Economic Substance for Licensed VASPs Under Heightened Scrutiny

Regulators across the leading licensing hubs are no longer satisfied with a registered address and a nominee director. A virtual asset service provider (VASP) that holds a licence but cannot demonstrate genuine economic substance in the licensing jurisdiction faces revocation, supervisory censure, and – increasingly – coordinated enforcement across multiple borders. The substance question has moved from a box-ticking exercise to a live examination that can derail banking relationships, payment-rail access, and the licence itself.

Economic substance requirements for VASPs compel operators to maintain real decision-making, qualified personnel, and operational infrastructure in the jurisdiction where the regulatory authorisation is granted. Under regimes including MiCA, VARA, and the MFSA VFA framework, supervisors now cross-reference corporate filings, staffing records, IT architecture, and AML governance to verify that the entity is not a shell dressed in a licence. For operators caught short, the cost is measured not just in regulatory fines but in the permanent loss of banking counterparts who will not return.

This page maps the regulated basis for substance obligations, identifies the most common gaps operators discover under supervisory examination, and explains how a cross-border licence structure must be built and maintained to withstand heightened scrutiny today.

What Is Economic Substance for a Licensed VASP?

Economic substance, in the context of a licensed VASP, means that the entity licensed to conduct virtual-asset activities actually conducts those activities from the jurisdiction in question – with qualified management present, decisions taken locally, and operational controls resident in that territory. It is a legal proxy for genuine business presence, and regulators use it to distinguish operating companies from address-only shells that route compliance risk elsewhere.

The concept draws from two distinct legal traditions. First, tax substance rules – promoted by the OECD under the base-erosion and profit-shifting (BEPS) project and adopted into domestic legislation across offshore and mid-shore jurisdictions – require that an entity carrying on a relevant activity have adequate employees, expenditure, and physical assets in that jurisdiction. Second, financial-regulation substance requirements, as codified under MiCA by ESMA and under VARA's activity-based rulebooks, go further: they require that senior management be genuinely present, that internal-control functions operate locally, and that the entity can demonstrate it is not managed from a parent or affiliate in a different jurisdiction.

In our practice, we see operators conflate these two strands. Satisfying the tax substance test does not automatically satisfy the financial-regulation test. A VASP that places a qualified CFO in the licensing jurisdiction for tax purposes but retains all compliance and technology decisions in a group entity in a third country will fail the financial-regulation strand under examination. Regulators at the MFSA, VARA, and the Bank of Lithuania are now routinely raising this distinction in supervisory letters.

The consequence of confusion between the two strands is real. An operator that believes it has cleared substance by filing the right corporate documents may discover – during a licence renewal or a triggered supervisory review – that the regulator is asking for employment contracts, board meeting minutes evidencing local quorum, and IT-hosting agreements. At that point, the gap between assumed compliance and actual compliance becomes urgent.

Which Regimes Currently Impose Heightened Scrutiny on VASP Substance?

Heightened scrutiny of economic substance is most pronounced in four regulatory environments: the EU under MiCA, the UAE (Dubai) under VARA, Hong Kong under the SFC's VASP licensing regime, and Singapore under the MAS Payment Services Act framework. Each jurisdiction approaches the examination differently, but the underlying demand is the same – the regulator wants evidence that the licence reflects operational reality.

Under MiCA, the passporting mechanism creates a structural pressure point. A CASP (crypto-asset service provider) authorised in one EU member state may provide services across the EEA without additional licensing. That makes the home-state authorisation strategically valuable – and makes the home-state national competent authority acutely aware that other NCAs are watching. ESMA's coordination role means that a substance concern raised by a single NCA can block or suspend passport notifications affecting the operator's entire EU market access.

VARA in Dubai has made substance a foundational requirement of its activity-based licensing model. The VARA rulebooks require management to be UAE-resident, key control functions to be staffed and documented locally, and IT infrastructure to meet data-residency expectations where required by category. Operators that established UAE legal entities as holding vehicles – expecting to operate the technology and compliance functions from Europe or Asia – are being asked to demonstrate that the Dubai entity is not a brass plate.

