BVI Crypto License (VASP)

The BVI crypto license is the official registration required for any company providing virtual asset services in or from the British Virgin Islands. Introduced under the Virtual Asset Service Providers Act 2022 (effective February 1, 2023), this license is issued by the BVI Financial Services Commission (FSC).

What does the BVI crypto license cover?

• Crypto custody: Storage and protection of clients’ crypto assets.
• Crypto exchange: Buy/sell/swap crypto, OTC trading, brokerage.
• General VASP: Wallets, payments, DeFi, blockchain infrastructure.

Companies can combine multiple categories into a single BVI VASP license. The FSC also offers a Regulatory Sandbox for startups to test their model for 18 months before full licensing.

Thus, the VASP regime in the BVI covers both classic crypto services, such as exchange and storage, and provides legal clarity, while leaving transactions with security tokens under the supervision of the Securities and Investment Business Act (SIBA).

Obtaining a British Virgin Islands crypto license provides companies with favorable conditions for working with digital assets. Here are the main advantages of the jurisdiction:

• Favorable and understandable regulation (VASP Act 2022);
• A tax-neutral environment with no corporate tax;
• International reputation as a reliable financial jurisdiction;
• High level of confidentiality and data protection;
• Simple and flexible corporate structure for doing business.

To obtain a crypto license in the British Virgin Islands (BVI), a company must meet the requirements set by the BVI Financial Services Commission (FSC):

• Corporate structure and local agent: BVIBC registration, unique name, presence of a director and shareholder. The company is registered as a BVI Business Company (BVIBC) with a unique name and compliance with corporate rules. It is mandatory to appoint a Registered Agent and Authorised Representative in the BVI. The structure must have at least one director and one shareholder; in certain models, the FSC recommends having a local director. The applicant may also be required to provide operational mapping – a map of operational processes with the distribution of functions between teams and providers.
• Capital: No fixed threshold, but capital must cover business risks. There is no fixed minimum capital requirement, but the company must confirm its ability to cover its operating expenses for 6-12 months. In some cases, the FSC requests a stress-testing summary and a description of the segregated assets logic, confirming the separation of client funds and the company’s own assets.
• AML/CTF: AML/CTF policies, KYC procedures, appointed CO/MLRO/DMLRO. The applicant implements KYC procedures, AML/CTF policies, a monitoring system, and a risk matrix. A Compliance Officer and MLRO are appointed. All VASPs are required to comply with UK sanctions requirements and FATF recommendations. The regulator welcomes the use of automated RegTech solutions and monitoring engines for transaction analysis.
• IT infrastructure: Description of technologies, data protection plan, audit (if necessary). The company provides a description of its technological architecture, data protection mechanisms, and keys, including a key management framework. The FSC assesses encryption measures, access control, wallet protection, and incident response plans. If necessary, an external IT audit is appointed.
• Cybersecurity: Security policy, customer data protection, response plans. A business continuity plan (BCP) must be prepared to confirm the ability to quickly restore operations. FSC may request a client asset protection model — a document describing how client assets are protected and how the company acts in force majeure scenarios.
• Risk Management: Risk management plan, threat assessment and protective measures.
• Business Continuity Plan (BCP): Mechanisms for uninterrupted operation and protection of customer assets.
• Reporting: Financial reports, audits, provision of data upon request by the FSC. The company keeps accounting records, submits annual reports, stores records, and is ready to undergo an audit. All beneficial owners, directors, and key personnel undergo due diligence before submitting an application.
• FSC guidelines and parallel asset regulation. Applicants use official FSC documents, including the AML/CFT Guide for VASP and Registration Guidelines. If the company’s assets have the characteristics of securities, activities are also regulated by the Securities and Investment Business Act (SIBA).
• Due Diligence: Verification of all beneficial owners and management.
• Registration fees.
  The fee depends on the VASP category and can start at USD 10,000.

These requirements confirm that the business operates transparently, complies with the law, and is capable of providing digital asset services securely. Below are the key conditions that must be met before applying:

KYC documents:

• Notarized copy of the passport of all participants;
• Notarized proof of address (utility bill/bank statement);
• Resume (CV) of each director and shareholder;
• Proof of source of funds (employment letter/bank reference).

Corporate documents:

• Business plan with financial model;
• Shareholding structure;
• Description of planned VASP services.
• Description of IT infrastructure, software used, and security systems.

Policies and procedures:

• AML/CTF policy;
• KYC and Customer Acceptance Policy;
• Cybersecurity policy;
• Risk assessment policy;
• Business Continuity Policy (BCP).

Operational Documents:

• Custody Services Agreement (if required);
• Appointment of Compliance Officer and MLRO;
• Agreement with Registered Agent.

The regulation of crypto services in the British Virgin Islands is based on the Virtual Asset Service Providers Act 2022, but depending on the business model, additional regimes may apply, including SIBA requirements, UK sanctions rules, and FATF standards. A VASP license is required for companies that provide services for the exchange, storage, management, and transfer of virtual assets, while individual transactions, such as the issuance of tokens that do not have the characteristics of a virtual asset, require prior legal analysis. 

To operate in the BVI, a company must have a corporate structure in the form of a BVIBC, a registered agent and a local representative office, as well as implemented AML/CTF procedures and an internal control system. Supervision is carried out by the FSC, which assesses the completeness of internal policies, corporate governance, and the company’s ability to safely provide services in the international market. This approach provides a combination of transparency, regulability, and flexibility, making the BVI an attractive jurisdiction for crypto operators focused on sustainable global operations.