Since 2016 I have been building COREDO as a team that turns complex regulatory challenges into working operational models. During this time we have carried out dozens of projects in the EU, the United Kingdom, Singapore and Dubai, as well as in a number of offshore and mid‑shore jurisdictions in Africa and Asia. Today entrepreneurs and CFOs increasingly come to me with one request: how to strategically choose between the Seychelles and Mauritius for a VASP license, accelerate the VASP 2026 licensing process and at the same time ensure AML/CFT compliance, bankability and a stable project economy. In this article I have compiled our practical experience, working checklists and a view of trends for 2024–2026 so that you can make an informed decision and move toward ROI without unnecessary iterations.
Choosing a VASP jurisdiction in 2026
Comparison of Seychelles and Mauritius for VASP
For VASP the strategic comparison of jurisdictions of the Seychelles and Mauritius focuses not so much on the attractiveness of the locations as on differences in regulation and practical compliance with requirements. Let’s review the key differences in the regulatory frameworks and approaches of the FSA and FSC to understand what risks and advantages each system carries.
Regulatory frameworks: FSA vs FSC
In the Seychelles supervision of VASPs is exercised by the Seychelles Financial Services Authority. The regulator relies on the local law on virtual asset service providers and general AML standards oriented to FATF recommendations for virtual assets. For VASP registration in the Seychelles the applicant prepares internal policies, appoints a responsible MLRO, describes custody architecture and demonstrates operational readiness.
Capital requirements and presence
VASP capital requirements in the Seychelles are structured by activity classes and are confirmed by paid-up share capital and liquid reserves. Economic presence in the Seychelles includes local control and reporting, availability of responsible persons and enforceability of service agreements.
Taxation, DTA and the impact of substance
In the Seychelles the tax regime is oriented toward international cooperation, participation in the CRS (automatic exchange of information) and meeting transparency requirements. The impact of economic substance on a VASP’s tax status in both jurisdictions is growing, especially in light of the Pillar Two initiatives (global minimum tax). Our experience at COREDO has shown: thorough documentation on risk management, transfer pricing and substance is the basis for a positive position in tax audits.
Banking services and bankability
In COREDO projects we develop an account roadmap: an operational account in a local bank, accounts in international EMIs, escrow for custody and segregation of funds, as well as integration with payment gateways and PSPs with demonstrable compliance with the Travel Rule.
Market access (passporting) and risks
The impact of MiCA on offshore VASP licenses is increasing: targeted marketing in the EU will require MiCA compliance and adherence to national regulator regimes. COREDO’s practice confirms: correct marketing policy and clauses in client documents reduce the risks of breaching local rules.
VASP License 2026: from application to go-live
obtaining a license VASP in 2026 is a multi-stage procedure covering the path from application submission to actual go‑live and requiring coordinated work of lawyers, compliance and IT. Below we will analyze key timelines and stages in detail to help plan the process and minimize the risk of delays.
Stages and timelines
The standard route includes preliminary diagnostics, preparation of policies and procedures, gathering registration documents, submission to the FSC or FSA, responses to queries, conditional approval and the final go‑live with verification of operational readiness. Timelines and stages of obtaining a license for VASP depend on the category, custody complexity and chosen providers. In our practice in Mauritius the typical horizon is 4–6 months to conditional approval and another 1–2 months to fulfil the conditions; in the Seychelles: comparable with good preliminary preparation.
Checklist of registration documents
- corporate documents, charter and the share capital structure;
- disclosure of beneficiaries (UBO) for VASP, compliance with UBO register rules;
- business plan, financial models, OPEX calculation and liquidity reserves;
- VASP compliance program 2026, AML/CFT policies, sanctions procedures and screening;
- technological requirements for VASP licensing: key management, custody, BCP/DRP;
- agreements with critical providers: KYC/KYB, KYT, blockchain forensics, custody insurance.
The COREDO team structures the document package so that the regulator can see the connectivity: risks – controls, metrics – reporting.
Fit and proper, UBO and background checks
In COREDO projects we perform an internal pre‑screen in advance to mitigate potential FSC/FSA queries and to justify the appointment of the MLRO, CTO and key functions.
AML/CFT 2026: operational control
In the context of AML/CFT 2026 it is critical to shift the focus from drafting policies to real operational control that actually reduces risks. This requires strengthening KYC, KYB, sanctions screening and regular PEP checks at all stages of client interaction.
KYC, KYB, sanctions screening and PEP
AML requirements for VASPs in Mauritius and AML requirements for VASPs in the Seychelles converge in spirit: demonstration of effectiveness, not only policies on paper. Regular AML training and employee testing with documented results help here.
Travel rule, KYT and blockchain forensics
AML implementation transaction monitoring for VASP relies on scenarios and manual reviews. At COREDO we set up performance metrics: escalation speed, average time to close an alert, and the share escalated to SAR.
MLRO and SAR: interaction with the regulator
The MLRO and the AML officer role include independence, access to the board of directors and the authority to stop transactions. SAR and the procedure for filing suspicious transactions are formalized with clear SLAs. In dialogue with the FSC/FSA, structured reporting, a log of decisions and regular AML/CFT 2026 effectiveness self-assessments for VASP management are helpful.
Requirements for VASP
Technological and operational requirements for VASP define a set of standards and practices that ensure security and compliance when working with crypto assets. Special attention is paid to hot/cold wallet architecture, multi‑sig schemes, custodial governance models and insurance — these solutions form the foundation of operational resilience and client protection.
