Regulators across the European Union, the United Kingdom and the Gulf have spent the past two years recalibrating how indirect tax applies to digital-asset businesses. A token exchange that settled its VAT (value-added tax) position under legacy guidance may now be operating on assumptions that no longer hold. The same transaction — a crypto-to-fiat swap, a staking reward pass-through, a custody fee — can attract materially different VAT outcomes depending on where the supplier is established, where its users sit and which licence the business holds. That gap between an old analysis and a current one is exactly where tax authorities are now focusing their attention.
The VAT treatment of crypto services under heightened scrutiny turns on three interlocking questions: how the relevant regime classifies the token or service, whether an exemption applies to that classification, and whether the business's cross-border structure supports the position it files. No single answer applies globally. Under MiCA (the EU's Markets in Crypto-Assets Regulation), service classification for VAT purposes runs in parallel with CASP authorisation — and a business that holds a CASP licence in one member state may nonetheless face VAT exposure in another if its supply chain is structured incorrectly. In our practice, we consistently find that the entity structure and the VAT position were designed in isolation. This page sets out how to bring them into alignment.
Why Has VAT Scrutiny of Crypto Services Intensified?
Tax authorities in the major hubs have materially stepped up indirect-tax audit activity targeting digital-asset businesses, and the drivers are structural rather than cyclical. The ESMA-coordinated MiCA supervisory apparatus creates, for the first time, a standardised EU-wide register of licensed crypto-asset service providers. That register is directly accessible to national tax administrations. An operator that obtained a CASP authorisation in Lithuania or Malta and passported into France or Germany now hands the French and German VAT authorities a readable map of its cross-border supply chain.
Outside the EU, the FCA's financial-promotion rules and MLR registration in the United Kingdom have created an analogous visibility layer. VARA in Dubai and the FSRA within Abu Dhabi's ADGM have both introduced detailed activity-based licensing that specifies, service by service, what a firm is authorised to do. That specificity is valuable for VAT analysis — but it also means that a misclassified service is identifiable from the licence itself.
The underlying legal tension has existed for years. Most jurisdictions inherited VAT frameworks built for financial services in the pre-crypto era. The result is a patchwork: some crypto services are treated as exempt financial services, others are taxable at the standard rate, and a significant category sits in genuine grey territory where the applicable rule depends on how you characterise the token. Authorities have been patient. That patience is ending.
FATF Recommendation 15 and its implementing guidance on virtual assets have pushed national supervisors to build out both their AML and their tax-information architectures simultaneously. The two are now inseparable. When a VASP files an AML suspicious-activity report, the same transaction data sits in a system that the tax authority can access. Operators who assumed that indirect tax was a secondary compliance matter have been surprised to find it is the first letter they receive.
For a scoped assessment of your VAT exposure across the jurisdictions where your business operates, contact OBOLUS at info@oboluslaw.com. The process above describes the standard analytical path. Your facts — the entity, the user base, the banking relationships — change the analysis materially.
How Does Token Classification Drive VAT Outcomes?
Token classification is the foundational step in any VAT analysis of a crypto business, and getting it wrong at the outset contaminates every downstream position. The three operative categories — payment tokens, utility tokens and investment or security tokens — attract different VAT treatment in virtually every jurisdiction that has issued guidance, and the labels a business applies to its own tokens in its whitepaper are not binding on a tax authority.
Under MiCA, the EU distinguishes between asset-referenced tokens (ARTs), e-money tokens (EMTs) and a residual category covering all other crypto-assets. That classification determines what kind of CASP authorisation is required. It also maps, imperfectly but usefully, onto the VAT question. An EMT issued and redeemed at par against a single fiat currency typically falls within the financial-services exemption in EU member states, mirroring the treatment of e-money. An ART referencing a basket of assets is more complex — the exemption may apply to the exchange leg but not to any management or structuring fee.
Payment tokens used purely as a medium of exchange have generally been treated as exempt in the UK since the HMRC guidance that followed the Court of Justice of the European Union's landmark decision. The FCA's current MLR registration regime does not itself determine the VAT treatment, but the nature of the regulated activity described in the registration application is increasingly used by HMRC auditors as the baseline for characterising the supply.
Utility tokens present the most persistent difficulty. Where a token grants access to a defined service — compute resources, platform features, content — the supply of that token may constitute a taxable supply of the underlying service. The VAT rate then depends on what that service is and where the customer receives it. A business that sells utility tokens to users in multiple EU member states and treats the entire flow as a single exempt financial-services transaction is almost certainly wrong in at least some of those states.
