Regulators in every major hub now treat economic substance as a licence condition, not a formality. A virtual asset service provider (VASP) that holds a regulatory authorisation but cannot demonstrate genuine local activity — staff, governance, infrastructure, decision-making — faces suspension, non-renewal or the withdrawal of its VASP registration without warning. For a regulated entity already holding a crypto licence, that risk is immediate and structural.
Economic substance for licensed VASPs sits at the intersection of licensing requirements, ongoing supervision obligations and the cross-border reality that most digital-asset businesses serve users in jurisdictions where they are not licensed. Getting that intersection wrong exposes the business to enforcement in the licensing jurisdiction and regulatory scrutiny everywhere else.
This page explains the regulatory basis for substance requirements, the process for meeting them, the common points of failure we see in practice, and how the cross-border licensing stack shapes the analysis for a regulated entity.
What Economic Substance Actually Means for a Licensed VASP
Economic substance, in the context of VASP licensing, means that the regulated entity conducts its core income-generating activities from the jurisdiction where it holds its regulatory authorisation. The requirement is not limited to having a registered office address. Regulators at VARA, the MAS under Singapore's Payment Services Act, the SFC in Hong Kong, and the FSRA in Abu Dhabi all apply some version of this test. They look at where senior management makes real decisions, where compliance and AML functions operate, where technology is controlled, and whether the staff count is proportionate to the licensed activities.
A letterbox entity — registered locally but managed entirely from abroad — has historically been treated as compliant in some low-scrutiny regimes. That model has largely closed. The convergence of FATF Recommendation 15 obligations with domestic licensing regimes means supervisors now inspect substance as part of annual reporting cycles and licence renewal.
In our practice, the failure point is rarely bad intent. It is the gap between the moment of authorisation and the build-out of genuine operations. A founding team that obtained a licence to raise institutional capital, then delayed the hiring and office programme, is the most common profile we see presenting this problem.
The Regulatory Basis: Why Substance Requirements Exist
Substance requirements for licensed VASPs derive from two distinct but reinforcing sources. The first is domestic licensing law. Each major regime embeds minimum operational requirements in its authorisation conditions or rulebooks. VARA's rulebooks specify staffing and governance expectations. Singapore's MAS sets fit-and-proper and operational requirements that presuppose a functioning local entity. The FSRA in ADGM requires that regulated activities be conducted from within the free zone. MiCA, the EU-wide framework administered by ESMA and national competent authorities, builds substance directly into the CASP authorisation test for a crypto-asset service provider.
The second source is international tax and anti-avoidance policy. The OECD's base erosion frameworks and the EU's list of non-cooperative jurisdictions both use economic substance as a marker of whether an entity has genuine commercial presence. For a VASP incorporated in a low-tax jurisdiction — the BVI, Cayman, or Mauritius — and licensed in a second jurisdiction, the question of where substance actually sits has tax consequences that run alongside the regulatory ones. That interaction is something we regularly advise on as a cross-border structuring matter.
Operators we advise routinely underestimate how quickly a regulator moves from an informal request for information to a formal notice. The trigger is often a licence renewal, a change-of-control application, or a banking correspondent review. Each of these prompts a fresh substance assessment.
What Does a Substance Programme Need to Cover?
A credible substance programme for a regulated VASP typically spans four dimensions, each of which a regulator may examine independently.
Governance and decision-making. Board or equivalent governance meetings must take place in the jurisdiction and must address material decisions about the licensed business. Minutes should record that consequential calls — risk appetite, product changes, material contracts — are made locally, not ratified after the fact from a parent entity abroad.
Qualified staff in jurisdiction. The compliance officer, MLRO and key management function holders the licensing regime designates must be physically present and actively working in the licensed jurisdiction. Relying on group-level compliance from a different country is a common source of supervisory friction. The head count must be proportionate to the scope and volume of the licensed activities.
Operational infrastructure. Core systems — AML transaction monitoring, customer due diligence workflows, custody infrastructure where applicable — must either be operated from the jurisdiction or subject to demonstrable local oversight. Regulators distinguish between outsourcing with appropriate governance and a purely managed-service model with no local control.
Physical presence and expenditure. Office space, local banking relationships, and operating expenditure in the licensing jurisdiction are all evidence markers. A VASP whose entire cost base sits in a parent company abroad, with no local spend, will struggle to satisfy a substance review.
How Does a Regulated Entity Build or Remediate Its Substance Position?
Building or remediating substance for an existing VASP authorisation is a structured process, not a single act. The process typically proceeds in phases.
The starting point is a substance gap analysis against the specific requirements of the licensing regime. This maps the current operating model against each dimension the regulator assesses. The output is a ranked remediation list, distinguishing items that are high-urgency — a missing local MLRO, board meetings held outside jurisdiction — from medium-term build items such as a technology infrastructure transition.
