TSM™ Compliance Atlas

Hong Kong — Regulatory Perimeter: SFC, HKMA and the Two-Ordinance Structure

1. SFO + AMLO Schedule 3B: the SFC's dual mandate

The SFC's authority over virtual assets rests on two pillars. The first is the long-standing Securities and Futures Ordinance (Cap. 571), which captures any token whose economic rights, cash flows or issuer promises make it a “security” or “collective investment scheme” under Hong Kong law — the classic case being tokenized funds, tokenized bonds and equity-linked tokens. The second is Schedule 3B of the AMLO, added in June 2023, which created the Hong Kong Virtual Asset Trading Platform (VATP) licensing regime for centralised trading platforms dealing in non-security virtual assets. Operating a VATP in Hong Kong, or actively marketing one to Hong Kong retail investors, without the required licence is a criminal offence (SFC, Virtual Asset Trading Platform Operators). Because tokenized commodities can fall on either side of the line depending on structure — an allocated-bar warehouse receipt token behaves like a security-adjacent CIS, while a pure commodity-referenced payment token behaves like a non-security VA — issuers must map the exact rights conferred to token holders before choosing a licence lane.

2. HKMA's mandate under the Stablecoins Ordinance (August 2025)

The Stablecoins Ordinance commenced on 1 August 2025 and created a separate licensing regime administered by the HKMA, targeting issuers of fiat-referenced stablecoins (FRS). Any person who, in the course of business, issues an FRS in Hong Kong, or issues an HKD-referenced FRS anywhere in the world, must hold an HKMA licence (HKSAR Government, Stablecoins Ordinance to commence operation on 1 August 2025). The HKMA has been explicit that it will “set a high bar for licensing” and expects to grant only a “handful of licences” in the initial cohort (HKMA, Robust and Sustainable Development of Stablecoins). Full licensing rules for reserve management, redemption, risk controls and governance are set out in the Guideline on Supervision of Licensed Stablecoin Issuers (HKMA, Guideline on Supervision of Licensed Stablecoin Issuers (PDF)).

3. The “permitted offeror” concept: who may distribute a stablecoin

Under section 9 of the Stablecoins Ordinance, only five categories of “permitted offerors” may offer a specified stablecoin to retail in Hong Kong: (1) licensed stablecoin issuers, (2) SFC-licensed virtual asset service providers (VATPs), (3) holders of a stored-value facility (SVF) licence, (4) SFC-licensed Type 1 corporations, and (5) authorised institutions (banks) under the Banking Ordinance (HKSAR Government, LCQ10: Regulation of digital assets). The practical consequence for tokenized metals is that a settlement stablecoin used inside a metals-token marketplace can only be offered through this closed distribution ring — a design choice that materially favours vertical integration (issuer plus VATP under common control or common licence) over pure open-market listing.

The VATP Licence — Capital, Custody, Responsible Officers, and the July 2025 Handbook

1. Type 1 + Type 7 regulated activities and Schedule 3B AMLO

The VATP Licensing Handbook (July 2025) confirms that a Hong Kong VATP typically requires two SFO-regulated activity licences — Type 1 (dealing in securities) and Type 7 (providing automated trading services) — where the platform trades any virtual asset with security characteristics, in parallel with the AMLO Schedule 3B VATP licence for non-security virtual assets (SFC, Licensing Handbook for VATPs (July 2025)). Suitability, disclosure and conduct standards are set in the SFC Guidelines for VATP Operators (SFC, VATP suitability requirements and Guidelines).

2. Capital, liquidity and Responsible Officer requirements

The financial resource floor for a VATP is meaningfully higher than most Asian peer regimes: HK$5 million paid-up share capital, HK$3 million liquid capital, and a twelve-month operating-expense liquidity buffer maintained on an ongoing basis, per the Guidelines. The platform must appoint at least two Responsible Officers (ROs), each ordinarily resident in Hong Kong, personally accountable to the SFC for the conduct of regulated activities. ROs must satisfy the standard SFC competence regime for their designated function (SFC, Competence Requirements for Individuals). External Assessors — independent third-party firms approved by the SFC — are required to audit an applicant's infrastructure, governance and controls before the SFC makes a licensing decision, which is what makes the Hong Kong process meaningfully slower and more expensive than the UAE or Singapore alternatives at the front end.

3. Client-asset custody: segregation, cold-storage minimums, insurance

The VATP client-asset regime is unusually prescriptive by international standards. Client virtual assets must be held on trust through a wholly-owned SFC-licensed subsidiary of the platform, with a minimum of 98% of client VA held in cold storage under the current Guidelines, third-party insurance covering “a reasonable portion” of assets held in hot wallets, and annual independent audits of the custody function. These custody rules are the direct HK counterpart to the SPDR/GLD-style allocated-bar model in physical bullion: they require the platform, not the client, to prove segregation continuously, and they materially raise the cost of running a small platform. Recent SFC circulars have expanded permitted VATP products and services — including allowing licensed VATPs, subject to SFC approval and daily stress testing, to connect their order books with overseas affiliated platforms (SFC, Circular on expansion of products and services of VATPs).

4. Licensed population and the swift licensing process

As at 31 March 2025, the SFC had licensed a total of ten VATPs and was reviewing licence applications from a further eight applicants, four of which were “deemed applicants” under the AMLO transition. The SFC adopted a swift licensing process for deemed-to-be-licensed applicants in January 2025, following risk-based on-site inspections of all deemed applicants (SFC, Annual Report 2024–25: Leading financial market transformation).

Tokenized Securities and Commodity-Linked Tokens — The SFO Analysis

1. The look-through test and SFO characterisation

SFC guidance since 2023 has been consistent: the classification of a tokenized product turns on the economic substance of the rights conferred by the token, not on the fact that the wrapper is a smart contract. If those rights amount to a “security” under section 1 of the SFO — including a share, debenture, unit in a CIS, or interest in a structured product — then the token is a security-token and every existing SFO licensing, prospectus, disclosure and conduct obligation applies as if the wrapper were paper. This is why security tokens marketed to Hong Kong retail must be offered under a Type 1 dealer through an SFC-licensed platform, and why tokenized funds require the fund manager to hold a Type 9 (asset management) licence (SFC, Virtual Asset Trading Platforms — Rules and Standards).

2. Type 9 without client-asset custody: the low-friction path

The Type 9 (asset management) licence is one of the most accessible institutional-grade licences in the SFC's regulated-activity ladder when the manager does not hold client assets: no minimum paid-up share capital and only HK$100,000 liquid capital are required, on the basis that a licensed third-party custodian is used (Zitadelle, Hong Kong SFC Licence Guide 2026 — Type 1, 4, 9). For a metals-token issuer that wants to structure a discretionary tokenized-metals fund but outsource actual bullion custody to Brink's or Malca-Amit, this is the practical entry point — the licensing cost is a small fraction of the VATP capital floor.

3. Commodity-linked token analysis: allocated vs. pooled vs. index-linked

There is no separate SFO category for “commodity-linked tokens,” and the SFC has repeatedly emphasised that each commodity-referenced token has to be analysed on its own facts. Three archetypes drive the answer in practice. First, a token that represents direct legal title to a specific allocated bar stored on a bailment basis is functionally a warehouse receipt: it is typically not a security by itself, but any secondary trading venue for it is a VATP if operated centrally, and the underlying storage arrangement raises separate custody-regulation questions. Second, a token representing a pro-rata interest in a pooled metals inventory managed by a promoter is almost always a collective investment scheme under the SFO and therefore a security — requiring Type 1/9 licensing and, for retail offers, SFC authorisation of the scheme. Third, a token whose payout is indexed to a metal or a metals benchmark (rather than delivering actual metal on redemption) is typically a structured product and again a security under the SFO. The choice between these three structures is the foundational compliance decision for any metals-token issuer working from Hong Kong.

The Stablecoins Ordinance and the ASPIRe Roadmap — What Changed in 2025–2026

1. The ASPIRe roadmap (February 2025)

In February 2025, the SFC published ASPIRe — Advancing Sustainable Progression through Innovation and Regulation, a twelve-initiative regulatory roadmap for virtual asset markets in Hong Kong. ASPIRe is not itself a binding rule: it is an active policy-statement commitment, with each initiative to be pursued through separate consultation, legislative action or new licensing regime development (Prokopiev Law Group, Hong Kong SFC Launches ASPIRe Regulatory Roadmap). Its most consequential commitments for tokenized metals are the new VA dealer and custodian licensing regimes (jointly consulted with the FSTB in June 2025, with consultation conclusions published in December 2025) and the framework for off-exchange OTC VA activity. The SFC has explicitly stated that the new dealer licensing regime will “mirror the standards applied to VATP regulation” while applying legal concepts familiar from Type 1 dealing-in-securities supervision (Tanner De Witt, ASPIRe: Looking back and ahead).

2. Stablecoins Ordinance mechanics: capital, reserves, redemption

The Stablecoins Ordinance targets issuers of fiat-referenced stablecoins (FRS) and any HKD-referenced FRS wherever issued. Licensed issuers must maintain minimum financial resources, hold reserve assets equal to at least 100% of the par value of the stablecoins in circulation, segregate those reserves from the issuer's own assets, and redeem holders at par upon request without unreasonable delay (Sidley, Hong Kong Implements New Regulatory Framework for Stablecoins). Fund flows received from customers during issuance must be denominated in the referenced currency, and the reserve composition, custody, and audit cadence are prescribed in the HKMA Guideline on Supervision of Licensed Stablecoin Issuers. A six-month transition period was granted to pre-existing operators; those operators had to apply within the first three months to continue operating during the transition (Jones Day, Hong Kong Passes Law on Stablecoins).