In our cross-border practice, we apply a four-step classification exercise before advising on any VAT position: identify the rights the token confers; map those rights to the applicable legal category in each relevant jurisdiction; determine whether an exemption applies and, if so, whether it is full or partial; and stress-test the classification against the actual contractual documentation. The whitepaper, the terms of service and the smart contract all need to tell a consistent story.
What Is the Cross-Border Supply Chain Problem for Crypto VAT?
The cross-border supply chain is where most digital-asset businesses accumulate their largest unanalysed VAT risk. A business established in one jurisdiction — say, a CASP authorised under MiCA in Malta — may supply services to users in twenty EU member states and to users outside the EU simultaneously. The place-of-supply rules differ for B2B and B2C supplies, and they differ further when the customer is outside the EU entirely. A custody fee paid by a professional investor in Germany is VAT-treated differently from the same fee paid by a retail user in the Netherlands, and differently again from a fee paid by a fund domiciled in the Cayman Islands.
The MiCA passporting mechanism resolves the regulatory question of which national competent authority supervises the business. It does not resolve the VAT question. An MFSA-authorised CASP passporting into France has a single regulatory supervisor but potentially multiple VAT registration obligations, depending on the nature and volume of its B2C supplies into France. Operators who conflate supervisory passporting with VAT passporting — a conflation we see regularly — end up under-registered and under-filing.
Outside the EU, the analysis multiplies. A business that holds both a VARA licence in Dubai and a MAS Digital Payment Token licence in Singapore is operating in two jurisdictions that each have their own indirect-tax regimes, their own rules on cross-border financial services and their own audit priorities. The FSRA within Abu Dhabi's ADGM adds a third regime. Managing those three positions coherently requires a holding structure in which the taxable person in each jurisdiction is clearly identified and the intercompany fee arrangements are priced at arm's length.
Intercompany arrangements are a particular flashpoint. A common structure places the IP-holding entity in one jurisdiction, the operational entity (holding the licence) in another and the treasury entity in a third. If the royalty or service fee flowing between those entities is not documented at arm's length and VAT-analysed in each relevant jurisdiction, the entire structure may be re-characterised on audit. In our experience, transfer pricing and VAT are addressed by different advisers who do not speak to each other. The resulting gap is precisely what a well-prepared tax authority exploits.
What Are the Most Common VAT Mistakes in Crypto Businesses?
The most common VAT mistake in digital-asset businesses is applying a single-jurisdiction analysis to a multi-jurisdiction business. This manifests in several recurring patterns we see across the businesses that come to us after a revenue-authority inquiry has already commenced.
First: treating all crypto-exchange services as exempt. The exchange of cryptocurrency for fiat currency has been held to be an exempt financial service in a number of jurisdictions, following EU jurisprudence. But that exemption does not extend automatically to brokerage fees, platform-access fees, staking-facilitation charges or data-feed subscriptions. A business that routes all of its revenue lines through the exchange-service exemption without analysing each line separately will face disallowance on audit.
Second: ignoring the input-tax recovery consequence of partial exemption. Where a business makes both exempt and taxable supplies, it can typically recover only a proportion of the VAT it pays on its own costs — the proportion attributable to taxable supplies. A crypto business that incorrectly treats all of its supplies as exempt may be over-recovering input tax, a position that attracts both a VAT liability and, often, a penalty for careless error.
Third: failing to register for VAT in states where the business has customers. The extension of digital-services VAT rules in the EU means that a non-EU business supplying digital services to EU consumers above a threshold must register and account for VAT in the EU, either via an individual member-state registration or the OSS (One-Stop Shop) mechanism. Many crypto businesses operating from Dubai or Singapore assume that their non-EU establishment removes EU VAT obligations. For B2C supplies, that assumption is wrong.
Fourth: inconsistency between the VAT position and the regulatory classification. Where a business has told its regulator that its token is a utility token (because it wanted to avoid securities-law obligations), it cannot simultaneously tell the tax authority that the token is an exempt financial instrument. Revenue authorities and financial regulators increasingly share data, and internal inconsistency across regulatory filings is a reliable audit trigger.
Which Operator Profile Faces Which VAT Risk?
Not every digital-asset business carries the same VAT profile. A practical decision matrix, drawn from the business types we most frequently advise, illustrates the divergence.
Profile A — EU-licensed exchange (CASP under MiCA), B2C user base across multiple member states. The primary VAT instrument is a careful supply-by-supply classification, a partial-exemption calculation and, where the business exceeds the OSS threshold in multiple states, a structured OSS registration. The key risk is under-classification of ancillary revenue lines (API access, premium tiers, data subscriptions) as non-exempt. Timeline for a scoped VAT review and position paper is typically a matter of weeks for the analytical phase; registration in additional states, where required, adds further time depending on the member state's processing pace.
