Licence renewal and ongoing authorisation management have become critical pressure points for digital-asset businesses operating across multiple regimes. Under MiCA, VARA, the MAS Payment Services Act and equivalent regimes, a licence does not operate indefinitely on the terms originally granted: conditions change, activities expand, and regulators expect periodic formal confirmation that the business still meets every threshold it met on day one. Missing a renewal window or failing to notify a variation can suspend permissions, trigger enforcement proceedings and — in banking terms — freeze the correspondent relationships that keep the business operational.
OBOLUS advises exchanges, custodians, token issuers and payment operators on the full lifecycle of their regulatory authorisations: initial grant, mid-period variation, periodic renewal and, where circumstances require, orderly wind-down of a permission. We map the licence stack across operating, custody and payment layers before a deadline arrives — not after it passes.
What Licence Renewal and Variation Mean in Practice
Renewal and variation are distinct regulatory actions, though they share a common consequence if mishandled: loss of permission to operate. Renewal is the periodic reauthorisation of an existing licence on substantially the same terms; variation is a formal amendment to add activities, change control, alter the geographic scope, or modify conditions the original grant imposed. Most digital-asset firms encounter both within the first two years of holding a primary licence.
Under MiCA, a CASP (Crypto-Asset Service Provider) authorisation granted by a national competent authority carries ongoing conditions that must be satisfied continuously — not just at application. The ESMA supervisory framework expects firms to maintain capital adequacy, governance standards and AML/CFT controls at all times. Any material change to the business model triggers a variation obligation; the threshold for "material" is lower than most operators assume.
VARA in Dubai applies a similar logic. The activity-based licence structure means that adding a lending product to an existing exchange licence is not a commercial decision alone — it is a regulatory event requiring a separate VARA rulebook compliance demonstration. We have seen operators in both the EU and the Gulf lose banking access because they added an activity without formal variation and the bank's compliance team flagged the discrepancy.
Jurisdictions with registration-based regimes — the BVI under its VASP Act 2022, the Cayman Islands under the Virtual Asset (Service Providers) Act, the FCA's crypto-asset registration under the Money Laundering Regulations — use similar variation logic. Even a registration that carries no fee-based supervision layer typically requires notification of controller changes, new services or jurisdictional expansion. Silence is not compliance.
The practical risk is not just regulatory. Payment partners, prime brokers and custody banks check licence status during periodic KYB reviews. An expired licence or an unnotified variation can trigger a bank's exit process independent of any regulator action.
OBOLUS assists with the process above. The path from deadline identification to renewal submission involves document retrieval, gap analysis against current supervisory expectations and, in many cases, a dialogue with the regulator before the formal filing. Your facts — entity structure, user base, banking relationships — shape the analysis.
If you are approaching a renewal window or a material change in activity, the right time to start is now. Contact OBOLUS at info@oboluslaw.com to scope the engagement.
The Regulated Basis for Renewal and Variation
Every renewal and variation obligation derives from the primary authorisation regime, and each regime handles continuity differently. Understanding the legal basis matters because it determines the documentary standard, the timeline the regulator expects and the consequence of non-compliance.
Under MiCA and the ESMA supervisory architecture, CASP authorisations issued by an NCA do not carry a fixed expiry date in the way some offshore registrations do. Instead, they impose ongoing conditions. The variation mechanism is the operative tool: any change to the scope of services, the governance structure, the key control functions or the capital base triggers a notification or full variation filing with the NCA. The NCA then has a defined assessment period — the length of which varies by category and by member state — to approve, reject or impose additional conditions.
VARA operates a rulebook-based authorisation. Each activity (advisory, broker-dealer, custody, exchange services, lending, management, transfer and settlement) carries its own rulebook compliance obligations. Adding an activity mid-licence requires VARA to confirm that the operator meets the new rulebook. VARA expects operators to self-identify variation obligations and to file proactively — not to wait for a supervisory enquiry.
