Where and how to register a crypto company

Step three. Check whether an exception applies. If the company never controls client assets, ask a lawyer whether the product falls outside the licensing rules.

Step four. Make a short list of three or four countries. Choose countries where your clients are, where your team can live and work, and where one license or a set of licenses covers all your activities.

Step five. Check the FATF status of each country on the short list. Remove the countries that banks in your target markets are likely to refuse.

Step six. Talk to banks before you file. Ask two or three banks or payment institutions whether they would open an account for your business model in each country on the short list.

Step seven. Calculate the full budget for each country on the short list. Include capital, fees, staff salaries, legal work, and technology.

Step eight. Choose the country and file the application. Do this only after steps one to seven. Chapter 25 lists the main law for each country in this chapter, and Chapter 26 gives the final checks before you file.

Which documents does a license application usually need?

Each regulator sets its own list of documents. The next paragraphs describe a typical package of ten documents, not a final list for any one country.

The first document is the set of founding documents of the company, together with a chart of the group structure. The chart shows every owner, up to the individuals who finally own the company.

The second document is a business plan with financial projections for at least three years.

The third document is proof of capital, such as a bank statement or a letter from an auditor.

The fourth group of documents is the “fit and proper” documents for each director, each owner, and each key manager: CVs, police certificates, references, and proof of the source of their funds. “Fit and proper” is the test that regulators apply to the people who run a licensed company. The regulator checks whether each person is honest, competent for the role, and financially sound.

The fifth document is the policy against money laundering and terrorist financing, known as the AML and CFT policy. This policy includes the rules for identifying clients, known as KYC, which stands for “know your customer.”

The sixth document is a risk assessment of the business.

The seventh group of documents is the policies on the custody of client assets, on IT security, and on the protection of client data.

The eighth group of documents is the client agreements and the terms of service.

The ninth document is proof of a real office, such as a lease agreement. A virtual address is not enough.

The tenth group of documents is the contracts with key service providers, such as a provider of transaction monitoring and an auditor.

A note from practice. Regulators most often return applications because the business plan describes one business and the policies describe another business. To avoid this problem, write the business plan first. Then write each policy around the activities in the business plan.

If you are choosing a country now, start with step one of the plan in this chapter: write one paragraph about what your company will do with client money and client crypto. Do not sign a registration contract with a consultant until this paragraph and the list of activities are ready.

Chapter 2. Structure and substance of a crypto company: what the regulator checks

The short answer. A regulator does not license a set of papers. A regulator licenses a real organization: real people, a real office, real money, and a management structure that makes sense. Regulators call this “substance.” This chapter explains how to choose the structure of the company or the group, what exactly the regulator checks under the word “substance,” when a nominee director is legal and when it is not, why insurance matters, how the visa of the director can delay the launch, and why the founder must keep personal money separate from the money of the company.

What does “substance” mean, and why does the regulator check it?

When a regulator reviews a license application, it does not look mainly at the name of the company or at the incorporation papers. The regulator looks for a real organization behind those papers: people, a physical place, money, and a management structure that makes sense. In licensing practice, this is what the word “substance” means. The full term is “economic substance.” It means proof that the company actually works in the country where it is registered, not only on paper.

A company that exists only on paper almost never passes this check. This chapter explains what substance is made of, how a company can prove it legally, and where the signs of a fake structure begin. A fake structure creates legal risk not only for the company, but also for the specific people behind it.

Should I build one company or a holding structure?

The first question comes even before substance: what kind of structure to build. There are two main options. The first option is a single company. The second option is a holding company with licensed subsidiaries in different countries.

A single company makes sense when the business works in one country only and has no plans to expand in the next year or two. A single company means less accounting work, one audit, and one regulator. A bank or an investor can also understand a single company easily.

The problem starts when the company wants to work in more than one country. Almost no single license covers the whole world. Even passporting under MiCA, the European Union regulation on crypto-asset markets, works only inside the European Union. Passporting is the system that lets a company licensed in one EU country serve clients in other EU countries. In the same way, Kazakhstan has two separate licensing systems. The Astana International Financial Centre in Kazakhstan, known as the AIFC, has its own regulator, AFSA. A license from AFSA has nothing to do with a license from the National Bank of Kazakhstan for activity outside the AIFC. Chapter 1 explains these regulators in detail.

