BVI VASP licensing requirements, start to finish.

The VASP Act captures any entity carrying on virtual asset service business in or from within the BVI. Five activities sit inside the perimeter: exchange between virtual assets and fiat currency; exchange between one or more forms of virtual assets; transfer of virtual assets; safekeeping or administration of virtual assets or of instruments enabling control over virtual assets; and participation in, or provision of, financial services related to an issuer's offer or sale of a virtual asset.

The phrase that catches people is 'in or from within'. A BVI company touching any of those activities falls inside the regime even where every customer sits elsewhere, because the service is being provided from within the jurisdiction. Incorporating in the BVI and serving only offshore users does not put you outside the Act — if anything it is the fact pattern the Commission looks at most closely.

Some business models sit outside. Pure proprietary trading of your own book is generally not a service provided to others. A single issuer selling its own token, without running a platform or custody service for anyone else, is usually outside the perimeter. Non-custodial software that never takes possession of assets or of keys is arguable, but the argument depends heavily on how the product is built and marketed. In every one of these cases the right output is a written regulatory analysis of your specific model, signed by BVI counsel, kept on file, and updated when the product changes. Banks and exchange counterparties will ask for it, and 'we assumed we were out of scope' is not an answer that survives diligence.

Applications go to the FSC through a BVI-licensed authorised representative — you cannot file directly. The core pack is substantial: incorporation documents and ownership chart; a detailed business plan with three-year financial projections that reconcile to the fee model you actually intend to charge; an operations and technology manual; a full AML/CFT manual mapped to the BVI Anti-Money Laundering Regulations and the AML/CFT Code of Practice rather than a generic template; cybersecurity, business continuity and disaster recovery policies; a wallet architecture and key-management description covering hot/cold split, signing thresholds and recovery; a customer-asset segregation and reconciliation model; and personal questionnaires, references and police certificates for every director, senior officer and significant owner.

The Commission reviews on a fit-and-proper basis and will come back with written questions. Two or three rounds is normal, and the questions get sharper each time — early rounds test completeness, later rounds test whether the people named in the pack understand the controls described in it. Applicants who file a thin pack to 'start the clock' almost always lose more time than they save, because each incomplete answer resets the review cycle.

Realistically, plan six to twelve months from initial scoping to registration for a well-prepared applicant. The FSC's own turnaround is only one component. Assembling a defensible AML framework, appointing officers who will pass fit-and-proper review, resolving ownership structures that include nominees or opaque holding vehicles, and answering follow-up rounds is usually what determines the calendar.

Fee levels are set by the FSC's published schedule and are revised periodically, so quote them from the current schedule rather than from a blog post. Expect a non-refundable application fee, an annual registration fee that scales with the service category, and separate line items where custody or an exchange service is part of the permission. Filing a category you do not need is a common and expensive mistake — permissions should match the product roadmap for the next eighteen months, not an aspirational five-year plan.

Fees are the smallest part of the cost base. Budget for the authorised representative and registered office, directors with relevant experience who will actually accept the appointment, an outsourced or in-house compliance function, annual audited financial statements, an independent AML audit, blockchain analytics tooling, and legal support through the question rounds. For most applicants the professional cost of getting registered exceeds the regulatory fees by a wide multiple.

On capital, the Act does not impose one headline number across all applicants. The FSC assesses whether your capital, insurance and financial resources are adequate for the risk of the activity, the custody model and the projected volumes. In practice that means a custodial exchange holding client assets is asked to demonstrate materially more resource than a non-custodial software provider with no ability to move client funds. Model your capital position against your custody design before you file, and be prepared to show a wind-down plan that funds an orderly return of client assets rather than an abrupt closure.

A registered VASP must maintain at least two directors, with the Commission expecting at least one individual who has genuine experience relevant to virtual asset business. You need an appointed Compliance Officer and a Money Laundering Reporting Officer with real authority, direct access to the board, and enough seniority to stop a transaction. A registered office is maintained through the authorised agent.

The FSC's supervisory focus has shifted from whether these roles exist on paper to whether they are exercised. That means board minutes that show risk being discussed, a compliance officer whose reports reach the board and change something, transaction monitoring alerts that are actually cleared with documented rationale, and training records for staff.

Ongoing obligations after registration include annual audited financial statements filed with the Commission; prior approval for changes of control and for changes of directors or senior officers; incident and cyber-breach notification; suspicious activity reporting to the BVI Financial Investigation Agency; Travel Rule compliance on virtual asset transfers, including handling of transfers to and from unhosted wallets; sanctions screening against the applicable lists; and record retention across customer files and transaction data. The Commission has administrative penalty powers, can impose conditions on a registration, and can revoke it. Treating registration as a certificate you obtain once, rather than a supervisory relationship you maintain, is the most common failure mode among the structures we are asked to rescue.

This is where most BVI structures actually break. Correspondent banks apply a jurisdictional risk overlay to BVI entities, and a registration certificate on its own will not open an operational account. We regularly meet founders who spent nine months and six figures on a registration and then discovered they could not receive a fiat wire.

What moves a banking file is the combination underwriters look for: a registered, actively supervised entity; identifiable decision-makers who can be met, diligenced and shown to have relevant history; a documented source of funds for the company and its shareholders; a clear flow-of-funds narrative that explains who sends money, why, and where it goes; blockchain analytics coverage with a named provider and documented escalation thresholds; a clean sanctions and adverse-media picture across the ownership chain; and an account structure that keeps client assets segregated from corporate money in a way the bank can reconcile.

Sequencing matters enormously. Starting banking conversations only after registration typically adds three to six months, because the evidence a bank wants is the same evidence you assembled for the FSC — just formatted differently. Running the two workstreams in parallel, and shaping the licensing pack so it doubles as the banking pack, is the single largest time saving available on a BVI project. It also surfaces a fatal problem early: if no institution in your target corridors will bank the model, that is far better to learn in month two than month twelve.

Against the Cayman Islands VASP regime, the BVI is generally quicker to registration and lighter on prescribed capital, but the AML burden is comparable rather than lower, and Cayman carries slightly better recognition with certain fund and institutional counterparties.

Against a European MiCA authorisation as a CASP, the BVI costs less and moves faster, but confers no passporting rights into the EU and carries a heavier banking discount with European correspondents. If a meaningful share of your users are in the EEA, a BVI registration does not solve your regulatory problem — it postpones it.

Against Dubai's VARA regime, the BVI requires far less local physical presence, office space and headcount, but confers less credibility with tier-one exchanges, market makers and banking partners, who increasingly treat a VARA permission as a quality signal.

The right answer depends on where your users actually are, whether you take custody, the size of your capital base, and which banking and exchange relationships your business cannot operate without. We scope that trade-off, and pressure-test it against real banking appetite, before anyone files anything. Choosing a jurisdiction because the registration is achievable, rather than because the resulting entity is bankable and serves your users lawfully, is how good projects end up rebuilding their structure eighteen months in.