Coredo

I founded COREDO in 2016, and since then our team has supported dozens of international projects: from company incorporations in the EU and Asia to obtaining crypto, payment and forex licenses. Over the years one topic consistently returns to the agenda of executives and CFOs: whether it is possible to work with clients from the EU without a license if the contacts originate from the clients themselves. This is MiCA reverse solicitation — a narrow corridor of lawful cross-border servicing where the time to market, compliance risks and profitability are at stake.

MiCA: what falls within the scope

MiCA rules for CASPs cover custody and administration of crypto-assets for clients, trading platform operations, exchange of crypto-assets for fiat or other assets, order execution, crypto-asset placements, receipt and transmission of orders, and crypto-asset advisory. If you perform these functions for EU clients from the territory of a third country, you must understand the boundaries of MiCA reverse solicitation and the national rules of complementation in individual member states.

The European Securities and Markets Authority coordinates practice together with national competent authorities (NCAs), but enforcement details are often shaped at the country level. Our experience at COREDO has shown: ignoring local guidelines is a short route to enforcement and regulatory inquiries, even if formally you rely on pan-EU rules.

What is reverse solicitation
I use a working definition: MiCA reverse solicitation is a situation where an EU client on their own initiative (client-initiated contact) approaches a provider in a third country, and that provider provides a service without prior individual or mass solicitation of demand in the EU. This is the passive reception doctrine: you accept a passive inbound, rather than creating an economic nexus by active measures in the Union.

MiCA licensing logic and exceptions
Exceptions to MiCA’s licensing obligation essentially boil down to the correct application of reverse solicitation, but national regulators calibrate the threshold of permissible actions differently. In one COREDO project for a client from Dubai we agreed with local lawyers in two EU jurisdictions the boundaries of permissible web communication: neutral content, no personalized offers, a strict ban on EU-ID retargeting.

MiCA transitional provisions are important for providers already operating under local regimes before full implementation. At the same time transitional provisions do not make reverse solicitation limitless: NCAs continue to apply their own economic presence tests, and ESMA publishes enforcement guidance that influences interpretations.

Servicing EU clients from a third country (onshore vs offshore servicing) is permissible in the absence of presence and substance in the EU, by forming a contractual structure outside the EU and building processes around passive reception. But as the share of EU clients grows and onshore teams, representative offices or agents appear in the Union, the risk of forced jurisdiction and enforcement arises.

Legally offering crypto-asset services
The key question is how to document inbound client requests. The solution developed at COREDO includes multi-level recording of client-initiated contacts in the CRM and web platform logs: recording the original click source, storing the voluntarily submitted contact form, timestamp, IP and geodata, as well as screenshots of user journeys.

Best practices for crypto service providers include an opt-in onboarding process where the client confirms they initiated the contact independently, understands the absence of an EU license and acknowledges that servicing is provided from a specific third country. Consent documentation and record-keeping requirements under MiCA require retaining these confirmations for periods at least equal to the document retention policy adopted in your jurisdiction and aligned with EU expectations.

The evidentiary basis in a dispute with a regulator relies on audit trails and IT logging. At COREDO we add to the legal memorandum an evidence preservation layer: captured versions of the site at the time of contact (web archives), cold campaign logs (showing zero EU targeting), internal instructions to managers prohibiting proactive contacts. Such COREDO practice demonstrates that even in the event of a regulatory request you can present a structured defense line.

KYC and EDD under reverse solicitation
AML principles under reverse solicitation are not weakened: a risk-based approach is mandatory just as it is for licensed activity. I recommend building KYC/CDD processes for non-residents from the outset, including PEP screening and EU sanctions lists, confirmation of beneficial ownership (UBO), and source-of-funds and wealth checks when internal thresholds are exceeded.

Enhanced Due Diligence for clients from the EU is necessary in cases of heightened risk related to jurisdiction, transaction typology or product category (for example, highly volatiletokens, participation in off-chain transactions, working with mixers). In some projects the COREDO team implemented a hybrid model: basic KYC in-house, while EDD and screening are carried out by a certified provider, with transparent outsourcing of compliance to a third party.Marketing: pre-contractual communication
Restrictions on advertising and cold outreach, the basic rule of reverse solicitation under MiCA. Any contact activity directed at EU residents, including partner programs with EU bloggers, referral payments, localized landing pages “for EU clients”, are red flags for NCAs. legal opinion drafting for reverse solicitation at our firm always includes a legal assessment of advertising campaigns and oversight of marketing materials.

