For an early-stage digital-asset founder, the first licence is the milestone that attracts investors and opens banking. The second engagement with the regulator – renewal, a material variation to add a service line, or an emergency amendment to correct a structural defect – is the one that kills companies. Regulators treat a post-authorisation interaction as a credibility audit. Any gap between what your licence says and what your business does is not merely an administrative problem: it is the factual predicate for a suspension, a public censure, or a referral to enforcement. At the bottom-of-funnel stage, the question is not whether to engage with the renewal or variation process – it is whether you engage correctly or let it become an existential event.
Licence renewal and variation under any of the major VASP (virtual asset service provider) regulatory regimes requires a founder to demonstrate that the business still meets the conditions of its original regulatory authorisation – and, for a variation, that the proposed change falls within the permitted scope of the applicable regime. The process is governed by the same regulator that granted the initial licence, applying the same fitness-and-properness standard, the same AML/CFT baseline, and – increasingly – enhanced requirements that were not in force at the time of the original application. This page maps the process, the cross-border complications, and the decision logic for founders who need to act quickly and correctly.
What is the regulated basis for renewal and variation?
Every major licensing regime embeds a post-authorisation compliance cycle: the licensed entity must periodically confirm that its controllers, capital, and operational controls remain adequate, and must seek prior approval before making material changes to the licensed business. Under MiCA and the CASP authorisation framework administered by ESMA and national competent authorities, a change in the categories of crypto-asset services provided triggers a formal variation application before the change is implemented – not after. The same logic applies under the VARA activity-based licence structure in Dubai, where each service category (exchange, custody, lending, advisory) carries its own approval, and adding a category requires a separate application to VARA. Under the Singapore Payment Services Act as administered by MAS, a change in payment service types or transaction volumes that crosses a regulatory threshold requires the licensee to upgrade its licence tier or notify MAS within prescribed timeframes.
Founders consistently underestimate the breadth of what counts as a "material change." A change of ultimate beneficial owner, the appointment of a new director, a new product line, a white-label arrangement with a third party, or a move of operational servers to a different jurisdiction can each trigger the variation obligation. In our licensing practice, we have seen enforcement action initiated not because a founder acted in bad faith, but because they treated an operational decision as purely commercial when it had a regulatory dimension they had not identified.
The renewal obligation is distinct from the variation obligation. Renewal is calendar-driven: most regimes require annual re-registration, a renewal fee, updated beneficial ownership disclosure, and confirmation of continued compliance with the applicable prudential and AML/CFT requirements. Variation is event-driven. Both can run simultaneously – and the consequences of missing either are the same: the licence lapses or is suspended, banking rails freeze, and the business trades unlicensed.
For a scoped assessment of your renewal or variation timeline, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the user base across jurisdictions, and the banking relationships – change the analysis materially.
What does the renewal and variation process actually involve?
The renewal and variation process has three distinct phases: pre-submission diligence, the application itself, and the post-submission engagement with the regulator. Early-stage founders typically lose time in the first phase and credibility in the third.
Pre-submission diligence means auditing the current licence against the current business. The questions are: what activities are you actually performing; which of those are within the licensed scope; which have drifted outside it; and which new activities require a variation before they can lawfully commence? This audit must go beyond the licence document itself. It must examine the AML/CFT programme, the customer due diligence procedures, the transaction monitoring system, the capital position, the governance structure, and the technology architecture – because the regulator will examine all of these on renewal and may require remediation before approving a variation.
For a variation, the application must describe the proposed change with precision. A vague description – "we intend to offer additional services" – invites a request for further information that delays the process by weeks or months. The application must explain the regulatory classification of the new activity under the applicable regime, the revised business model, the updated risk assessment, and the changes to the AML/CFT programme that the new activity requires. Under the MFSA's transition of the VFA framework to MiCA CASP standards in Malta, variation applications are subject to a heightened review of the applicant's AML function, reflecting the regulator's current supervisory priorities.
