Crypto Activity Licensing Setup (VASP)

VASP Crypto Licensing Setup

VASP licensing is a multi-month process with specific technical and organizational requirements. Success depends on proper preparation: regulators receive thousands of applications and quickly filter out those that do not demonstrate operational readiness.

Jurisdiction and License Type Selection

The first decision is where to obtain the license. Key factors:

Target market: EU-oriented business → Estonia/Lithuania/Malta (EU passporting). Middle East → Dubai VARA/DIFC. Asia → Singapore MAS. Global → BVI/Cayman Islands for holding + operational licenses by region.

Type of activity: crypto-to-fiat exchange requires different license than pure crypto-to-crypto. Custodial services — separate requirements.

Timeline: Estonia 2-4 months, Singapore 12-18 months.

Estonia — Most Popular Entry Point

Estonia's FIU issues two types of VASP licenses:

• Exchange licence: crypto exchange for fiat and between cryptocurrencies
• Wallet service licence: provision of crypto wallets (custody)

Estonia's Technical Requirements:

• AML Officer with experience (CV provided)
• AML Policy document (specific, not generic)
• Transaction monitoring system (description of rules)
• IT Security Policy
• Actual business presence in Estonia (post-2022 tightening — need local staff or director)

Dubai VARA — for MENA Market

VARA (Virtual Assets Regulatory Authority) — Dubai's regulator, launched in 2022.

VARA VASP activity categories:

1. VA Issuance Services
2. VA Broker-Dealer Services
3. VA Custody Services
4. VA Exchange Services
5. VA Lending and Borrowing Services
6. VA Management and Investment Services

Each category requires separate approval. VARA is known for detailed technology requirements: penetration testing reports, cloud security controls, DRP/BCP plans.

Technical Requirements for Most Licenses

Key Management

Requirement: custody keys in Hardware Security Module (HSM)
or Multi-Party Computation (MPC)

Solutions:
- Fireblocks MPC (SaaS, $50k-200k/year)
- AWS CloudHSM ($1.6/hour)
- Thales Luna HSM (on-premise, $30k+)
- Ledger Enterprise

Segregation of Client Assets

Most regulators require separation of client assets from operational:

// Architecture: separate HD wallet paths for client vs company
const PATHS = {
  CLIENT_FUNDS: "m/44'/0'/1'/", // Client segregated wallets
  OPERATIONAL: "m/44'/0'/2'/",  // Company operational
  COLD_STORAGE: "m/44'/0'/3'/", // Cold storage
};

// Daily reconciliation
async function reconcileClientAssets(): Promise<ReconciliationReport> {
  const onPlatformBalances = await db.sumAllUserBalances();
  const walletBalances = await blockchain.getWalletBalances(CLIENT_WALLET_RANGE);
  
  const discrepancy = Object.keys(onPlatformBalances).reduce((issues, asset) => {
    const diff = Math.abs(onPlatformBalances[asset] - walletBalances[asset]);
    if (diff > RECONCILIATION_TOLERANCE) {
      issues.push({ asset, onPlatform: onPlatformBalances[asset], inWallet: walletBalances[asset] });
    }
    return issues;
  }, [] as DiscrepancyItem[]);
  
  const report = { timestamp: new Date(), discrepancies: discrepancy, passed: discrepancy.length === 0 };
  await db.saveReconciliationReport(report);
  
  if (!report.passed) await alertComplianceAndTech(discrepancy);
  return report;
}

Business Continuity Plan (BCP)

Technical section of BCP includes:

• RTO (Recovery Time Objective): maximum time to recover after incident
• RPO (Recovery Point Objective): maximum acceptable data loss
• Hot/warm/cold standby: failover architecture
• Key person dependencies: what happens if key employees leave

Must document real architecture with specific RTO/RPO values.

Penetration Testing (for VARA and several others)

VARA requires annual pentest from accredited provider:

• OWASP Top 10 for web applications
• Smart contract audit (if applicable)
• Infrastructure pentest
• Social engineering assessment

Licensing Timeline

Support with VASP licensing includes jurisdiction selection, documentation preparation, technical system setup, and regulator communication.