The SFC in Hong Kong and MAS in Singapore operate on similar principles. Both regulators conduct detailed fit-and-proper assessments of senior management and expect those individuals to be genuinely engaged in the licensed entity's operations. In a recent licensing cycle, we advised an operator expanding from a European base into Asia that the MAS examination of its proposed CEO's actual time-commitment in Singapore was the pivotal issue – not the capital position or the technical documentation.

FINMA in Switzerland and the FCA in the United Kingdom apply analogous pressure through different procedural tools. FINMA's requirement that the board of directors maintain effective oversight of a Swiss-incorporated entity effectively requires senior decision-makers to be engaged in Switzerland. The FCA's MLR registration process has evolved to scrutinise the actual location of compliance officers and the adequacy of UK-based AML systems.

For a multi-jurisdiction operator, the cumulative substance obligation across these regimes is significant. The entity structure and staffing plan that satisfies one regulator may not satisfy another. Mapping the matrix before the structure is committed is considerably less expensive than restructuring under supervisory pressure.

For an initial assessment of your current substance position, contact OBOLUS at info@oboluslaw.com. The process above describes the standard regulatory expectation. Your specific facts – the entity structure, the location of management, the technology architecture – change the analysis materially.

What Are the Most Common Economic Substance Gaps Operators Discover Under Examination?

The most consistent substance gap in our cross-border practice is the disconnect between the legal seat of the licensed entity and the actual location of decision-making. An operator whose compliance function, technology team, and senior leadership sit in a country where the group is not licensed is managing a structural exposure that becomes acute the moment a regulator runs an on-site examination or requests management-accounts data showing where operational expenditure is actually incurred.

The gaps we encounter most frequently fall into four categories.

Management presence in name only. The director registered with the regulator holds the correct qualifications but attends board meetings by video from a different time zone. Regulators – particularly VARA and the MFSA – are now documenting attendance records and asking where directors reside for the majority of the year. A nominee arrangement that does not involve genuine engagement in operational decisions does not satisfy the substance requirement under current supervisory expectations.

Payroll disconnected from the licence jurisdiction. The entity maintains the minimum headcount required for its licence category but the employment contracts are with a group entity in a different country, and the salary cost is recharged to the licensed entity under an intercompany arrangement. Regulators treat this as a proxy employment structure and expect the headcount to be genuinely engaged by and paid by the licensed entity directly.

Technology and data infrastructure located outside the jurisdiction without documentation. Where a regulator requires data residency or expects core processing to occur within its territory, hosting agreements with a group technology company outside that territory can constitute a substance failure. The absence of documentation – even where the infrastructure is physically present – is treated by regulators as equivalent to its absence.

AML governance driven from the parent. The licensed entity's AML officer is present and qualified, but the policies, risk-appetite statements, and transaction-monitoring rules are authored and maintained by the group compliance function in a third country. In a FATF-aligned jurisdiction, a regulator examining AML governance will expect to see evidence that the local AML officer has meaningful independent authority, not simply ratification authority over group decisions.

How Do You Build a Substance Structure That Survives Scrutiny?

A substance structure that survives heightened regulatory scrutiny is built from the licence conditions outward, not from the group's existing corporate architecture inward. The starting point is a precise reading of what the applicable regime – MiCA, VARA, MAS, or whichever applies – actually requires: by headcount category, by management-presence standard, by IT architecture, and by governance documentation. Only once those requirements are mapped can an operator design an entity structure that satisfies them without unnecessary cost.

The process has five practical components.

First, a substance-gap audit against the applicable regime's published requirements and any supervisory guidance specific to the operator's licence category. This audit produces a prioritised remediation list, distinguishing between gaps that constitute a present regulatory breach and those that represent a future risk under stricter examination.

