How to Register a Company for a Cryptocurrency Project: Step‑by‑Step Legal Guide
⚖️ Crypto Company Registration · Step-by-Step Legal Guide · 2025–2026
How to Register a Company for a Cryptocurrency Project: Step‑by‑Step Legal Guide
Every successful cryptocurrency project begins with one foundational decision: where and how to register the legal entity that will hold the licences, enter contracts, open bank accounts, and carry regulatory responsibility. Getting the corporate structure wrong at the outset creates problems that compound at every subsequent stage — from licensing delays to banking refusals to investor due diligence failures. This guide walks through the full process, from entity type selection to post-registration compliance, covering the major crypto-friendly jurisdictions of 2025–2026.
Company Registration
Crypto Licensing
MiCA · EU
VARA · Dubai
RAK DAO
AIFC · Kazakhstan
El Salvador DASP
📋 In this article
1
Why Legal Structure Is the Foundation of Every Crypto Project
Entity types · Holding vs. operating · Regulatory liability · Investor expectations
›
2
How to Choose the Right Jurisdiction
Regulatory framework · Tax · Banking access · Substance requirements · Crypto-friendliness
›
3
The Step-by-Step Company Registration Process
Name reservation · Documents · Directors & shareholders · Registered office · Account opening
›
4
Top Crypto-Friendly Jurisdictions: EU, UAE, Kazakhstan and El Salvador
MiCA EU · VARA Dubai · RAK DAO · AIFC Kazakhstan · El Salvador DASP
›
5
Post-Registration Requirements: Banking, AML and Ongoing Compliance
Corporate bank account · KYC/AML programme · Regulatory reporting · Substance requirements
›
6
Common Mistakes, Cost Estimates, and Your Action Plan
8 common errors · Cost comparison · 6-step action plan · Legal advisory CTA
›
🌍 Jurisdiction-specific licensing pages
1
Why Legal Structure Is the Foundation of Every Crypto Project
Before writing a single line of smart-contract code or drafting a whitepaper, a crypto project needs an answer to one question: what legal vehicle will sit beneath the business? The entity you incorporate determines which licences you can apply for, which banks will open accounts for you, how investors will conduct due diligence, and ultimately who bears personal regulatory liability when things go wrong. Choosing the wrong structure at the outset rarely stays cheap — righting it later typically costs three to five times more than getting it right from the start.
🏢
Limited Liability Company (LLC)
Most common
The default choice for most crypto operating companies. Flexible governance, pass-through or corporate tax options depending on jurisdiction, and strong liability protection for founders.
- Simple and fast to incorporate
- Broad investor acceptance
- Flexible profit distributions
- Works well for DeFi/VASP operations
📋
Private Limited Company (Ltd / GmbH / SAS)
Investor-preferred
The go-to structure where equity financing, formal cap tables, and share-class mechanics are needed. Required in many EU jurisdictions for licensed crypto activities.
- Recognised globally by institutional investors
- Share classes enable complex cap tables
- Required for MiCA CASP licensing
- Compatible with convertible notes and SAFEs
🔒
Foundation (Stiftung / Fondation)
Protocol governance
Commonly used to hold protocol IP, manage treasury, and steward decentralised networks without shareholders. Popular in Switzerland, Liechtenstein, and the Cayman Islands.
- No shareholders — reduces securities risk on token
- Asset protection and perpetual existence
- Credible governance narrative for communities
- Pairs well with an operating company subsidiary
⛓️
DAO LLC / Hybrid DAO
Emerging structure
Available in Wyoming, Marshall Islands, and RAK DAO (UAE). Brings a legal wrapper to on-chain governance structures, giving the DAO legal standing and limiting member liability.
- Bridges on-chain governance with legal recognition
- Members protected from unlimited personal liability
- Enables DAO to sign contracts and open accounts
- Still evolving — regulatory treatment varies by jurisdiction
🏗️ Holding Company vs. Operating Company — How the Two-Layer Structure Works
🔷 Holding Company
IP
Holds IP and token rightsOwns smart contracts, trademarks, domain names, and the token issuance vehicle — isolated from operational risk.
🏦
Receives investor equityVenture capital, SAFE notes, and convertible instruments are issued here to give investors a clean, recognised equity interest.
🛡️
Asset protection layerTypically in a low-tax, stable jurisdiction (Cayman Islands, BVI, Gibraltar) to shield core assets from operational liabilities.
📊
Consolidates group accountsUpstream of all subsidiaries, enabling group-level financial reporting and simplified governance.
🔵 Operating Company
📜
Holds the regulatory licenceThe VASP, CASP, or exchange licence sits here — in the jurisdiction where customers are served and regulators have supervisory authority.
🏧
Opens bank and payment accountsOperational accounts for customer funds, fiat-to-crypto flows, salaries, and supplier payments all flow through the operating entity.
👥
Employs staff and contractorsEmployment contracts, local payroll, and substance (physical presence) requirements are met at this level.
