Operating a licensed VASP (virtual asset service provider) without genuine economic substance in the licensing jurisdiction is one of the most common – and most consequential – structural errors in digital-asset business today. Regulators across every major hub now scrutinize the quality of presence behind a licence, not merely the fact of authorisation. A business that holds a VASP registration in one country while its decision-makers, clients and revenues sit elsewhere is exposed to revocation, enforcement action and the loss of the banking relationships the licence was meant to protect.
Economic substance requirements have evolved from a corporate-tax concept into a full licensing and regulatory condition. Under the VARA regime in Dubai, under MiCA as administered by national competent authorities across the EU, and under the Payment Services Act administered by the MAS in Singapore, regulators have moved well beyond paper compliance. The question is no longer whether you hold authorisation. It is whether your authorised entity does real, documented work in the jurisdiction where it is licensed.
This page maps the substance obligation from first principles across the leading licensing hubs, identifies the cross-border conflicts that arise when a VASP group spans multiple jurisdictions, and explains how OBOLUS structures the licence, banking and operational layers as one mandate.
What is economic substance for a licensed VASP?
Economic substance, in the VASP licensing context, is the body of evidence that an authorised entity genuinely carries on the regulated activity in the jurisdiction where it is licensed – not merely that it is registered there. The specific indicators vary by regime and regulator, but the core tests are consistent across VARA, MiCA national competent authorities, the MAS, the SFC in Hong Kong and the FCA in the United Kingdom.
Regulators generally look for several interconnected elements. First, key management and control must be exercised locally. A board that meets once a year in the licensing jurisdiction while the real decisions are taken elsewhere does not satisfy substance. Second, qualified staff must be present – not necessarily in large numbers, but in roles that correspond to the licensed activities. A custody VASP with no qualified custodian on the ground is a structural problem. Third, the licensed entity must bear real economic risk and conduct the core income-generating activity. A shell that passes all revenue upstream to a parent while bearing no costs is the paradigm case of an entity without substance.
Beyond those foundations, most jurisdictions now expect a physical office, documented governance processes, local compliance and AML functions, and – critically – bank accounts held in the licensing jurisdiction that process regulated revenues. Operators who build the licence without building the underlying infrastructure routinely discover that the banking rails follow the substance, not the certificate.
Under MiCA, the European Securities and Markets Authority (ESMA) and national competent authorities have signaled clearly that CASP authorisations granted without genuine local operations will face heightened supervisory scrutiny and risk revocation. That signal is relevant to every EU-licensed VASP with a cross-border group structure.
Why substance has become a licensing condition, not just a tax rule
The conflation of substance requirements across tax and regulatory regimes is deliberate. FATF Recommendation 15, which requires countries to supervise VASPs for AML/CFT compliance, has pushed regulators toward a common standard: the supervisor of a VASP must be the supervisor with real oversight of the real activity. A jurisdiction that licenses an entity doing nothing within its borders cannot meaningfully supervise it.
This is not merely theoretical. Regulators in the leading hubs increasingly conduct on-site inspections, request evidence of local staffing, review meeting minutes and board attendance records, and cross-reference AML transaction volumes against the entity's reported headcount. In our cross-border practice, we have seen operators surprised to find that a substance review arrives well before the first licence renewal date – often triggered by a suspicious transaction report, a banking dispute or a change of control filing.
The tax dimension compounds the regulatory one. The BEPS (Base Erosion and Profit Shifting) framework developed by the OECD, and the economic substance legislation enacted in BVI, Cayman and other offshore holding jurisdictions, require entities conducting "relevant activities" – which generally include holding intellectual property, financing, headquarters functions and fund management – to demonstrate local substance or face penalties and information exchange with the jurisdiction of the controlling shareholder. A VASP group that places the operating licence in one jurisdiction, the IP in another, and the holding company in a third must satisfy substance tests in each layer simultaneously.
The BVI's VASP Act 2022 operates alongside the BVI's broader economic substance regime; a BVI holding entity above a licensed VASP subsidiary must confirm annually whether it conducts relevant activities within the meaning of the substance legislation. Non-compliance is an independent ground for regulatory action, separate from the VASP registration itself.
To map how your current group structure holds up against the substance tests in each jurisdiction where you are licensed or considering a licence, contact OBOLUS at info@oboluslaw.com. The substance analysis often surfaces gaps before a regulator does – and remediation is considerably easier when it is voluntary.
How do substance requirements differ across the leading VASP licensing hubs?