Profile B — Non-EU operator (Dubai VARA or Singapore MAS licensed), supplying into EU and UK markets. The VAT instrument here is a determination of whether the business has a fixed establishment in any EU member state, followed by a place-of-supply analysis for each revenue line. The key risk is the assumption that offshore establishment removes EU and UK VAT obligations. A business supplying B2C digital services into the EU above the applicable threshold owes EU VAT regardless of where it is established. The practical resolution often involves a structural decision — whether to operate the EU-facing book out of an EU entity (with its own CASP authorisation) or to register for EU VAT as a non-established supplier.
Profile C — Token issuer, single jurisdictional establishment, global token sales. The VAT instrument is an analysis of whether the initial token sale constitutes a taxable supply and, if so, what is supplied to whom. Where the token grants access to a future service, the sale may be treated as a supply of a voucher (single-purpose or multi-purpose, with different VAT consequences) or as a prepayment for a taxable service. The key risk is treating the token sale as entirely outside scope without adequate legal analysis. The timeline for a whitepaper-to-VAT-position exercise is typically a matter of weeks, subject to the complexity of the token's rights structure.
Profile D — Staking and DeFi protocol, fee revenue from smart-contract interactions. This is the most analytically contested profile. Many jurisdictions have not issued clear guidance on whether automated protocol fees constitute a supply for VAT purposes, and who the supplier is. The key risk is inaction: filing no VAT position at all and treating the protocol as outside scope indefinitely. The practical approach is a jurisdiction-by-jurisdiction materiality assessment, a documented legal position for each material revenue stream and a monitoring protocol as guidance develops.
If a prior VAT analysis stalled or an inquiry has already commenced, a second read can surface the structural reason and the route to resolution. Write to OBOLUS at info@oboluslaw.com. If a prior application stalled or a position was challenged, a fresh assessment frequently identifies both the source of the exposure and a defensible remedial path.
How Does Holding Structure Interact With Tax Residency and VAT?
Personal tax residency and corporate structure must be decided together — treating them as separate workstreams is one of the most expensive errors a digital-asset founder can make. This is not a theoretical concern. In our practice, we regularly advise founders who relocated personally to a low-tax jurisdiction while leaving the operating company managed and controlled from their previous home state. The corporate tax position is determined by where management and control sit, not where the company is incorporated. A founder who moved to Dubai but continues to chair board calls from London has not moved the company's tax residence.
The VAT dimension of this structural question is often overlooked entirely. Where a holding company is the VAT group representative, its place of establishment determines the place-of-supply rules for intra-group transactions. A holding structure designed to optimize direct tax without regard to VAT group eligibility may inadvertently create irrecoverable input-tax costs within the group, or expose the group to VAT registration obligations it did not anticipate.
A common assumption in the market is that relocating personally is enough to change the group's tax position. It is not. The analysis requires a concurrent review of the holding structure, the management-and-control facts, the employment and service agreements, and the place-of-supply chain. Founder residency is one input; it is not the output. We align founder residency with the holding structure and exit plan as a single coordinated exercise, because the cost of misalignment — both in direct tax and in VAT — compounds over time.
The Travel Rule (the FATF obligation to pass originator and beneficiary data alongside a virtual-asset transfer) creates an additional structural consideration. Where an intercompany transfer of crypto assets triggers Travel Rule obligations, the documentation generated by that transfer is potentially reviewable by both the AML supervisor and the tax authority. Intercompany crypto flows that are VAT-unanalysed, Travel-Rule-undocumented and transfer-pricing-unpriced represent a triple exposure point. Addressing them as a single workstream is materially more efficient than addressing them in sequence.
In a recent structuring matter, an early-stage exchange operator established in a Gulf free zone had designed its holding structure for corporate tax efficiency but had not analysed the VAT consequences of its intercompany IP-licensing arrangement. The royalty flow created a VAT registration obligation in a member state the operator had not identified. We restructured the intercompany arrangement, obtained the required registration and documented a defensible place-of-supply position before the business launched into the EU market. The matter resolved before any inquiry commenced.
Addressing the Common Assumption: "Our Tokens Are Exempt"
A common assumption among digital-asset businesses is that because cryptocurrency exchange has been held exempt in leading jurisdictions, the exemption extends to the entire business. It does not. The exemption that applies to the exchange of a cryptocurrency for fiat currency — or for another cryptocurrency — is narrow. It covers that specific transaction. It does not cover brokerage commissions, custody administration fees, lending margins, staking-facilitation spreads, white-label service fees or data subscriptions. Each of those revenue lines requires its own classification and its own exemption analysis.