⚖️
Bears regulatory liabilityAML obligations, customer complaints, and enforcement actions land here — keeping the holding layer cleaner for investors.
⚠️ Founders beware: Personal regulatory liability
In most jurisdictions, crypto licences impose personal obligations on directors and senior management — not just the company. Compliance failures, AML breaches, or market manipulation can result in individual fines, bans from the industry, or criminal prosecution. This means the choice of directors and compliance officers is a regulatory decision, not just a governance one. Before appointing anyone to a licensed entity's board, confirm they pass the regulator's fit-and-proper test and have no prior regulatory violations.
💡 What investors check before writing a cheque
Sophisticated crypto investors — VCs, family offices, and digital-asset funds — have standard due diligence requirements that make or break funding rounds. A poorly structured company will fail these checks regardless of how strong the product is.
📑
Clean cap table
Equity instruments (shares, SAFEs, convertibles) must flow from a single recognised entity in a predictable jurisdiction. Fragmented structures across multiple opaque vehicles cause deal-killers in due diligence.
⚖️
Regulatory clarity
Investors want confirmed legal opinion on token classification, licence status, and whether the entity can be sold or listed. Ambiguous structures stall exits and secondary market transactions.
🏦
Banking access
Institutional investors require that the company holds accounts at regulated financial institutions. Companies without stable banking are considered high-risk even if the product is strong.
🛡️
IP ownership clarity
Who owns the core smart contracts, brand, and code base? If IP is scattered across individual founders or unrelated entities, professional investors will require expensive assignments before proceeding.
2
How to Choose the Right Jurisdiction
Jurisdiction selection is not simply about finding the lowest tax rate — it is a multi-factor decision that shapes every subsequent step of the business: which licences are available, which banks will work with you, how much substance is required on the ground, and how credible the entity appears to counterparties. The crypto-specific regulatory landscape has shifted dramatically since 2022; what was permissive two years ago may now impose full MiCA-style obligations, while previously overlooked jurisdictions have emerged as genuine leaders in crypto-friendly regulation.
1
Regulatory Framework & Licence Availability
Does the jurisdiction offer a clear, fit-for-purpose crypto licence for your business model — exchange, wallet, broker, fund, or token issuer? Are the licensing timelines and costs realistic?
- Is there a dedicated VASP or CASP regime?
- What is the typical licence processing time?
- How actively does the regulator supervise licence holders?
2
Tax Treatment of Crypto Activities
Consider corporate income tax on trading profits, capital gains treatment, VAT on crypto transactions, and transfer pricing rules if operating a group structure. Some jurisdictions offer territorial taxation or crypto-specific exemptions.
- How are token sales and staking income treated?
- Is there a tax treaty network with your key markets?
- Are there substance-over-form rules that could reclassify income?
3
Banking & Payment Access
A licence without banking is worthless. Some jurisdictions have strong bank-regulator coordination that makes account opening feasible; others are effectively banking-blacklisted despite formal licences. Verify banking access before committing.
- Which local banks service licensed VASPs?
- Are EMI or PSP alternatives available?
- Is correspondent banking available for USD/EUR flows?
4
Substance Requirements
Regulators increasingly require demonstrable local substance — directors residing in-country, physical offices, local compliance staff, board meetings on-site. "Letterbox" entities are under pressure from both regulators and FATF grey-list scrutiny.
- How many locally resident directors are required?
- Is a physical office mandatory or can a registered address suffice?
- Are there local staffing thresholds?
5
Crypto-Friendliness & Political Stability
Beyond formal regulation, the practical attitude of regulators, courts, and politicians to crypto matters enormously. A jurisdiction that is formally permissive but hostile in practice — or politically volatile — creates existential risk.
- Has the regulator publicly committed to supporting crypto innovation?
- How have courts treated crypto disputes historically?
- Is the political environment stable over a 5-year horizon?
📊 Jurisdiction quick-comparison matrix
| Jurisdiction | Crypto Licence | Tax Burden | Banking Access | Substance | Timeline |
|---|---|---|---|---|---|
| 🇪🇺 EU / MiCA | Clear (CASP) | Varies by state | Strong | Significant | 3–9 months |
| 🇦🇪 VARA Dubai | Comprehensive | 0% Corp tax* | Selective | Local office req. | 3–6 months |
| 🏝️ RAK DAO | DAO LLC frame. | 0% Corp tax | Limited options | Minimal | 1–4 weeks |
| 🇰🇿 AIFC Kazakhstan | CASP licence | 0% in AIFC zone | Developing | Local presence | 2–4 months |
| 🇸🇻 El Salvador | DASP licence | 0% on BTC gains | Challenging | Flexible | 1–3 months |
| 🇨🇭 Switzerland | FINMA DLT licence | Moderate | Good (crypto banks) | Significant | 6–18 months |
💡 The two-jurisdiction strategy
Many mature crypto businesses use a two-jurisdiction approach: a fast-to-incorporate, low-tax entity (e.g. RAK DAO or El Salvador) as the holding or IP vehicle, paired with a licensed operating entity in a jurisdiction that provides market access (e.g. EU/MiCA or AIFC). This separates the substance and regulatory exposure from the corporate treasury, and allows the operating entity to serve regulated markets while the holding entity benefits from a favourable tax environment. Both layers must have genuine economic substance to withstand OECD BEPS scrutiny.