The second phase is a legal and structural review of the cross-border operating model. Where group entities in other jurisdictions provide services to the licensed VASP, the intercompany arrangements must reflect market terms and must not imply that real management and control sits offshore. This review frequently surfaces issues in service agreements drafted before the licensing application was filed.
The third phase is regulator communication. In many jurisdictions, proactively notifying the regulator of a remediation programme and a realistic timeline is materially better than waiting for an inspection to reveal the gap. We have seen regulators in leading hubs treat proactive disclosure as a mitigating factor when considering enforcement posture.
The fourth phase is ongoing monitoring. Once remediation is complete, a substance compliance calendar — tracking governance meeting records, headcount certifications, local expenditure schedules — should be embedded in the compliance function. Annual licence renewals and supervisory questionnaires will draw on this documentation directly.
The process above describes the standard path. Your facts — the entity structure, the jurisdictions involved, the gap between current and required substance — change the analysis materially. To map the substance requirements for your licensing jurisdiction and operating model, contact OBOLUS at info@oboluslaw.com.
What Are the Most Common Mistakes Regulated Entities Make?
Substance failures in licensed VASPs cluster around a small number of recurring patterns. Recognising them early is the best way to avoid an enforcement outcome.
Treating the application as the finish line. Substance obligations do not crystallise at authorisation and remain static. They scale with the business. A VASP that obtained its crypto licence with five employees and has since grown its transaction volumes tenfold must have a substance profile that reflects the current business, not the one described in the initial application.
Outsourcing compliance without retaining local accountability. Group-level AML and compliance functions can support the licensed entity, but the licensed VASP must have an identified local officer who owns the function and is answerable to the regulator. Many operators conflate outsourcing the work with delegating the regulatory obligation. These are not the same.
Misreading substance requirements when passporting. Under MiCA, a CASP authorised in one EU member state may passport across the EU/EEA. But the substance requirement attaches to the home-state authorisation. Using the passport to serve users across Europe while progressively hollowing out the home-state operations is a pattern regulators are now explicitly examining.
Ignoring the banking dimension. A licensed VASP that cannot maintain a correspondent banking relationship because its substance profile does not satisfy the bank's AML correspondent due diligence standards has a compounding problem. The substance gap creates the banking gap; the banking gap then triggers a regulator notification event.
In a recent matter, a payments company holding two VASP authorisations in separate EU jurisdictions discovered during a banking correspondent review that its governance arrangements in both entities pointed to management decisions being made at group level in a third country. We restructured the governance arrangements and implemented separate local compliance frameworks, each satisfying the relevant national competent authority. The banking relationships were restored following the provision of updated substance documentation.
How Does the Cross-Border Operating Model Affect Substance Planning?
Most VASP-licensed entities do not operate in a single jurisdiction. The entity holding the crypto licence may sit in one country, the technology infrastructure in a second, the banking in a third, and the majority of users in a fourth. Each of those facts carries a regulatory and substance implication.
The question is not only whether the licensing jurisdiction is satisfied. It is whether activity directed at users in other jurisdictions creates secondary licensing obligations in those places — and whether the substance profile of the primary licensed entity supports a defensible position that it is not conducting regulated activities in the secondary jurisdiction without authorisation.
This is particularly acute for operators serving US persons — where the SEC, CFTC, FinCEN and state money-transmitter licensing regimes apply independently of any offshore authorisation — or operators directing activity at UK persons following FCA financial-promotion rules, or at EU users post-MiCA. A single offshore licence, however well-substantiated locally, does not create a global safe harbour. Operators we advise are explicitly counselled that substance in the primary licensing jurisdiction is necessary but not sufficient.
Where an operator holds licences in multiple jurisdictions — a common profile for an exchange or custodian at scale — the substance requirements in each must be assessed independently and the intercompany model must not inadvertently centralise management in a way that undermines substance in any one of them.
If a prior application stalled or a licence was placed under review following a substance inquiry, a structured second read of the operating model usually identifies the cause and the available remediation path. Contact OBOLUS at info@oboluslaw.com to discuss.
Which Substance Profile Fits Your Operating Model?
Not every licensed VASP has the same substance challenge. The right remediation strategy depends on the entity profile, the licensing regime, and the stage of the business.
Profile A: Early-stage regulated entity, recently authorised, light operational build-out. The primary risk is the gap between the substance described in the licence application and the substance actually in place. The priority is a rapid gap analysis, followed by a sequenced hiring and governance programme. The timeline to a defensible substance position is typically a matter of months. The key risk is an early supervisory inquiry before remediation is complete — proactive regulator communication is usually the right posture.
Profile B: Established VASP, growing user base, group structure with a foreign parent. The substance question turns on where management and control actually sits and whether intercompany agreements support a clean substance position in the licensing jurisdiction. The process involves a legal review of group arrangements and, frequently, amendments to service agreements and governance documents. This is a medium-term structural project, not a checklist exercise.