Pre-contractual communication rules of MiCA allow responses to specific inquiries, but prohibit expanding the dialogue into mass mailings.

Structuring relationships with an EU client

Transparency and disclosure in reverse solicitation are an ally, not an obstacle. Proper product governance, client segmentation and territorial risk assessments, as well as a documented evaluation of the applicability of the MiCA scope to specific assets (for example, ART or EMT), will help demonstrate the model’s good faith to NCAs. At COREDO we formalize governance and board-level oversight in the form of a report to the board on the share of EU clients and triggers for migration to licensing.

Data protection and GDPR implications are also critical. Even if you are outside the EU, processing personal data of EU residents requires GDPR compliance: appointing a DPO where necessary, legal bases for processing, cross-border data transfers and contracts with processors. Confidentiality and information exchange with counterparties must take into account banking secrecy, local AML rules and NCAs’ requirements.

Risks: compliance, reputation, taxes

Limiting reputation risks requires a conservative information policy and readiness for regulatory inquiry. Evidence preservation and a document retention policy are not formalities: the absence of log records and screenshots often undermines the provider’s legal position. Our clients who had an established audit trail went through checks with minimal losses.

Tax consequences of cross-border services depend on economic presence. The economic nexus test and the risk of a permanent establishment (PE) in the EU depend on where key managerial decisions are made, where employees are located and where marketing is conducted from. We recommend assessing cross-border tax reporting implications together with tax advisors and taking into account CRS/FATCA when structuring.

Checklist for responding to a request from an EU client

• Confirm client-initiated contact: record the channel, time, IP, consent.
• Check geotargeting: exclude retargeting and personalized offers for the EU.
• Perform KYC/CDD, conduct PEP/sanctions screening, determine the risk profile.
• Assess tokens: MiCA scope and classification (ART/EMT/utility), product limitations.
• Provide disclosures: non-resident provider status, lack of an EU license, contract jurisdiction.
• Appoint the MLRO responsible for monitoring and the travel rule, record thresholds and alerts.
• Preserve all evidence: website screenshots, CRM logs and marketing platform logs.
• Assess the share of EU clients and thresholds for migration to EU licensing.
• Prepare a legal opinion on MiCA reverse solicitation and internal instructions for the team.

Licensing or reverse solicitation
Licensing vs servicing via reverse solicitation: a matter of cost-benefit analysis. The economic feasibility of operating without a license is high at early stages when you need to quickly test a product and reach initial transactions. But compliance cost modeling shows: as the share of EU revenue grows, the cost of marketing controls, legal opinions and enforcement risks begins to exceed the CAPEX for obtaining a license in the chosen EU jurisdiction.

Exit strategies include migrating the business to the EU or servicing remotely while obtaining a license in a country oriented towards CASP. A regulator sandbox program option sometimes accelerates testing of innovative products. Registration formalities in the EU and interaction with a local lawyer, preparation of governance documents, AML policies and procedures for CASP, this is an area where the COREDO team has implemented full cycles, including product governance and board supervision.

Practice and interaction with ESMA/NCAs

The COREDO team prepares legal opinions on MiCA reverse solicitation taking into account national nuances, including the legal position of third countries and MiCA, product mapping and assessment of the marketing footprint. We agree with the client in advance on a response playbook: who responds, what data is disclosed, how the internal compliance manual for CASP is demonstrated, and how evidence preservation is presented.

Practical tip: conduct a pre-emptive gap review of marketing, onboarding and IT logging before going live with EU traffic. It is faster and cheaper than urgently fixing traces after a regulatory letter.

Internal policies and controls
Drafting an internal control policy for CASP in the context of reverse solicitation is not a simplified version of the “full” license. Documents should cover the risk-based approach to AML/CFT, KYC/EDD, transaction monitoring algorithms, thresholds for SAR, travel rule, outsourcing governance and data quality controls. The internal compliance manual for CASP structures the roles of the MLRO, the second line of defense and escalations to the board.

Governance and board-level oversight address strategic issues: limits on the share of EU revenue, triggers for moving to licensing, a compliance and legal risk reserve budgeting model. It is at this level that it is decided whether reverse solicitation will remain an experiment or become a bridge to a full EU presence.