🚩 Jurisdiction red flags — avoid these pitfalls
Certain signals should eliminate a jurisdiction from consideration, regardless of how attractive the headline terms appear:
- FATF grey-listed or blacklisted — correspondent banks will refuse to process payments, making real-world operations impossible even with a valid licence.
- No track record of licensing crypto businesses — a brand-new crypto regime with no precedent approvals offers little predictability on timeline, cost, or regulatory stance.
- No accessible banking for licence holders — a licence without a bank account is not a functional business. Always verify which specific banks currently serve licensed VASPs in the jurisdiction.
- Rapidly changing political environment — jurisdictions that have reversed crypto-friendly laws in the past (or where a single political change could do so) add existential risk to long-term business plans.
- No mutual recognition or passporting — a licence that only allows you to serve local clients defeats the purpose of an international crypto business. Confirm the scope of permitted activity before committing.
3
The Step-by-Step Company Registration Process
Once jurisdiction and entity type are confirmed, the incorporation process itself follows a largely universal sequence — though the timelines, document requirements, and pain-points differ materially between jurisdictions. The steps below represent the standard workflow for a crypto operating company, from initial name reservation through to a functioning bank account. Missing or skipping any step typically creates complications downstream that are expensive to fix.
1
Name Reservation & Company Name Check
Day 1–2
Before filing incorporation documents, confirm that the proposed company name is available, compliant with the jurisdiction's naming rules, and does not conflict with existing trademarks. Crypto-specific restrictions apply in several jurisdictions — words like "bank", "exchange", or "insurance" may require special authorisation.
- Search the companies registry for name availability
- Conduct a trademark search (national + EU/WIPO if international)
- Avoid regulated terms without the corresponding licence (e.g. "bank", "insurance")
- Reserve the name formally if the registry allows a holding period
2
Prepare Incorporation Documents
Days 3–7
The core constitutional documents — Memorandum of Association, Articles of Association (or equivalent), and founder resolutions — must be drafted in accordance with local company law. For crypto projects, these documents should also define token issuance authority and board governance specifically, not just standard boilerplate.
- Memorandum & Articles of Association (or LLC operating agreement)
- Shareholder / member register
- Founding resolutions (appointment of directors, registered address, share structure)
- Beneficial ownership declaration (mandatory in most jurisdictions post-2021)
3
Appoint Directors & Beneficial Owners — KYC / Fit & Proper
Days 5–14
Every jurisdiction now requires certified KYC documentation on directors, shareholders, and ultimate beneficial owners (UBOs). For licensed crypto entities, most regulators also apply a fit-and-proper test — checking for prior criminal history, financial sanctions, regulatory bans, and relevant professional qualifications. Allow extra time for apostille-certified documents from foreign nationals.
- Certified passport copy and proof of address (less than 3 months old)
- Professional CV / résumé for all directors
- Criminal background check (apostilled, where applicable)
- Source-of-funds declaration for all UBOs holding ≥25%
- Regulator fit-and-proper questionnaire (for licensed entities)
4
Establish a Registered Office & Legal Address
Days 3–10
All companies must have a registered address in the jurisdiction of incorporation. For many crypto licences this must be a genuine operating address — not merely a mail-forwarding service. Some regulators conduct physical inspections before or after licence issuance, so confirming the substance of the registered address is critical.
- Registered office agreement with a local service provider or your own leased premises
- Proof of address: lease agreement or registered agent confirmation
- Local phone number and operational email
- Consider whether co-working space meets the regulator's "physical presence" threshold
5
File with the Companies Registry & Obtain Certificate of Incorporation
Days 7–30 (jurisdiction-dependent)
Submit the completed incorporation documents, together with the applicable registration fees, to the relevant companies registry. In some jurisdictions (e.g. RAK DAO, UAE free zones) this can be done digitally within days; in others (EU member states, Switzerland) notarisation and physical filing are required, adding one to two weeks.
- Submit via online registry portal or through a local notary / agent
- Pay registration and stamp duty fees
- Receive Certificate of Incorporation (CoI) and company number
- Request certified copies of CoI for bank account and licence applications
6
Register for Tax & Obtain Applicable Tax Numbers
Days 14–21
Post-incorporation, most jurisdictions require registration with the tax authority to obtain a tax identification number (TIN), VAT number, or equivalent. This step is essential for opening bank accounts and for billing clients. In the UAE free zones, tax registration must occur within 30 days of incorporation for Corporate Tax purposes.
