Crypto & VASP Licensing
Singapore MAS DPT, UAE VARA, Lithuania CASP under MiCA, Hong Kong VASP, Labuan and Seychelles — covering exchanges, custody, OTC, and brokerage models across Southeast Asia and beyond.
Licences Delivered
400+
VASP & crypto licences
Jurisdictions Active
16
Live licensing regimes
Typical Engagement
4u201312 months
From mandate to licence
First-Pass Rate
94%
Submitted applications
01 — Engagement fit
Where this service
Where this service
compounds.
We work best with operators who treat this work as part of the product, not as an obstacle. Here is where we deliver — and where we may not be the right call.
Ideal engagement
When we deliver outsized value
Crypto exchanges entering regulated markets
Exchanges, OTC desks, and trading platforms that need a Tier-1 or Tier-2 regulated base to access institutional banking, onboard institutional clients, and operate in regulated jurisdictions.
Custody and digital-asset infrastructure providers
Custodians, wallet providers, and tokenisation platforms that need VASP authorisation to satisfy institutional clients' due-diligence requirements and access regulated banking rails.
FinTech platforms adding crypto rails
Payment companies, neobanks, and B2B platforms adding crypto exchange or custody functionality who need regulatory cover without building a standalone crypto compliance stack from scratch.
Look elsewhere
When we may not be the right fit
Unregistered token issuers seeking regulatory cover
We do not assist projects seeking a VASP licence primarily to add legitimacy to a token issuance that does not meet securities or utility-token standards. Regulatory substance is not cosmetic.
Operators requiring nominee UBO structures
Engagements where the required regulatory disclosures on ultimate beneficial ownership cannot be satisfied u2014 due to sanctions, prior enforcement, or intentional opacity u2014 are outside our scope.
Licence-only with no operational intent
We build licences for businesses that intend to operate. Shelf-licence strategies and dormant VASP registrations held purely as IP assets without operational substance are not an engagement we take on.
02 — What you receive
Concrete
Concrete
deliverables.
Every engagement is scoped against a defined deliverable set. No "best-efforts" billing — the package is what you get, capped variations agreed in writing.
Jurisdiction selection & structure memo
A written analysis of 2u20133 viable jurisdictions for your specific service model u2014 exchange, custody, OTC, or brokerage u2014 mapped against capital requirements, banking access, operational timeline, and client geography.
Corporate structure & entity formation
Incorporation of the licensed entity in the chosen jurisdiction with compliant director and shareholder structure, local substance requirements met, and registered office established.
AML/CFT programme to VASP standard
A full VASP-grade AML programme: risk methodology, customer onboarding and due diligence procedures, travel rule compliance framework, transaction-monitoring rules, and STR/CTR filing procedures.
Full application dossier & submission
Preparation of the complete regulatory application u2014 business plan, financial projections, cybersecurity policy, risk management framework, UBO declarations u2014 and management of the full review cycle.
Regulator liaison & query management
Direct management of all regulatory correspondence, RFI responses, and interview preparation throughout the review process. We attend meetings with the regulator and manage every interaction.
Banking & operational infrastructure
Introduction to banking channels capable of servicing a regulated VASP u2014 including EMI accounts, correspondent banking, and custody infrastructure u2014 so the licence is operational, not just granted.
03 — Engagement cadence
How the work
How the work
actually moves.
A typical engagement runs along the phases below. Where we are joining mid-stream — into an existing application or a live operation — we adapt from the relevant entry point.
Jurisdiction decision & entity formation
Weeks 1u20138Select the optimal VASP regime and incorporate the regulated operating entity with the correct ownership structure.
AML/CFT build & dossier preparation
Weeks 8u201316Build full AML/CFT compliance programme and prepare regulator-standard application dossier including risk assessments.
Regulator review & Q&A rounds
Months 4u201310Manage all regulator correspondence, respond to information requests, and attend examination meetings.
Licence grant & operational go-live
Months 10u201312Receive licence, configure banking and custody rails, and launch operations under full regulatory oversight.
"A VASP licence without a functioning AML programme and an operational banking channel is a legal document, not a business. We build all three." — — GSS Legal, Crypto & VASP Services
04 — Common questions
Before
Before
we start.
The questions we get on every diagnostic call. If yours isn't here, raise it in the consultation.
A DPT (Digital Payment Token) licence under the Singapore Payment Services Act is a full regulatory authorisation u2014 it requires capital, substance, an in-country compliance officer, and survives rigorous MAS due diligence. A VASP registration (as used in some European jurisdictions pre-MiCA) was a lighter-touch anti-money-laundering registration that did not confer the same level of regulatory credibility. Under MiCA from December 2024, EU registrations have been replaced with full CASP authorisations that carry similar substance requirements to DPT licences.
Both are Tier-1 crypto licences, but they serve different strategic purposes. MAS is optimal for operators targeting Singapore's institutional market and Southeast Asian clients u2014 the regulatory brand and banking access in SGD are unmatched in the region. VARA is the entry point to the Gulf institutional market and global expansion via Dubai. Most exchange operators we work with at scale hold both; at earlier stage, the choice is driven by primary client geography and banking requirements.
MiCA (Markets in Crypto-Assets Regulation) is the EU's unified crypto-asset regulatory framework, fully effective December 2024. A CASP (Crypto-Asset Service Provider) authorisation under MiCA is required for any entity providing crypto exchange, custody, portfolio management, transfer, or advisory services to EU-resident clients u2014 whether or not the provider is EU-based. A Lithuania CASP is among the fastest paths to MiCA authorisation: 6u201312 weeks, with EU-wide passporting rights on issue.
The applying entity must be a Singapore-incorporated private limited company. A foreign parent can own 100% of the Singapore entity, but the local entity must have at least one Singapore-resident director, a physical Singapore office, and locally engaged staff including an AML compliance officer. We manage the Singapore subsidiary incorporation as part of the MAS engagement.
Capital requirements vary significantly by jurisdiction and licence type. Singapore MAS: SGD 100,000 (SPI) to SGD 250,000 (MPI) plus a security deposit for MPI. UAE VARA: from USD 100,000 depending on service category. Lithuania CASP: EUR 150,000 for most service types. Labuan FSA: USD 110,000 (custodian) to USD 360,000 (exchange). We include a detailed capital and cost analysis in every jurisdiction selection memo.
Ready when you are
Tell us where
Tell us where
you want to
operate.
Forty-five minutes with a partner. Jurisdiction memo within seven days. No retainer required to start.
45 min
First call with a partner.
No retainer required.
No retainer required.