARA regime in Dubai, activity-specific licence conditions explicitly require that licensed entities maintain a meaningful physical presence within the Emirate, that board meetings take place in Dubai and that key personnel are based there. VARA's rulebooks address this across multiple activity categories. In our cross-border practice, we have seen VARA's supervision team request evidence of local substance during periodic reviews – not only at the initial authorisation stage.

Singapore's MAS Payment Services Act licensing regime and Hong Kong's SFC VASP licensing framework each maintain analogous expectations. Both regulators assess whether the control and oversight of the licensed activity genuinely resides with personnel in the jurisdiction, and both have heightened their scrutiny of cross-border group structures where the licensed entity is presented as a subsidiary of a larger foreign operation.

Beyond the authorising regulator, the FATF Recommendations – specifically the provisions on effective supervision of virtual asset service providers – direct member-state regulators to look through corporate structures and assess where genuine control sits. A licensed entity that functions as a conduit for a group operating from an unsupervised jurisdiction faces a dual risk: the home regulator may find the licence conditions are not met, and the host regulator in the operational jurisdiction may find an unlicensed activity is being conducted.

What Substance Elements Does a Licensed VASP Actually Need?

The minimum viable substance profile for an institutional-grade licensed VASP comprises six identifiable elements, each of which must be demonstrable on request – not merely asserted in a compliance manual.

The first is board composition and meeting cadence. A majority of directors should be genuinely independent of the parent group and should meet in-jurisdiction on a regular schedule that corresponds to the real governance rhythm of the business. Board minutes must reflect substantive deliberation rather than rubber-stamped resolutions. For institutional clients, this is the single most scrutinised element during counterparty onboarding.

The second is local senior management. At least one C-suite or equivalent role – a chief executive, chief compliance officer or chief risk officer – should be based in the licensed jurisdiction and engaged in day-to-day business decisions. A nominal local director who is not operationally active will not satisfy either a regulator or an institutional due-diligence team.

The third is physical operational presence. This does not require a trading floor. It requires an address that the regulator can visit and find staff conducting the licensed activity. Shared-services offices are increasingly scrutinised; a dedicated space with visible operational activity is strongly preferable for the institutional segment.

The fourth is decision-making documentation. Risk decisions, client acceptance decisions and material operational decisions should be documented as having been made – or at minimum ratified – in the licensed jurisdiction. Where group policies apply, a local policy-adoption record demonstrating local management engagement is required.

The fifth is a staffed compliance function. An AML officer and a compliance team physically present in the jurisdiction – rather than outsourced to the parent group's central compliance function in a third country – is the standard increasingly expected under both MiCA and the VARA rulebooks.

The sixth is tax substance alignment. Several jurisdictions that have been popular VASP licensing locations maintain economic substance legislation that mirrors or exceeds the OECD/BEPS substance standards. A substance profile that satisfies the licensor but fails the local corporate tax authority creates a second enforcement vector that can destabilise the structure.

What Are the Most Common Substance Mistakes Institutional VASPs Make?

The most destructive error is timing: building the substance case only when a regulator or counterparty has already raised a concern. At that point, the business is operating defensively – assembling a retrospective narrative rather than presenting an integrated and contemporaneous record. In our experience, that distinction is immediately visible to an experienced supervising authority and to an institutional compliance team conducting a site visit or documentation review.

A second recurring error is group-function creep. A business will launch with a properly staffed local entity and genuine local governance. Over eighteen to twenty-four months, as the group matures and efficiency pressures grow, functions migrate to the parent: compliance is centralised, treasury is managed from the group headquarters, and technology decisions are taken by a group CTO with no formal relationship to the licensed entity. The licensed entity's substance profile hollows out without any deliberate decision to remove it. By the time a licence renewal or a major counterparty review arrives, the historical substance record has diverged significantly from the current operational reality.

A third error is the "offshore wrapper" assumption: the belief that a BVI or Cayman registration layered above an EU or UAE licensed entity simplifies the structure without creating substance complications. In fact, it frequently creates the opposite. Institutional counterparties and their legal counsel will trace the corporate chain to its apex and ask where the genuine management and control of the licensed entity sits. A parent holding company in an opaque jurisdiction with no local operations injects substance doubt into the licensed-entity tier even where that tier would otherwise be compliant.

Operators we advise routinely underestimate the extent to which institutional clients have developed their own substance evaluation frameworks. Prime brokers, custodians and fund administrators each maintain their own criteria, which frequently go beyond the regulatory minimum. Satisfying the licensor is necessary but not sufficient for the institutional segment.

How Does the Cross-Border Reality Complicate VASP Substance?

A licensed VASP serving institutional clients is almost invariably a cross-border business by nature. The entity sits in one jurisdiction; the management team may be distributed across several countries; the institutional clients are in a third set of jurisdictions; banking runs through correspondent relationships in yet another. Each of those layers introduces a substance consideration that the others do not resolve.