- Register for corporate income tax (TIN / EIN)
- Apply for VAT registration if turnover thresholds are exceeded
- In the EU: apply for EORI number if importing/exporting services
- Set up accounting and bookkeeping system from Day 1
7
Apply for the Crypto Licence (VASP / CASP / DASP)
1–9 months (varies by jurisdiction)
Once the company is incorporated and has a tax number, the licensing application can be filed. This is typically the longest and most document-intensive step — requiring a detailed AML/CFT policy manual, a business plan, staff CVs, technology descriptions, and capital adequacy evidence. Regulators assess the application actively, often requiring several rounds of clarifications.
- Business plan (3–5 year financial projections, service description, target markets)
- AML/CFT policy and procedures manual
- MLRO / Compliance Officer appointment and CV
- Minimum capital adequacy evidence (bank letter or audited accounts)
- Technology and cybersecurity assessment
- Response management for regulator queries
8
Open Corporate Bank Account & Payment Infrastructure
1–4 months (often the hardest step)
Banking is the final — and frequently the most challenging — step for crypto companies. Many traditional banks still refuse or delay onboarding, even for licensed VASPs. A strategic approach is essential: approach multiple banks simultaneously, consider EMI and PSP alternatives, and prepare a comprehensive business profile with full AML documentation ready at the first meeting.
- Prepare a detailed bank presentation pack (business model, AML policy summary, projected volumes)
- Approach 3–5 banks and EMIs simultaneously to reduce timeline risk
- Include crypto-specialist banks where available (e.g. BCB Group, Sygnum, SEBA)
- Set up a backup EMI account while the main bank application is processed
- Expect enhanced due diligence: source of funds, customer profile, transaction flows
📋 Complete document checklist for crypto company incorporation
Corporate Documents
✓
Memorandum & Articles of Association
✓
Certificate of Incorporation
✓
Register of Shareholders & Directors
✓
Founding Board Resolution
✓
Registered Office Agreement
✓
Tax Registration Certificate (TIN / VAT)
✓
Certificate of Good Standing (ongoing)
KYC & Compliance Documents
✓
Certified passport copies — all directors & UBOs
✓
Proof of residential address (≤3 months)
✓
Criminal background checks (apostilled)
✓
Source-of-funds declaration (all UBOs ≥25%)
✓
AML/CFT Policy Manual
✓
MLRO appointment letter & CV
✓
Business plan with 3-year financial projections
⏱️ Realistic timeline expectations
End-to-end, from beginning the incorporation process to having a functioning licensed entity with a bank account, typically takes 3 to 12 months depending on jurisdiction. The fastest jurisdictions (RAK DAO, El Salvador) can complete company formation in days, but banking and licensing add several months regardless. EU-based CASP licensing under MiCA currently averages 6–9 months from complete application submission. Build these timelines into your fundraising and product-launch roadmap — banking delays are the single most common cause of project cash-flow crises.
💡 Hire a local agent from Day 1
Every jurisdiction has procedural quirks that are not visible in official guidance documents. A local incorporation agent or legal firm with a crypto-specific track record can save weeks of back-and-forth with registries and regulators, and often has established relationships that accelerate document turnaround. The cost of professional support is almost always lower than the cost of delays caused by procedural errors.
4
Top Crypto-Friendly Jurisdictions: EU, UAE, Kazakhstan & El Salvador
The following five jurisdictions represent the most practical and frequently chosen destinations for crypto company registration in 2025–2026. Each has a distinct regulatory framework, tax profile, and target business model. The right choice depends on your specific activity (exchange, wallet, fund, DeFi protocol, token issuer), your investor profile, and where your customers are located.
🇪🇺
European Union — MiCA (Markets in Crypto-Assets Regulation)
CASP Licence · EU Passport
🏛️ Regulatory Framework
RegimeMiCA Regulation (EU) 2023/1114, fully applicable from December 2024. Supervised by national NCAs with ESMA coordination.
Licence typesCASP (Crypto-Asset Service Provider) covering exchange, custody, brokerage, portfolio management, and advice.
Key advantageEU-wide passport — one CASP licence permits services across all 27 EU member states.
📊 Practical Factors
Timeline3–9 months from complete application (varies by member state NCA).
Capital req.€50,000–€150,000 minimum own funds depending on service class; larger CASPs require €150,000 + capital adequacy buffer.
SubstancePhysical office, resident MLRO, at least one EU-resident director. Full AML programme required.
💡 Best Suited For
Exchanges, brokers, custody providers, and token issuers targeting European retail and institutional customers. Essential if you intend to market to EU residents.
Top NCA jurisdictionsLithuania, Malta, Netherlands, Germany, Luxembourg — each with different licensing speeds and regulatory cultures.
TaxVaries by member state: Ireland (12.5%), Malta (5% effective), Lithuania (15%), Germany (15–30%).