Second, a management-and-staffing plan that identifies which roles must be filled locally, what the minimum time-commitment standard is for each role in that jurisdiction, and whether the individuals currently named in licence applications or holding appointments genuinely meet it. In jurisdictions where a residency requirement applies to the compliance officer or the CEO, the analysis becomes a matter of immigration law as well as financial regulation.

Third, a governance-documentation review. Substance is evidenced through documents: board minutes that show quorum of locally present directors, a locally approved AML policy, a locally maintained risk register, and IT-hosting agreements that match the regulatory expectation. Operators frequently have the substance in practice but lack the documentation to prove it. The remedy is a structured documentation programme, not a restructuring.

Fourth, an intercompany-agreement review. Where the licensed entity relies on services from affiliated entities – technology, shared compliance, back-office functions – the intercompany agreements must be at arm's length, the service levels must be documented, and the control over the services must demonstrably rest with the licensed entity. Transfer-pricing considerations interact directly with this requirement, creating a joint tax-and-regulatory exposure if the agreements are not structured carefully.

Fifth, an ongoing monitoring plan. Substance is not a one-time assessment; it must be maintained through the licence lifecycle. Annual supervisory returns, ad hoc requests from the regulator, and triggered reviews following a change of control or a material change in the business all require the operator to re-demonstrate substance. Building the monitoring function into the compliance calendar before it is demanded is the difference between a smooth supervisory cycle and an emergency remediation.

How Do Substance Obligations Interact Across Multiple Jurisdictions?

A VASP operating under multiple licences – a common structure for operators seeking both EU market access through MiCA and Gulf market access through VARA – faces substance obligations that can directly conflict. Each regulator expects the senior management of its licensed entity to be genuinely present and engaged in that jurisdiction. When the same individual is named as the CEO or compliance officer for entities in two different countries, the question of where that individual actually sits becomes a live regulatory risk in both jurisdictions simultaneously.

The resolution for most operators is a clear division of senior responsibilities at the group level: the CASP entity under MiCA is managed by EU-resident personnel with documented authority over EU operations, and the VARA entity in Dubai is managed by UAE-resident personnel with equivalent authority over UAE operations. Group-level functions – such as technology architecture, product development, and treasury management – may be performed centrally, but the interface between the central function and each licensed entity must be governed by documented service agreements that preserve the autonomy of each licensed entity's management.

The tax dimension is unavoidable. Where a group entity in a low-tax jurisdiction receives management fees, royalties, or intercompany income from the licensed entities, the OECD BEPS standard and local controlled-foreign-corporation rules will examine whether the substance in the licensed jurisdiction is adequate to justify the allocation of profit. The alignment between the financial-regulation substance requirement and the tax substance requirement is not automatic. An operator can satisfy one without satisfying the other, and a structure that fails either will produce enforcement exposure in both domains.

Banking is the third axis of cross-border substance interaction. Correspondent banks and digital-asset banking partners – typically in Europe, the UAE, or Singapore – conduct their own substance assessments of the VASPs to which they provide services. A banking partner that perceives the licensed entity as a brass plate will not open or will close the account, regardless of the regulatory licence held. In our practice, we have seen operators lose banking access because the KYC documentation submitted to the bank showed management decisions being made from a jurisdiction where the group held no licence and the licensed entity had no genuine operations. The licence did not protect the banking relationship; the substance did.

A micro-matter illustrates the point. In a recent cross-border licensing engagement, a crypto-exchange operator held EU authorisation under an established NCA and was expanding into the Gulf. The operator named its existing EU compliance officer as the responsible individual for the new Gulf entity. During the application process, the Gulf regulator requested evidence of UAE residency and physical presence. The compliance officer was not UAE-resident. We advised the operator on the division of the compliance function, the restructuring of the intercompany service agreement to preserve EU substance, and the appointment criteria for a UAE-resident compliance officer. The application proceeded on revised terms. Both substance positions were documented and aligned.