The classic cross-border tension is the "EU licence, non-EU management" model. A business obtains CASP authorisation in an EU member state – historically Lithuania or Malta have been common entry points – while retaining its genuine senior management and decision-making infrastructure in a jurisdiction outside the EU. The MiCA framework's requirement for genuine local governance directly conflicts with this model. The national competent authority in the licensing state has both the supervisory mandate and the enforcement tools to require remediation. Failure to remediate risks licence withdrawal – and for an institutional VASP, a licence withdrawal is not a manageable event.

The VARA regime presents the mirror image of this problem for businesses that have licensed in Dubai while retaining their operational infrastructure in a non-UAE jurisdiction. VARA's activity-specific rulebooks are explicit on the expectation of local presence. For institutional clients who are themselves UAE-registered or who have regulatory obligations to use supervised UAE counterparties, a VARA licence held by an entity that does not substantively operate from Dubai may itself be a commercial disqualifier.

Beyond the licensing jurisdiction, a licensed VASP with institutional clients in the EU, Singapore and Hong Kong simultaneously faces the possibility that each of those jurisdictions' regulators may assert supervisory interest in the VASP's activities with clients resident in their markets. Singapore's MAS and Hong Kong's SFC have each demonstrated willingness to scrutinise the activities of foreign licensed entities serving local institutions. The AML and Travel Rule obligations that attach to cross-border VASP transfers – under the FATF framework and implemented in each of these regimes – apply regardless of where the VASP is licensed. Substance, in this multi-jurisdictional picture, is not a single-jurisdiction question. It is a structural architecture question.

If your current substance architecture was designed for one jurisdiction and your client base has since grown across borders, a structural review is not optional – it is urgent. Write to OBOLUS at info@oboluslaw.com to initiate a scoped cross-border substance audit. If a prior application stalled or a banking relationship has closed, a second read can surface the structural reason and the route back.

Decision Matrix: Which Substance Profile Fits Your Operator Type?

Substance design is not uniform. The right architecture depends on the legal nature of the licensed activities, the jurisdiction of authorisation, the institutional client base served and the group structure through which the VASP operates. The following profiles illustrate how those variables interact.

Profile A – EU-licensed exchange serving institutional asset managers. This operator needs CASP authorisation in an EU member state with a substance profile that satisfies the national competent authority and the MiCA passporting requirements. The primary substance risk is management-control localisation: the board must be majority in-jurisdiction, the compliance function must be in-jurisdiction and key risk decisions must be documented as locally made. The key structural risk is group-function creep as the exchange scales and begins centralising operations at the parent level. Timeline from substance design to compliant profile is typically measured in months, depending on the starting position and the speed of local hiring.

Profile B – VARA-licensed broker-dealer serving sovereign wealth funds and family offices. This operator requires substance that satisfies both VARA's rulebook expectations and the considerably higher due-diligence standard of its institutional client base. Local headcount in Dubai, a resident senior manager holding an appropriate function approval and a board meeting cadence conducted in the UAE are baseline requirements. The additional institutional layer means the operator needs a contemporaneous governance record – not merely a compliant static snapshot – because sovereign-fund due diligence teams routinely request board minutes, decision logs and local organisational charts. Timeline to institutional-grade substance: longer, because the governance documentation infrastructure is as important as the physical presence.

Profile C – Multi-jurisdictional custody and staking business serving pension funds. This is the most complex profile. The business may hold a custody authorisation under MAS in Singapore, a separate VASP registration under the BVI FSC regime and be building toward an SFC licence in Hong Kong. Each regime has its own substance expectations; the institutional client base – pension funds – applies the strictest due-diligence standard in the market. Here, substance must be designed as an architecture across jurisdictions, with clear documentation of which entity is responsible for which licensed activity, which entity's management and control is genuinely local and how the group structure resolves rather than compounds the substance question. Allied counsel in each relevant jurisdiction are engaged to sign off on the local layer.

What Does the OBOLUS Substance Design Process Look Like?

The first step is a diagnostic review of the existing structure. We examine the current corporate chain, the constitutional documents, the board composition, the staffing record in the licensed jurisdiction, the decision-making documentation and the banking relationships. The diagnostic identifies the gap between the current profile and the profile required to satisfy the authorising regulator, the institutional counterparty standard and the local tax-substance regime. This stage typically takes a matter of weeks and produces a written gap analysis.

The second step is structural design. Based on the gap analysis, we produce a substance architecture recommendation: which roles need to be based in-jurisdiction, how the board should be constituted, what governance documentation cadence is required, how group functions can be structured to avoid substance migration and – where allied counsel are needed in additional jurisdictions – how those workstreams are coordinated. We map the licence, the banking and the tax stack before the client commits to any restructuring cost.

The third step is implementation support. We assist with the preparation of board governance frameworks, the drafting of local decision-making protocols, the review of employment arrangements for local senior personnel and the preparation of the regulatory submissions required where a material change to the VASP's structure or management requires notification to the authorising regulator. Under MiCA, the VARA regime and MAS each have mandatory change-notification obligations that apply to material management changes – getting those notifications right avoids inadvertent licence condition breaches.