MAS in Singapore issues licences under the Payment Services Act across three tiers: money-changing, standard payment institution and major payment institution. A business that grows beyond the transaction thresholds for its current tier must apply for an uplift to the next tier. This is a renewal-adjacent obligation triggered by commercial growth, not just a calendar event. Failing to uplift is a breach of the licence conditions, not merely an administrative oversight.
The AIFC/AFSA in Kazakhstan, ADGM/FSRA in Abu Dhabi, and FINMA in Switzerland each apply comparable structures: continuous conditions, variation by notification or formal application, and regulatory expectations of proactive disclosure. In our cross-border practice, the businesses that manage renewal and variation cleanly share one characteristic — they treat their licence as a living compliance document, not a filing made at inception.
How Does the Renewal and Variation Process Work?
The process from deadline identification to issued confirmation typically moves through four stages, and the timeline at each stage depends on the regime, the category of change and the quality of the submission.
Stage one: gap analysis. Before any filing, we assess the current licence conditions against the business as it operates today. This means reviewing the activity scope, the corporate structure, the AML/CFT programme, the capital position and any regulatory correspondence since the original grant. Gaps identified here determine whether the filing is routine or whether pre-submission dialogue with the regulator is advisable.
Stage two: document preparation. Renewal and variation filings typically require updated governance documents, a current AML/CFT policy, evidence of ongoing capital compliance, updated beneficial ownership disclosures and, in variation cases, a revised business plan describing the proposed change. Regulators in the leading hubs increasingly expect AML/CFT policies to address the Travel Rule (the obligation to pass originator and beneficiary data with a transfer) with specificity — generic language is no longer adequate.
Stage three: submission and regulator dialogue. Most regimes have a defined assessment period after submission, but the clock rarely runs without interruption. Regulators issue information requests (often called "completeness checks" or "requests for further information") that pause or extend the timeline. Managing these requests promptly — and correctly — is the operative skill. A response that concedes a compliance gap inadvertently can extend the assessment by months.
Stage four: condition management post-approval. Approved variations often carry new conditions attached: enhanced reporting, capital increases, restricted marketing in certain markets. We map these conditions at approval so the business knows, on day one of the new scope, exactly what it has committed to.
Timeline across regimes varies. Simple renewals in registration-based regimes (BVI, Cayman) are measured in weeks. Complex variations under MiCA or VARA — particularly those involving controller changes or new activity classes — are measured in months. We advise clients to begin the process materially in advance of any external deadline.
Common Mistakes That Delay or Derail Renewal
Renewal and variation applications fail — or stall — for predictable reasons. The most frequent are not technical. They are sequencing errors, documentary gaps and missed notification obligations that compound over time.
The first and most consequential mistake is treating the licence grant as the conclusion of the regulatory relationship. In our practice, we regularly advise businesses that received their licence, expanded commercially and arrived at a renewal filing carrying several years of unnotified variations. Reconstructing compliance history for a regulator who expects contemporaneous notification is significantly harder than notifying in real time.
The second mistake is submitting without a pre-submission review. Regulators in the major hubs have increased their scrutiny of ongoing condition compliance in recent years. An application that reveals a gap — in AML policy, in capital, in governance — opens a supervisory dialogue that the operator did not choose and is not prepared for. A gap identified internally, corrected and then disclosed proactively is treated very differently to one a regulator identifies from the application itself.
A third recurring issue is mismanaging the beneficial ownership disclosure. Controller changes — including those triggered by funding rounds, restructurings and secondary share sales — are typically notifiable events. We have seen operators complete a Series A and notify the relevant regulator six months later, which is routinely treated as a breach of the original authorisation conditions rather than a delayed administrative step.
The fourth mistake is jurisdictional: assuming that a licence in one hub covers a new market because the legal team "looked into it." A single offshore licence is not enough to serve clients globally. Each regime determines its own nexus rules — where a client is located, where the service is deemed to be provided and whether a local authorisation is required. Cross-border legal analysis before commercial expansion is not optional; it is the basis for a defensible compliance position.