Substance standards are not uniform. Each regime has its own threshold, its own evidence framework and its own enforcement posture. Understanding the differences is essential before committing to a jurisdiction for a new licence or before restructuring an existing group.
In the UAE, the VARA regime in Dubai applies to mainland entities and imposes activity-specific rulebooks. VARA expects a UAE-resident senior management presence, a physical office, and operational governance documented against the applicable VARA rulebook for each licensed activity – whether that is exchange, custody, lending, or advisory services. VARA's approach is notably granular: a separate operational assessment applies to each licensed activity, and an entity licensed for multiple activities must demonstrate substance in each. The ADGM / FSRA regime in Abu Dhabi takes a comparable approach within the ADGM financial free zone.
In the EU, the MiCA regime creates a CASP authorisation that passports across the EU and EEA. The passporting benefit is real – but it travels with the entity, not the group. A CASP authorised in Lithuania, Malta or another member state must maintain its substance in that state to preserve passporting. Under MiCA, the CASP must have its registered office and at least its head office in the EU member state that granted the authorisation. Relocating the real activity while keeping the registered office on paper is a structural defect that national competent authorities are now actively auditing.
In Singapore, the MAS administers VASP licensing under the Payment Services Act. The MAS has developed a reputation for thorough pre-licensing scrutiny of management competence and local control, meaning substance is assessed at the application stage – not merely at renewal. Major payment institution licence holders face ongoing MAS supervision that includes reviews of outsourcing arrangements; a Singapore-licensed entity that outsources its core DPT service functions offshore may find that arrangement challenged on substance grounds.
The SFC in Hong Kong has adopted a VATP (virtual asset trading platform) licensing regime that requires the applicant to be incorporated in Hong Kong and to conduct its licensed activities within Hong Kong. The SFC's licensing conditions typically include requirements for local responsible officers and for the trading platform's core systems to be accessible and auditable from Hong Kong.
In the BVI and Cayman Islands, the frameworks administered by the BVI FSC and by CIMA respectively create lighter regulatory touch points for certain VASP categories – but the economic substance legislation that runs alongside them is not light. Operators who use offshore vehicles expecting to avoid substance obligations often discover that the substance rules for holding and financing activities are the stricter layer.
What are the most common economic substance mistakes for VASP operators?
In our cross-border practice, the same structural errors appear across client groups regardless of the licensing jurisdiction chosen. Identifying them early determines whether remediation is straightforward or expensive.
The most frequent mistake is outsourcing the entire compliance and AML function to a third-party provider in a different jurisdiction and treating that as satisfying the local compliance obligation. Most substance frameworks require the compliance officer to be locally present, or at minimum to be the legal responsibility of locally present management. A contracted compliance function in another country does not constitute local substance – it constitutes a cross-border outsourcing arrangement that itself requires a regulatory framework to operate lawfully.
The second common mistake is board composition. Operators regularly appoint non-executive directors in the licensing jurisdiction to satisfy a headcount test while the executive management – the CEO, CCO and CFO – are based elsewhere. Regulators are not satisfied by this. The substance test focuses on where decisions are actually made, not where nominal appointments reside. Meeting minutes that show the local board ratifying decisions already made by offshore management are evidence against substance, not for it.
The third mistake is treating the licence as sufficient for cross-border service delivery without analysing the regulatory position in each market where clients are located. A single VASP authorisation – however well-constructed – does not create a right to solicit or service clients in jurisdictions where a separate registration, notification or exemption applies. We regularly advise operators who discover this limitation after they have already begun client onboarding in markets their licence does not cover.
The fourth – and most operationally damaging – mistake is building the licence before building the banking. Substance in a licensing jurisdiction does not automatically produce banking relationships there. Banks in every leading hub conduct their own substance review of VASP applicants, independent of the regulator. An entity that cannot open a local bank account is, practically speaking, unable to demonstrate that its regulated revenues flow through the licensed entity. The banking relationship and the substance review are symbiotic; they must be built in parallel.
Cross-border substance conflicts: when your group spans multiple licences
Multi-jurisdiction VASP groups face a compounded substance problem. Each licensed entity must satisfy the substance standard of its own regulator – but the group's corporate structure, intragroup contracts, IP ownership and management reporting lines create conflicts that are invisible when each jurisdiction is analysed in isolation.
The most common conflict is the intragroup service agreement. A VASP group typically places the technology platform, the brand IP or the risk management function in one entity and licenses or provides those services to the operating subsidiaries. This is a legitimate and widely used structure. However, each service agreement must reflect a real arm's-length commercial relationship, with real payments from real revenues. Where the operating entities lack genuine income – because revenues are consolidated at group level – the service fees cannot be substantiated, and the entire arrangement may be recharacterized as a transfer of economic activity out of the licensing jurisdiction.