Post-submission, the regulator will issue queries. Treating those queries as a formality is the single most common mistake we observe. Each query is an opportunity for the regulator to assess whether the management team understands the regulated business. Answers must be substantive, direct, and consistent with the rest of the application file. An answer that contradicts an earlier disclosure – even inadvertently – creates a fitness-and-properness issue that can be harder to resolve than the original query.
Timelines vary materially by regime and by the complexity of the variation. We describe them qualitatively: a straightforward annual renewal in a well-staffed registry is typically processed in a matter of weeks; a variation adding a new service category in a hub with an active supervisory pipeline can take several months. In our practice, we advise founders to begin the pre-submission audit at least three months before the renewal deadline and to initiate variation applications before implementing the proposed change – not concurrently.
How does a multi-jurisdiction structure affect renewal and variation?
The cross-border reality for most early-stage founders is that the licence in one hub does not cover the activities their users actually access from other jurisdictions. A VASP registration in the BVI under the VASP Act administered by the BVI FSC does not passport into the EU. A MiCA CASP authorisation in Lithuania passports across the EU/EEA but does not extend to Singapore, Hong Kong, or Dubai. A VARA licence in Dubai covers mainland activities but does not govern activities within the DIFC financial free zone, which has its own regime.
The renewal and variation problem multiplies across each jurisdiction in which the business operates. A structural change – moving the holding company, adding a new beneficial owner, changing the technology stack – can simultaneously trigger variation obligations in three or four regimes. Managing those obligations in sequence, rather than in parallel, creates a window during which the business is technically unlicensed in at least one jurisdiction. That window is the risk.
In a recent matter, a payments-focused entity held registrations in two EU member states and a VASP registration in a common-law offshore centre. When it sought to add a custody service line, the variation requirement triggered in all three regimes simultaneously, each with different documentation standards and different timelines. We coordinated the parallel applications, mapped the points of overlap in the disclosure requirements, and managed the sequencing so that the custody service did not launch until all three variations were approved. The entity avoided a period of unlicensed operation that would have exposed its banking relationships to termination.
Founders relying on a single offshore registration to serve a global user base face an additional and growing risk: the regulators in the jurisdictions where users are located do not defer to the offshore licence. The FCA in the UK, ESMA and national competent authorities in the EU, and MAS in Singapore each assess whether a service is offered "in" or "into" their territory by economic substance and user location – not by where the entity is incorporated. Renewal of the offshore registration does not resolve the exposure in those markets.
What mistakes do early-stage founders most often make?
The most costly mistake is treating the renewal as an administrative task and delegating it entirely to an administrative function without legal review. Regulators do not treat renewal as administrative. They treat it as an annual opportunity to assess whether the entity remains fit for its licence. An AML/CFT programme that was adequate at the time of the original application but has not been updated to reflect the regime's current guidance – which evolves through supervisory communications, regulatory notices, and, in the EU, through MiCA's implementing standards published by ESMA – will draw a query at best and a remediation notice at worst.
The second common mistake is implementing a material change without a variation application. Founders often rationalise this: the change seems minor; the regulator is unlikely to notice; the application process will take too long. The exposure is severe. Under most regimes, operating outside the terms of the licence is a criminal offence and a grounds for revocation – not merely a technical breach. The BVI FSC, CIMA in the Cayman Islands, and VARA in Dubai each have the power to suspend, revoke, or impose conditions without prior notice in cases of serious non-compliance.
The third mistake is inadequate governance documentation. Regulators examine the minutes, the policies, and the management information that governance structures are supposed to produce. A startup that has been running on founder decisions and informal communications will not satisfy a regulator that expects a board-approved AML policy, a documented risk appetite, and evidence of management information that the compliance function reports to the board. Building this infrastructure after receiving a renewal query is reactive and unconvincing. Building it before the renewal application is the correct sequence.
A fourth, specifically cross-border mistake: failing to disclose to the home-jurisdiction regulator that the entity also holds registrations or operates in other jurisdictions. Several major regimes now require ongoing disclosure of foreign regulatory interactions, including queries, investigations, and regulatory changes in third countries. A founder who receives a supervisory letter from a foreign regulator and does not disclose it to their home-state regulator on renewal has compounded a manageable problem into a disclosure failure.