For this reason, companies that plan to work in several regions usually build a holding structure. In a holding structure, a parent company sits at the top. Under the parent company, there is a separate licensed subsidiary in each target country. This structure solves the problem of needing several licenses. However, it creates a new problem. Each subsidiary keeps its own accounts and goes through its own audit. Tax authorities also pay separate attention to payments between the parent company and its subsidiaries, and so does the licensing regulator.

The choice between a single company and a holding structure is a choice between two trade-offs. A single company is simple, but it works in one country. A holding structure is complex, but it works in many countries. There is no correct answer until the founder knows the actual plans of the company.

Does an offshore holding company need its own substance?

A parent company in an offshore jurisdiction has substance rules of its own. The British Virgin Islands have the Economic Substance Act of 2018 for companies and limited partnerships. The Cayman Islands have the International Tax Cooperation Act on economic substance. Both laws were introduced to meet the international standards of the OECD, the Organisation for Economic Co-operation and Development.

These laws apply to companies that carry out “relevant activities.” The list of relevant activities includes banking, distribution and service centers, fund management, headquarters, holding, insurance, intellectual property, and shipping. A company that carries out a relevant activity must show adequate substance in the jurisdiction. This means enough employees there, adequate premises there, adequate spending there, and core income-generating activities there. In most cases, the company must also be managed and directed from the jurisdiction.

A pure equity holding company is a company that only holds shares in other companies. A pure equity holding company faces a reduced test. The requirement to be managed and directed from the jurisdiction does not apply to it.

A company that breaks these rules pays a fine. In the British Virgin Islands, the minimum fine is 5,000 US dollars for a first offense and 10,000 US dollars for a second offense. In the Cayman Islands, the fine is 10,000 Cayman Islands dollars, about 12,200 US dollars, for a first failure, and 100,000 Cayman Islands dollars, about 122,000 US dollars, for a later failure. If the company keeps breaking the rules, the registry can strike the company off the register. Check the current amounts in the law of each jurisdiction before you rely on them.

What does the regulator check under the word “substance”?

The regulator checks five specific things. The next five paragraphs describe them one by one.

The first thing is an office. The office must be a real place where people can find the staff at work during business hours. A mailing address or a virtual office does not count. The office must have an active lease agreement. The company must not sign the lease agreement later and date it earlier to make it look older.

The second thing is a local director. The local director must be more than a name in the company register. This person actually takes part in running the company and can answer the questions of the regulator in real detail. As a rule, the local director lives in the country of registration or near it.

The third thing is staff. The company must have a minimum number of employees who work for this company specifically. People who split their time between ten other companies do not count.

The fourth thing is the lease agreement. Regulators often ask for the lease agreement as a separate document. The lease agreement is one of the simplest ways to tell a real company from a fake one.

The fifth thing is key roles approved by the regulator. Most regulators require the company to fill certain roles with named people whom the regulator approves. The most common roles are a senior executive officer, a finance officer, a compliance officer, and a money laundering reporting officer, known as an MLRO. The MLRO is the person who reports suspicious transactions to the authorities. Each of these people goes through a “fit and proper” check. In a fit and proper check, the regulator checks whether the person is honest, competent for the role, and financially sound.

Two examples show how this works in practice.

In the AIFC in Kazakhstan, a full license application must include information on all Approved Individuals. It must also include separate applications for Approved Individual status for the Senior Executive Officer, the Finance Officer, the Compliance Officer, the MLRO, and the Director. AFSA reviews each of these people. As Chapter 1 explains, AFSA also expects the company to have a real presence in Kazakhstan: real people and a real office.

In Dubai, VARA, the Virtual Assets Regulatory Authority, requires each licensed company to appoint two Responsible Individuals of sufficient seniority. Each Responsible Individual must be a full-time employee of the company. Each must be a fit and proper person. Each must live in the UAE or hold a UAE passport. VARA must approve both people during the licensing process. The company must make sure that both people meet these rules at all times. The company must check this every year and keep a record of each check. Before the company replaces a Responsible Individual, it must ask VARA for approval.

These checks are not a formality. The regulator approves a specific person, not a name on a form. If a Responsible Individual or an Approved Individual cannot clearly explain what the company actually does, the regulator has a reason to refuse the application, even if every other document in the package is in order.