3. The HKMA Stablecoin Issuer Sandbox

The HKMA launched the Stablecoin Issuer Sandbox in early 2024 as a pre-implementation channel through which prospective issuers could work through business models, governance and risk-management architectures with HKMA supervisors and receive early feedback on regulatory expectations. HKMA has been explicit that sandbox participation is neither a prerequisite for a licence nor a guarantee of one — every eventual application must be assessed under the same “common and robust” standards (HKMA, Robust and Sustainable Development of Stablecoins).

4. First licence cohort and ASPIRe in action (2026 update)

As of the SFC's Web3 Festival 2026 speech, the ASPIRe roadmap has moved from policy statement to concrete legislative motion: the joint SFC-FSTB consultation on VA dealer and custodian licensing regimes closed in mid-2025 with broad support, and consultation conclusions were published in December 2025, laying the groundwork for the introduction of formal legislative proposals (SFC, ASPIRe in Action: Advancing Hong Kong's Digital Asset Journey (Web3 Festival 2026)). On the stablecoin side, the HKMA received 77 applications in the first application window and has publicly signalled it will grant only three to four licences in the initial cohort, currently expected in the first half of 2026.

Practical Path for a Tokenized Metals Issuer from Hong Kong

1. The four-stage sequencing for a Hong Kong metals-token launch

In practice, a metals-token issuer launching out of Hong Kong should follow a four-stage sequence. Stage one is a formal legal characterisation of the token: is it an allocated warehouse receipt, a pro-rata CIS interest, or a benchmark-indexed structured product? Each answer routes to a different SFO licensing lane and materially changes the marketing rules. Stage two is the licence stack itself — typically some combination of Type 1, Type 7, and Type 9, or a full VATP under Schedule 3B if the issuer intends to operate its own trading venue; a fund manager relying on a third-party custodian may only need Type 9 with the HK$100,000 liquid-capital floor. Stage three is settlement leg — if the issuer intends to accept an HKD-referenced stablecoin as settlement asset, the counterparty stablecoin issuer must either be HKMA-licensed or fall within one of the section 9 “permitted offeror” categories, which in most cases collapses back to using an HKMA-licensed FRS or a foreign USD-stablecoin offered exclusively to professional investors. Stage four is the physical leg — SFC guidance is strongly in favour of LBMA-approved refiners and vault operators with allocated storage, insured through the Lloyd's market, and audited on a bi-annual bar-count basis.

2. Physical custody: LBMA weight-lists as the SFC-friendly default

Although the SFO does not prescribe a specific physical custody standard, Hong Kong Good Delivery and LBMA Good Delivery rules are the de facto floor for institutional metals custody in the region — publishable weight lists, unique bar serial numbers, refiner marks and dual-count audit cadence. A tokenized-metals issuer that adopts the LBMA weight-list model from day one aligns automatically with the way SFC-licensed intermediaries expect to see “proof of underlying” for any commodity-linked security or structured product they distribute.

3. Distribution to Hong Kong investors: professional-investor rails vs. retail

The single biggest choice a Hong Kong tokenized-metals issuer makes is who is allowed to buy. Distributing to professional investors only (defined under the SFO as HKD 8 million investment portfolio for individuals, HKD 40 million total assets for corporations) opens most of the private-placement exemptions from prospectus and CIS-authorisation requirements, at the cost of a materially narrower distribution base. Distributing to retail pulls the product back inside full CIS authorisation, prospectus, product KYC and suitability rules under the SFC Guidelines, and typically requires listing on a fully licensed VATP. Because tokenized-metals products are a genuinely new category for Hong Kong retail, the practical route for a start-up issuer is professional-only for launch and retail only after a track record has been established.

4. AML/CFT layer: SFC AML Guideline and Travel Rule

On the anti-money-laundering side, Hong Kong applies a full FATF-aligned customer-due- diligence and transaction-monitoring regime through the SFC AML/CFT Guideline for Licensed Corporations and SFC-supervised AIs (2023) (SFC, AML/CFT Guideline for Licensed Corporations (2023)). Suspicious Transaction Reports have no fixed frequency — they must be filed as soon as suspicion crystallises — and are lodged via the Joint Financial Intelligence Unit (JFIU) e-STREAMS portal (Joint Financial Intelligence Unit (JFIU)). The FATF Travel Rule applies to VATP-facilitated transfers of virtual assets at or above the applicable threshold, and sanctions screening is against both the UN Security Council lists and the Hong Kong CEDB consolidated list (CEDB, Consolidated Sanctions List).

5. Strategic takeaway for TSM-style issuers

For a small, single-mandate tokenized-metals issuer, the most efficient Hong Kong path in 2026 is typically a Type 9 asset-management licence managing a professional-investor tokenized metals fund, with third-party LBMA-tier physical custody, secondary trading on an existing SFC-licensed VATP rather than a self-operated venue, and settlement in a foreign USD-referenced stablecoin distributed by a permitted offeror — deferring both the full VATP capital stack and the HKMA stablecoin licence to a later, scaled stage. This aligns cost with revenue while keeping the door open to full retail authorisation once the ASPIRe dealer and custodian regimes are legislated and operational.

Singapore — Regulatory Perimeter: MAS as Single Regulator, PSA and SFA in Parallel

1. The PSA perimeter: digital payment tokens and stablecoins

The Payment Services Act 2019 is the primary statute for digital payment tokens (DPTs) and stablecoins in Singapore. It captures any “digital payment token service” — dealing in DPTs, facilitating exchange between DPTs and fiat, custody of DPTs, cross-border money transfers using DPTs, and arranging DPT transactions — and requires either a Standard Payment Institution (SPI) or Major Payment Institution (MPI) licence. The DPT-service class is not a self-standing licence but an activity that must be added to an SPI or MPI licence (MAS, Licensing for Payment Service Providers). MAS also brought stablecoin issuance under a dedicated single-currency stablecoin (SCS) framework in 2023 that sits inside the PSA architecture, with reserve, redemption and disclosure obligations aimed at the ten-largest-currency stablecoins pegged to G10 fiat.

2. The SFA perimeter: tokenized capital markets products

The Securities and Futures Act 2001 captures tokens whose economic substance is a share, debenture, unit in a collective investment scheme, business trust unit, or derivatives contract. MAS's long-standing position, restated in the Guide to Digital Token Offerings and the more recent Guide on Tokenisation of Capital Markets Products, is that form does not override substance: a token is judged by the rights it confers on the holder, not by its technical wrapper. If those rights make it a capital-markets product, the full SFA regime applies — prospectus, licensing of intermediaries, market-conduct rules (MAS, Guide on the Tokenisation of Capital Markets Products (PDF)). For tokenized metals this matters because a token that promises delivery of a specific bar or a proportional claim on a pooled inventory is often close to a collective-investment-scheme unit under SFA definitions.

3. Single regulator, unified conduct rules

Unlike the United States or the UK, Singapore does not split securities, commodities and payments across multiple agencies. MAS acts as central bank, payments regulator, securities regulator and insurance regulator simultaneously, which produces an unusually coherent set of cross-domain rules (AML/CFT under the Corruption, Drug Trafficking and Other Serious Crimes Act, technology-risk management under the MAS TRM Guidelines, outsourcing under MAS Notice PS-N02). The trade-off is concentration: a single MAS reservation on a business model — for example, DPT retail marketing restrictions from June 2023 — applies across every regulated channel at once.

The DPT-Service Licence — SPI, MPI, Capital Requirements and the 2025 Guidelines

1. SPI vs MPI: threshold-driven choice

The PSA distinguishes SPI and MPI licences by activity volume. An SPI is permitted below the thresholds of S$3 million/month per payment service (or S$6 million/month for two or more services combined) and holds no more than S$5 million in relevant customer money. Above those thresholds a firm must upgrade to an MPI, which carries higher base capital, a permanent Singapore office and a full compliance establishment. For anything at institutional scale — particularly a tokenized commodities settlement product intended for wholesale flow — the MPI is effectively the only path, because volumes cross the SPI ceiling on day one (MAS, Licensing for Payment Service Providers).

2. Capital, controllers, resident management

Base capital for an MPI is S$250,000. MAS additionally requires that the applicant has at least one executive director resident in Singapore, that key persons pass a fit-and-proper assessment covering competence, honesty, financial integrity and reputation, and that the firm maintains adequate security deposits where relevant customer money is held. Controllers — any person holding 20% or more of the applicant — are subject to separate MAS approval and must supply source-of-wealth evidence and criminal-record disclosures. The MAS Notice PSN01 risk-based approach to AML/CFT applies from day one.

3. Custody, safeguarding and reporting

A DPT-service-licensed MPI holding customer digital assets must comply with the Notice PSN04 rules on segregation of customer assets, safeguarding of at least 90% of customer DPTs in cold storage, and maintaining a trust arrangement or bank account for fiat balances. Continuous reporting includes semi-annual returns, ad-hoc reporting of significant incidents (technology failures, cyber breaches, material customer complaints) and annual audited accounts filed with MAS. The October 2025 revision of the licensing guidelines tightened the “custody adequacy” test and clarified expectations for smart-contract-based custody (MAS, PS-G01 Licensing Guidelines (Oct 2025 PDF)).

SFA Rules for Tokenized Capital Markets Products — Prospectus, CMS Licence, Custody

1. Prospectus obligations under SFA Part 13

Any offer of securities, units in a collective investment scheme, or debentures to the Singapore public must be made under a prospectus registered with MAS, unless an exemption applies. The classic exemptions used by tokenized-asset issuers are small offers (S$5 million or less over 12 months), private-placement offers (no more than 50 persons in 12 months), and accredited-investor / institutional-investor offers. For tokenized metals structured as CIS units, the prospectus route is required for retail distribution, and MAS additionally requires an approved trustee and a licensed fund manager (MAS, Guide on the Tokenisation of Capital Markets Products (PDF)).

