Building a crypto product with offshore reach and looking at the British Virgin Islands (BVI) for authorization? This article lays out a clean, bank-ready path—scope, controls, documentation, and sequencing—so the first version of your product ships without rework. For a structured start point with steps and timelines, see BVI VASP license.
Table of Contents
At a Glance
- Who this suits: custodial wallets, exchanges/OTC, payment/transfer rails, and B2B infrastructure providers.
- What moves the needle: a documented AML/CTF program that matches real product flows; clear custody design; working Travel Rule.
- Bank-ready posture: segregation of client assets, monitoring in action, and a crisp counterparty narrative.
- Faster outcomes: narrow v1 scope, complete documents, and short, evidenced responses to clarifications.
Scope: When a Crypto Business Becomes a “VASP”
Regulators focus on whether you touch client assets and whether your service looks like exchange, brokerage, custody, or payments. Common in-scope activities:
- Exchange/brokerage: matching, order routing, OTC, or market access for customers.
- Custody/hosted wallets: you control keys or can move client funds.
- Transfers/payments: moving crypto between users or to external wallets; on/off-ramps.
- Staking, yield, or similar programs: additional scrutiny due to custody and counterparty risk.
Non-custodial tools can have lighter obligations, but embedded brokerage, routing, or settlement can still bring you into scope. Map your actual flows before you commit to architecture.
Choose a Model That Ships (and Stays Compliant)
- Non-custodial app: lower custody risk; ensure you’re not running an order book or executing client trades indirectly.
- Custodial wallet: implement dual controls, withdrawal allow-lists, hot/cold thresholds, and reconciliation.
- Exchange/OTC: keep v1 narrow (e.g., spot only) and defer leverage/derivatives to later phases.
- Payments/remittance: emphasize Travel Rule coverage, sanctions, and source-of-funds on both sides of the flow.
Document who holds keys, where decisions are made, which entity serves which users, and how data moves. Clarity prevents “scope ping-pong” during review.
What Reviewers Expect to See
- Governance: named Compliance Officer with direct access to senior management; fit-and-proper checks on directors and UBOs.
- AML/CTF program: KYC/KYB standards, sanctions screening, transaction monitoring typologies, suspicious activity reporting, and recordkeeping.
- Travel Rule plan: a practical method for qualifying transfers (provider or interoperable solution) that works in your main corridors.
- Custody & safeguarding: key management (HSM/multisig), segregation of client vs company assets, withdrawal approvals, reconciliation cadence.
- Technology & security: wallet architecture, change management, incident response, vendor controls, penetration-testing policy.
- Conduct & disclosures: client agreements, risk summaries, fee schedule, complaints handling, fair-marketing standards.
- Financial resilience: realistic budget, runway, capital/insurance posture appropriate to the model, and continuity planning.
Compliance-by-Design: Make It Work in Production
- KYC/KYB: verify retail users; for businesses, collect company docs and UBO evidence; risk-rate and refresh based on exposure.
- Sanctions: screen on onboarding and continuously; include counterparties and key vendors.
- Monitoring: rules + machine-assisted detection; include typologies for mules, mixers, chain-hopping, and sanctioned exposure.
- Case management: ticketing with timestamps, analyst notes, and escalation trails.
- Recordkeeping: auditable logs for onboarding, risk decisions, transfers, alerts, and outcomes for the required retention period.
Design controls into onboarding, funding, trading, and withdrawal flows; retrofits are the biggest source of delays and contradictions.
Custody Architecture: What Passes Scrutiny
- Key management: HSM or well-audited multisig; strict role-based access control.
- Segregation: separate client assets from operational funds; ledger alignment and daily reconciliation.
- Withdrawal controls: dual approvals, velocity/amount limits, and address allow-lists for higher-risk cases.
- Incident response: playbooks for wallet compromise, abuse patterns, chain forks, and vendor outages.
- Change management: controlled deployments and emergency rollback paths.