🇦🇪
Dubai, UAE — VARA (Virtual Assets Regulatory Authority)
VASP Licence · Dubai Market
🏛️ Regulatory Framework
RegulatorVARA — the world's first dedicated virtual-asset regulatory authority, established in 2022 under Law No. 4 of 2022 (Dubai).
Licence categoriesAdvisory, broker-dealer, custody, exchange, lending & borrowing, management & investment, transfer & settlement.
StructureOperate via DIFC or mainside Dubai. Both require VARA approval; DIFC entities also supervised by DFSA.
📊 Practical Factors
Timeline3–6 months from initial application to full MVP licence.
Corporate tax9% from 2023 — but qualifying free zone entities may retain 0% on qualifying income.
BankingSelective but improving — Emirates NBD, Mashreq, and several international banks have dedicated VASP desks. Prior coordination advised.
💡 Best Suited For
Exchanges and custody providers targeting the GCC, Asia-Pacific, and African markets. Attracts high-net-worth and institutional clients in a no-income-tax environment.
Key requirementPhysical office in Dubai mainland or DIFC; qualified compliance officer; robust AML programme compliant with VARA's rulebook.
PrestigeHigh global recognition — VARA licence is well-recognised by institutional counterparties worldwide.
🏛️ Regulatory Framework
StructureUAE's first dedicated Web3 free zone, specifically designed for DAOs, blockchain projects, and digital-asset businesses operating globally.
Entity typeDAO LLC — a legally recognised limited liability wrapper for decentralised organisations. Members have limited personal liability.
NoteRAK DAO is not a crypto-exchange or VASP licence — it is a corporate domicile and governance framework for Web3 projects.
📊 Practical Factors
Speed1–4 weeks incorporation — one of the fastest globally for a recognised legal entity.
Corporate tax0% on qualifying free zone income; no personal income tax on founders or staff.
BankingLimited — most RAK DAO entities use EMI accounts or crypto-native banking; traditional bank account opening is more challenging than VARA-licensed entities.
💡 Best Suited For
DeFi protocols, DAO governance structures, Web3 startups seeking IP holding and treasury management without immediate exchange/custody licensing needs.
Typical structureRAK DAO entity as holding/IP vehicle + separate licensed operating entity (VARA Dubai or EU/MiCA) for customer-facing activities.
CostLow setup cost — RAK DAO incorporation fees are among the most competitive in the Gulf region.
🇰🇿
Kazakhstan — AIFC (Astana International Financial Centre)
CASP Licence · Central Asia Hub
🏛️ Regulatory Framework
RegulatorAstana Financial Services Authority (AFSA) — an independent regulator operating under English common law within the AIFC special economic zone.
LicenceCASP (Crypto-Asset Service Provider) — covers exchange, brokerage, custody, and lending of digital assets.
Legal systemAIFC operates under English common law with its own Court (AIFC Court) and Arbitration Centre — familiar to international investors.
📊 Practical Factors
Timeline2–4 months for complete CASP licensing from full application submission.
Tax0% corporate tax within AIFC zone until 2066 under the founding charter. 0% personal income tax for AIFC employees.
BankingDeveloping — AIFC has its own banking infrastructure, and several local and international banks are beginning to service AIFC CASP entities.
💡 Best Suited For
Exchanges and VASPs targeting the CIS market (Russia, Kazakhstan, Central Asia), and projects seeking a credible licence under English common law at lower cost than EU or Dubai.
Key advantageLong-term tax certainty, English law governance, and rapid regulatory development make AIFC one of the most compelling emerging jurisdictions.
SubstanceLocal representative office and MLRO required; physical presence in Astana Hub (AIFC campus) strongly preferred by AFSA.
🇸🇻
El Salvador — DASP (Digital Asset Service Provider)
DASP Licence · Bitcoin Legal Tender
🏛️ Regulatory Framework
RegulatorComisión Nacional de Activos Digitales (CNAD) — established under the Digital Assets Law 2023, which creates a comprehensive framework for DASPs.
LicenceDASP licence covering exchange, custody, brokerage, and issuance of digital assets. Bitcoin remains legal tender alongside USD.
UniquenessOnly country in the world where Bitcoin is legal tender — strong political and government commitment to crypto at the highest level.
📊 Practical Factors
Timeline1–3 months — one of the fastest licensing timelines globally.
Tax0% on Bitcoin gains for foreign investors; no capital gains tax on BTC transactions. Flat 30% corporate rate on other income, but effective rate much lower with proper structuring.
BankingChallenging — traditional USD correspondent banking remains difficult; crypto-native banking solutions more practical.
💡 Best Suited For
Bitcoin-native businesses, Lightning Network operators, BTC custodians, and projects that want a credible licence in the lowest-regulatory-friction environment globally.
Key advantageMinimal substance requirements, rapid licensing, and strong government support create the fastest path from idea to licensed entity globally.
LimitationDASP licence not yet recognised by EU or US regulators as equivalent — does not replace MiCA CASP for European market access.