2. CMS licence for arrangers and dealers

A firm that deals in, arranges, advises on or manages tokenized capital-markets products in Singapore requires a Capital Markets Services licence under the SFA. The regulated activities most relevant to a tokenized-metals structure are dealing in capital markets products, fund management (for a pooled tokenized product), and providing custodial services for capital markets products. Capital requirements for a CMS licence are activity-specific — typically S$250,000 base capital for dealing in securities, higher for fund management — and MAS applies a substance-over-form test that rejects “shell” Singapore entities used to passport into Southeast Asia.

3. Custody and record-keeping for tokenized products

MAS's tokenization guide is explicit that records held on distributed ledgers do not automatically satisfy statutory recordkeeping requirements. A licensed intermediary must maintain an authoritative internal record of customer holdings that can be reconciled with on-chain data, must be able to respond to MAS reporting requests independently of the ledger, and must ensure that custody arrangements — whether self-custody smart contracts or a licensed custodian — meet the SFA standard of “fit and proper arrangements to safeguard customer assets”. For a tokenized-metals structure the underlying physical metal must additionally be held under a chain of custody documented in accordance with LBMA Good-Delivery-equivalent standards where applicable.

2025–2026 Developments — Project Guardian, Tokenized Fund Operationalisation, Retail Access

1. Project Guardian and the tokenized-funds pathway

Project Guardian is MAS's public-private consortium testing tokenized asset markets under controlled real-transaction conditions. Its participants include major global banks, asset managers and infrastructure providers, working across four workstreams — fixed income, foreign exchange, funds, and wealth management. In 2025 MAS published the Operationalising Tokenised Funds report, which sets out expected operating models, risk controls and audit trails for a Singapore-domiciled tokenized fund (MAS, Operationalising Tokenised Funds (PDF)). The report is not binding regulation, but it is the closest thing Singapore has to a “preferred model” blueprint and materially reduces uncertainty for an issuer intending to launch a tokenized commodities fund domestically (MAS, Project Guardian).

2. Tokenized funds and the FIRA guidance

Alongside Project Guardian, MAS has advanced Financial Sector Development Fund grants for tokenization infrastructure and continues to refine the Financial Institutions (Rules and Applications) framework for tokenized products. The practical effect is that a Singapore-licensed fund manager can now structure a tokenized metals or commodities fund with a workable operating model that MAS has effectively pre-approved at the pattern level — unit registry mirrored on-chain, off-chain transfer agent as system of record, redemption and NAV strike aligned with traditional-fund cadence.

3. Retail access and the “wealthy accredited investor” regime

Singapore continues to distinguish sharply between retail and accredited investors. The 2023 DPT retail-marketing restrictions — no incentives, no credit facilities, no financing of purchases — remain in force, and MAS shows no appetite to open the mass-market retail channel to novel tokenized commodity products. The workable path remains accredited investors (annual income S$300,000+, net personal assets S$2 million+, or financial assets S$1 million+) and institutional investors. For tokenized metals aimed at wholesale trading houses, refineries, family offices and licensed dealers, this restriction is not commercially binding — the target audience is accredited by construction.

Practical Path for a Tokenized-Metals Issuer — Singapore Structure, Timeline, Cost

1. Structural choices at inception

The primary structural choice for a tokenized-metals issuer in Singapore is between (a) an SFA-regulated tokenized fund holding physical metals via a licensed custodian, distributing units on-chain to accredited and institutional investors, and (b) a DPT-only wrapper where the token is designed to fall outside the CIS definition — effectively an allocated-bar warehouse receipt token where the holder has a direct legal claim on identified inventory. Option (a) is heavier but opens the accredited retail channel and Project Guardian ecosystem; option (b) is lighter but restricts the token to institutional counterparties and requires very careful legal drafting to avoid inadvertent CIS status.

2. Licensing runway and capital budget

A realistic runway for MPI+DPT approval is 12–24 months from filing, with an additional 6–12 months for a parallel or subsequent CMS licence for the metals-token entity. Applicants must fund the Singapore entity to base capital (S$250,000 MPI + S$250,000 CMS for dealing in securities), plus working capital of at least 12 months of operating cost, plus a compliance and technology-risk-management establishment (chief compliance officer, MLRO, technology risk officer). Total two-year budget for a licensed Singapore entity typically lands in the S$3–5 million range before any commercial revenue.

3. Distribution and market posture

A licensed Singapore tokenized-metals entity distributes to accredited and institutional investors in Singapore, and can passport into other Asia-Pacific markets under reciprocity arrangements — MAS's Financial Services and Markets Act 2022 and cross-recognition memoranda with Hong Kong SFC, Japan JFSA and Australian ASIC provide the practical framework. Retail distribution requires either full prospectus registration and CIS authorisation or restricting the retail wrapper to a listed vehicle on SGX. The most productive commercial focus is the institutional layer: banks, insurance treasury desks, family offices, licensed commodity trading houses and refineries operating in Singapore's substantial precious-metals and base-metals trade.

Japan — JFSA: Payment Services Act, FIEA and a Bank-Only Stablecoin Model

1. Payment Services Act — crypto-assets and EPIs

The PSA, as amended in 2020 and again in 2022 and 2025, distinguishes two categories: crypto-assets (Article 2, paragraph 5) — digital tokens usable as a means of payment or exchange, not denominated in a national currency — and Electronic Payment Instruments (Article 2, paragraph 5-2), added by the June 2023 amendments — digital tokens denominated in or referencing a national currency and issued as a means of payment. Stablecoins pegged to yen or foreign fiat are EPIs. Crypto-assets are supervised through the Crypto-Asset Exchange Service Provider (CAESP) registration regime under Article 63-2 PSA. EPIs are supervised through a separate Electronic Payment Instruments Business (EPIB) licence for intermediation and through a bank / trust company / fund-transfer service provider structure for issuance.

2. Financial Instruments and Exchange Act — ERTRs

Where a token represents a stake in a collective investment scheme, a share, a bond, or another transferable right that would be a Type 1 or Type 2 security under FIEA if issued in traditional form, the token is an Electronically Recorded Transferable Right (ERTR) (FIEA Article 2, paragraph 3). ERTRs are treated as Type 1 securities under FIEA and are subject to the full prospectus, marketing, and distribution rules that apply to traditional securities in Japan. Issuance typically requires a securities registration statement (Kaji) unless a private-placement exemption applies, and distribution requires a Type 1 Financial Instruments Business Operator (FIBO) licence.

3. Territorial scope

The PSA and FIEA both apply to persons who solicit or provide services to persons in Japan. Reverse solicitation is recognised as a defence in limited circumstances but is applied conservatively by the JFSA. Foreign entities operating a crypto-asset exchange or an EPI intermediation business face the same authorisation requirements as domestic entities. There is no fast-track passport arrangement with other jurisdictions.

Japan — Licence Categories: CAESP, EPIB, FIBO and Fund Transfer Service Provider

1. CAESP registration

Registration is required under PSA Article 63-2 for any person carrying on crypto-asset exchange business in Japan, defined as (i) sale and purchase of crypto-assets, (ii) intermediation, agency or brokerage of such sale and purchase, (iii) management of user money or crypto-assets in connection with (i) or (ii), or (iv) issuance of crypto-assets to users. Minimum capital: JPY 10 million with net assets of not less than JPY 0. Segregation of user assets is required: crypto-assets held for users must be held in cold wallets to the maximum extent practicable (guideline: at least 95% in cold wallets), and any hot-wallet holdings must be backed by the operator's own assets on a one-for-one basis. Governance requirements include internal control, cybersecurity, business continuity, and JFSA-approved AML/CFT programme.

2. Electronic Payment Instruments Business (EPIB) licence

The EPIB licence, introduced by the June 2023 PSA amendments, is required for any person that (i) exchanges EPIs for national currency or for other EPIs, (ii) intermediates such exchange, or (iii) manages EPIs on behalf of users. EPIB licensees are supervised by the JFSA and, for banking-related activities, by the relevant Local Finance Bureau. EPIB licensees are subject to AML/CFT programme obligations, user-asset segregation, and information-security standards similar to those applied to CAESPs. The EPIB licence is required by intermediaries even where the EPI issuer is a bank or trust company.

3. Fund Transfer Service Provider (FTSP) licence and stablecoin issuance

Under the amended PSA, stablecoin issuance is restricted to banks, trust companies, and fund-transfer service providers. The FTSP category (Article 37 PSA) itself has three sub-tiers: Type I (unlimited transaction value), Type II (up to JPY 1 million per transaction) and Type III (up to JPY 50,000 per transaction). The August 2025 grant of a Type II FTSP licence to JPYC Inc. was the first ever stablecoin-issuer licence in Japan under the 2023 amendments and established the market template for yen-denominated stablecoins. Foreign trust-type stablecoins have been recognised as EPIs and eligible for distribution in Japan since 1 June 2026, subject to equivalence assessment of the issuer's home regime.

4. FIBO licence for security-token distribution

Distribution of ERTRs requires a Type I FIBO licence (for handling of Type 1 securities on a principal or intermediation basis) or, for certain private placements, a Type II FIBO licence. Minimum capital requirements: Type I FIBO JPY 50 million, Type II FIBO JPY 10 million. Governance, senior-manager approval, and market-conduct rules under FIEA and JFSA guidelines apply. Custody of security tokens on a discretionary basis additionally requires an Investment Management Business (IMB) licence.