The cross-border regulatory conflict extends to AML and the Travel Rule (the obligation to pass originator and beneficiary data alongside a virtual-asset transfer). A VASP group that operates licensed entities in, say, Singapore, Dubai and an EU member state must comply with the Travel Rule requirements of each jurisdiction's regime for transfers touching each entity. Those requirements are not identical. The thresholds, the data fields required, and the treatment of transfers between affiliated group entities differ. A shared technical Travel Rule solution may satisfy one regime and fall short in another.
In our cross-border practice, we structure the licensing mandate to map each entity's substance footprint, its regulated activity perimeter, and its intragroup contractual relationships simultaneously. The goal is a group structure where each licensed entity is genuinely operable as a stand-alone regulated business – because that is what every supervisor in every jurisdiction will test it against.
If your group holds or is applying for licences in more than one jurisdiction, the interaction between those substance obligations requires a coordinated legal analysis. Write to info@oboluslaw.com to map the cross-border conflicts before they become compliance findings.
Decision matrix: which substance profile fits your VASP build?
Not every VASP group has the same operating profile, and the appropriate substance architecture depends on where the business genuinely operates, where its users are, and what the group's banking and tax objectives are. The following profiles represent the decision branches we work through most frequently with new clients.
Profile A – Single-jurisdiction operator. A VASP that operates exclusively within one regulatory perimeter – for example, a Singapore-licensed DPT service provider serving Southeast Asian institutional clients only – should build substance entirely within Singapore. The MAS's Payment Services Act framework expects local management, local compliance, and local banking. The structure is relatively straightforward; the primary risk is outsourcing core functions offshore in a way that later attracts MAS scrutiny. The applicable timeline to achieve full operational substance, from entity setup to a functional compliance program, typically runs several months before an application is filed. The key risk is timeline: underestimating the pre-application substance build is one of the most common causes of licence delay.
Profile B – EU-passporting business. A fintech group that wants to serve clients across the EU using a single CASP authorisation under MiCA should select a member state where it can genuinely build head-office operations. The substance obligation is highest in the authorising member state. The passporting benefit is significant – covering the entire EU/EEA without separate applications – but it demands that the authorising entity be the genuine locus of management and decision-making. The key risk is selecting a jurisdiction for speed or low regulatory fees and then discovering that the local regulator requires a depth of local management the operator cannot practically deliver.
Profile C – Dual-hub group (UAE + EU / UAE + Asia). A VASP group operating from both the Gulf and a major Asian or European hub needs genuine substance in each licensed entity. The cross-border conflicts described above – intragroup services, Travel Rule compliance, AML governance – are most acute in this profile. The group requires a deliberate holding structure, well-documented intragroup agreements, and a compliance framework that satisfies both regulators simultaneously. The key risk is regulatory divergence: what VARA accepts in Dubai may not satisfy what MiCA national competent authorities expect in Amsterdam or Dublin.
Profile D – Offshore holding above operating entities. A group using BVI or Cayman holding entities above licensed operating subsidiaries must satisfy both the VASP substance rules of the operating jurisdictions and the separate economic substance legislation of the holding jurisdiction. This is the highest-complexity profile from a compliance standpoint. The benefit – structural flexibility and tax efficiency in certain configurations – is real, but it must be built carefully. The key risk is treating the offshore holding layer as costless from a substance perspective and discovering that the economic substance legislation creates filing obligations, potential penalties, and automatic information exchange with the shareholder's home jurisdiction.
The substance build process: what does engagement look like?
Addressing economic substance for a licensed VASP is a process with defined stages, not a single document. In our practice, we structure the engagement in phases that move from analysis to implementation to ongoing maintenance.
The first phase is a substance audit of the existing or proposed structure. We map each licensed entity against the substance criteria of its regulator, identify gaps, and produce a written analysis that the management team can use as a remediation roadmap. For a new group considering where to licence, this phase produces a jurisdiction-by-jurisdiction substance assessment that informs the domicile decision before commitment.
The second phase is structural design. Where the audit reveals gaps – board composition, local staffing, intragroup contracts, banking – we work with the management team to design the remediation. This includes drafting the intragroup service agreements, the governance framework and the compliance operating model that regulators will review on inspection.
