Economic substance requirements have become one of the most frequently misunderstood obligations facing licensed virtual asset service providers (VASPs) – entities that exchange, transfer, custody or broker digital assets under a regulatory authorisation. Operators that secured a licence in a favorable jurisdiction and then ran the business remotely are now discovering that the same regulators who issued that licence expect to see real people, real decisions and real infrastructure within the licensed territory. The gap between holding a licence and holding it compliantly is where enforcement begins.
This page explains what economic substance means in the context of a licensed VASP, how regulators across the major digital-asset hubs assess it, where operators most commonly fall short, and how OBOLUS approaches the substance build from initial gap analysis through to ongoing compliance monitoring.
What Is Economic Substance for a Licensed VASP?
Economic substance, in the VASP licensing context, is the requirement that a licensed entity conducts genuine business activity – management, operations, compliance and risk functions – inside the jurisdiction that issued its authorisation. It is not a single rule but a layered expectation drawn from the licensing regime itself, from FATF Recommendation 15 and its guidance on effective supervision, and increasingly from the domestic tax frameworks that run alongside the regulatory regime. A shell entity with a nominal local director and a rented address will not satisfy the test in any of the leading digital-asset hubs today.
The practical markers regulators look for fall into three broad categories. First, governance presence: resident or locally accessible senior management with genuine decision-making authority over the VASP's key risk functions. Second, operational infrastructure: physical premises (leased or serviced), local IT systems or access controls, and bank accounts maintained in-jurisdiction. Third, staffing depth: a compliance officer, an AML/CFT officer and, depending on the licence category, a technology or risk officer who can interact with supervisors on short notice.
The weight given to each marker varies by jurisdiction and by licence category. Under the VARA regime in Dubai, activity-based licences – covering exchange, custody, broker-dealer and other functions – each carry distinct substance expectations tied to the rulebook for that activity. Under MiCA, a CASP (Crypto-Asset Service Provider) authorised in one EU member state and passporting across the bloc must demonstrate that the authorising state is its genuine centre of operations, not merely its registered address. The FSRA within ADGM applies a similar expectation under its virtual assets framework. In each case, the supervisory risk is the same: a licence that exists on paper but lacks operational grounding can be suspended or revoked, and the downstream consequence – loss of banking, inability to serve institutional counterparties, enforcement exposure – is existential.
For a scoped substance gap analysis of your current VASP structure, contact OBOLUS at info@oboluslaw.com. The process above describes the standard supervisory expectation. Your specific entity – the jurisdiction, the licence category, the corporate group structure – changes the analysis materially. Map your options.
Which Jurisdictions Apply Substance Rules to VASPs?
Every major digital-asset licensing jurisdiction now applies some form of substance requirement, and the level of scrutiny has increased sharply as regulators move from registration models toward full authorisation frameworks. The differences between jurisdictions are matters of degree and emphasis, not of principle.
In Dubai under VARA, the substance expectation is embedded in the activity licence conditions. Entities seeking exchange or custody licences must demonstrate local management, a physical establishment and the capacity to implement VARA's technology governance standards in-country. The rulebooks explicitly address where core business decisions must be taken.
In the EU under MiCA, the passporting architecture creates a particular substance pressure. Because a CASP authorised in Lithuania, Malta or another member state can offer services across all 27 member states, the authorising national competent authority (NCA) must be satisfied that genuine management and operations sit within its territory. ESMA has been explicit in supervisory communications that substance is a prerequisite to the passporting privilege. Malta's MFSA, the Bank of Lithuania and other NCAs have each signaled that applications from structures with minimal local presence face a higher procedural bar.
In Singapore, the MAS Payment Services Act licensing regime requires that the applicant entity be incorporated locally and that its management and compliance functions are demonstrably exercised from Singapore. The MAS has refused or deferred licensing for entities that appeared to be using a local subsidiary as a booking vehicle while running operations offshore.
In Hong Kong, the SFC VATP licensing framework similarly expects that the licensed entity maintains its core operations – order matching, custody, compliance oversight – within the jurisdiction and under the supervision of locally present senior management.