Which approach is right for your situation?
The right approach to renewal and variation depends on three factors: the complexity of the licence structure, the nature of the proposed change, and the founder's current state of compliance documentation.
Profile A – single-jurisdiction, no structural change, compliant documentation: The renewal is a process-management exercise. The key risk is timing: missing the deadline by even a day can trigger a lapse. The appropriate approach is a pre-renewal audit ninety days before the deadline, a documentation refresh, and a supervised submission. The timeline is predictable. The risk is low if the process is managed systematically.
Profile B – single-jurisdiction, proposed variation to add a service category: The variation is a substantive regulatory application. The appropriate approach begins with a classification analysis: does the proposed service fall within an existing category under the applicable regime, or does it constitute a new regulated activity requiring a separate authorisation? The answer changes the complexity and the timeline. A service that appears to be an extension of the existing licence may in fact require a separate CASP authorisation under MiCA, or a separate activity approval under VARA. The risk of proceeding without that analysis is operating unlicensed in the new service category.
Profile C – multi-jurisdiction, structural change affecting multiple licences simultaneously: This is the highest-risk profile and the one that most frequently results in a gap period of unlicensed operation. The appropriate approach is a parallel-application strategy, with sequencing managed so that the new service or structure does not launch until the last required approval is in place. This requires coordination across the relevant regimes and, where we do not have direct standing in a jurisdiction, engagement of allied counsel in the relevant jurisdiction who work to the same brief.
Profile D – single or multi-jurisdiction, prior application history, regulatory query outstanding: Where a prior renewal was queried or a variation was refused, the next application must address the prior concern directly and demonstrably. A renewed application that does not acknowledge the prior query will be treated as a failure of candour. The appropriate approach is a legal analysis of the prior query, a remediation plan with documented implementation, and a transparent disclosure of the remediation in the new application.
If a prior application stalled or a banking relationship was closed following a regulatory query, a second read can surface the structural reason and the route back. Contact OBOLUS at info@oboluslaw.com or message us via t.me/oboluslaw.
Self-assessment: are you ready for renewal or variation?
Before initiating a renewal or variation submission, a founder should be able to answer yes to each of the following questions with documentary evidence in hand – not in preparation.
First: is the entity's beneficial ownership structure accurately disclosed to the regulator, and has any change since the last submission been notified within the required timeframe? Second: does the current AML/CFT programme reflect the regime's most recently published guidance, including any updates to the Travel Rule obligations for transfers between VASPs? Third: is the entity's capital position within the prudential requirements applicable to each licensed category, and are those calculations documented and board-approved? Fourth: has the compliance function produced management information to the board within the preceding quarter, and are the board minutes accurate? Fifth: has the entity made any disclosure to a foreign regulator since the last renewal – and if so, has that disclosure been reflected in the home-jurisdiction renewal file?
A no answer to any of these questions does not mean the renewal cannot succeed. It means the pre-submission audit must address the gap before the application is filed. Filing with a known gap, in the hope the regulator does not identify it, is the most reliable route to a remediation notice or a refusal.
How do renewal and variation interact with tax and banking?
The regulatory and commercial implications of a renewal or variation are not confined to the licensing file. Banking and tax sit immediately adjacent and are affected by the same structural decisions.
Banks that hold accounts for licensed digital-asset businesses conduct their own periodic reviews of the regulatory status of account holders. A licence that lapses – even briefly, due to a missed renewal deadline – can trigger an account review and, in many cases, a termination notice. Banks in the major hubs increasingly align their own KYB (know-your-business) cycles with the regulatory calendar. A founder who notifies the bank promptly of a renewal and provides updated regulatory documentation is far less likely to face account disruption than one who lets the licence lapse and then scrambles.