5. Electronic Composite Information Service Business (ECISB) — new 2025 category

The 2025 amendments introduced a lighter-touch intermediary category, the Electronic Composite Information Service Business (ECISB) and its narrower sibling ECISBO, to cover aggregators and information-only intermediaries that do not themselves execute trades or hold user assets. This category is intended to enable comparison, discovery and non-executing information services without triggering the full CAESP or EPIB obligations. It is unlikely to be the right licence category for a tokenized-metals issuer itself, but it may be relevant for platform partners that intend to list the token informationally.

Japan — Tokenized Commodities and Metals: Classification and Structuring

1. Direct-claim structure — crypto-asset classification

Where the token grants a direct claim on an allocated quantity of physical metal, with no fiat peg and no promoter's promise of profit, the token is likely a crypto-asset under PSA Article 2, paragraph 5. The issuer must be a CAESP-registered entity (or must appoint a CAESP-registered exchange as distributor). The metal-custody arrangement is governed contractually between the issuer and the vault; the token itself is subject to the CAESP asset-segregation and cold-wallet rules. Sale, purchase and exchange of the token in Japan is a CAESP activity requiring registration by the counterparty carrying it out on a principal or intermediation basis.

2. Pooled fund structure — ERTR / FIEA classification

Where the token represents a pro-rata interest in a metal pool managed by a manager with discretion, the arrangement is a collective investment scheme under FIEA and the token is an ERTR. The manager requires an Investment Management Business licence; the fund itself requires a fund vehicle (typically an Article 63 exempted business or a Japanese investment trust under the ITA) or must be marketed via a private-placement exemption. Distribution of the ERTR requires a Type I or Type II FIBO licence.

3. Commodity-backed stablecoin structure — EPI classification

A token issued at a fixed ratio (one token per one troy ounce of gold, or a redemption promise at a yen-denominated NAV of the metal) may be classified as an EPI where its economic function is that of a payment or settlement instrument. Under the current regime EPI issuance is restricted to banks, trust companies and FTSPs — the same restrictive perimeter that applies to yen-denominated stablecoins. This severely constrains a metal-backed stablecoin structure targeted at Japanese retail: the issuer must be, or must be partnered with, a Japanese bank, trust or FTSP.

4. Foreign issuer — equivalence and distribution

From 1 June 2026 the JFSA has recognised foreign trust-type stablecoins as EPIs eligible for distribution in Japan, subject to equivalence assessment of the issuer's home-jurisdiction regulatory regime and the appointment of a Japanese-domiciled EPIB-licensed intermediary. This is the most promising channel for a foreign tokenized-metals issuer that has been structured as an EPI-equivalent in its home jurisdiction (for example a Wyoming SPDI-issued token or a Swiss FINMA-regulated stable token) — but requires an equivalence determination that the JFSA has so far granted sparingly.

Japan — 2025–2026 Developments: JPYC Licence, Foreign Equivalence and ECISB

1. JPYC Type II FTSP licence (August 2025)

JPYC Inc. received a Type II Fund Transfer Service Provider licence from the Kanto Local Finance Bureau in August 2025, becoming the first stablecoin issuer authorised in Japan under the 2023 PSA amendments. The Type II tier allows per-transaction values up to JPY 1 million. The licence established the market template for yen-denominated stablecoins and demonstrated that the JFSA's conservative approach to stablecoin issuers — segregated reserves, robust custody arrangements, strict AML/CFT programmes — is workable in practice.

2. Foreign trust-type stablecoin equivalence (1 June 2026)

The June 2026 amendments to the PSA and subordinate legislation opened the Japanese market to foreign trust-type stablecoins that qualify as EPIs. The framework requires (a) an equivalence assessment of the issuer's home-jurisdiction regulatory regime, (b) a Japanese EPIB-licensed intermediary, and (c) transaction limits and disclosures designed to protect Japanese retail users. This is the first significant opening of the Japanese market to foreign stablecoin issuers and is regarded as a structural change in the Japanese digital-asset framework, though early usage remains cautious.

3. ECISB / ECISBO intermediary category

The 2025 amendments introduced the Electronic Composite Information Service Business (ECISB) and Electronic Composite Information Service Business Operator (ECISBO) categories, providing a lighter regulatory posture for aggregators, comparators and information-only intermediaries that do not execute trades or hold user assets. This category enables new business models around discovery and comparison of digital-asset products without the full weight of CAESP or EPIB registration.

4. Ongoing JFSA supervisory focus areas

JFSA supervisory guidance throughout 2025 and 2026 has focused on (i) cybersecurity and cold-wallet segregation, (ii) AML/CFT programme adequacy, particularly in cross-border transactions, (iii) prevention of insider trading and market manipulation on crypto-asset exchanges, and (iv) consumer-suitability and risk-disclosure standards. Enforcement actions have been rare but material, typically resulting in business improvement orders (BIOs) rather than licence revocations.

Japan — Practical Path for a Tokenized-Metals Issuer

1. Path A — Distribution via Japanese CAESP partner (crypto-asset classification)

Structure the token as a direct claim on physical metal, obtain a legal opinion that the token is a crypto-asset under PSA Article 2, paragraph 5, and appoint a licensed Japanese CAESP as exclusive distributor to Japanese residents. The distributor takes on the customer-facing CAESP obligations (segregation, cold wallet, AML/CFT). The issuer avoids direct CAESP registration but contractually supports the distributor's compliance framework. Estimated legal and set-up cost: JPY 80–150 million. Timeline: 9–15 months (including CAESP listing due diligence).

2. Path B — EPI equivalence via foreign trust-type stablecoin route

Where the token has a strong stablecoin character (fiat-referenced fixed ratio, redemption at NAV), pursue the June 2026 foreign trust-type equivalence pathway. This requires (a) home-jurisdiction recognition of the issuer as a regulated stablecoin issuer, (b) equivalence assessment by the JFSA, and (c) appointment of a Japanese EPIB-licensed intermediary. Timeline: 18–30 months from first application. Cost: JPY 150–300 million. Ideal for issuers that already hold a robust home-jurisdiction stablecoin authorisation.

3. Path C — Direct Japanese CAESP registration

Establish a Japanese subsidiary and apply directly for CAESP registration under PSA Article 63-2. This is the highest-cost path (minimum capital JPY 10 million and typical build-out including cold-wallet infrastructure, cybersecurity, staffing and JFSA engagement of JPY 500–800 million) and takes 18–30 months. Justified only where Japan is expected to be a top-3 strategic market and where local presence is strategically necessary.

4. Path D — Fund-token (ERTR) via FIEA

Where the metal-token structure is more naturally a collective investment scheme (pooled interests, active management, rebalancing), issue the token as an ERTR under FIEA, appoint a Japanese Type I or Type II FIBO as distributor, and rely on private-placement exemptions where feasible. This path fits professional-only structures but is unsuitable for retail-scale distribution. Estimated cost: JPY 200–400 million. Timeline: 12–24 months.

5. Timeline and cost summary

Path A (CAESP-distributor for a crypto-asset-classified token) is the fastest and most cost-effective entry route: 9–15 months, JPY 80–150 million. Path B (EPI equivalence) is transformational but slow and expensive: 18–30 months, JPY 150–300 million. Path C (direct CAESP) is only justified with a very high level of strategic commitment. Path D (ERTR) is a niche route for professional-only fund-style products.

South Korea — Regulatory Perimeter: the FSC, FSS and the Virtual Asset User Protection Act

1. VASP registration under SFIA — real-name accounts and ISMS

Since September 2021, any entity providing virtual-asset exchange, custody or wallet services in Korea must register as a Virtual Asset Service Provider (VASP) with the Korea Financial Intelligence Unit (FIU, under the FSC), satisfying two structural gatekeeping requirements: an Information Security Management System (ISMS) certification from the Korea Internet & Security Agency, and, for platforms offering won-denominated trading, a real-name bank account partnership under which a licensed Korean bank verifies customer identity before enabling fiat deposits and withdrawals. These two gates have historically been the binding constraint on new-exchange entry, since only a small number of Korean banks have been willing to sponsor real-name account partnerships (FSC, FSC and FSS Hold Meeting to Review Registration of VASPs).

2. VAUPA — user-asset protection layered on top of registration

VAUPA does not replace SFIA registration; it adds substantive obligations for all registered VASPs: segregation of user deposits and virtual assets from the VASP's own assets, with user deposits held at a bank custodian and user virtual assets kept separate and traceable; at least 80% cold-storage of user virtual assets; mandatory insurance or reserve funds against hacking and system failure; 15-year record retention for transaction records; and criminal and administrative penalties for unfair trading (market manipulation, wash trading, insider/material-nonpublic-information misuse), with penalties scaling to a multiple of illicit gains and, in serious cases, life imprisonment (CryptoSlate, South Korea Virtual Asset User Protection Act).

3. FSC versus FSS: policy authority and supervisory execution

The FSC is Korea's top financial-policy authority, responsible for VASP registration approval, rulemaking under VAUPA and SFIA, and coordination with the National Assembly on pending digital-asset legislation. The FSS conducts inspection, examination and enforcement of registered VASPs' compliance with custody, segregation and cold-storage obligations, and refers serious violations for administrative or criminal sanction. A tokenized-commodity issuer engaging with the Korean market should expect both a policy-level FSC registration process and an ongoing FSS examination relationship (Financial Services Commission, English homepage, Financial Supervisory Service, English homepage).

