Does my crypto business need a licence? What is a VASP licence and how do I get one?

The first criterion that influences the need for a particular licence is the company’s activity. For example, in the vast majority of cases, if a company simply uses cryptocurrency as a method of accepting or making payments, and the laws in the company’s and the counterparty’s country of incorporation generally permit such activities, no licence is required. However, if a company provides any services directly related to a particular blockchain (such as issuing its own tokens, developing blockchain software, offering users crypto wallet or crypto exchange services, etc.), it may well be required to get a licence.

Here we approach a second, equally important, criterion: the countries where the company operates. This definition includes, in particular:

• The jurisdiction where the company is incorporated;
• The countries where the company’s management (director/CEO, compliance officer, AML officer, and other senior executives) resides;
• The countries where the company’s clients — both individuals and other companies —are located.

If a company is engaged in crypto-related activities that could potentially require a licence, it is necessary to consider the legal requirements of all the above-mentioned jurisdictions at the project planning stage. It is perfectly possible that a company will need to apply for multiple licences in different countries: for example, when both the jurisdiction where the company is incorporated and the country where its clients are located (especially if it is an EU member state) require a licence for this crypto-related activity. It is important to note that, although countries’ approach to licensing is similar in essence, they differ a lot in detail. For example, if a company provides non-custodial wallet services to its clients, it is entirely possible that the jurisdiction where the company is registered does not require a licence, but the laws of the countries where its clients are located, do.

For guidance, you can look at the list of countries where crypto giants (such as Binance or Kraken) are licensed.

When deciding whether a company needs a licence, it is necessary to determine whether its activity qualifies as licensable in the countries where the company is incorporated, where its management resides, and where its clients are located.

The activities of companies providing licensable services in the virtual asset sector are normally regulated by a Virtual Asset Service Provider (VASP) licence. Some jurisdictions may also use such designations as Digital Asset Service Provider (DASP) or Crypto Asset Service Provider (CASP). Generally, all crypto licensing regimes are commonly referred to as VASP.

As mentioned above, many of these regimes are essentially similar. The starting point for most of them is the VASP Guidance[1], first issued by the FATF in 2019. This guidance establishes the following key definitions:

• Virtual asset is a digital representation of value that can be sold or transferred digitally and can be used for payment or investment purposes;
• Virtual Asset Service Provider is any individual or legal entity that by way of business carries out one or more of the following activities:
  • Exchange between virtual assets and fiat currencies;
  • Exchange between one or more forms of virtual assets;
  • Transfer of virtual assets on behalf of another person;
  • Custody and/or administration of virtual assets or instruments that enable control over virtual assets;
  • Participation in or provision of financial services related to an issuer’s offer and/or sale of a virtual asset.

Subject to their risk-based approach, countries may make this list shorter or longer, add activities that are generally prohibited, or establish different VASP licensing requirements for different types of crypto businesses. More details on the requirements in various jurisdictions can be found in the relevant publications on our website:

Furthermore, since crypto projects often offer their users functionality that allows them to transfer fiat or cryptocurrency to each other, they may be required to obtain a payment system licence. These licences are normally called Money transmitter, Money service operator, Money service business, Payment service provider, and others. Sometimes, a crypto licence is a type of payment system licence.

We should also mention separately companies that issue their own tokens (i.e. launch ICOs). Financial regulators around the world closely monitor the financial products sold in their domestic markets and how well issuers comply with regulations governing public offerings of securities. This applies to ICOs too: if a token (especially a security token) is issued publicly without complying with relevant requirements, the regulator may hold the company liable. The most prominent example is the United States, where the Securities and Exchange Commission (SEC) can qualify an ICO as an IPO if a token issue meets the so-called Howey Test[2]. This is a problem that Telegram faced in 2020-2021.