In a recent renewal matter, a payments company operating under an EU CASP authorisation had expanded its product set to include digital-asset lending. The lending activity had not been subject to a formal variation application. When the business filed its routine renewal, the NCA identified the activity expansion and placed the renewal on hold pending a retrospective variation review. We structured the variation filing to run in parallel with the renewal, addressed the NCA's information requests within the standard response window and secured both the variation and the renewal confirmation without a gap in permissions. The matter closed within a business quarter.
Cross-Border Licence Stack: How Renewal Interacts Across Jurisdictions
A digital-asset business licensed in one jurisdiction and operating commercially in others carries a parallel obligation set: each active authorisation has its own renewal and variation calendar, and events in one jurisdiction can trigger obligations in another.
The most common cross-border trigger is a change of control. A merger, acquisition or significant secondary sale of shares in the licensed entity typically requires notification to every regulator that has approved the current ownership structure. Under MiCA's NCA framework, the ADGM/FSRA regime and the MAS Payment Services Act, the acquiring controller must separately satisfy the regulator's fit-and-proper assessment. The sequence matters: a jurisdiction that approves first can become the template for subsequent filings, but the timeline in each jurisdiction runs independently.
A second cross-border dimension is the interaction between a primary operating licence and a custody or payment sub-licence in a separate jurisdiction. Exchanges commonly hold an exchange licence in one hub, a custody authorisation in a second and a payment processing permission in a third. When the exchange files a renewal variation to add staking services, the change may trigger a variation obligation in the custody jurisdiction — because the staking function touches assets under custody — and a notification in the payment jurisdiction if fee flows change.
Allied counsel in the relevant jurisdiction handles the local filings in these multi-jurisdiction matters. OBOLUS coordinates the strategy, manages the overall timeline and ensures that the position taken in any one filing is consistent with every other. Inconsistent representations to different regulators are among the most serious risks in a multi-jurisdiction renewal cycle.
Tax and banking interact directly with licence status. A renewal that results in changed conditions — new activity scope, new capital requirements, modified geographic restrictions — should trigger a review of the entity's tax status and its banking terms. Banks periodically re-verify licence scope against account usage; a mismatch between what the licence authorises and what the bank observes in transaction flows can trigger an account review independent of any regulatory action.
If your business operates in more than one licensed jurisdiction, a coordinated renewal calendar is the starting point for the next 12 months. Message us at t.me/oboluslaw to map the filing timeline across your stack.
Decision Matrix: Which Renewal Path Fits Your Profile
No two renewals follow exactly the same path. The appropriate process depends on the operator's profile, the regime under which it is licensed and the nature of any change since the original grant.
Profile A — routine renewal, no material change. An exchange or custodian whose business model, ownership structure and geographic scope are unchanged since the original grant. The renewal is primarily a compliance confirmation: updated financials, refreshed AML/CFT programme, current governance documents. In a registration-based regime (BVI, Cayman), this is typically completed within a matter of weeks. Under MiCA or VARA, the timeline is longer and the documentary standard higher, but the process is procedurally straightforward. The key risk is underestimating the current supervisory expectation for AML/CFT policy detail.
Profile B — variation required, activity expansion. A firm that has added services — lending, staking, OTC brokerage — to its existing licence scope without formal variation, or that now wishes to add them formally. This profile requires a variation filing that substantially mirrors an initial application for the new activity. The timeline is materially longer than a routine renewal. Pre-submission dialogue with the regulator is strongly advisable before the formal filing. The risk of an adverse information request is highest in this profile.
Profile C — change of control or ownership restructuring. A business that has undergone a funding round, secondary sale or corporate restructuring triggering controller change obligations across one or more licences. This is the most technically complex profile. Each regulator must assess the incoming controller; the sequence of filings and approvals must be managed carefully to avoid a gap in authorisation continuity. The timeline is measured in months, not weeks. Allied counsel manages local filings; OBOLUS coordinates strategy across jurisdictions.
Profile D — regulatory uplift triggered by growth. A firm that has grown beyond the threshold for its current licence tier — most commonly under the MAS Payment Services Act tier structure. The uplift application is essentially a new application at the higher tier, though the regulatory relationship established under the existing licence is a positive factor. Timeline varies by jurisdiction and by the maturity of the firm's compliance programme.