South Korea Licence Categories: VASP Registration, Real-Name Bank Partnership and STO Recognition

1. VASP registration — the default gate

Any entity performing virtual-asset exchange, transfer, custody or wallet services for Korean users must register as a VASP with the FIU/FSC, filing corporate documentation, AML/CFT policies, ISMS certification, and (for exchanges) evidence of a real-name bank account partnership if won-fiat trading is offered. Non-bank-partnered VASPs may still register and operate crypto-to-crypto only platforms without fiat rails, a materially lighter registration path used by smaller or niche platforms.

2. Real-name bank account partnership — the binding constraint

For any platform wanting to serve Korean won deposits and withdrawals, a partner bank must agree to provide real-name verified accounts, following its own risk assessment of the exchange's AML controls, security posture and financial stability. This bank-gatekeeping step has been the primary reason only four exchanges (Upbit, Bithumb, Coinone, Korbit) operate at meaningful won-trading scale; banks have historically been reluctant to extend new partnerships, creating a de facto oligopoly at the fiat on/off-ramp layer of the market.

3. STO recognition under the Capital Markets Act (February 2023 guidelines)

On 5–6 February 2023, the FSC published guidelines distinguishing security tokens from other digital assets: a token is treated as a security under the Financial Investment Services and Capital Markets Act (FSCMA) where it confers rights such as dividends or residual-property claims consistent with the FSCMA's definition of an investment contract security, and can be recognised as a dematerialised (electronically registered) security under the Act on Electronic Registration of Stocks and Bonds, with a qualifying issuer able to act as its own account manager and issue directly without an intermediary broker-dealer. Non-security digital assets remain outside the FSCMA and fall instead under VAUPA/SFIA and the pending Digital Asset Basic Act (FSC, Security Tokens — press release, 6 February 2023).

Tokenized-Commodity Rules: STO Guidelines, the KRX Tokenized-Asset Marketplace and Security-Token Tests

1. The FSC's security-versus-non-security test for commodity-backed tokens

Under the February 2023 guidelines, a token is analysed under the FSCMA's investment contract security definition, focused on whether holders have a reasonable expectation of profit derived from the managerial efforts of the issuer or a third party, rather than a straightforward redemption right against a specifically identifiable physical asset. A tokenized-metals product offering pure allocated-metal redemption with no yield or profit-sharing component sits closer to a non-security digital asset regulated under VAUPA/SFIA; a version offering yield, staking, or pooled-trading profit-sharing on the metal pool is more likely to be pulled into FSCMA security-token treatment (Lee & Ko, The FSC's Announcement of the Guidelines on Security Tokens).

2. Dematerialised registration and issuer-as-account-manager

Where a tokenized-metals product is structured as a security token, the FSC's framework allows the issuer to register as its own account manager under the Act on Electronic Registration of Stocks and Bonds, issuing and recording token ownership directly on a distributed ledger without a securities-company intermediary — a meaningfully more direct issuance pathway than in most jurisdictions, though still subject to FSCMA prospectus, disclosure and investor- protection obligations (FSC, Security Tokens — press release, 6 February 2023).

3. KRX tokenized-asset marketplace and secondary-market ambitions

The Korea Exchange (KRX) has publicly explored building a regulated secondary market for tokenized securities, intended to give security-token holders (including potential holders of a tokenized-metals security token) a liquid, exchange-supervised venue rather than relying solely on OTC or platform-specific trading. As of mid-2026 this remains at the exploratory/ pilot stage rather than a live, generally available market, tracking alongside the broader legislative debate over the Digital Asset Basic Act and its STO provisions.

2025–26 Developments: The Digital Asset Basic Act, Won-Stablecoin Framework and STO Delay

1. Digital Asset Basic Act (DABA-KR) — introduced June 2025

Introduced by the ruling party on 10 June 2025, the Digital Asset Basic Act proposes shifting stablecoin-issuance oversight from the Bank of Korea to the FSC, lowering the minimum equity-capital requirement for a won-stablecoin issuer from KRW 5 billion to KRW 500 million (roughly USD 360,000), mandating full reserve backing and redemption rights, and requiring foreign issuers to establish a Korean branch or subsidiary and obtain an FSC licence on equal terms with domestic issuers. As of early 2026 the Act faces delay amid a dispute over the precise stablecoin capital and bank-ownership rules, with full implementation (including subordinate regulations) unlikely before 2027 (Nate News, Korea's Digital Asset Basic Act faces delay amid dispute over stablecoin rules).

2. Competing won-stablecoin bills and the bank-anchored model

Alongside DABA-KR, two further bills — the Value-Stabilised Assets Act (July 2025, KRW 5 billion capital floor, no interest payments to holders, monthly reserve disclosure) and the Payment Innovation Act (July 2025, more permissive treatment of foreign stablecoins via simple FSC registration) — compete with DABA-KR for the final legislative template. By late 2025, ruling and opposition parties converged on a “Korean-style stablecoin” model requiring domestic banks to hold at least 51% equity in any won-stablecoin issuer, targeting passage in an early-2026 extraordinary National Assembly session (The Cryptonomist, Korean Stablecoin Framework Advances Digital Asset Legislation).

3. STO legislative track delayed to 2027

The security-token (STO) amendments originally expected to formalise the February 2023 FSC guidelines into binding legislation have been split from the main DABA-KR track and pushed to take effect in 2027. Market participants are advised not to treat DABA-KR as the gating event for Korean market entry, and instead to plan compliance around the statutes actually in force today — VAUPA and the revised SFIA — while monitoring the STO track separately (Korea Crypto & Blockchain Law Blog, Korea's Digital Asset Basic Act Delayed).

Practical Path for a Korea-Facing Tokenized-Metals Product

1. Structure and characterisation choice

The first decision is whether the tokenized-metals product will carry any yield, staking, or pooled-trading profit-sharing feature. A pure allocated-metal redemption token, with no such feature, is the more tractable non-security path: it can be evaluated for listing directly by one of the four real-name-bank exchanges (Upbit, Bithumb, Coinone, Korbit) under existing VAUPA/SFIA rules, without a separate FSC securities registration. Any yield or profit-sharing feature should be assumed to require FSCMA security-token registration, dematerialised-securities recording, and likely a KRX marketplace listing pathway once mature.

2. Filing and listing sequence

Month 0–3 — legal characterisation opinion (non-security vs. FSCMA security token), engagement of Korean counsel, initial outreach to real-name-bank exchanges for listing-review criteria; Month 3–8 — exchange-level listing review (AML/security audit of the issuer, ISMS-equivalent technical review, reserve-verification documentation for the metal-backing pool), FSC/FIU coordination if any VASP registration is required on the issuer side; Month 8–14 — listing approval, integration with the exchange's custody and settlement systems, launch of won-denominated trading; Month 14–18 — ongoing FSS examination cadence begins, ongoing compliance with 80% cold-storage, segregation and 15-year record-retention obligations.

3. Cost envelope and distribution posture

Korea offers no direct token-issuance passport of its own — the token must be issued from a primary domicile and then listed into Korea. Two-year all-in cost for the non-security VASP-listing path sits in the USD 1–2.5 million range: Korean legal and characterisation opinions (USD 150–300k), exchange listing and technical-integration fees (USD 200–500k), reserve-verification and custody documentation tailored to Korean exchange requirements (USD 150–350k), and ongoing compliance/local-representative staffing (USD 400–900k). The FSCMA security-token path adds prospectus, account-manager registration and KRX-marketplace integration costs on top, and should be budgeted materially higher and later, pending the 2027 STO legislative track (Financial Services Commission, English homepage).

UAE — Regulatory Perimeter: VARA, ADGM FSRA, DFSA and SCA in Parallel

1. VARA: Dubai's dedicated virtual-asset authority

VARA was established in 2022 under Dubai Law No. 4 of 2022 as the world's first dedicated virtual-asset regulator with statutory authority over the Emirate of Dubai (excluding DIFC). Its rulebook is the most detailed dedicated crypto framework in any major jurisdiction, covering seven regulated activities — advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, and virtual asset issuance — each with a bespoke rulebook. VARA also publishes cross-cutting compendia covering market conduct, technology and information, and company obligations. The VA Issuance Rulebook, most recently amended on 19 May 2025, sets the framework for token issuance including tokenized commodities (VARA, Virtual Asset Issuance Rulebook (19 May 2025 PDF)).

2. ADGM FSRA: Abu Dhabi's common-law framework

The ADGM Financial Services Regulatory Authority supervises financial services in the free-zone jurisdiction of Abu Dhabi Global Market under an English-law common-law statutory system. FSRA has published progressive digital-asset frameworks since 2018 and covers digital security tokens (regulated as securities under the FSMR), accepted virtual assets (a whitelist regime), and as of 2025 a finalised Fiat-Referenced Token framework for stablecoins. In November 2025 at Abu Dhabi Finance Week, ADGM FSRA presented major enhancements including a formal staking framework, an updated custody regime, and public consultation on tokenized funds (ADGM, FSRA Digital Assets Framework Enhancements (Nov 2025)).

3. DFSA and SCA: parallel channels

The Dubai Financial Services Authority (DFSA) regulates financial services in the DIFC free zone and licenses crypto tokens under its investment token and crypto-token regimes; the federal Securities and Commodities Authority (SCA) handles virtual assets outside the free zones, typically in the northern Emirates. For an institutional tokenized-metals issuer VARA (Dubai) and FSRA (ADGM) are the two commercially relevant regulators; DFSA is used for wholesale-focused DIFC-domiciled structures and SCA is rare in practice.

VARA Licensing — Seven Regulated Activities, VA Issuance Rulebook, Capital and Custody

1. The VA Issuance Rulebook (May 2025 revision)

The VA Issuance Rulebook, most recently amended on 19 May 2025, is the operative document for anyone issuing a virtual asset from Dubai or targeting Dubai investors. It covers authorisation, general obligations, categorisation, marketing, and specific rules for asset-referenced virtual assets (ARVAs) and fiat-referenced virtual assets (FRVAs). A tokenized-metals product falls into the asset-referenced virtual asset category, which imposes reserve requirements, redemption obligations, prohibition on interest payments, and enhanced disclosure standards (VARA, VA Issuance Rulebook (May 2025 PDF)).