Documentation Checklist (Typical)
- Corporate pack: articles, registers, org chart, shareholder agreements (if any).
- People & ownership: IDs, proof of address, CVs; ownership attestations; background/fitness confirmations.
- Business plan: products, customer segments, jurisdictions served, corridors, economics, and growth plan.
- Compliance program: AML/CTF manual, sanctions policy, KYC standards, Travel Rule method, monitoring procedures, escalation, and training plan.
- Tech & security pack: wallet/key design, vendor matrix and due diligence, pen-testing policy, incident playbooks.
- Custody & safeguarding: hot/cold thresholds, withdrawal approvals, reconciliation, and (if applicable) insurance.
- Financials: 12–24-month budget, liquidity runway, capital policy, continuity scenarios.
- Customer docs: T&Cs, risk disclosures, fee schedule, fair-marketing standard, complaints handling.
Timeline & Sequencing (Keeps Momentum)
- Model mapping & scope (1–2 weeks): diagram onboarding → funding → action → withdrawal; decide custodial vs non-custodial; list corridors and partners.
- Policy drafting (2–4 weeks): build AML/CTF, Travel Rule, monitoring, custody, and security policies tied to your real flows.
- Pre-filing alignment (1–2 weeks): appoint Compliance Officer; validate vendors (KYC, Travel Rule, custody); align org chart and decision rights.
- Submission & clarifications: file a complete pack; respond with concise, evidenced answers (policy excerpt, screen, log) to keep the clock moving.
- Go-live readiness (parallel): integrate vendors, test withdrawal approvals, run tabletop incident drills, finalize reporting templates.
Keep v1 tight. Add advanced features (derivatives, leverage, staking programs) only after the base is live and stable.
Banking & PSPs: What They Actually Check
- Segregation & reconciliation: clear separation of client vs company assets; daily/weekly recs with evidence.
- AML in action: onboarding flows, monitoring screenshots, case notes, and escalation outcomes.
- Counterparty story: top vendors/exchanges/market makers, expected monthly volumes, geographies, and FX pairs.
- Runway & governance: budget, cash position, and board oversight (minutes/resolutions).
Many teams open with a fintech-friendly EMI/PSP for operations and cards, adding a traditional bank later for redundancy and currencies. Choose partners that support your corridors and risk profile—re-onboarding mid-scale is expensive.
Costs: Budget by Buckets
- One-off setup: advisory and policy drafting, application preparation, legal reviews.
- Technology & security: KYC/KYB vendor, Travel Rule solution, custody tooling, monitoring stack, security testing.
- Ongoing compliance: officer time, audits, monitoring, reporting, training, renewals.
Chasing a single “license fee” number is misleading; under-budgeting creates gaps that delay approval or banking.
Five Pitfalls That Stall Approvals
- Policy–product mismatch: manuals claim controls that the app hasn’t implemented.
- Vague custody narrative: unclear key management, no dual controls, weak reconciliation.
- Travel Rule “later”: reviewers expect a working method, not intent.
- Entity role confusion: cross-border group with fuzzy service maps; document who serves which users.
- Thin counterparty due diligence: no assessments for exchanges, market makers, or custodians you rely on.
FAQ
Do all crypto businesses in BVI need the same authorization?
No. Requirements depend on whether you handle client assets and whether you operate exchange, brokerage, custody, or payment features.
Can a non-custodial app avoid the heavy lift?
Often lighter, yes—but embedded trading or settlement can still trigger obligations. Validate scope before building.
How long does approval take?
It depends on completeness and complexity. Narrow scope and evidence-backed answers typically move faster.
What do banks want to see?
Segregation, reconciliation, AML in action, and credible governance. Show logs, screens, and minutes—not just promises.
Who can help
LegalBison is an international advisory firm that helps crypto and fintech teams obtain the permissions they need, design workable compliance programs, and secure banking. The team blends legal precision with practical build-out so founders can launch safely and scale with confidence. Learn more at legalbison.com.