COREDO practice examples that work
Case 1: a Singaporean provider serving EU holdings on a request basis. The COREDO team built opt-in onboarding, centralized KYC with EDD for high-risk profiles and a strict “no EU marketing” policy. We prepared a legal opinion on MiCA reverse solicitation with a risk map and a migration plan to a Cypriot license upon reaching a 25% EU-share threshold. A regulatory inquiry from one of the NCAs was closed with an evidentiary base: logs, screenshots, instructions.

Case 2: a Dubai VASP with active content marketing. COREDO’s audit revealed hidden geotargeting to several EU countries and a referral network with EU bloggers. We froze the campaigns, rewrote public disclosures, implemented pre-clearance, trained the sales team and put in place a document retention policy. At the same time we started the licensing process in Estonia; after 8 months the company moved to an onshore model.

Case 3: a British fintech platform with utility tokens. The legal assessment showed exceptions for some tokens, but ancillary services fell within the MiCA scope. COREDO’s practice confirmed: mixed models more often err in classification. We separated product flows, for some — reverse solicitation with neutral web architecture, for others — an application for a license in Slovakia.

Contract models and data protection
Contract models with an EU client should include: choice of law and dispute jurisdiction outside the EU, clear product restrictions, terms for termination of service on regulatory grounds and notifications, disclosure of economic and legal risks. Contracts should set out mechanisms for KYC/EDD, consents for processing and transfer of data, as well as the provider’s rights to transaction monitoring and freezing operations upon red flags.

When reverse solicitation is not advantageous
Business model alignment with MiCA requires an honest assessment. If your growth depends on marketing, partnerships and public promotion, reverse solicitation will limit scaling and increase the cost of compliance. If the business case envisages a significant flow of clients from the EU, it is advisable to plan for EU licensing in advance, choosing jurisdictions with a clear NCA practice and accessible infrastructure (for example, Cyprus, Estonia, some Central European countries).

Compliance cost modeling helps management see where the breaking point lies between the costs of legal protection for the reverse model and the CAPEX/OPEX of a licensed presence. The COREDO team often calculates scenarios: a basic reverse for 6–9 months, a hybrid model with limited marketing and a full transition to a license with an onshore team and presence and substance requirements.

What the regulator will ask during an inspection
Preparation for a regulator’s inspection on client-initiated contacts: it is not only documents. Regulators check product governance, the continuity of the customer information trail, monitoring stability, response to alerts and the competence of the MLRO. We conduct simulated requests where the client team answers questions about site structure, onboarding logic, token classification and the use of EU sanctions lists.

The regulatory perimeter under MiCA changes as ESMA publications are released, and COREDO regularly updates templates of the internal compliance manual for CASP. This allows rapid implementation of changes: for example, strengthening requirements for pre-contractual disclosures or revising the passive client test procedure.

Nuances of ART, EMT and utility tokens
Asset-referenced tokens are regulated more strictly, especially regarding issuance, reserves and disclosures. E-money tokens under MiCA trend towards requirements similar to electronic money, including capital and safeguarding of funds. Utility tokens may be outside MiCA with a narrow functional purpose, but as soon as trading availability or an investment motive appears: we return to the MiCA scope.

COREDO helps clients with product mapping: a matrix of token functions, use scenarios, impact on AML/KYC and product restrictions in reverse solicitation. This reduces the risk of incorrect classification and NCA claims.

From hypothesis to a sustainable model

• Carry out a MiCA scope and applicability assessment to the product, taking into account national transpositions.
• Decide whether the model allows passive inbound without marketing in the EU.
• Build web and CRM architecture with inbound logging, disable EU targeting.
• Develop an internal compliance manual, AML policies, travel rule procedures and the MLRO role.
• Set up KYC/CDD/EDD, sanctions and PEP checks, transaction monitoring.
• Prepare a legal opinion on MiCA reverse solicitation and a response plan for inquiries.
• Agree on ToS, agreements, disclosures, a privacy notice and GDPR processes.
• Identify triggers for moving to licensing, calculate ROI and choose a jurisdiction.
• Maintain record-keeping, evidence preservation and regular board oversight.