2. Capital requirements and safeguarding

Capital floors are activity-specific. The VA Issuance licence carries a base paid-up capital of AED 1.5 million plus liquid capital covering at least six months of operating expenses and, for asset-referenced tokens, additional own-funds calculated as a percentage of outstanding token supply. The Broker-Dealer licence requires AED 1.5 million; Custody AED 3 million (higher due to fiduciary risk). Firms must additionally maintain a professional-indemnity insurance policy calibrated to the size of assets under supervision.

3. Marketing, promotions and cross-border reach

The Marketing Regulations under the VARA compendium apply to any communication that promotes a virtual asset service or product to persons in Dubai, whether the promoter is licensed in Dubai or not. Unlicensed cross-border marketing is a regulatory breach with enforcement authority to impose monetary penalties and issue cease-and-desist orders. For a tokenized-metals issuer this means that even listing on a global exchange requires either a VARA licence or an assurance that Dubai investors are excluded via IP geo-blocking, KYC-address filtering and clear jurisdiction disclaimers.

ADGM Digital Assets Framework — Accepted Virtual Assets, Digital Security Tokens, FRT

1. FSMR classification and the whitelist regime

ADGM's framework rests on the Financial Services and Markets Regulations 2015 (FSMR) as applied to digital assets by FSRA guidance. A token whose economic rights mirror those of a share, debenture, or unit in a collective investment fund is a digital security token subject to the full securities regime — issuance under a prospectus, dealing by a licensed intermediary, custody by a licensed custodian. A token that is not a security but is used for investment or payment is an accepted virtual asset; FSRA maintains a public whitelist of assets that authorised firms may deal in, and the addition of a new asset to the list requires FSRA approval.

2. Fiat-referenced token framework (2024–2025 finalisation)

The Fiat-Referenced Token framework, finalised in stages through 2024 and 2025, creates a dedicated stablecoin licence class for tokens pegged to a single fiat currency. Requirements include full one-for-one reserve backing in high-quality liquid assets, monthly independent attestation, holder-face-value redemption, and a prohibition on interest payment to holders. This framework does not directly cover commodity-backed tokens — those are treated as either digital securities (if they embed investment rights) or as commodity-referenced arrangements outside the FRT regime. For a tokenized-metals issuer the practical implication is that any stablecoin used for settlement inside the product must itself be FRT-licensed if issued in ADGM or licensed elsewhere under equivalent standards.

3. Staking framework, custody and 2025 enhancements

At Abu Dhabi Finance Week in November 2025, FSRA presented a formal staking framework (setting out permissible arrangements for firms offering staking-as-a-service) and updated custody expectations covering multi-signature schemes, hardware-security modules, insurance, and business-continuity planning (ADGM, FSRA Digital Assets Framework Enhancements (Nov 2025)). The framework also introduced clearer guidance on tokenized funds, aligning ADGM with parallel Singapore and Hong Kong developments.

2025–2026 Developments — VARA Revisions, ADGM Enhancements, DIFC Tokenization

1. VARA rulebook revision (May 2025)

The May 2025 revision of the VA Issuance Rulebook tightened definitions around asset-referenced virtual assets, clarified the perimeter for tokenized real-world assets (including commodities), and added proportionality provisions for issuers below certain thresholds (VARA, VA Issuance Rulebook (May 2025 PDF)). VARA also revised its Marketing Regulations and issued updated guidance on advertising standards, targeting the enforcement gap around social-media promotion.

2. ADGM FSRA enhancements (November 2025)

The ADGM Finance Week announcements in November 2025 covered five substantive framework enhancements: the fiat-referenced token framework was completed, a staking framework was published, custody standards were updated for institutional multi-signature and MPC arrangements, tokenized-funds guidance was consulted on, and a formal cross-border recognition mechanism with certain other digital-asset regulators was proposed (ADGM, FSRA Digital Assets Framework Enhancements (Nov 2025)).

3. DIFC investment token and DFSA activity

The DFSA's investment token framework, originally published in 2021 and updated multiple times since, remains the operative regime for DIFC-domiciled tokenized-security issuers. During 2025 the DFSA consulted on additional rules for tokenized funds and for the treatment of tokenized real-world-asset custody, emphasising alignment with the ADGM and VARA frameworks to reduce cross-Emirate arbitrage. For an institutional tokenized-metals issuer, DIFC is a credible but less-used third option: heavier common-law compliance overhead than VARA, but offering the DIFC court's English-law dispute-resolution advantage.

Practical Path for a Tokenized-Metals Issuer — UAE Domicile, VARA vs ADGM, Timeline

1. VARA vs ADGM: choosing a domicile

VARA is preferable when the product is token-native and distribution is through crypto-native exchanges and custodians. Its rulebook is dedicated to virtual assets, its licence categories map cleanly to digital-asset business lines, and its licensee ecosystem is heavily crypto-industry-focused. ADGM FSRA is preferable when the product is security-token-native and distribution is through traditional-finance channels (banks, asset managers, family offices). Its common-law framework maps cleanly onto existing securities-industry practice, and its ecosystem includes many traditional-finance firms with digital-asset capabilities.

2. Licensing timeline and cost budget

Both VARA and ADGM FSRA target licensing timelines of 9–18 months from initial engagement to final approval. The application process runs through pre-application dialogue, formal application submission (with detailed business plan, risk-management framework, technology and cyber-security documentation, AML/CFT policies, and financial projections), regulator review and interviews, and finally licence grant with any specific conditions. Capital-plus-operating-cost budget for a two-year runway with multiple activity licences typically lands in the USD 3–6 million range for either VARA or ADGM.

3. Distribution posture and cross-border strategy

A UAE-licensed tokenized-metals issuer can distribute freely to counterparties in its home Emirate and, with appropriate documentation, to counterparties in other Emirates and internationally. Cross-border marketing into other jurisdictions (Singapore, Hong Kong, EU) requires either equivalence recognition or local supplementary licensing — there is no automatic global passport for a UAE digital-asset licence. For institutional distribution into the GCC and broader Middle East region, a UAE base is materially advantageous; for global institutional distribution the UAE base must be supplemented by additional licensing in target markets.

Switzerland — Regulatory Perimeter: FINMA as Single Regulator Under FinMIA, FinSA and the DLT Act

1. Three token classes: payment, utility, asset

FINMA's 2018 ICO Guidelines, restated and refined through subsequent guidance, distinguish three functional token classes: payment tokens (used as means of payment, subject to AML rules under the Anti-Money Laundering Act), utility tokens (functional access to a service, typically outside financial-market regulation), and asset tokens (representing debt or equity claims, treated as securities under FinMIA and FinSA). Hybrid tokens are treated under the highest-category rules that apply. A tokenized-metals product with a delivery right, redemption feature or profit participation almost always falls into the asset-token bucket and triggers the securities perimeter (FINMA, FinTech authorisation overview).

2. DLT Act and ledger-based securities

The DLT Act (Federal Act on the Adaptation of Federal Law to Developments in Distributed Ledger Technology) entered into force in stages during 2021 and introduced two key changes: the concept of ledger-based securities under the revised Code of Obligations Art. 973d (permitting native issuance of securities on a distributed ledger without a paper certificate or central securities depository), and a new licence category, the DLT trading facility, under FinMIA Art. 73a ff. The result is a coherent legal stack in which a token can be a Swiss security in its own right, transferable and settled on-chain, without needing a wrapper structure (FINMA, Licensing as a DLT trading facility).

3. Single regulator, integrated conduct rules

FINMA supervises banks, securities firms, insurers, asset managers, financial-market infrastructures and collective investment schemes. That concentration produces an unusually integrated rulebook: AML/CFT under the Anti-Money Laundering Act (AMLA), prudential rules under FinIA, market-conduct rules under FinSA, and technology-neutral licensing under FinMIA all overlap coherently. FINMA also runs a pre-application dialogue mechanism — interested parties can present a project to FINMA before filing, materially reducing failed-application risk. This is the standard practice for any novel tokenized product structure.

Licence Categories — DLT Trading Facility, Fintech Licence, Securities Firm, CISA Fund Manager

1. DLT trading facility licence

Under FinMIA Art. 73a ff., a DLT trading facility is a multilateral venue that admits participants (including retail customers), holds DLT securities in central custody, or clears and settles transactions in DLT securities. The facility must be a Swiss legal entity with registered office and head office in Switzerland, and licensing is subject to a mandatory audit-firm audit before licence grant. FINMA publishes formal application guidelines and updated audit-report templates — the September 2025 revision of the audit-report guidelines is the current baseline (FINMA, DLT trading facility page). This licence is required for anyone operating a metals-token secondary market with pooled participants; it is not required for a bilateral OTC issuer.

2. Fintech licence (Art. 1b Banking Act)

The fintech licence, introduced in 2019, is a lighter-touch prudential category for institutions accepting public deposits up to CHF 100 million, provided those deposits are not invested and no interest is paid. Minimum capital is CHF 300,000 or 3% of accepted deposits, whichever is higher. For a tokenized-metals issuer, the fintech licence is the appropriate vehicle if the token model involves holding customer fiat balances to fund gold or silver purchases — that is, a stablecoin-style pass-through structure. It is not required if the token is a pure asset-token security without deposit-taking.