Offshore jurisdictions including the BVI FSC and CIMA in the Cayman Islands operate registration or lighter licensing tracks, but both have been subject to FATF mutual evaluation pressure and have tightened AML/CFT and substance expectations over successive review cycles. A BVI or Cayman VASP registration that was straightforward two years ago may now require demonstrably more operational presence than was originally anticipated.
How Do Regulators Actually Assess Substance?
Regulators assess VASP substance through a combination of the application file, on-site or desk-based supervisory reviews, and ongoing reporting obligations – and the gap between what an application says and what a review finds is a common trigger for enforcement. Understanding the assessment methodology helps operators build substance that survives scrutiny, not just satisfy a checklist.
At the application stage, most regulators require: a detailed organisational chart showing where each function is located; CVs and background-check materials for senior management; lease agreements or facility evidence for the physical premises; a compliance framework signed off by the local compliance officer; and, in many hubs, a business continuity plan that assumes the local office is the primary operational site.
Post-authorisation, supervisory engagement shifts to the quality of the substance. Regulators conduct supervisory visits – announced and unannounced – and interview local staff. A compliance officer who cannot answer questions about the VASP's transaction monitoring rules, or a CEO who is physically present fewer days per year than the licence conditions imply, represents a substance failure regardless of what the application said. In our practice, we have seen regulatory correspondence that begins with questions about board-meeting minutes and quickly becomes a show-cause notice when the minutes reveal that decisions were being made by an offshore parent without meaningful local input.
The FATF Travel Rule – the obligation to transmit originator and beneficiary data with a virtual-asset transfer – also has a substance dimension: the competent authority must be able to reach the VASP's compliance officer when Travel Rule exceptions or suspicious transaction reports require follow-up. An offshore management team that is unavailable during the supervisory jurisdiction's business hours is a Travel Rule enforcement risk as well as a substance risk.
What Are the Most Common Substance Mistakes?
The most costly substance mistakes are structural, not operational – they are baked into the entity design before the licence is applied for, which means correcting them after authorisation requires either restructuring or a supplemental application to the regulator. We regularly advise operators on substance failures in three categories.
Nominee director arrangements are the most prevalent. An operator appoints a local professional director to satisfy the presence requirement but retains all real decision-making authority at the group parent level. Modern regulators have seen this structure extensively. They test it by asking whether the local director has authority to commit the entity to contracts, approve risk policies and sign regulatory correspondence without seeking overseas sign-off. Where the answer is no, the arrangement fails.
Split compliance functions present a related problem. Many operators centralise their AML/KYC and transaction-monitoring operations at a group level for efficiency. Where the licensed entity's compliance officer is nominally local but functionally reports upward into a group compliance structure based offshore, the regulator's view is typically that the compliance function is not genuinely local. The fix is not necessarily to duplicate infrastructure but to establish clear delegation, documented local sign-off authority and a reporting line that demonstrably flows through the licensed entity.
Stale substance is the third category. A firm that built genuine substance at the time of application – local staff, a real office, an engaged compliance officer – but then allowed it to atrophy as the business scaled is in a particularly difficult position. Regulators treat post-authorisation substance erosion as evidence of ongoing non-compliance, not merely a historical lapse. Licence renewal and periodic supervisory reviews regularly surface this issue.
What Is the Cross-Border Reality for Multi-Licensed VASPs?
For a VASP operating under licences in two or more jurisdictions – a common profile for an exchange serving both EU retail clients under a MiCA CASP authorisation and institutional clients in the Gulf under a VARA licence – substance requirements multiply and can interact in unexpected ways. Each regulator expects genuine local substance; neither is satisfied by pointing to substance in the other jurisdiction.
The practical consequence is that multi-licensed VASPs face a substance cost stack. They need locally engaged senior management, local compliance officers and physical premises in each licensed jurisdiction. Group-level functions can be shared – technology infrastructure, analytics, legal – but the regulated functions (compliance, risk, AML, customer onboarding oversight) must each have a clear, documented local anchor.