Conclusions

The COREDO team has walked this path with clients many times: from the legal opinion and process setup to transitioning to a licensed model in the EU. I am convinced that resilience in the crypto-economy is built on two pillars – strategic clarity and operational excellence. Reverse solicitation can become your bridge to Europe if you define the boundaries in advance, stay within the regulatory perimeter and make a timely decision about licensing.

Since 2016 I have been leading COREDO through dozens of regulatory cycles and changes in the EU, the UK, Singapore and the UAE. The COREDO team has gone all the way from company formation and CASP/VASP licensing to building mature AML‑programs, reserve proofs and setting up operational resilience. In this article I have compiled the strategy we actually use in projects: how to prepare a crypto exchange and related fintech services for MiCA in the EU and for VARA in Dubai by 2026, with details, not theory for theory’s sake.

MiCA and VARA: what you need to know in 2026

MiCA and VARA are already shaping a new regulatory landscape for crypto-assets, so it is worth having a clear understanding of the main implications for businesses and users. Below we break down what is important to know in 2026: the scope of MiCA, requirements for providers and practical interaction with VARA.

Scope of MiCA

VARA mandate in Dubai

CASP vs VASP, terms and responsibilities

In the EU under MiCA, Crypto‑Asset Service Provider (CASP); in Dubai — Virtual Asset Service Provider (VASP). The difference is not only in terminology. COREDO’s practice confirms: VARA describes technological and information requirements in greater detail (logging, cybersecurity, BCM), while MiCA focuses on prudential and market integrity aspects for EU market participants. For crypto exchanges the question “MiCA vs VARA for crypto exchanges” often means not choosing “or” but “and”, when an international structure builds a licensing architecture covering both jurisdictions.

Extraterritoriality and equivalence

Market entry: EU vs Dubai

Choosing a strategy for market entry in the EU or Dubai is determined by differences in regulation, taxes and access to customer and technological infrastructure. Special attention should be paid to passporting under MiCA and its limitations, which directly affect the speed and scalability of presence in Europe.

MiCA passporting: limitations

VARA license for exchanges in Dubai

ROI from compliance: CapEx vs OpEx

How to obtain a crypto exchange license

Licensing crypto exchanges is a complex process implemented through clearly structured step-by-step procedures that minimize regulatory and operational risks. The first key stage, registration of a legal entity in the EU and bringing operations into compliance with MiCA requirements, is followed by the preparation of documents, compliance processes and technical integration.

Registering a legal entity in the EU under MiCA

Registration in the UAE: Free Zone/Mainland

Migration of license, clients and data

Capital, governance and risk management

Understanding capital requirements, effective governance and reliable risk management processes form the basis of financial resilience and compliance with regulatory standards. In the next section we will examine the minimum capital and reserves necessary to maintain solvency and cover potential losses.

Minimum capital and reserves

Management of conflicts of interest

Operational resilience (BCM)

AML/KYC: from policies to technologies

AML/KYC today requires a shift from formal policies to technological solutions that automate checks and minimize operational risks. This is especially important when implementing MiCA and VARA requirements and when organizing KYC/EDD for corporate clients.

KYC/EDD requirements under MiCA and VARA

Travel Rule for cross-border transactions

FATF, AMLD5/6 and STR/CTR with authorities

Sanctions, screening, PEP/SDN and information exchange

Proof of reserves and asset custody

The topics of custody, proof of reserves, and overall asset security define the rules for storage and transparency when working with digital assets. Below we will review MiCA’s custody requirements and the key provisions of custodian agreements that help ensure compliance with these standards.

Agreements and custody under MiCA

Custody models under VARA and insurance

Proof of reserves: audit and certification

CISO and cyber risks of wallet providers

Disclosure and investor protection

Operational transparency and detailed disclosure: key elements of effective investor protection in the digital assets space. In the following subsections we will examine MiCA’s disclosure requirements, the organization of the token register and the content of the whitepaper that help implement these principles in practice.

MiCA disclosure: registry and whitepaper

Stablecoin regulation and reserves

Protection of token marketplace consumers

Compliance and operational integrations

Tools for compliance and support of operational integrations combine automated risk monitoring, blockchain activity analysis and ML models to fight fraud. Below we will examine the key elements in detail: KYT and on‑chain monitoring, anti‑fraud ML and graph analytics.