3. Securities firm, CISA fund manager, banking licence

A firm that deals in securities for the account of clients, arranges primary issuance, or provides custody for securities (including tokenized securities) requires a securities firm licence under FinIA, with capital and organisational requirements calibrated to activity scope. A tokenized metals product structured as a collective investment scheme requires a CISA licensed fund manager and, depending on structure, approval as an open-ended (SICAV) or closed-ended (SICAF) fund. Where deposit volume exceeds CHF 100 million or interest is paid, a full banking licence is required. FINMA applies a substance-over-form analysis and will reject structures designed to avoid the applicable licence category (FINMA, Authorisation categories).

Rules for Tokenized Commodities — Asset Tokens as Securities, Custody, AML Overlay

1. Asset tokens are securities; ledger-based securities under Art. 973d CO

Under FINMA's ICO Guidelines and the DLT Act amendments, an asset token representing a claim on physical metal — whether a proportional interest in pooled inventory, a delivery right against a specific bar, or a profit-participation right — is a security for the purposes of FinMIA and FinSA. Since 2021, such securities can be issued natively on a distributed ledger as ledger-based securities under Code of Obligations Art. 973d, with transfer effected on the ledger and no physical certificate or central securities depository required. This makes Switzerland one of the very few jurisdictions where a tokenized commodity right can be a legally native on-chain security rather than a wrapper of an off-chain instrument.

2. Prospectus, custody and market-conduct rules under FinSA

A public offer of asset tokens to Swiss investors triggers FinSA prospectus obligations, with a Prospectus Office reviewing and approving the prospectus before publication. Exemptions apply for offers to professional or institutional clients, offers below CHF 8 million over 12 months, or offers to fewer than 500 investors. Custody of asset tokens for third parties requires a licensed custodian — either a bank, a securities firm, or a fintech-licensed institution with permitted scope. Market-conduct rules on suitability, appropriateness, conflict-of-interest disclosure and best execution apply from day one.

3. AML overlay: payment-token classification and travel rule

Even where a metals token is classified as an asset token, its payment functionality — the ability to transfer economic value between wallets — brings it within the scope of the Anti-Money Laundering Act when facilitated by a financial intermediary. VASP-equivalent services (exchange, custody, transfer) require SRO or FINMA affiliation for AML purposes. FINMA's Guidance 07/2024 on stablecoins, published in July 2024, further clarified that stablecoin issuers accepting public funds require a banking or fintech licence and that the underlying reserves must satisfy customer protection standards (FINMA, Stablecoins guidance 07/2024). For a tokenized-metals product with a stable-value peg to a fiat currency, the stablecoin guidance applies in parallel to the asset-token analysis.

2025–2026 Developments — Stablecoin Guidance, DLT Venues Live, Institutional Adoption

1. FINMA Guidance 07/2024 on stablecoins

In July 2024 FINMA published Guidance 07/2024 on stablecoins, addressing the classification and prudential treatment of fiat-referenced tokens. The key clarification: a stablecoin that gives the holder a redemption claim against the issuer is a deposit requiring a banking or fintech licence; a stablecoin structured as a fund unit falls under CISA; and stablecoin holders are counted as financial intermediary customers for AML purposes, requiring the issuer to identify each holder. This has direct implications for a metals-token issuer if the token's economic behaviour resembles a stable-value claim (FINMA Stablecoins Guidance 07/2024).

2. DLT trading facilities and secondary market infrastructure

BX Digital received a DLT trading facility licence in 2024, joining the earlier SIX Digital Exchange (SDX) in the secondary-market infrastructure layer. The audit-report template guidelines were refreshed in September 2025, tightening expectations on cyber-risk, custody governance and business-continuity documentation for applicants. FINMA also published updated participation-declaration templates (B2, B3) in mid-to-late 2025, standardising the disclosure of qualified holdings and directorship mandates (FINMA DLT documentation library).

3. Institutional adoption and cross-border alignment

Swiss banks — UBS, Sygnum, SEBA, Amina, Hypothekarbank Lenzburg, Zuger Kantonalbank — are now among the most active tokenization service providers globally. Cross-border alignment with the EU's MiCA regime is achieved not by mirroring MiCA but by the recognised equivalence of the Swiss framework: Swiss-issued asset tokens sold into the EU under FinSA prospectus rules and cross-border passporting under bilateral arrangements. FINMA has also signalled coordination with the Bank for International Settlements Innovation Hub on tokenized-cash and CBDC experiments through Project Helvetia and Project Agorá.

Practical Path for a Tokenized-Metals Issuer — Swiss Structure, Timeline, Cost

1. Entity form and cantonal choice

The default legal form for a Swiss tokenized-metals issuer is an Aktiengesellschaft (AG) with minimum share capital of CHF 100,000 (of which CHF 50,000 must be paid in). A GmbH with CHF 20,000 minimum capital is possible for smaller structures but rarely used for regulated entities. Canton choice matters for tax and ecosystem: Zug hosts the largest concentration of tokenization firms (Crypto Valley), Zurich anchors the banking and DLT-venue infrastructure, Geneva is the traditional commodity-trading hub. Cantonal corporate tax rates vary from ~11.9% (Zug) to ~19.7% (Geneva) in 2025.

2. Licensing runway and capital budget

A realistic runway for a Swiss securities-firm licence is 12–18 months from filing, with an additional 3–6 months for the FinSA prospectus review. The applicant must fund the Swiss entity to base capital (typically CHF 1.5 million for a securities firm, more if custody activities are included), plus a compliance and technology-risk-management establishment (chief compliance officer, chief risk officer, IT-risk officer, all Swiss-resident). Pre-application dialogue with FINMA (typical duration 3–6 months) is strongly recommended and materially reduces application friction. Total two-year budget for a licensed Swiss entity typically lands in the CHF 3–6 million range before commercial revenue.

3. Distribution and market posture

A licensed Swiss tokenized-metals entity distributes to Swiss professional and institutional investors without prospectus, and to Swiss retail investors only under an approved FinSA prospectus. Cross-border distribution into the EU is possible under FinSA equivalence with EU prospectus rules (subject to notification) or via a MiCA-authorised affiliate. The commercial opportunity is the intersection of Switzerland's traditional strength in physical commodity trading (Geneva and Zug), the institutional depth of Swiss private banking, and the maturity of the Swiss DLT and tokenization ecosystem — a combination no other European jurisdiction currently offers at the same level.

Liechtenstein — Regulatory Perimeter: The FMA, the TVTG and the Token Container Model

1. The Token Container Model

The TVTG's central conceptual innovation is the Token Container Model: a token is legally treated as a container that can hold one or more rights, including rights over physical goods, financial instruments, currencies, ledger-based securities, licences, memberships or any other private-law entitlement recognised under Liechtenstein civil law. The token is not itself a right — it is a technology-neutral wrapper. This decouples token functionality from token substance and provides a solid legal foundation for tokenized real-world assets, including physical metals: the rights embedded in the token flow directly from the property-law regime, and civil-law enforcement (courts, succession, insolvency) proceeds as if the on-chain entry were the primary legal record. No other jurisdiction offers a comparable civil-law statute today.

2. Fourteen categories of TT Service Provider

The TVTG defines fourteen categories of trusted-technology (TT) service provider, each with its own registration duties, minimum capital, and organisational standards: Token Issuers, Token Generators, Tokenisation Service Providers, TT Depositaries, Physical Validators, TT Exchange Service Providers, TT Verifying Authorities, TT Price Service Providers, TT Identity Service Providers, TT Agents, Token Lending Undertakings, TT Trading Platform Operators, TT Crypto-Asset Managers, and TT Transfer Service Providers. The two categories that matter most for tokenized metals are the Token Issuer (the entity that generates and offers the token) and the Physical Validator (the entity that enforces property-law rights on the physical goods underlying the token).

3. FMA supervision and international integration

The FMA administers registration, supervision and enforcement under the TVTG and coordinates directly with EEA counterparts through the ESA network (EBA, ESMA, EIOPA). The FMA operates a formal pre-application dialogue, publishes binding Instructions (Instruction 2024/1 is the current live TVTG guidance) and issues detailed Q&A material on specific token structures. Since Liechtenstein joined MiCA in late 2024, tokens that fall within MiCA scope (asset-referenced tokens, e-money tokens, other crypto-assets) also require MiCA authorisation from the FMA, granting an automatic EEA passport across all 30 member states (FMA, Liechtenstein Financial Market Authority).

Liechtenstein Licence Categories, Capital Thresholds and Registration Procedure

1. Minimum capital by category (regular procedure)

The TVTG ties minimum capital to the substance of the activity and, in several categories, to the total value of the tokens issued or under management. The core figures are: Token Issuer — CHF 50,000 (up to CHF 5M offered per year), CHF 100,000 (CHF 5M–25M) or CHF 250,000 (over CHF 25M); Physical Validator — CHF 125,000 (up to CHF 10M value under validation) or CHF 250,000 (over CHF 10M); TT Depositary — CHF 100,000; TT Trading Platform Operator — CHF 150,000; TT Crypto-Asset Manager — CHF 50,000; TT Exchange Service Provider — CHF 30,000 to CHF 100,000 depending on volume; other TT categories carry lower thresholds ranging between CHF 5,000 and CHF 30,000.

2. Governance, AML/CFT and substance requirements

Applicants must maintain a Liechtenstein registered office or place of residence, appoint fit-and-proper senior management with adequate professional qualifications, adopt AML/CFT policies aligned with the Due Diligence Act (SPG) and the associated Ordinance (SPV), maintain ten-year record retention, and operate an internal control system proportional to the activity. For higher-risk categories — Physical Validator, TT Depositary, TT Trading Platform Operator, Token Issuer above CHF 5M/year — additional organisational requirements apply (segregation of client assets, business continuity, IT-security controls, insurance cover). The FMA charges a registration fee of CHF 3,500 for the regular procedure; the simplified procedure is free.