The cross-border substance problem intensifies at the banking layer. A VASP with a VARA licence and an EU MiCA authorisation may find that its institutional banking relationships require it to demonstrate that the entity with which the bank is dealing is itself a genuine operating entity, not a brass-plate vehicle routing business through a licensed subsidiary. Banking counterparties increasingly apply their own substance assessment when onboarding crypto business, and a VASP that satisfies its regulator but fails its bank's due diligence is operationally paralyzed.
Tax considerations interact closely here as well. Jurisdictions that offer favorable corporate tax treatment for licensed VASPs – certain free zones in the UAE, the AIFC in Kazakhstan, specific regimes in Malta and Lithuania – often attach substance conditions to the preferential rate. Operating without meeting those conditions generates both a tax exposure and a potential licensing concern simultaneously. In our cross-border practice, we map the substance requirement across the licensing, banking and tax layers before an operator commits to a particular hub combination, because the cost of remediation after the fact is consistently higher than the cost of correct design upfront.
Earlier this year, a payments-focused digital-asset company sought our assistance after its primary banking partner raised concerns about the substance of its EU-licensed entity. The business had genuine operations in the Gulf but had structured its EU activity through a licensed subsidiary with minimal local staffing. We conducted a substance audit across the EU and Gulf entities, identified the specific gaps that had triggered the banking concern, and advised on a phased remediation plan that brought the EU entity into compliance within a regulatory cycle – without requiring the business to interrupt its operational model. The banking relationship was retained.
If a banking partner, a regulator or a counterparty has raised substance concerns about your licensed entity, the analysis is time-sensitive. Write to info@oboluslaw.com or message us at t.me/oboluslaw to discuss the specific structure. Map your options.
Which Substance Model Fits Your Profile?
There is no single substance model that works across all VASP profiles. The right approach depends on the licence category, the jurisdiction, the size of the business and the group structure. The decision matrix below is a practical orientation, not a definitive prescription – the facts of a specific structure will always modify the analysis.
Profile A – Single-jurisdiction startup, exchange or custody licence: The operator is building its first regulated presence. The substance requirement is relatively contained: one or two locally engaged senior staff with genuine authority, a physical premises (serviced office at minimum, dedicated office preferred by many regulators), local bank accounts, a locally signed compliance framework. The timeline to reach a defensible substance position typically runs alongside the licence application itself – substance is built as part of the application, not after it. The principal risk for this profile is nominee directors and remote compliance functions, both of which should be avoided by design.
Profile B – EU-licensed CASP seeking pan-European passporting under MiCA: The operator wants the passporting privilege that MiCA makes available. The authorising NCA will scrutinize whether the home state is genuine. Substance must be credible relative to the size of the EU business: a meaningful compliance team, a board that meets in-country and makes documented decisions, local banking. The risk is that cost pressure leads to a thin local structure – enough to obtain authorisation but insufficient to survive a first supervisory review. The remediation cost when a review identifies substance weakness at the passport stage is significant.
Profile C – Multi-licensed operator with existing Gulf and Asian presence: The operator already holds authorisations under VARA or from the SFC and is adding an EU or UK layer. The substance challenge is demonstrating genuine local management in each jurisdiction without creating a management structure that is spread so thin it cannot actually govern the business. The solution typically involves a clear jurisdiction-of-domicile for each regulated function, documented delegation authorities and a group governance structure that is transparent to each regulator. The cross-border tax interaction must also be mapped at this stage.
Profile D – Offshore-registered VASP facing tighter scrutiny: The operator holds a BVI or Cayman registration and is finding that banking counterparties and institutional clients are asking harder questions about substance. The path forward is either a substance build in the offshore jurisdiction (where the regulator now expects it) or a migration to a full authorisation in a more established hub – with substance built as part of the new application. Both options have lead times measured in months, which is why early action is consistently better than reactive remediation.
A Common Assumption: One Good Licence Is Enough
A common assumption among operators entering the digital-asset space is that a licence obtained in a favorable jurisdiction provides global coverage – or at least broad coverage – for the business. That assumption has become increasingly costly to hold.
The reality is that a licence in jurisdiction A addresses the regulatory requirement in jurisdiction A. Where the VASP's clients are located in jurisdiction B, where its banking sits in jurisdiction C and where its group parent is tax-resident in jurisdiction D, each of those layers generates its own regulatory or compliance requirement. MiCA's passporting mechanism is the most structurally coherent attempt to create genuine cross-border coverage, but it operates only within the EU/EEA and still requires real substance in the authorising member state.