KYT and on-chain monitoring

ROI assessment: automation, BPM, KPI/KRIs

Integration with banks: PSD2 and KYC

Blockchain interoperability and oracles

Regulatory supervision and sanctions

Attention to supervision and potential sanctions has become a key factor for market participants: non-compliance with rules often entails operational and reputational risks. Below we examine regulatory practice at the ESMA and national regulator levels, including reporting requirements and the frequency of document submissions.

Reports to ESMA and national regulators: frequency

VARA regulatory sandboxes: appeals

Supervisory sanctions and fines

COREDO Case Studies: launching exchanges in the EU and Dubai

COREDO case studies demonstrate how we bring exchanges to the EU and Dubai markets through a phased regulatory compliance strategy. Next, we will break down the MiCA compliance plan — from onboarding counterparties and setting up internal processes to scaling operations and maintaining compliance.

Exchange compliance plan under MiCA

VARA risks and controls in Dubai

Migration from Asia to the EU: clients and data

Liquidity, M&A and exits

For sustainable business expansion, liquidity, proper M&A planning and well‑thought exit strategies remain key. In the following section we will examine the principles of liquidity management and stress testing that help assess a company’s ability to withstand shocks and prepare for deals and exits.

Liquidity management and stress tests

IPO and M&A exit strategy: regulatory framework

Impact of geopolitics and sanctions

Checklist for launching an exchange under MiCA/VARA 2026

• Legal structure: SPV/branch/subsidiary; beneficial ownership register; tax planning.
• Licensing: CASP under MiCA with passporting; VARA VASP classes for exchange/custody/broker-dealer.
• Governance: board, independent directors, risk committee; roles CCO, MLRO, CISO.
• Capital and reserves: minimum requirements and buffers; liquidity plan and stress tests.
• AML/KYC: risk‑based KYC/EDD, sanctions (PEP/SDN), STR/CTR, FATF/AMLD5/6, Travel Rule (OpenVASP/Sygna/TRP).
• Custody: hot/cold wallets, multisig, HSM, insurance; agreements with custodians under MiCA.
• Proof of Reserves и аудит: methodology, independent attestation, regular public reporting.
• Technology: KYT, on‑chain analytics, anti‑fraud ML, SIEM/PAM; BPM automation, KPI/KRIs.
• Transparency: token registry and classification under MiCA; whitepaper and disclosures; market conduct.
• Operational resilience: BCM, incident management, RTO/RPO, redundant sites and backups.
• Integrations: banking gateways, PSD2 compatibility, banks’ KYC requirements.
• Regulation: reports and frequency, VARA sandboxes, right of appeal, engagement with the regulator.
• Data and GDPR: DPIA, client and data migration, contracts with providers, access control.
• Smart contracts: audits, bug bounties, deployment management; oracle risks and interoperability.

Why COREDO is a long-term partner

The 2026 MiCA regulation for crypto-assets and the 2026 VARA regulation for virtual assets in Dubai set a high bar for crypto exchanges. For some it’s a barrier, but I see a window of opportunity: passporting under MiCA, equivalence and international recognition of VARA, mature procedures, a foundation for scaling without regulatory surprises. Our experience at COREDO has shown that the right compliance architecture not only grants market access but also saves capital, speeds up deals, and increases company valuation.

Since 2016 I have been building COREDO as a company that removes regulatory uncertainty for entrepreneurs and financial directors. During this time the COREDO team has obtained licenses and set up operating models in the EU, the United Kingdom, the Czech Republic, Slovakia, Cyprus, Estonia, Lithuania, Singapore and Dubai. In this article I have compiled practical recommendations on CASP licensing, with a focus on capital, personnel, AML and technological resilience. I draw on the experience of numerous projects so that you can immediately see where the main value lies and how to avoid costly mistakes.

Why MiCA and global supervision now

The European MiCA regulation introduces common requirements for CASPs regarding capital, organizational structure and client protection, and also provides passporting mechanisms in the EU. COREDO’s practice confirms: the new regime raises the entry threshold, but with proper preparation accelerates scaling across regions and reduces fragmentation of requirements. We take into account that MiCA and the capital requirements for CASPs tie own funds to the set of services and fixed overhead costs.

Choosing a jurisdiction and market entry

Decisions on choosing a jurisdiction and forming a market entry model define the legal, tax and commercial framework of expansion. Below we will examine step by step how these factors manifest in the EU context: from regulatory harmonization to requirements for economic substance.