Which Licence Profile Requires What Level of Substance Investment?

Not every licensed VASP faces the same substance obligation. The depth of the requirement varies by licence category, by jurisdictional regime, and by the operator's specific activity set. The following profiles illustrate how the substance requirement scales.

Profile A – single-jurisdiction exchange operator under MiCA. The operator holds a CASP authorisation in one EU member state and provides services only within that jurisdiction. The substance requirement is proportionate to a single licensed entity: qualified management locally engaged, AML governance documented locally, and IT infrastructure meeting the NCA's expectations for the exchange-services category. The risk is management drift – where the operator grows and the senior decision-makers relocate. The monitoring obligation is ongoing.

Profile B – passporting CASP across the EEA. The same EU-authorised CASP provides services in multiple member states under the MiCA passport. The home-state substance obligation does not increase with the number of passported jurisdictions, but the visibility of the entity to multiple NCAs does. A substance concern at the home NCA level now carries cross-border consequences for every jurisdiction where the passport is exercised. The risk profile is higher; the investment in substance documentation should reflect that.

Profile C – multi-hub operator under MiCA and VARA. The operator holds both a CASP authorisation in the EU and a VARA licence in Dubai. As described above, each jurisdiction requires its own management, governance, and operational documentation. The substance investment is materially larger. The principal risk is the shared-individual problem – one person named across both licences – which must be resolved structurally, not by exception.

Profile D – offshore entity seeking substance for tax purposes only. A fund or treasury vehicle domiciled in the BVI or Cayman Islands holds virtual assets and seeks to satisfy the economic-substance requirements applicable to relevant activities under those jurisdictions' domestic substance legislation. This operator is not necessarily a licensed VASP but faces the OECD-derived substance obligation directly. The requirement is tax-origin rather than financial-regulation origin, but the documentation discipline is similar. Where the same entity also holds a financial-services registration, the two substance obligations must be mapped jointly.

If a prior application stalled or a banking relationship was closed because of a substance concern, a structured review can identify the gap and the path forward. Write to OBOLUS at info@oboluslaw.com.

A Common Assumption: One Licence Covers the Group

A common assumption among operators expanding into digital-asset markets is that a single licence – obtained in a jurisdiction known for relative accessibility and proportionate capital requirements – is sufficient to serve clients globally without further regulatory authorisation. That assumption does not survive contact with the regulatory reality of 2024 and beyond.

The assumption has a factual basis in the early history of VASP regulation, when many jurisdictions had not yet enacted mandatory licensing regimes. An operator registered in a permissive jurisdiction could argue, with some plausibility, that its offshore registration satisfied any applicable regulatory obligation. That argument is no longer available in any jurisdiction where MiCA, VARA, MAS, or an equivalent domestic regime has taken effect.

Each of those regimes applies on the basis of where the operator provides services, not only where the operator is incorporated. An EU-based user accessing an exchange operated by an offshore entity triggers the MiCA perimeter analysis, regardless of where the exchange holds its licence. VARA's scope covers the provision of virtual-asset services in or from Dubai – meaning that an entity physically operating in Dubai must be VARA-licensed regardless of an offshore corporate structure. MAS takes the same territorial approach to digital payment token services.

The substance implication is direct. Once the operator accepts that it needs a licence in the jurisdiction where its users, operations, or revenues are located, it must also accept the substance obligation that attaches to that licence. Offshore registration is not a substitute; it is an additional exposure.

Operators we advise regularly arrive having relied on an offshore structure that was appropriate at the time of formation and is now inadequate for the regulatory environment in which the business is actually operating. The remediation path is not simple – it involves entity restructuring, management appointments, intercompany-agreement redesign, and engagement with one or more regulators – but it is manageable with a clear view of the target structure and the applicable requirements.

Self-Assessment Checklist: Is Your Substance Position Adequate?