A variation that changes the entity's service scope or ownership structure may also have tax implications. In jurisdictions that offer preferential tax treatment conditional on the nature of the licensed activity – the AIFC regime in Kazakhstan, for example, or certain structures in the ADGM environment in Abu Dhabi – a change to the licensed activity profile can alter the tax position. We map these interactions as part of the variation analysis, referring to the applicable licensing requirements and the tax treatment of the modified business model before the variation is filed.
The interaction with the Travel Rule is also material. A variation that adds a new service category – particularly one involving the transfer of digital assets between VASPs – creates an immediate obligation to implement the Travel Rule for the new category. Under FATF Recommendation 15 and its implementing provisions across the major regimes, the obligation applies to each new category from the date of authorisation. A founder who launches a transfer service before the Travel Rule compliance infrastructure is in place is non-compliant from day one.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – the full scope of OBOLUS licensing counsel across 70+ jurisdictions
- VASP Licence Application Under Heightened Scrutiny – applying for or reapplying after a prior refusal or regulatory concern
- Crypto Fraud and Asset Recovery in Liechtenstein – cross-border recovery where regulated assets and disputes intersect
A common assumption: "my offshore registration covers my global operations"
A common assumption among early-stage founders is that a single offshore VASP registration – whether in the BVI, the Cayman Islands, or a similar centre – is sufficient to cover a global user base. It is not. The offshore registration satisfies the home-jurisdiction requirement. It does not satisfy the licensing or registration requirement of any other jurisdiction into which the service is offered.
This is not a technicality that enforcement agencies overlook. The FCA has taken action against entities operating in the UK without registration. ESMA and national competent authorities have issued warnings against entities marketing to EU users without MiCA authorisation. MAS has acted against entities offering digital payment token services in Singapore without a licence under the Payment Services Act. The pattern is consistent: the operative question for each regulator is whether the service is offered to residents of their jurisdiction – not where the entity is incorporated.
The practical implication for renewal and variation is that a founder who has been operating on an offshore registration while building a user base across multiple jurisdictions must address that mismatch as part of the renewal strategy. Renewing the offshore registration without addressing the unlicensed market exposure is not compliance – it is deferred risk. In our practice, we map the full licence stack before advising on renewal or variation, because renewing one licence while the entity operates unlicensed in two others does not reduce the overall risk profile.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than seventy jurisdictions, on disputes and on-chain asset recovery across more than twenty-five forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – so founders understand the full regulatory exposure before the regulator does. To discuss your renewal or variation situation, contact info@oboluslaw.com.
To pressure-test your licence structure before you file, message us via t.me/oboluslaw or write to info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in post-authorisation compliance cycles, multi-regime variation strategy and VASP licence management for early-stage digital-asset businesses across the major licensing hubs.
FAQ
How long does a crypto licence take to obtain?
Timelines vary materially by jurisdiction, licence category and the state of the applicant's compliance documentation. A straightforward registration in a streamlined regime is typically processed in a matter of weeks. A full CASP authorisation under MiCA, or an activity-based licence under VARA in Dubai, typically takes several months from submission of a complete application. Pre-submission preparation – the audit, the AML programme, the governance documentation – commonly takes as long as the regulatory review itself. Begin at least three months before any target launch date.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction. The right licensing environment depends on where your users are located, the nature of the service (exchange, custody, issuance, payment), the banking you need to access, and your tax and governance objectives. A MiCA authorisation in an EU member state provides passporting across the EU/EEA. VARA in Dubai offers a deep crypto-native regulatory environment. MAS in Singapore is rigorous but commands international recognition. We map the decision across all four dimensions before recommending a primary jurisdiction and the satellite registrations that supplement it.
Do I need a separate custody licence?
In most major regimes, custody of digital assets is a separately regulated activity. Under MiCA, custodying crypto-assets for third parties is one of the enumerated CASP services requiring specific authorisation. Under VARA in Dubai, custody is a distinct activity class with its own approval and capital requirements. Under the Singapore Payment Services Act, certain custody functions engage regulated service categories. Whether your existing licence covers custody – or whether a variation or separate application is required – depends on the precise scope of your current authorisation and the regime's classification of the custody function you are providing.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.