VASP License Support for Virtual Asset Businesses

Quick Facts

Service Snapshot	What to Expect
Starting point	Business assessment and jurisdiction selection
Scope	Corporate structuring, VASP license application and compliance framework
Price basis	Agreed work, official fees and external costs
Timing	Client readiness, document preparation and authority review

Is This the Right Fit for Your Business?

An assessment is relevant if you provide virtual asset services for customers, including exchange, custody or transfers. Software-only development or investing solely for your own account does not automatically make you a VASP. However, a non-custodial label alone does not settle the question: actual control and active facilitation matter under FATF guidance.

A VASP license assessment should also identify activities needing separate treatment, such as derivatives or tokenized financial instruments. The broader crypto license guide helps place these alternatives in context.

VASP License vs. Other Licensing Routes

There is no universal “VASP license.” The appropriate route depends on the services you provide, where your customers are and the requirements your business must meet.

Route	Examples	What It Means in Practice	What to Assess
AML registration	US MSB (FinCEN), Canada MSB (FINTRAC)	Registration for AML/CFT supervision. It should not be treated as permission for every financial activity.	Whether additional permissions apply. In the US, this includes checking state-level licensing requirements.
Activity-specific licensing	Dubai (VARA)	Permission to provide the virtual asset services specified in the licence.	Permitted activities, capital, staffing and ongoing compliance obligations under the relevant VARA requirements.
EU CASP authorisation	EU national competent authorities under MiCA	Authorisation for specified crypto-asset services, with cross-border provision across the EU subject to MiCA procedures.	Whether your business needs CASP authorisation. Certain existing financial institutions can provide eligible services through the Article 60 route, as recognised in MiCA Article 59.
VASP registration or licensing in offshore jurisdictions	Seychelles, Cayman Islands	Country-specific regulatory regimes. “Offshore” describes the location, not a lighter category of permission.	The applicable offshore licensing requirements and restrictions in customer markets. For example, Cayman custody and trading platform services require a licence under CIMA’s rules.

How to Choose

Start with what customers can do through your platform and where they are located. Identify the required permissions before comparing capital, staffing, costs and launch timelines. Incorporating a company alone does not authorise it to provide regulated crypto services.

A business serving several markets may need multiple permissions. Gofaizen & Sherle can help assess the appropriate combination and define the scope of application support.

Which Virtual Asset Services Need Assessment?

Map what the business actually does before choosing a VASP license. FATF’s activity categories provide a starting point, while domestic law determines the permission.

Business Model	Activity to Assess
Exchange or OTC desk	Conversion between fiat and virtual assets, or between virtual assets
Custodial wallet	Safekeeping or administration of assets or instruments enabling control
Transfer / remittance service	Moving virtual assets for another person
Trading platform	Operating a market for customer orders, assessed under the relevant national activity definitions
Token distribution intermediary	Participation in financial services related to an issuer’s offer or sale

Issuing a token and providing services around its distribution are distinct questions. A VASP license should never be assumed to cover every digital asset product.

What Does VASP License Support Include?

Gofaizen & Sherle can support the following workstreams, with deliverables agreed for the selected route:

• Assessment: activity classification, jurisdiction comparison and an application gap list.
• Corporate setup: company formation and ownership or governance structuring.
• Application preparation: business descriptions, corporate evidence and regulator-facing documents.
• Compliance framework: AML/CFT policies, customer due diligence procedures and governance responsibilities.
• Regulator communications: responses to questions and revisions to the submission.
• After authorisation: compliance updates and ongoing regulatory support within the agreed engagement.

VASP license support does not replace the client’s responsibility to provide accurate evidence, appoint suitable personnel and implement operational controls.

What Determines VASP License Cost?

VASP license cost depends on service scope, entity structure and the work already completed. Compare quotations by separating these items:

Budget Component	What to Clarify
Gofaizen & Sherle professional fee	Included deliverables, revisions and exclusions
Official charges	Application, supervision and renewal fees where applicable
Third-party costs	Translations, certification, audits and external providers
Share capital and regulatory capital	Applicable minimums, payment timing and ongoing capital requirements
Operating budget	Staff, premises, technology and ongoing compliance

Required capital is a separate funding requirement, not a licensing fee. A VASP license quotation should specify whether company setup and post-authorisation work are included or separately scoped.

What Information Is Needed from the Client?

For an initial VASP license assessment, prepare:

• Company documents and ownership details, including beneficial owners.
• Services, customer countries and transaction-flow descriptions.
• Management profiles, funding information and planned local presence.
• Existing business plans, compliance policies and technology-provider arrangements.

This is an assessment checklist. The final application requirements depend on the chosen route.

How Long Does Preparation and Review Take?

There is no reliable global VASP license timeline. The overall timeline includes preparing the application documents, putting the required staff, systems and controls in place, and waiting for the regulator to assess the application. Missing ownership evidence, unresolved custody arrangements or changes to the business model can affect the schedule. Any estimate should identify its assumptions and the stages outside Gofaizen & Sherle’s control.

Which Regulations Apply?

FATF sets international AML/CFT standards. National legislation establishes registration or licensing duties and supervisory powers. A VASP license is therefore assessed against local law, not issued by FATF.

For EU projects, the MiCA regulation guide explains the framework. Businesses planning Dubai operations can consult the VARA regulations overview.

What Is the Current Regulatory Status?

European Union
The maximum MiCA grandfathering period ended on 1 July 2026. An old national registration no longer provides that transitional basis for continuing operations, as ESMA’s statement explains. See crypto licensing in Europe for regional route selection.

United Kingdom
FCA registration under the Money Laundering Regulations remains relevant for in-scope UK business. The new FSMA application period is 30 September 2026–28 February 2027, ahead of the regime starting on 25 October 2027, according to the FCA timetable.

Which Local Requirements Affect the Company?

Local presence and territorial rules can change the setup required.

Market	Requirement or trigger
European Union	Article 63 applicants need a registered office in a member state where they provide some services, effective management in the EU and at least one EU-resident director under Article 59.
United Arab Emirates	Mainland and free-zone filing channels differ. VARA excludes DIFC. Its Approval to Incorporate permits setup, not virtual asset operations.
United Kingdom	Financial-promotion rules can apply to marketing to UK consumers even where the company is overseas, as the FCA explains.

What Ongoing Compliance Duties Follow?

Plan AML/CFT controls as operating responsibilities, with named owners and evidence of completion. Depending on applicable law, these cover customer checks, transaction monitoring, suspicious-activity reporting, records and Travel Rule information, reflecting FATF’s preventive standards. Governance, capital and reporting duties must also be checked against the specific regime. VARA, for example, requires both compulsory and activity-specific rulebooks.

Two practical risks require attention:

1. Application refusal: VARA may refuse a license where a firm does not meet its standards.
2. Loss of operating basis: ESMA’s post-transition instructions require unauthorised CASPs to stop new EU onboarding and wind down affected activities.