EU regulatory harmonization

MiCA creates uniform rules, but in practice each state retains particularities in supervision and expectations regarding local presence. Economic substance and local presence of a CASP are not a formality: real resident directors, an office, a full-time MLRO, and management functions within the country strengthen the position at the application stage. At COREDO we design the organizational structure of the CASP in advance for licensing and prepare a passporting strategy to later use cross-border CASP services without duplicating licenses.

Estonia, Malta, Lithuania offer different entry barriers. In Estonia the minimum share capital for a VASP depends on the services and usually ranges from €100,000 to €250,000; personnel and control requirements have been strengthened since 2022. In Malta the VFA classification raises the bar for capital and governance: for advanced classes this means hundreds of thousands of euros and enhanced internal controls. Lithuania actively welcomes crypto business: VASP registration is possible, but banks and payment providers expect confirmed substance and a mature AML framework.

Depth and supervisory models in four countries

The FCA conducts strict registration of crypto companies: there is no formal minimum capital, but a CASP’s own funds must cover risks and fixed expenses, and personnel must demonstrate competencies and independence of compliance functions. FINMA and the Swiss cantonal regulators apply a high level of scrutiny to custody solutions and directors’ responsibilities. In Singapore under MAS’ PSA for DPT providers the minimum capital and security deposit depend on the volume of operations; mature processes for cybersecurity and key management are expected. In Dubai, VARA imposes clear requirements for product documentation, outsourcing of critical functions, and SLAs with providers.

CIS: a bridge to the EU and Asia

Capital for CASP: terms and calculations

For proper capital management within CASP it is important to first build a clear understanding of key terms before moving on to practical calculations. In the first section we will go through the basic terminology and regulatory logic to lay the foundation for further capital assessment methods and concrete computations.

Terminology and regulatory logic

Capital versus liquidity: the regulator for CASP requires both. Capital is a buffer against losses; liquidity is the ability to meet obligations and withstand outflows. Some jurisdictions apply elements of ICAAP: internal capital assessment and stress-testing, and risk-weighted assets (RWA) are adapted to the nature of crypto exposures and operational risks.

Risks, stress tests and capitalization

How to calculate capital requirements for a crypto exchange? We take the minimum CASP share capital, add a buffer to FOE (fixed overheads) for 12–18 months, account for CASP reserve capital requirements for custody and cyber risk coverage. Capitalization strategies when scaling a CASP include additional issuances, subordinated debt as a source of regulatory capital within limits, and cyber insurance, which indirectly reduces net losses in stress scenarios.

Funding and corporate actions

Personnel: fit and proper and organizational design

A company’s effectiveness largely depends on its personnel, adherence to the fit and proper principles, and thoughtful organizational design. In the following points we will examine staffing requirements and leadership roles in detail to understand how to build competencies, responsibilities, and managerial interactions within the organization.

Requirements and leadership roles

The roles of MLRO, CCO, CTO, CFO, CIO in a CASP allocate responsibilities: MLRO: management of AML and SARs, CCO – overall compliance framework and reporting, CTO/CIO – security, keys, infrastructure, CFO: capital, liquidity, reporting. The responsibility of CASP directors and staff is personal: the regulator assesses their decisions, the management of conflicts of interest in CASP leadership, and the independence of control.

Hiring and screening effectiveness

Recruitment and personnel screening procedures for a CASP include background checks, biography checks, criminal record and sanctions screening of the director, verification of education and actual achievements. Preparing CVs and proof of experience for CASP applicants should be substantive: projects, KPIs, implemented rollouts, certifications. The composition of the compliance and AML department in a CASP is built from an MLRO, KYC/KYB analysts, a sanctions officer, a reporting officer, and an independent internal auditor.

Ongoing operating expenses for CASP personnel should be planned for 12–18 months ahead. Performance indicators for the compliance function (KRI, KPI) include SLA for KYC, alert processing time, escalation rate, SAR quality, as well as ROI metrics from investments in compliance personnel. The assessment of the economic efficiency of hiring vs outsourcing shows: some functions are cost-effective to keep in-house, while others should be given to an external provider. Compliance function: in-house vs centralized for a CASP group: often a hybrid model with coordination at the holding level.

Succession, motivation and retention

Technologies, security and resilience

Reliable technologies, the indispensable foundation for ensuring the security and operational resilience of services. Below we will examine in detail custody, segregation and key management practices that are critically important for protecting assets and maintaining operations during incidents.