In the European Union, MiCA sets its own rules on where the company and its managers must be. Chapter 1 lists these rules: the company must have a registered office in an EU country, the company must be effectively managed from the European Union, and at least one director must live in the European Union.

Can a company outsource part of its work and still have substance?

A company can hire contractors for some functions, for example a provider of identity checks or a cloud provider. However, outsourcing does not move the legal duty away from the company. The regulator still holds the licensed company responsible for the work of its contractors. The key roles described in this chapter, such as the compliance officer and the MLRO, must remain real people inside the company who answer for the work. Chapter 22 explains the risks of outsourcing in detail.

Is a nominee director legal?

Nominee directors are usually the point where legitimate practice ends and what a regulator or a court later treats as a fiction begins.

A nominee director is a person who holds the position of director on paper but does not actually take part in running the company. A nominee director is not automatically illegal. There are legitimate uses for a nominee director. For example, a nominee director can be a temporary solution while the real managing partner is still getting a visa and residency. A nominee director can also meet a local-director requirement during a transition period.

A nominee director becomes a problem when the company uses the nominee director not as a temporary practical solution, but for one of three purposes. The first purpose is to hide the real beneficial owner. The second purpose is to avoid personal liability. The third purpose is to prepare a doubtful transaction that the nominee director knows nothing about and cannot explain.

The beneficial owner is the individual who finally owns or controls the company. A nominee director does not hide the beneficial owner for long. Banks and regulators require the company to disclose its beneficial owners, and the bank sees the same people that the regulator sees. Chapter 14 and Chapter 24 explain how banks and regulators check the owners of a company.

The company is not the only party that pays for this practice. The nominee director who takes on this role carries a real risk of personal liability, and in some countries criminal liability. The risk is highest if the company later goes bankrupt or becomes linked to a chain of suspicious asset transfers. The person who signed the documents remains responsible as the signer, even if someone else made the actual decisions.

For the beneficial owner, the bigger risk lies elsewhere. Regulators that run fit and proper checks increasingly insist on meeting the actual person listed as director. If that person cannot answer basic questions about the business, the regulator may refuse the license, and a refusal is not even the worst outcome. The situation is much worse when the truth comes out after the regulator has already granted the license, during an inspection. Then the question is no longer only whether the regulator will revoke the license. The question becomes the personal liability of everyone who stood behind the structure.

What insurance does a crypto company need?

Two types of insurance need to be kept apart. The first type is general professional liability insurance. The second type is custody insurance. Custody insurance is a narrower policy that covers the client assets that a company actually holds.

Insurance under MiCA. Under MiCA, a crypto-asset service provider must hold prudential safeguards. Prudential safeguards are a financial cushion that protects clients if something goes wrong. MiCA allows three ways to hold this cushion. The first way is the own funds of the company. The second way is an insurance policy that covers the territory of the European Union, or a comparable guarantee. The third way is a combination of own funds and insurance. Chapter 1 explains the minimum amounts. So under MiCA, insurance is one of the ways to meet the requirement, not a separate extra requirement.

If the company chooses an insurance policy, MiCA sets five strict conditions for the policy.

First, the company must publish the policy on its website.

Second, the first term of the policy must be at least one year.

Third, the insurer may cancel the policy only with at least 90 days’ notice.

Fourth, the insurer must be authorized under EU law or national law, and the insurer must be a third party, not a company of the same group as the crypto company.

Fifth, the policy must cover specific risks, including the loss of documents, misleading statements, breaches of legal duties and of confidentiality, failure to manage conflicts of interest, losses from business disruption or system failures, and gross negligence in safeguarding client assets where this applies to the business model.

Insurance where the law does not require it. In countries where the law does not formally require insurance, the situation is not really simpler. Banks and institutional partners still expect to see insurance before they open an account or sign an agreement. In these countries, the expectation comes from the partner instead of the regulator. On paper, the company can ignore it. In practice, serious partners will not work with the company without insurance.

Custody insurance. Custody insurance deserves separate attention, because it covers the most expensive risk in this industry: a hack or a loss that affects wallets with the assets of clients, not the own funds of the company. The amount of the policy must match the actual amount of client funds under custody. A minimum amount chosen only to meet a formal rule is not enough. When a claim happens, enough coverage means a loss that the company can survive. Too little coverage can mean the end of the company.