In our cross-border practice, most businesses approaching renewal sit between Profiles A and B. The practical question is whether the gap between the licence as granted and the business as operated is small enough to address within a routine renewal or large enough to require a standalone variation filing. That assessment is the starting point for every engagement.
Self-Assessment Checklist: Before You File
A renewal or variation filing is only as strong as the compliance position it reflects. Before instructing counsel or submitting directly, an operator should be able to answer the following questions with documentary evidence.
First: is the current licence scope accurate? Map every service the business provides — including white-label, API-based or partner-distributed services — against the activity list on the current licence. Any service that is not explicitly within scope is a potential variation obligation, not a commercial grey area.
Second: is the AML/CFT programme current? Regulators in the leading hubs have updated their expectations for AML/CFT programme content, Travel Rule implementation and sanctions screening in recent years. A policy written at application stage and not reviewed since may be structurally adequate but operationally outdated. The gap, if identified in a regulator review, will extend the assessment period.
Third: is the beneficial ownership register accurate and up to date? Every change in controlling interests since the original authorisation should have been notified. If it was not, the renewal filing is the opportunity — but not a comfortable one — to rectify the position. A proactive disclosure framed correctly is substantially better than a disclosure made in response to a regulator's question.
Fourth: are capital levels within the required range, and can that be evidenced? Regulators increasingly ask for evidence of ongoing capital compliance, not just a snapshot at the renewal date. Internal treasury records, audited financials and, in some regimes, a specific capital adequacy return are part of the standard documentary set.
Fifth: have there been any regulatory enquiries, enforcement actions or material complaints since the original licence grant? These must be disclosed. How they are framed — the context, the remediation taken and the current position — is a matter of legal strategy, not simply a factual report.
If any of these five questions reveals a gap, that gap should be addressed before the filing, not explained within it.
Related at OBOLUS
- Licensing & Registration for Digital-Asset Businesses – the full OBOLUS licensing practice overview across 70+ jurisdictions
- Economic Substance for Licensed VASPs – meeting ongoing substance requirements for established VASP operators
- Real-World Asset Tokenization: Legal Counsel – legal structuring for RWA tokenization programmes across multiple regimes
FAQ
How long does a crypto licence take to obtain?
Timeline varies by jurisdiction and by the complexity of the application. Registration-based regimes — such as the BVI under its VASP Act or the Cayman Islands under its equivalent framework — are typically measured in weeks for a well-prepared submission. Full authorisation regimes under MiCA, VARA or the MAS Payment Services Act are measured in months; complex applications involving new activity categories or controller assessments take longer. The quality of the submission and the promptness of responses to regulator information requests are the primary variables within the operator's control.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction. The appropriate venue depends on where your users are located, which activity you intend to conduct, your banking requirements and your tax structure. MiCA passporting makes an EU CASP authorisation attractive for European user bases. VARA suits Dubai-centric operations with a Gulf and MENA commercial focus. MAS is suited to businesses with a Southeast Asian nexus and institutional counterparties. A single offshore licence is not sufficient to serve clients globally — each target market requires separate nexus analysis. We map the licence, banking and tax stack together before any commitment is made.
Do I need a separate custody licence?
In most flagship regimes, custody of client digital assets is a regulated activity that requires either a standalone authorisation or explicit inclusion within an existing licence's permitted activity scope. Under MiCA, custody is a distinct CASP service category. VARA treats it as a separate activity with its own rulebook. MAS addresses custody within the Payment Services Act framework. A business that holds client assets — even incidentally, as part of a broader exchange or payment service — should verify whether its current authorisation covers custody explicitly. Assuming coverage without confirmation is one of the most common and consequential compliance gaps we encounter.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before clients commit — not after a deadline has passed. Digital assets are the whole of our practice. To discuss your renewal or variation matter, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP authorisation lifecycle management, cross-border licence stacking and variation strategy across MiCA, VARA, MAS and equivalent regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.