The third phase is implementation. For cross-border groups, this involves coordinating with allied counsel in the relevant licensing jurisdictions to ensure that the local law requirements are met at each entity level, not just at group level. The Travel Rule, AML program, and data-protection obligations in each jurisdiction are addressed as part of implementation, not as an afterthought.
The ongoing phase is maintenance. Substance is not a one-time exercise. Regulators conduct periodic reviews; staffing changes, banking events and group restructurings each trigger a fresh substance analysis. We regularly advise established operators on the substance implications of a new product line, a change of ownership or an entry into a new market.
Earlier this year, we acted for a multi-jurisdictional payments company that had obtained a VASP registration in a leading common-law hub but structured the actual compliance, technology and banking functions at group level in a different country. The regulator raised a formal question about the adequacy of local substance during a routine review. We conducted a rapid gap analysis, restructured the intragroup service agreement, documented the governance delegation properly and advised on placing a qualified local compliance officer. The operator retained its registration and avoided a public enforcement notice. No specific figures are attached to that outcome; what mattered was the speed of the structural response.
Self-assessment checklist for VASP substance
Before engaging counsel or filing a licence application, operators can use the following checklist to identify the most significant gaps in their substance position. Each item corresponds to a question a regulator or banking compliance team is likely to ask.
- Are the CEO, CCO and CFO – or their functional equivalents – resident in or meaningfully present in the licensing jurisdiction?
- Does the board meet in the licensing jurisdiction, and do the minutes reflect genuine deliberation on local operational matters?
- Is the compliance officer a qualified individual physically present in the jurisdiction, or a contracted service managed from elsewhere?
- Does the licensed entity have its own bank account in the jurisdiction, through which its regulated revenues flow?
- Are intragroup service agreements in place, documented at arm's length, with payment flows that correspond to real economic activity in the licensed entity?
- Is the AML program specific to the licensed entity, or is it a group policy applied without local adaptation?
- Has the Travel Rule implementation been tested against the specific threshold and data-field requirements of the licensing jurisdiction, not just a generic cross-jurisdiction standard?
- If the group includes an offshore holding company, has the economic substance legislation of that holding jurisdiction been assessed for the current structure?
Answering "no" to any of these questions does not mean a licence will be refused or revoked. It means the operator has a documented gap that needs to be addressed in a defined sequence. Regulators generally respond better to proactive disclosure and a remediation plan than to a gap discovered during inspection.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – the full OBOLUS licensing practice overview across 70+ jurisdictions
- EMI licence for crypto firms in South Africa – regulatory authorisation for payment and crypto businesses entering the South African market
- Economic substance for established VASP operators – ongoing substance maintenance and remediation for operating licensed businesses
FAQ
How long does a crypto licence take to obtain?
Timelines vary significantly by jurisdiction and licence category. In our experience, applications in well-staffed, well-prepared groups move faster than those where the substance build and the application run concurrently. As a general guide, the pre-application substance build – staffing, governance, banking, AML program – typically takes longer than the formal regulatory review period. Operators who underestimate the preparation phase consistently experience avoidable delays. Consult current guidance from the relevant regulator for the formal review timeline, as these periods change as regulatory capacity and application volumes shift.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction. The right answer depends on where your clients are, where your banking can be established, the regulatory perimeter of your licensed activities, your tax and holding structure, and the operational capacity you can genuinely place on the ground. A VARA licence in Dubai suits a business that can build real UAE substance and targets Gulf and MENA markets. A MiCA CASP authorisation suits a business that can build genuine EU head-office operations and wants passporting across the EU/EEA. We advise on jurisdiction selection as the first step of the licensing mandate, not the last.
Do I need a separate custody licence?
In most flagship jurisdictions, custody of virtual assets is a regulated activity that requires its own authorisation or a specific custody permission within a broader VASP licence. Under MiCA, custody and administration of crypto-assets on behalf of clients is a distinct CASP service requiring specific authorisation. VARA in Dubai applies its rulebook separately to custody services. The MAS in Singapore and the SFC in Hong Kong both treat custody as a regulated function. Bundling custody into an exchange or brokerage licence without confirming that the licence expressly covers custodial activity is a structural risk we regularly see in inbound group structures.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than 70 jurisdictions, on disputes and on-chain asset recovery across more than 25 forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We structure licensing, banking and tax as one mandate rather than three disconnected workstreams – mapping the licence stack across operating, custody and payment layers before you commit. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing and Jurisdictions Analyst – specializing in cross-border VASP authorisation, economic substance structuring and multi-hub licence strategy for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.