Why can the visa of the director delay the launch?

Founders rarely think early about one more part of substance: the visa and residency status of the founder, or of the person who acts as the local director. In a number of countries, the regulator wants more than a company with a local address. The regulator wants a real person with the legal right to live and work in that country. Depending on the country, this means a work visa, a residence permit, or citizenship. For example, VARA in Dubai requires each Responsible Individual to live in the UAE or hold a UAE passport.

Getting a visa is a separate process. The visa process runs at the same time as the company registration and the license application, not after them. The visa process often takes longer than the founder expects, especially if the founder focuses more on the product and the token model than on immigration law.

Hypothetical example. The legal entity is ready. The bank account is almost open. The license package is complete. But the work permit of the director is still not ready, and this one ordinary detail delays the launch of the company by months.

If the founder does not plan to move to the country, a more sensible path is to find a local director who already has the right residency status. This path is better than trying to solve the immigration question, the corporate question, and the licensing question at the same time through one person.

How does the structure affect the bank, investors, and taxes?

The structure that a company chooses at the start affects much more than the licensing process. The same choice decides three things that founders usually think about separately.

The bank. A bank has its own policy for assessing risk. Suppose the parent company is registered in a country with a doubtful reputation. Then the risk level of the whole group goes up, even if the operating subsidiary sits in a country with a clean reputation and has a clean license. Chapter 3 explains how banks assess crypto companies.

Investors. Institutional funds often have internal rules about which structures they may invest through. A holding company registered in the wrong country can shut out a whole category of investors before the conversation about the terms of the deal even starts.

Taxes. The countries of the parent company and of the operating subsidiaries decide whether double taxation applies, whether tax treaties are available, and how the tax authorities treat payments between the companies of the group. Tax authorities also look at where the company actually makes its decisions. Suppose the directors of an offshore holding company in fact make all decisions from another country. Then the tax authorities of that other country may ask whether the company should pay tax there. Chapter 8 explains the taxes of a crypto company.

In short, a decision about the structure that the founder makes in the first month of the project keeps affecting the company for years after the registration is finished.

Why must personal money and company money stay separate?

The last mistake, and probably the most common one in practice, is mixing the personal assets of the founder with the assets of the company. At first, the mixing looks harmless. The founder pays a personal expense from the company account, because “it’s basically my company anyway.” The founder keeps some of the crypto of the company in a personal wallet for convenience. The founder does not keep separate books, because separate books feel like something that can wait.

Legally, this mixing leads directly to the loss of the separation between the company and the person behind it. Different legal systems call this by different names. In the United States and the United Kingdom, courts call it “piercing the corporate veil.” In serious cases, a court can ignore the separate legal status of the company and make the owner personally liable for the debts of the company. In Russia, the Federal Law “On Insolvency and Bankruptcy” allows a court in a bankruptcy case to make the persons who control the company personally liable for its debts. This is called subsidiary liability.

Once the line between the founder and the company disappears in practice, not only on paper, the personal assets of the founder can be used to pay the debts of the company. The obligations of the company become the personal problem of one individual, not the problem of a company with limited liability.

The founder usually realizes this when it is too late to fix: during an audit, or during a dispute with a client or a partner. At that moment, someone asks whose money this actually was: the money of the company or the money of the founder. Suddenly the answer is not obvious even to the founder, because nobody kept records that could settle the question.

Substance checklist before you file

Use this checklist of ten points before you file a license application. Each regulator sets its own exact rules, so check the rules of your regulator on the date you file.

The company has a real office with an active lease agreement signed on the real date.

The local director lives in the country or near it and can explain the business in detail.

The company has its own staff, not people shared with many other companies.

The key roles are filled with named people: a senior executive officer, a compliance officer, an MLRO, and any other roles that the regulator requires.

Each key person has the documents for the fit and proper check.

Each person who must live in the country has a valid visa or residence permit, or has already applied for it.

If the parent company is in the British Virgin Islands or the Cayman Islands, the parent company meets the economic substance law of that jurisdiction.

The company knows who its beneficial owners are and can disclose them to the bank and to the regulator.

The company has the insurance that the regulator or its partners require, and the custody policy matches the real amount of client assets.