The fourth step is the institutional readiness review. Before a new institutional counterparty due-diligence process begins, we review the substance record from the perspective of an external compliance team: what documentation exists, what gaps remain, and whether the record presented would satisfy the standard applied by the specific category of institution the client is targeting. We have seen institutional onboarding processes collapse not because the VASP's substance was genuinely inadequate, but because the documentation of adequate substance was not organised in a form a third-party reviewer could efficiently evaluate. That is a solvable problem, and solving it before the counterparty review begins is materially cheaper than addressing it after the relationship has stalled.

In a recent engagement, a licensed exchange with CASP authorisation in an EU jurisdiction had built what appeared to be a well-structured local subsidiary. When a major European prime broker initiated its onboarding review, the broker's compliance team raised concerns about the extent to which the local entity's compliance function was genuinely independent of the parent group's centralised compliance operation. We conducted a rapid gap review, restructured the reporting lines for the local compliance officer, produced a contemporaneous documentation trail of locally made compliance decisions and assisted the client in presenting a revised substance narrative to the prime broker's legal team. The onboarding was completed within weeks of the restructure. The underlying substance had been there; the documentation infrastructure had not.

Is One Licence Enough to Serve Institutional Clients Globally?

A common assumption among businesses entering the institutional digital-asset market is that a single licence in a well-regarded jurisdiction – an EU CASP authorisation, or a VARA licence in Dubai – is sufficient to service institutional clients across all markets from that one base. That assumption does not survive contact with the market.

The MiCA passporting mechanism allows a CASP authorised in one EU member state to provide services across the EU and EEA without separate national authorisations. That is a powerful tool within its geographic scope. Outside that scope, it provides nothing. A VASP licensed only in the EU and seeking to onboard a Singapore-based sovereign fund, a Hong Kong family office or a New York-based hedge fund will encounter regulatory barriers in each of those markets that a single EU licence does not resolve. MAS, the SFC and US federal and state regulators each have their own registration, licensing or exemption requirements for VASPs providing services to persons in their jurisdictions.

For institutional clients specifically, the concern is not only regulatory. A sophisticated institutional investor's legal and compliance team will ask whether the counterparty VASP is appropriately authorised in every jurisdiction relevant to the proposed activity. A VASP that relies on a single licence to cover a multi-jurisdictional client base may find that the institutional client's own regulators – not the VASP's regulator – determine that the arrangement is impermissible.

The practical answer for most institutional VASPs is a licence stack: a primary authorisation in the jurisdiction of principal operations, supplementary registrations or authorisations in the key markets where institutional clients are located, and a clear legal analysis of the territorial scope of each licence and how together they cover the intended activity. Building that stack is not a one-time exercise; it requires ongoing maintenance as the regulatory regimes in each jurisdiction evolve.

Related at OBOLUS

• Licensing and registration for digital-asset businesses – the complete licensing practice covering 70+ jurisdictions and all major VASP categories
• Legal counsel for digital-asset custodians – custody-specific licensing, substance and operational legal support
• Economic substance for licensed VASPs for established operators – substance design and remediation for VASPs past the initial authorisation stage

FAQ

How long does a crypto licence take to obtain?

Timelines vary materially by jurisdiction and licence category. In well-developed hubs, an application from a well-prepared applicant may be processed in a matter of weeks to several months; in more demanding regimes, review periods extend considerably longer. Preparation quality – completeness of the application, clarity of the substance case and responsiveness to regulator queries – is the single variable most within the applicant's control. We scope realistic timelines jurisdiction-by-jurisdiction at the outset of an engagement, not at the point of submission.

Which jurisdiction is best for licensing my crypto business?

There is no single answer that applies across operator types. The right licensing jurisdiction depends on the activities the business intends to conduct, the location of its institutional client base, its banking requirements, the substance it can genuinely establish and its cross-border group structure. EU licensing under MiCA offers passporting across the EEA but imposes meaningful substance requirements. VARA in Dubai offers strong institutional credibility for MENA-facing businesses. MAS in Singapore is the standard for Asia-Pacific institutional mandates. We assess these variables together before recommending a primary jurisdiction – and we map the supplementary registrations required to cover the full client base.

Do I need a separate custody licence?

In most leading jurisdictions, custody of digital assets is a regulated activity separate from exchange or brokerage operations. Under MiCA, VARA and the MAS Payment Services Act regime, a VASP that holds client assets – even as an ancillary function to a primary brokerage or exchange activity – will typically require a custody authorisation or an explicit custody permission within its existing licence. Providing custody services without the appropriate authorisation is a common structural error in institutional VASP builds, and one that institutional counterparties will identify immediately during onboarding review. Whether a separate licence is required, or whether the existing authorisation can be extended, is a jurisdiction-specific analysis we conduct as part of the licence-stack review.

OBOLUS is an independent digital-asset law boutique acting exclusively for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than seventy jurisdictions, on disputes and on-chain asset recovery across more than twenty-five forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence, banking and tax stack across operating, custody and payment layers before you commit to any structure – that integrated approach is what distinguishes institutional-grade advice from regulatory-checklist work. We advise crypto exchanges, custodians, token issuers and funds across more than seventy licensing jurisdictions. To discuss your situation, contact info@oboluslaw.com.

By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP authorisation strategy, economic substance design and multi-jurisdictional licence-stack architecture for institutional digital-asset businesses.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.