Profile C: Multi-licensed operator, passporting or serving users across several jurisdictions. Substance requirements must be assessed for each licensed entity. The risk is that optimising substance in the primary hub inadvertently creates a deficiency in a secondary one. A coordinated review across all licensing jurisdictions, with allied counsel in the relevant local jurisdictions where necessary, is the appropriate response.
Profile D: Operator considering a new licence, with an existing unregulated or lightly regulated entity in the same group. Substance planning should begin at the application stage, not after authorisation. The application itself will require a substance plan. Building it correctly from the outset avoids the remediation cost later.
Self-Assessment: Is Your Substance Position Defensible?
The following markers are not legal advice, but they track the questions a regulator is most likely to ask in a substance review.
Is there a local officer — a designated compliance officer or MLRO — who is employed in the licensing jurisdiction, answers to the local regulator, and is reachable by that regulator without routing through a parent entity? If the answer is no, that is a primary deficiency in most regimes.
Were the last three board or management meetings of the licensed entity held in the jurisdiction and documented with minutes reflecting local decision-making? If governance documentation shows that decisions were made elsewhere and later ratified by the local board, that is a substance weakness.
Does the licensed entity have a banking account in the licensing jurisdiction in its own name, with transaction flows that reflect the licensed activities? A VASP routing all its client-related flows through a parent account in a different country will have difficulty demonstrating operational substance.
Are the core AML and transaction monitoring functions operated or materially overseen from within the licensing jurisdiction? A VASP that relies entirely on a group technology platform, with no local visibility or control over alerts and investigations, is exposed on this point.
If any of these questions produce an uncertain answer, the substance position warrants a formal review before the next supervisory cycle, licence renewal, or banking correspondent audit.
Related at OBOLUS
- Licensing & Registration for Digital-Asset Businesses – the full practice overview across 70+ jurisdictions for VASPs, exchanges and custodians
- Crypto Exchange Setup in Singapore – MAS licensing requirements and the Payment Services Act framework for exchange operators
- Economic Substance for Established Operators – substance strategy for VASPs at scale with multi-jurisdictional group structures
A Common Assumption Worth Addressing
A common assumption among regulated entities is that the jurisdiction where they obtained their VASP registration sets the outer limit of their compliance obligations. The reasoning runs: the licence was granted, therefore the business is compliant, therefore no further substance work is needed unless there is an explicit supervisory request.
That assumption is incorrect in at least two directions. First, substance obligations are ongoing and dynamic. They evolve as the business grows, as licensing regimes tighten, and as supervisors update their inspection frameworks. A substance position that was satisfactory at authorisation may not be satisfactory two years later under the same regime. Second, the primary licensing jurisdiction does not confer global permission. Directing services at users in the UK, the EU, the US or Singapore creates independent regulatory exposure in each of those places that no offshore licence resolves. The question of whether economic substance in the primary jurisdiction creates a plausible regulatory perimeter depends heavily on the facts of each operating model.
In our cross-border practice, the businesses that manage this well are the ones that treat substance planning as a continuing operational discipline, reviewed on the same cycle as AML audits and licence renewals, not as a one-time compliance event.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance obligations that sit around them. Digital assets are the entirety of our practice. We map the licence stack across operating, custody and payment layers before you commit, so that substance gaps are identified before they become supervisory problems. To discuss your regulated entity's substance position, contact us at info@oboluslaw.com or via t.me/oboluslaw.
FAQ
How long does a crypto licence take to obtain?
Timelines vary significantly by regime and application quality. In the major hubs, initial authorisation processes typically run from several months to over a year, with the MAS, SFC and VARA each operating detailed vetting procedures. Lithuania and certain other EU jurisdictions have historically processed applications more quickly, though MiCA convergence is extending timelines across the EU. Substance readiness at the point of application materially affects how smoothly the process moves.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on where your users are, what activities you conduct, your banking relationships, your capital structure and your appetite for ongoing compliance cost. VARA in Dubai, MAS in Singapore, the SFC in Hong Kong and CASP authorisation under MiCA each suit different operator profiles. Substance requirements, tax treatment and the quality of local banking access are all material inputs to the selection. We assess these factors together before recommending a structure.
Do I need a separate custody licence?
In most leading regimes, custody of client digital assets is a separately regulated activity. Under MiCA, VARA's rulebooks, the SFC's VATP framework and the MAS Payment Services Act, holding client assets requires either a dedicated authorisation or explicit coverage within the primary licence. Operating custody activities under a licence that does not cover them is a common regulatory breach. Whether a separate custody authorisation is required depends on the regime and the structure of the licensed entity's activities.
By Aisha Tan, Licensing & Jurisdictions Analyst — specialising in multi-regime VASP authorisation, economic substance strategy and the cross-border licensing requirements facing regulated digital-asset entities across 70+ jurisdictions.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.