More practically: institutional counterparties – prime brokers, banks, custodians – conduct their own due diligence on VASP clients that is independent of the licence. They look at the substance of the licensed entity, at the quality of its AML/CFT regime, and increasingly at whether its compliance infrastructure is proportionate to the volume of business it processes. A licence from a well-regarded regulator that sits atop a thin operational structure will often fail that due diligence even if it formally satisfies the regulatory requirement.
Operators we advise regularly come to us after having structured around a single licence and then discovering that a second jurisdiction – often the one where their most significant institutional clients are based – requires either registration or a locally compliant substance presence. The remediation path is longer and more expensive than a correctly designed multi-jurisdiction structure from the outset.
Self-Assessment: Does Your Licensed VASP Have Defensible Substance?
The following questions are a practical starting point for assessing whether a licensed entity's substance would survive supervisory scrutiny. They are not a substitute for a legal opinion on any specific structure.
- Can the local senior manager commit the entity to a new material contract without seeking offshore sign-off first?
- Are board or management meetings documented, held in-jurisdiction (physically or in a manner consistent with the licence conditions), and do the minutes reflect genuine deliberation on risk?
- Does the local compliance officer have independent authority to file suspicious transaction reports without group-level approval?
- Is the entity's AML/CFT policy signed and owned locally, not merely adopted from a group template without local adaptation?
- Can the regulator reach a senior management representative in-jurisdiction within the same business day?
- Does the physical premises reflect the scale of the business – or is it a serviced office address used by multiple entities?
- Has the substance structure been reviewed since the licence was granted, to confirm it has not eroded as the business scaled?
- Does the substance position in the licensed jurisdiction align with the tax position taken on that entity's income?
If the answer to any of these questions is uncertain, a substance review is warranted before the next supervisory contact.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – the complete practice overview covering authorisation strategy across 70+ jurisdictions
- VARA Licence Application Under Heightened Scrutiny – tactical guidance on Dubai's activity-based licensing process when prior applications have stalled
- Staking Service Legal Framework in Turkey – jurisdiction-specific analysis of staking authorisation and the applicable regulatory obligations
FAQ
How long does a crypto licence take to obtain?
Timelines vary significantly by jurisdiction and licence category. In established hubs, initial authorisation processes typically run from several months to over a year, depending on the completeness of the application, the complexity of the business model and the regulator's current processing queue. Substance preparation – hiring local staff, establishing premises, drafting the compliance framework – adds lead time that must be built into the project plan before the application is submitted. We advise clients to begin substance preparation in parallel with, not after, the application drafting process.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The best jurisdiction depends on where your clients and counterparties are located, where you can build credible substance, what banking relationships you need and what your medium-term product roadmap looks like. MiCA's CASP authorisation offers EU passporting but requires real substance in the home member state. VARA in Dubai offers an activity-based framework with strong institutional credibility in the Gulf. Singapore's MAS Payment Services Act regime suits businesses with an Asian institutional client base. The right answer is almost always a mapped stack, not a single licence.
Do I need a separate custody licence?
In most leading digital-asset jurisdictions, custody is either a standalone regulated activity requiring its own authorisation or a separately permissioned activity within a broader VASP licence. Under MiCA, crypto-asset custody is a defined CASP service. Under VARA's activity-based framework, custody is a distinct licence category. Under the MAS Payment Services Act, safeguarding of digital payment tokens carries specific requirements. Operating a custody function without the applicable authorisation – even as part of a broader exchange or brokerage activity – is a common compliance gap. Whether your model requires a separate custody authorisation depends on how your product is structured and which regime applies.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit alongside those activities. We map the licence stack across operating, custody and payment layers before you commit to a jurisdiction or structure – because remediation is consistently more expensive than correct design. Our disputes team also coordinates freezing relief and on-chain tracing across leading common-law forums when enforcement action is needed. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP authorisation strategy, economic substance structuring and multi-jurisdiction licence stack design for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.