Hot/cold wallet and multi-signature architecture
Requirements for hot and cold wallets boil down to the principle of minimizing exposure and separating duties. Multi‑sig, cold wallet and hot wallet architectures are complemented by segregation of user funds and custody rules. For significant volumes I recommend custody insurance and independent cold storage audits, including a technical assessment of key protection (key management).
Custody rules and crypto asset storage imply detailed procedures for access, logging and emergency scenarios. The solution developed at COREDO often includes hardware modules, version control and regular drill tests.
Cybersecurity: SOC2, ISO27001, ISAE
Cybersecurity for crypto businesses in offshore jurisdictions: a mandatory block. SOC 2 and ISO 27001 security requirements increase trust from banks and institutions. ISAE 3000 / ISAE 3402 audits are appropriate for service providers. In COREDO projects we perform a pre‑assessment, close critical controls and plan certification together with licensing.
Operational resilience BCP/DRP
Structuring and tax model
A well-designed corporate structuring directly determines the practical applicability of the chosen tax model and the level of legal risk for the business. In the following subsections we will examine in detail the options for organizing a VASP offshore, the related tax consequences and practical measures to minimize risks.
VASP structure in offshore jurisdictions
The administration of trust structures and foundations is possible for holding IP or reserve assets, provided there is UBO transparency and compliance with the UBO register.
Transfer pricing, CRS, BEPS, Pillar Two
CRS (automatic exchange of information) and OECD BEPS rules require proper documentation of intercompany services and rates. Transfer pricing and transactional schemes must reflect substance and market conditions. Pillar Two — the global minimum tax — becomes a factor when planning profits and royalties.
Capital, investments and exit/M&A
COREDO case studies and takeaways
COREDO’s practice is based on real cases and concise extracts of experience that help quickly identify practical solutions and risks. In the first subsection we will analyze VASP registration in Mauritius and the key findings useful for similar tasks.
VASP registration in Mauritius
Cryptocurrency exchange licensing in the Seychelles
Bank servicing and integration with PSPs
Cost of compliance and ROI
Assessing the cost of compliance is not only about initial investments but also an ongoing burden on the budget that directly affects expected ROI. To properly calculate returns, OPEX, licensing fees and annual payments must be analyzed separately.
OPEX and annual licensing fees
VASP license ROI in Mauritius vs Seychelles
Regional expansion and scaling
Scaling operations and regional expansion require pre-planned modularity: additional licenses, the availability of regional accounts, and expansion of the compliance team. Passporting and access to African and EU markets are achieved through local licenses and partnerships, not through a “universal” offshore license.
Impact of MiCA on 2024–2026 trends
New regulatory trends during 2024–2026 are substantially changing requirements for the digital assets market, and MiCA’s influence is already setting benchmarks for enforcement and compliance. In the following subsections we will examine how these changes are reflected in European rules for VASPs and what service providers will need to take into account.
MiCA: EU rules for virtual asset service providers
Virtual assets, FATF recommendations
FATF compliance for VASPs is an informal “currency of trust”. Regulators expect a clear linkage between risks and controls, including Due Diligence providers for VASPs, scenario monitoring and SAR‑procedures. The COREDO team pays attention to country‑risk models and periodic risk reassessment.
Regulatory sandboxes and innovation
Risk checklists
Risk management and regular checklists help to identify vulnerabilities in advance and reduce the likelihood of non-compliance during inspections. Next we’ll review compliance with FSC/FSA requirements and practical steps for preparing for on-site inspections.
On-site inspection for FSC/FSA
Regulatory reviews and on-site inspections include interviews, selective transaction reviews, testing of BCP/DRP and verification of reporting. Reporting requirements in FSC / FSA cover regular reports, audits and VASP inspections. Our checklist includes a self-assessment of key controls and readiness for spot-checks.
Nominee directors
Marketing restrictions in the EU and Britain
COREDO Licensing Roadmap
When building the COREDO licensing roadmap, COREDO focuses on aligning business processes and technical solutions to minimize risks and accelerate engagement with regulators. Within this strategy, the choice of technology stack and vetted due diligence providers that ensure compliance and transparency at every stage is especially important.
Stack and due diligence providers
AML training and compliance program
The VASP 2026 compliance program is built as a living system: policies, playbooks, metrics, training. AML training and employee testing are mandatory for all roles, including product and support. We prepare VASP reporting, audits and inspections in a format convenient for regulators, banks and investors.
Hybrid models: custody, broker, exchange
The functional classification of a VASP defines the scope of the license: exchange, wallet, custody. For hybrid models, boundaries of responsibility, requirements for reserve storage, cold storage audits and custody insurance are important. We also evaluate opportunities for licensing stablecoin and e‑money through partnership schemes and local licenses.
Brief risk profile Seychelles vs Mauritius
- Seychelles: speed, flexibility, affordable compliance costs; greater focus on EMIs/PSP; important to carefully establish AML/KYT and demonstrate the effectiveness of controls.
- Mauritius: strong DTA network, developed banking sector, focus on substance; higher requirements for an office and team; a convenient platform for Africa and institutional flows.
Key takeaways
The COREDO team has gone through this journey with different models: from crypto exchanges to custodians. I see how proactive AML/CFT planning, technological discipline, a proper corporate structure and respect for regulators’ requirements transform a launch from a ‘risk’ into an ‘investment’. If you are building a VASP in 2026, start with a risk map, define target markets taking into account MiCA and FATF, assemble a strong team of directors and an MLRO, and then sequentially close out issues related to custody, banking and reporting. COREDO’s practice confirms: this approach shortens timelines, reduces OPEX and accelerates the path to sustainable ROI.