🎯 Which jurisdiction fits your project?
Want EU market access
→ EU/MiCA CASP — essential for serving EU retail customers. Choose Lithuania for speed, Malta for tax efficiency, or Germany for prestige.
GCC & Asia targeting
→ VARA Dubai — best recognised VASP licence in the Middle East/Asia corridor; pairs well with a RAK DAO holding entity.
DAO or DeFi protocol
→ RAK DAO — fastest, lowest-cost legal wrapper for decentralised projects; add a licensed operating subsidiary for customer-facing activities.
CIS / Central Asia market
→ AIFC Kazakhstan — English common law, 0% tax until 2066, and growing regional crypto ecosystem. Excellent for CIS-focused exchanges.
Bitcoin-native business
→ El Salvador DASP — fastest global licensing, 0% BTC gains tax, and the world's most crypto-committed government. Ideal for BTC-only products.
5
Post-Registration Requirements: Banking, AML and Ongoing Compliance
Incorporating a company is the beginning, not the end, of the compliance journey. Once the entity is registered and a licence is in hand, a new set of continuous obligations begins — obligations that require genuine operational infrastructure, not just paperwork. Regulators across all major crypto jurisdictions have significantly intensified their ongoing supervision of licensed entities since 2023, and failures in post-registration compliance are now the leading cause of licence suspensions and enforcement actions.
🏦
Corporate Banking & Payment Infrastructure
A functioning bank account at a regulated financial institution is the oxygen of any crypto business. Approach multiple banks simultaneously — expect enhanced due diligence lasting 4–12 weeks. Prepare a full bank presentation pack covering your business model, customer profile, projected transaction volumes, AML controls, and corporate structure. Where traditional banking remains unavailable, EMI accounts (e.g. Modulr, BCB Group, Fiat Republic) bridge the gap while long-term banking relationships are established.
🛡️
AML/CFT Programme — Mandatory Components
Every crypto entity licensed under MiCA, VARA, AIFC, or similar regimes must implement a documented, risk-based AML/CFT programme from Day 1 of operation. This is not a static document — it must be actively implemented, tested, and updated as the business evolves. Regulators conduct annual or ad-hoc AML audits and may request evidence of live programme operation, not just the existence of a written policy.
📋
Regulatory Reporting Obligations
Licensed crypto companies must file regular reports with their regulator covering financial position, customer volumes, suspicious transaction activity, and governance changes. Failure to file on time — even without any underlying misconduct — typically triggers automatic regulatory warnings and can escalate to licence suspension. Establish internal reporting calendars with advance reminders from the moment the licence is received.
🏢
Substance & Physical Presence
Post-BEPS and post-FATF review pressure has made genuine substance non-negotiable for licensed crypto entities. Substance means real economic activity in the jurisdiction: qualified resident staff, a functioning office, board meetings held in-country, and management decisions made locally. Entities that maintain a nominal address while operating remotely face growing risk of licence revocation and tax residency challenges from other jurisdictions.
🔍 AML/CFT programme — required components
Core Programme Elements
✓
Written AML/CFT Policy & Procedures ManualRisk-based, jurisdiction-compliant, reviewed at least annually by senior management.
✓
Customer Due Diligence (CDD) FrameworkStandard, simplified, and enhanced due diligence procedures; ongoing monitoring protocols.
✓
KYC Onboarding ProgrammeIdentity verification (ID + liveness check), sanctions screening, PEP screening, adverse media checks.
✓
Transaction Monitoring System (TMS)Automated monitoring of on-chain and off-chain transactions against pre-set risk thresholds and typologies.
✓
Suspicious Transaction Reporting (STR/SAR)Internal escalation procedure and direct reporting channel to the Financial Intelligence Unit (FIU).
Governance & Staff Requirements
✓
Money Laundering Reporting Officer (MLRO)Qualified, fit-and-proper, approved by the regulator — distinct from the CEO and operations roles.
✓
AML Training ProgrammeAnnual mandatory training for all staff; specialist training for compliance and customer-facing teams.
✓
Business-Wide Risk Assessment (BWRA)Annual assessment of the company's inherent ML/TF risks by product, geography, customer, and channel.
✓
VASP-to-VASP Travel Rule ComplianceTechnical and procedural capability to collect, transmit, and verify originator/beneficiary data on transfers above threshold (€1,000 under MiCA; $1,000 under FATF guidance).
✓
Record-Keeping for 5+ YearsKYC records, transaction data, STR reports, and AML audit records retained as required per local law.
📅 Regulatory reporting calendar
Ongoing / Real-time
Suspicious Transaction Reports (STRs)
Filed with the FIU within the jurisdiction-mandated timeframe (typically 24–72 hours of suspicion being identified). No threshold — qualitative assessment.
Monthly
Transaction Volume Reports
Many regulators (VARA, AFSA) require monthly reporting on customer numbers, transaction volumes, and fiat/crypto ratios. Template-based submission.