Custody and key management

Asset insurance and client loss coverage reduce operational risks; cyber insurance and capital requirements are linked: having adequate coverage can affect the assessment of residual risk in ICAAP. Agreements with liquidity and leverage providers should limit counterparty risks, and outsourcing exchange engines and SLAs for critical functions are required with transparent RTO/RPO.

Compliance and privacy

Technical requirements: SOC2, ISO27001, regular pentest, vulnerability management and access control. Business continuity and backup policies support operational resilience, while incident reporting and engagement with the regulator reduce regulatory risks during outages. Practices to prevent personal data leaks (GDPR/PDPA) and integration of HR and compliance for access control to assets close significant security gaps.

Independence of quality control

internal audit and the quality control of CASP personnel assess the effectiveness of the first and second lines of defence. Critical functions can be outsourced, but responsibility remains with the directors; we define vendor control KPIs and independent monitoring. Engagement with external auditors and capitalization reviews helps demonstrate the maturity of risk management.

License application: documents and process

Properly assembled documents and a structured submission process are the key to a successful application, and checkpoints help track readiness at each stage. We’ll start with organizational matters, then go over substance requirements and finish with the practical part – a business plan that confirms the project’s economic justification.

Substance of the organization and business plan

Product documentation details custody chains, exchange procedures, brokerage, limits on client transactions and margin risks. Segregation of client funds is codified in contracts and operating instructions, taking into account regulatory guidance on custodian vs exchange liabilities. The organizational structure of a CASP for licensing demonstrates the independence of compliance and risk functions.

Deal structure: timing and cost

Timing and cost of obtaining a CASP license depend on the jurisdiction and the readiness of the materials. In the EU, with a quality package, review takes from 3 to 9 months; in Singapore and Dubai: longer for complex models. We assess in advance the ongoing operating expenses for CASP personnel and funding sources for the CASP license to avoid cash shortfalls at the finish.

Reporting and control in the operational phase

In the operational phase, reliable reporting and continuous internal control become key to minimizing risks and ensuring compliance with standards. Regulatory reporting and AML are especially important – they require clear coordination of procedures, data transparency and prompt incident response.

AML and regulatory reporting

Internal reporting procedures and regulatory reports record compliance with capital and liquidity requirements, security incidents and governance changes. Capital and liquidity reporting rules vary, but in all cases a transparent accounting of own funds for CASP and FOE is required. AML reporting and Suspicious Activity Reports (SAR) require a qualified MLRO and precision in escalation procedures.

Liquidity management in cases of laundering and rapid outflows relies on pre-approved limits and stress plans. Setting limits on client transactions and margin risks reduces the likelihood of sudden breaks and market cascades. Regulatory fines and license refusals typically occur due to undercapitalization, weak AML and unverified sources of capital; the COREDO team remedied such situations through recapitalization and redesign of the KYC/KYB framework.

Structure audit, modification and closure

Regulatory approvals for changes to capital structure and corporate rights: a standard practice when scaling. External auditors check capitalization, IT controls and compliance with GDPR/PDPA. Business closure procedures and protection of clients’ interests include an asset return plan, regulator notifications and an independent audit of segregation.

COREDO case studies: where details matter

In Lithuania, the COREDO team implemented a project for an exchange CASP oriented toward a MiCA passport. The key was the strategy: the minimum capital for the CASP was covered with equity, and the CASP’s own funds were strengthened with subordinated debt within the limits. We implemented an ICAAP approach and outflow stress tests, recalculated FOE for 18 months and achieved a comfortable assessment by the regulator.

In Singapore, a solution developed at COREDO helped a DPT provider obtain a status compliant with PSA requirements. We built a SOC2-compliant architecture, implemented KMS/HSM and multisig, conducted a pentest and set up incident reporting. MAS positively assessed the competencies of the MLRO and the independence of internal audit.

In Estonia, our experience at COREDO showed how critical staffing requirements are for crypto companies. We supplemented the team with a strong MLRO, separated the CCO and MLRO roles, strengthened Travel Rule integration, and updated AML policies in light of AMLD6 and FATF. The result: a successful license review, reduced risk of enforcement actions, and stable relationships with banks.