Each jurisdiction, based on its risk management approach, sets its own requirements for companies licensed to conduct crypto activities. However, the list of possible requirements from which states select those to apply in their territory is generally similar. Below are the most common ones:

• A certain level of authorised capital. The law usually requires a company to deposit in advance a clearly defined amount of authorised capital either into the company’s account or with the regulator. However, some jurisdictions may also require that the amount of authorised capital be determined by the regulator when reviewing the application based on the company’s proposed business.
• Professional insurance, a certain amount of insurance coverage. A requirement that is largely similar to the level of authorised capital. As a rule, coverage is required to be adequate to the company’s proposed business.
• A local representative. This requirement is more common in offshore jurisdictions already familiar with the concept of a local registered agent. Such a representative performs a similar function, but only for interactions between the regulator and the company regarding VASP licensing. These representatives are usually themselves licensed entities and there are very few of them in the jurisdiction.
• A local director. An extremely common requirement. Many jurisdictions require that all or some of the directors of a licensed company be resident in their territory.
• Number of directors. Jurisdictions often require a company to have a certain minimum number of directors (usually 2 or more).
• Qualification of directors. Fit and proper test. This requirement is present to some extent in all jurisdictions that issue VASP licences, although the specific required qualification of a director varies. In the vast majority of cases, the director is expected to have a relevant higher education and/or experience in the cryptocurrency field that give no reason to doubt their competence. Additionally, some jurisdictions ask that one or all directors pass an in-person state exam to be considered sufficiently qualified.
• A physical office. This requirement typically correlates with having a local director (but not necessarily).
• A local compliance officer. Like the director, the compliance officer is a person who can be held liable if a company is in breach of regulations. Therefore, jurisdictions often require that this position be held by a person permanently residing in the country where the licence is issued.
• A local AML reporting officer. The requirement is largely similar to that for a local compliance officer. Often, these positions can be held by the same person.

Each project is unique and requires a tailored approach to selecting a jurisdiction based on the company’s activities, the countries where its clients and management are located, and the company’s ability to meet the VASP licence requirements described above. GSL specialists will be happy to help you find a jurisdiction best suited for your project.

According to statistics, Canada currently leads by a wide margin among countries with the largest number of issued crypto licences, with over 1,400 companies currently registered and authorised to engage in such activities. It is because this country has no separate VASP licence and issues authorisations for operations with “virtual currencies” under the long-existing Money Service Business regime.

Lithuania has the second-largest number of VASP licences, with over 500 companies. However, it should be noted that with the adoption of the Markets in Crypto-Assets Regulation (MiCA), by the European Parliament, all companies that hold the relevant licence in Lithuania and other EU countries (such as Cyprus, Ireland, the Netherlands, France, Italy, and Germany), will be required to get an updated licence under the MiCA Regulation. In most cases, the Regulation imposes significantly stricter requirements than those previously set in the legislation of EU member states.

As a consequence, many crypto projects are looking for new jurisdictions that can host their operations for clients outside the EU. In such cases, the choice often turns to familiar offshore zones: British Virgin Islands, Bermuda, the Bahamas, and so on. Since the 2020s, these jurisdictions have been actively developing and adopting crypto licensing laws. Since this legislation only came into force in most of these jurisdictions in 2022-2024, the number of issued VASP licences is currently small. However, given the demand in the marker, this number is certain to grow significantly in the coming years.

Summing up, if your company’s activity is in any way related to the provision of financial services using cryptocurrency instruments, you will most likely need to obtain a licence in the countries where the company is incorporated and managed from, and where its customers are located. Companies applying for such a licence face varying, and sometimes quite stringent, requirements. If you plan to establish a company to obtain a licence in the country of incorporation, it makes sense to consider the familiar offshore territories that have recently adopted VASP legislation.

[1] Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers

[2] The Howey Test refers to a set of criteria used to determine whether a transaction is an investment under U.S. law. These criteria were first formulated by the U.S. Supreme Court in Securities and Exchange Commission vs. W.J. Howey Co., 328 U.S. 293 (1946).