Quarterly
Financial Position Reports
Capital adequacy, liquidity ratios, and own funds calculations filed with the regulator. MiCA CASPs must maintain continuous capital adequacy buffers.
Annual
Audited Financial Statements
Prepared by an approved auditor; submitted to both the regulator and the companies registry. Crypto-specific accounting treatment for digital asset holdings must be addressed.
Annual
AML/CFT Compliance Report
Self-assessment of AML programme effectiveness, STR statistics, training completion rates, and any material control failures or remediation actions taken.
Immediate
Material Change Notifications
Any change in directors, shareholders, business activities, or corporate structure must be notified to the regulator — typically within 30 days, sometimes prior approval required.
🏢 Substance requirements — what regulators actually check
👤 Local Directors
At least one director (often more) must be resident in the jurisdiction. Directors are assessed on fit-and-proper criteria; CV and criminal record required upfront.
🏢 Physical Office
Lease agreement or ownership proof for a physical office. Co-working spaces are accepted in some jurisdictions; a registered address alone is increasingly insufficient.
👥 Local Staff
Compliance officer, MLRO, and often customer-facing roles must be locally employed. Remote working staff do not generally count toward substance headcount.
📋 Board Meetings On-site
Major decisions must be made and minuted in-jurisdiction. Regulators may request board minutes to verify that management decisions are not made from a third country.
💻 Technology Infrastructure
Core operational systems — customer onboarding, transaction processing, compliance tools — should be accessible from and partly hosted within the jurisdiction for some regulators.
💰 Capital On Account
Minimum capital adequacy must be maintained continuously, not just at the time of licence application. Breaches trigger immediate regulatory escalation under MiCA and VARA rules.
⚠️ Consequences of non-compliance — real penalties, not theoretical risks
In 2024 and 2025, regulators across the EU, UAE, and Kazakhstan significantly increased enforcement activity against licensed crypto entities. Common triggers include: late or incomplete regulatory filings, inadequate AML programmes, failure to maintain minimum capital, and undisclosed changes in beneficial ownership. Penalties range from formal warnings and financial fines (up to 10% of annual turnover under MiCA) to licence suspension and, in cases of serious misconduct, criminal referrals of directors to prosecutors. Compliance is not an optional overhead — it is the cost of maintaining the right to operate.
6
Common Mistakes, Cost Estimates, and Your Action Plan
Even well-resourced teams make avoidable mistakes when structuring their crypto company. Many of these errors are not discovered until due diligence, bank onboarding, or regulatory review — at which point they are significantly more expensive to fix than they would have been at the outset. This final section addresses the eight most common structural errors, provides realistic cost ranges for different incorporation paths, and sets out a six-step action plan to get your project from concept to licensed, banked entity.
1
Choosing a jurisdiction based on tax alone — ignoring banking access
Low-tax jurisdictions attract crypto founders with zero-corporate-tax headlines, but many offer poor or no banking access for crypto businesses. A company with a licence but no bank account cannot operate.
Verify banking access in the specific jurisdiction before committing — ask specifically which banks currently serve licensed VASPs there, and speak to operators in that jurisdiction.
2
Putting all founders as directors of the licensed entity without fitness checks
Regulators require directors of licensed entities to pass fit-and-proper tests. Technical co-founders with no compliance background, prior litigation history, or regulatory bans elsewhere may fail these checks and delay or block the licence entirely.
Separate governance roles early: consider having a professional independent director serve on the licensed entity while technical founders focus on product and hold equity above the line.
3
Drafting generic AML policies rather than product-specific risk assessments
Template AML policies copied from the internet are immediately recognisable to experienced regulators. They do not reflect the actual risks of the specific business model, product set, or customer geography — and regulators explicitly reject generic submissions.
Commission a bespoke Business-Wide Risk Assessment (BWRA) that maps your specific products, customer types, geographies, and transaction patterns to real ML/TF risk scenarios.
4
Failing to reserve sufficient capital for the licensing and banking phase
Founders routinely underestimate the cash needed from incorporation through to operational launch. Legal fees, regulatory capital requirements, office setup, staff, and the "dead time" waiting for a bank account all consume cash before a single customer is onboarded.
Budget a minimum of 18–24 months of operating runway from the date of incorporation — not from the date of first revenue. Banking delays alone can consume 3–6 months of unplanned cash.
5
Operating before the licence is received ("pre-licensing customer onboarding")
Some founders begin onboarding customers or processing crypto transactions while a licence application is pending, believing they are in a grey zone. In most jurisdictions, unlicensed crypto activity is a criminal offence — not a civil infringement.
Obtain interim written confirmation from the regulator of any permissible pre-licensing activities. Until then, only marketing and customer pre-registration (with no funds transferred) is typically safe.