In Dubai, the COREDO team established outsourcing of exchange engines with strict SLAs, formalized agreements with custodians and custody terms, and provided for asset and cyber risk insurance. This allowed for reduced capital add-ons for operational risks and sped up VARA approval. We also implemented KPI/KRI for compliance to transparently demonstrate ROI at the board level.

Checklists for CASP license

• Capital and liquidity:
  • Own funds (own funds): minimum and FOE ≥ 25% of annual expenses.
  • Proof of sources of capital: bank statements, SPA, audit.
  • Recapitalization plan: additional share issuance, subordinated debt, cyber risk insurance.
  • Liquidity reserves and stress tests: outflows, margin calls, provider outages.
• Personnel and governance:
  • Fit and proper for CASP management; independent CCO, qualified MLRO.
  • Procedure for checking the director’s background, criminal record and sanctions clearance.
  • Management succession plan; Risk, Audit, RemCo committees; conflict of interest.
  • Compensation models and risk-oriented bonuses; compliance KPI/KRI.
• Technology and security:
  • Segregation of client funds; cold/hot wallets, KMS, HSM, multisig.
  • KYT: Chainalysis/Elliptic/TRM; Travel rule provider; sanctions lists.
  • SOC2/ISO27001; pentest; BCP/DR; incident reporting and contact with the regulator.
  • SLA with outsourcers; agreements with custodians and liquidity providers.
• Documentation and process:
  • Organizational chart and job/function descriptions; local substance.
  • Business plan: products, revenue models, stress scenarios, financial forecasts.
  • AML/CTF policies, sanctions, KYC/KYB, SAR reports; internal reporting.
  • Passporting plan to the EU; assessment of tax and licensing consequences.

Cost planning and return on investment

Assessing the economic efficiency of hiring vs outsourcing requires comparing TCO: salaries, training and certification of AML/CTF staff, software licenses, external auditors. Metrics for return on investment in compliance and security are measured by reductions in losses from incidents, refusals in banking relationships, fines and licensing timelines. Techniques for optimizing personnel and compliance costs include a centralized center of expertise for the group, policy harmonization and shared services.

Staff planning when entering new markets builds in increased workloads for the MLRO and IT security, as well as stronger Travel Rule compliance and reporting. Economic efficiency assessment that takes into account capital threshold requirements by jurisdiction (EU/Asia/CIS) helps choose the optimal scaling route. comparison of jurisdictions by entry barrier and personnel cost we record in the financial model to support the board of directors’ decision.

Trends and Recommendations

Regulatory trends: tightening capital requirements after incidents and clarifying regulatory guidance on custodian vs exchange liabilities. Benchmarking of capital requirements between the EU and Asia shows an increased emphasis on FOE and operational risk. The impact of crypto insurance on capital requirements is becoming noticeable: regulators view real coverage with minimal exclusions positively.

Managing liquidity and sudden increases in outflows is becoming a key competency. Management of conflicts of interest, the role of the board of directors and committees, measures to reduce operational and reputational risk: all of this affects the assessment of an organisation’s “fit and proper” status. Taxation and reporting requirements for CASP require constant calibration as product lines and geography change.

Lessons from COREDO’s practice

In one project, the regulator initiated license revocation due to a capital shortfall after market fluctuations and an increase in FOE. The COREDO team quickly prepared a recapitalization plan, arranged subordinated debt, and updated the ICAAP and stress scenarios. The regulator accepted the adjustments, and the client avoided a business shutdown and strengthened liquidity reserves.

Another case concerned the travel rule: the provider was failing to meet SLAs and AML alerts were piling up. The solution developed at COREDO included replacing the provider, rebuilding the alert logic, setting KPIs for the team, and improving the MLRO’s competencies. Within two months processing time decreased threefold, and SARs became more accurate in structure and content.

I also highlight a project on the transition from a subsidiary to a branch in the EU. We assessed licensing implications in advance, adjusted capital and internal reporting, and agreed on governance changes. As a result the client retained passporting and optimized their tax position without regulatory delays.

How to gain time and reduce risks

The sooner you turn regulatory requirements into a concrete plan, the easier it is to scale the business and protect clients’ interests. Regulators in the EU, the UK, Switzerland, Singapore and Dubai expect from CASPs the same as from mature financial participants: sufficient capital, responsible management, transparency and operational resilience. COREDO’s experience confirms: it is these principles that make crypto business sustainable and predictable over the long term.