A second assumption is that small businesses or early-stage operators are beneath the audit threshold. Revenue authorities in the major jurisdictions have demonstrated, repeatedly, that the size of the business is not the primary audit-selection criterion. Structural novelty — a new token type, a new service architecture, an unusual cross-border supply chain — attracts attention regardless of revenue quantum. A business with a seven-figure annual revenue but a novel DeFi structure is more likely to receive an inquiry than a conventional exchange with an eight-figure revenue and a settled VAT position.
A third assumption is that a VAT opinion obtained at the time of the token launch remains valid indefinitely. It does not. VAT guidance on digital assets is actively evolving in every major jurisdiction. A position that was defensible under 2021 guidance may be untenable under 2024 guidance. Periodic re-review is not optional for businesses operating at scale.
Self-Assessment: Is Your VAT Position Defensible?
Before engaging counsel, operators can apply a practical self-assessment to identify whether a VAT review is urgent. The following questions, drawn from the analytical framework we apply in initial scoping calls, indicate the pressure points.
Does your business have a current, written VAT classification for each material revenue line? If the answer is no — or if the classification was prepared more than two years ago without subsequent review — the position should be treated as unanalysed for the purposes of an audit. A verbal understanding between the finance team and an external accountant is not a defensible VAT position.
Has your business expanded into new jurisdictions, launched new products or changed its service architecture since the last VAT review? If yes, the existing analysis may not cover those changes. MiCA, which became directly applicable across the EU in 2024, has materially changed the regulatory context against which VAT exemption arguments are assessed. A pre-MiCA VAT opinion should be reviewed against the new supervisory architecture.
Does your business have intercompany transactions — royalties, service fees, shared-services charges — that cross VAT jurisdictional lines? If yes, each of those transactions requires a place-of-supply analysis and, where the charge is for a taxable service, a reverse-charge or registration analysis in the recipient jurisdiction. The absence of that analysis is the most common source of material VAT exposure in multi-entity digital-asset groups.
Is your business's VAT position consistent with the regulatory classification it has adopted for licensing purposes? Inconsistency between regulatory filings and tax filings is an audit trigger. If the business has told its regulator one thing about the nature of its tokens or services and its VAT filing implies a different characterisation, that inconsistency needs to be resolved before it is identified by an authority.
Related at OBOLUS
- Tax and cross-border structuring for digital-asset businesses – our full practice overview covering holding structures, exit planning and intercompany arrangements
- Tax treatment of tokens in the UAE under VARA – jurisdiction-specific analysis of token taxation in Dubai's VARA regime
- Worldwide freezing orders in Singapore – rapid asset-preservation options for digital-asset disputes in the Singapore forum
FAQ
Where should a token-issuing entity be domiciled?
Domicile selection for a token-issuing entity turns on four concurrent factors: the regulatory regime governing the token type, the VAT treatment of the token sale in the chosen jurisdiction, the corporate tax rate on any subsequent appreciation or fee income, and the founder's own tax residency. No single jurisdiction is optimal across all four dimensions for every business. The practical answer requires a coordinated analysis of the regulatory, VAT and direct-tax position in two or three candidate jurisdictions before committing to a structure. We advise on that comparative exercise as a single scoped mandate.
How are staking rewards taxed?
The tax treatment of staking rewards varies significantly by jurisdiction and remains unsettled in several major markets. In most jurisdictions that have issued guidance, staking rewards are treated as ordinary income at the point of receipt, with the market value at receipt forming the cost base for any subsequent disposal. For VAT purposes, whether the staking activity constitutes a supply of services — and to whom — is a separate question that turns on the protocol architecture and the staker's role. Businesses operating staking-as-a-service products face additional complexity because they may be making a supply to both the token holder and the network. Current tax positions should be reviewed against the latest guidance in each relevant jurisdiction.
Does remote working create tax residency risk?
Remote working creates tax residency risk for both the individual employee and, in certain fact patterns, the corporate entity. An employee working remotely from a jurisdiction where the company has no establishment can inadvertently create a permanent establishment in that jurisdiction, triggering corporate tax obligations and, potentially, payroll-tax and social-security obligations. For founders and directors, the risk is more direct: the exercise of management and control from a jurisdiction, even temporarily, may constitute tax residence of the company in that jurisdiction. Businesses with remote or distributed teams should document the location of management decisions and review employment agreements against the tax-residency rules in the jurisdictions where key personnel are based.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance structures that sit around them. We structure licensing, banking and tax as one mandate rather than three disconnected workstreams — aligning founder residency with the holding structure and exit plan from the outset. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Lydia Brennan, Tax & Structuring Analyst — specialising in cross-border VAT analysis, holding-structure design and tax-residency planning for digital-asset businesses and their founders.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.