6
Treating the corporate structure as permanent — no restructuring optionality built in
The initial jurisdiction and structure should be designed with future scenarios in mind: Series A fundraising, listing on a centralised exchange, expansion into new jurisdictions, M&A. A structure that is optimal for a seed-stage startup may be incompatible with institutional investor requirements three years later.
At the point of incorporation, model at least three future scenarios (fundraise, acquisition, regulated expansion) and confirm the structure is compatible with each — or plan for the restructuring cost explicitly.
7
Ignoring Travel Rule compliance obligations at launch
The FATF Travel Rule — requiring originator and beneficiary data to be transmitted with transfers above threshold — is now enforced across all major jurisdictions. Many early-stage crypto companies launch without any Travel Rule solution, only to face urgent and expensive retrofit projects after licensing.
Integrate a Travel Rule solution (e.g. Notabene, Sygna, VerifyVASP) as part of your technical launch infrastructure, not as a post-licensing add-on.
8
Failing to notify the regulator of post-licensing changes (directors, ownership, products)
Licensed entities must notify regulators of any material changes — new directors, new shareholders, new products, new geographies. Many founders treat these as administrative formalities and miss deadlines, triggering formal regulatory warnings that can escalate to licence conditions.
Maintain a live "change register" listing every event that may require regulatory notification, with responsibility assigned to the MLRO and automatic calendar reminders set for filing deadlines.
💰 Indicative cost comparison — company formation + licensing (2025–2026)
| Jurisdiction | Incorporation | Licence Fees | Legal / Advisory | Capital Required | Est. Total Year 1 |
|---|---|---|---|---|---|
| 🇪🇺 EU / MiCA (Lithuania) | €1,000–3,000 | €3,000–10,000 | €20,000–50,000 | €50,000–150,000 | €75,000–215,000 |
| 🇦🇪 VARA Dubai | AED 10,000–20,000 | AED 50,000–300,000 | $25,000–60,000 | AED 200,000–500,000 | $80,000–250,000 |
| 🏝️ RAK DAO | AED 5,000–15,000 | N/A (no VASP lic.) | $8,000–20,000 | None specified | $15,000–40,000 |
| 🇰🇿 AIFC Kazakhstan | $2,000–5,000 | $10,000–30,000 | $15,000–35,000 | $50,000–100,000 | $80,000–170,000 |
| 🇸🇻 El Salvador | $1,000–3,000 | $5,000–15,000 | $10,000–25,000 | $50,000 (BTC/USD) | $65,000–95,000 |
| Note: Figures are indicative ranges only. Actual costs vary by entity complexity, services scope, and market conditions. Ongoing operational costs (staff, office, banking, auditing) are excluded. | |||||
🚀 Your 6-step action plan — from concept to licensed entity
1
Define your business model and target jurisdiction shortlist
Map the specific activities (exchange, custody, brokerage, token issuance), your target customer geography, investor profile, and 3-year growth plan. These inputs determine which jurisdictions are compatible — not the other way around.
Do this first
2
Obtain legal and structural advice from a crypto-specialist law firm
Commission a written legal opinion on jurisdiction selection, entity structure, token classification, and regulatory obligations. This document becomes the foundation for everything that follows — including investor due diligence and regulator applications.
Before incorporating
3
Incorporate the entity and register for tax
Engage a local incorporation agent, reserve your company name, prepare constitutional documents, appoint directors, establish the registered office, and obtain your Certificate of Incorporation and tax number.
Weeks 2–6
4
Build your compliance infrastructure — AML programme, MLRO, policies
Develop the full AML/CFT policy manual, appoint your MLRO, select KYC/onboarding technology, integrate a Travel Rule solution, and conduct your initial Business-Wide Risk Assessment. This infrastructure must be operational before the licence application is filed.
Months 1–3
5
File the licence application and manage the regulatory process
Submit the complete licensing application — business plan, AML manual, director KYC, capital evidence, technology description — and assign a dedicated point of contact for regulator queries. Proactive communication with the regulator during review significantly reduces total processing time.
Months 2–10
6
Open banking, complete operational setup, and begin regulated activity
Approach banks and EMIs in parallel with the licensing process. Once the licence is received, complete banking setup, establish regulatory reporting systems, and launch operations — with your compliance calendar locked in from Day 1.
Months 3–12
⚖️ Expert Crypto Licensing & Company Formation Advisory
Ready to register your crypto company the right way?
WCR Legal's crypto licensing team has guided founders through company formation and regulatory licensing across the EU, UAE, Kazakhstan, and El Salvador. We combine deep regulatory expertise with practical banking and corporate structuring advice — so your entity is built to operate, not just to incorporate. From jurisdiction selection to licence approval, we manage the full process.
Jurisdiction & entity structure analysis
MiCA CASP licensing (EU, all member states)
VARA Dubai VASP licensing
AIFC Kazakhstan CASP licensing
El Salvador DASP licensing
RAK DAO DAO LLC formation
AML programme design & MLRO support
Banking introductions & account opening support