The following checklist is not a substitute for legal advice, but it provides a practical basis for an initial internal assessment of substance adequacy before engaging with a regulator or a banking partner.

Management presence: Are the directors named in the licence application physically present in the licensing jurisdiction for the majority of their working time? Do board meetings held in that jurisdiction have quorum of locally present directors? Are the minutes of those meetings retained and available for supervisory inspection?

Compliance and AML governance: Is the AML officer employed directly by the licensed entity and resident in the licensing jurisdiction? Are the AML policies, risk-appetite statements, and transaction-monitoring rules approved by the local AML officer? Is there documented evidence of the local AML officer exercising independent judgment – not simply ratifying group decisions?

Technology and data: Where the applicable regime imposes data-residency requirements, is the relevant data hosted in that jurisdiction under an agreement with the licensed entity directly? Where core processing occurs remotely, is there a documented service agreement that preserves the licensed entity's control and accountability?

Staffing and payroll: Are the employees performing regulated functions employed directly by the licensed entity? Are their employment contracts and payroll costs resident in the licensing jurisdiction? If group-staff secondments are used, are the secondment agreements documented and at arm's length?

Intercompany arrangements: Are all services provided by affiliated entities to the licensed entity governed by documented arm's-length agreements? Are the transfer prices defensible under the OECD standard? Does the licensed entity retain the right to terminate or substitute the service provider?

Banking documentation: Is the KYC package submitted to banking partners consistent with the substance documentation held by the regulator? Where a banking partner has raised substance questions, has the response been coordinated with the regulatory submission to ensure consistency?

If the answer to any of these questions is no or uncertain, the substance position requires attention before the next supervisory cycle or banking renewal.

Related at OBOLUS

• Licensing and Registration for Digital-Asset Businesses – the full scope of VASP licensing across 70+ jurisdictions, from application to ongoing compliance.
• Economic Substance for Licensed VASPs in El Salvador – jurisdiction-specific substance obligations for El Salvador-licensed operators.
• Economic Substance for Licensed VASPs – Established Operators – substance maintenance and restructuring for operators with existing licence portfolios.

FAQ

How long does a crypto licence take to obtain?

Licensing timelines vary significantly by jurisdiction and licence category. Under MiCA, authorisation timelines depend on the national competent authority and the completeness of the application. VARA and MAS applications involve staged review processes that typically extend over several months. Substance preparation – appointing qualified management, establishing local operations, and assembling governance documentation – often takes as long as the regulatory review itself. We advise clients to build the substance structure before filing, not during.

Which jurisdiction is best for licensing my crypto business?

There is no universally optimal jurisdiction. The right choice depends on where the operator's users are located, which banking relationships it needs, the activity set it plans to offer, and the capital and staffing the operator can deploy. An EU MiCA authorisation provides EEA passporting but requires genuine EU substance. VARA in Dubai offers access to the Gulf market but imposes UAE management-presence requirements. MAS in Singapore delivers credibility in Asia but involves a rigorous licensing process. We map the options against the operator's specific business model before a jurisdiction is selected.

Do I need a separate custody licence?

In most leading jurisdictions, custody of virtual assets for third parties is a separately regulated activity. Under MiCA, custody and administration of crypto-assets on behalf of clients is a distinct CASP service category. VARA treats custody as a discrete activity-based licence. The SFC in Hong Kong and MAS in Singapore take the same approach. An operator providing custody within a broader exchange or trading service should not assume that its exchange licence covers custody. The applicable regime must be read carefully against the operator's actual service scope.

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers, and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking, and compliance that sit around them. Digital assets are the whole of our practice. We map the licence, substance, and banking stack across operating, custody, and payment layers before you commit – so the structure you build is the structure that survives examination. We also work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications where recovery is in issue. To discuss your situation, contact info@oboluslaw.com.

By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in multi-hub VASP licensing structures and the economic substance obligations that attach to regulated digital-asset entities across the EU, UAE, and Asia-Pacific.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.