3. Filing procedure and decision timeline

Applications are filed electronically to the FMA in German or English. The application dossier includes the constitutional documents of the applicant, proof of paid-in capital, fit-and-proper documentation for management and controllers, business plan, risk assessment, AML/CFT policies, technical documentation of the token architecture, and specimen contracts with counterparties. The FMA has a statutory three-month decision window from a complete application, extendable where additional information is required. Applicants that already hold a Liechtenstein banking, investment-firm or fund-manager licence use the simplified procedure and typically obtain confirmation within 4–6 weeks. Pre-application dialogue with the FMA is a well-established and recommended step for any novel token structure.

The Physical Validator: Liechtenstein's Unique Instrument for Tokenized Real-World Assets

1. Property-law linkage and civil enforcement

Under the Token Container Model, the token holds one or more rights recognised under Liechtenstein private law. Where those rights relate to a physical good — a bar of gold, a pallet of silver, a lot of platinum — the Physical Validator is the legally-designated counterparty responsible for verifying, safeguarding and enforcing the property-law claim of the token holder. The Validator's duties include physical inspection of the metal, verification of provenance and title, safekeeping (directly or through subcontracted vaulted storage), insurance, and standing available to enforce the token holder's civil-law claim in the event of dispute, insolvency or fraud. Liechtenstein civil law then treats the on-chain entry as the primary legal record, with the Validator's records as evidentiary support.

2. Token Issuer plus Physical Validator: the standard architecture

The dominant Liechtenstein architecture for tokenized metals pairs a Token Issuer (the entity that generates and offers the token, typically a Liechtenstein AG or GmbH holding the metal on its balance sheet) with a Physical Validator (which may be the same entity, but is more often a separate specialist counterparty for governance and creditor-protection reasons). Both entities register under the TVTG, with the Validator carrying the CHF 125–250k minimum capital plus insurance and vaulted-storage arrangements. Where the token is offered to EEA investors and falls within MiCA scope, the Issuer additionally holds a MiCA authorisation from the FMA.

3. Interaction with MiCA and cross-border reach

Since Liechtenstein joined MiCA as an EEA member in late 2024, the FMA is a fully passporting MiCA competent authority. A Liechtenstein Token Issuer holding a MiCA authorisation can offer the token across the entire EEA (30 member states) without further authorisation in each host state. Where the token is structured as a ledger-based security (metals-backed debt instrument, participation right) rather than a MiCA crypto-asset, EU Prospectus Regulation and MiFID II rules apply and the offering typically uses a Liechtenstein-approved prospectus with EEA passport. Distribution into Switzerland uses FinSA rules (Liechtenstein prospectuses are recognised in Switzerland).

2025–26 Developments: MiCA Overlay, FMA Instruction 2024/1 and Rising TVTG Registrations

1. FMA Instruction 2024/1 (1 February 2024)

Instruction 2024/1 consolidates and codifies the FMA's operating practice under the TVTG and TVTV into a single document. It covers registration procedures, categorisation guidance for each of the fourteen TT service provider types, documentation standards, capital and organisational requirements, the AML/CFT baseline, and interaction with adjacent Liechtenstein financial- services licences. Instruction 2024/1 is now the primary operating reference for TVTG applicants and replaces the earlier patchwork of Q&A publications.

2. MiCA overlay and EEA incorporation (late 2024)

Liechtenstein incorporated MiCA into EEA law and gave the FMA competent-authority status following the standard EEA process. MiCA-scope tokens (asset-referenced tokens, e-money tokens, other crypto-assets) now require MiCA authorisation from the FMA in addition to TVTG registration where relevant. The upside is the automatic EEA passport — a Liechtenstein-authorised issuer can distribute across all 30 EEA member states without additional host-state authorisation. TVTG registrations that fall outside MiCA scope (typically tokens holding property-law rights over physical goods, ledger-based securities, or purely utility tokens) continue under the TVTG only.

3. Registration momentum and market maturity

The public TVTG register has grown steadily since 2020 and now contains 90–100 registered TT service providers, covering the full spectrum of categories with heavy weighting toward Token Issuers, TT Exchange Service Providers, TT Depositaries and Physical Validators. Institutional participants include Bitcoin Suisse, VP Bank, Bank Frick, LCX, Aktionariat, HashKey and other regulated counterparties. This registered base is deep enough to support end-to-end operational stacks in Liechtenstein — issuance, validation, custody, trading, transfer, price service — and materially strengthens the jurisdiction's proposition against Switzerland for issuers targeting EEA institutional distribution.

Practical Path for a Liechtenstein Tokenized-Metals Issuer

1. Structure and category selection

The default architecture is a Liechtenstein AG (share capital CHF 50,000 minimum, fully paid) registered as a Token Issuer under the TVTG, holding the physical metal (or fully-backed metal claims) on its balance sheet and issuing tokens representing property-law rights over the underlying metal. A separate specialist Physical Validator is typically appointed for governance and creditor-protection reasons, with vaulted storage subcontracted to LBMA-accredited counterparties in Zurich, Frankfurt, Vienna or London. Where the token also falls within MiCA scope, the Issuer additionally holds a MiCA authorisation from the FMA. Where the token is structured as a ledger-based security rather than a MiCA crypto-asset, EU Prospectus Regulation applies and a Liechtenstein-approved prospectus provides the EEA passport.

2. Filing sequence and timeline

A realistic Liechtenstein timeline: Month 0–2 — AG incorporation in Vaduz, appointment of Liechtenstein-resident director and compliance officer, engagement of vaulted-storage counterparty, Physical Validator (if separate entity) incorporation, engagement of Liechtenstein legal counsel; Month 2–5 — TVTG registration application filed with the FMA (Token Issuer + Physical Validator categories), MiCA authorisation application filed in parallel where relevant, prospectus drafted for ledger-based security route; Month 5–8 — FMA statutory three-month review window, Q&A, remediation; Month 8–12 — registration and (if applicable) MiCA authorisation confirmed, prospectus approved, token generation, first issuance, first NAV. Simplified procedure entities (already holding a Liechtenstein banking or investment-firm licence) collapse the second and third phases into a 4–6 week window.

3. Distribution reach and cost envelope

A Liechtenstein Token Issuer with MiCA authorisation distributes to professional and institutional investors across all 30 EEA member states under a single authorisation, and to Liechtenstein and Swiss retail investors under prospectus. Distribution into the UK requires FCA overseas-fund recognition or professional-only marketing. Two-year all-in build cost typically lands in the CHF 1.5–3 million range: legal (CHF 200–400k), FMA fees and MiCA authorisation costs (CHF 50–100k), Physical Validator infrastructure and insurance (CHF 300–600k), custody set-up (CHF 150–400k), technology and audit (CHF 200–400k), Liechtenstein compliance and governance staff (CHF 400–700k). Material savings versus Switzerland come from lower capital requirements, a simpler licensing category, and the automatic MiCA passport that removes the need for parallel EU vehicles.

European Union — MiCA: The First Full Continental Crypto-Asset Regime

1. The three MiCA token categories

MiCA classifies crypto-assets into three categories with sharply different regulatory consequences. Asset-Referenced Tokens (ARTs) reference the value of one or more assets — including one or more official currencies, one or more commodities, or a basket — and are subject to the heaviest regime (reserve requirements, own-funds obligations, redemption rights, prudential supervision by home-state authority with EBA involvement). E-Money Tokens (EMTs) reference a single official currency and are treated as a form of e-money with additional MiCA overlay. Other crypto-assets that are neither ART nor EMT are subject to lighter requirements (whitepaper publication, marketing rules, CASP licensing for intermediaries) but no dedicated prudential regime. Tokenized commodities and metals typically fall into the ART category, because they reference the value of one or more commodities (ESMA, Crypto-Assets policy hub).

2. Crypto-Asset Service Providers (CASPs) and passporting

A firm providing any of ten defined crypto-asset services in the EU — custody and administration on behalf of clients, operation of a trading platform, exchange of crypto-assets for funds or other crypto-assets, execution of orders, placing of crypto-assets, reception and transmission of orders, advice, portfolio management, transfer services, or issuance — requires a CASP authorisation from a national competent authority in one Member State. That authorisation passports automatically across all 27 EU Member States plus the three EEA states (Norway, Iceland, Liechtenstein), creating for the first time a genuine single market for crypto-asset services.

3. Transitional arrangements and legacy regimes

MiCA includes transitional provisions of up to 18 months for firms that were legally providing crypto-asset services in a Member State before 30 December 2024 under a pre-existing national regime. That transition window closes at the latest by 30 June 2026 (subject to Member State discretion to shorten it), and after that date all firms serving EU customers must hold a full MiCA CASP authorisation. This transition has produced a wave of applications through 2025–2026, particularly to authorities in Ireland, Malta, Germany, France and the Netherlands, all competing to become the preferred domicile.

The Asset-Referenced Token Regime — Reserves, Own Funds, Redemption, Significant ART

1. Authorisation and whitepaper requirements

Under Articles 16–24 of MiCA, an ART issuer must apply for authorisation from the competent authority of its home Member State. The application must include a detailed programme of operations, a business plan, governance arrangements, a risk-management framework, a description of the reserve assets and reserve-asset segregation policy, IT and cyber-security arrangements, and a proposed crypto-asset whitepaper that meets the specific ART disclosures set out in Article 19 and Annex II. The whitepaper must be approved by the competent authority before the ART may be offered to the public (EUR-Lex, Regulation (EU) 2023/1114 (MiCA)).

2. Reserve of assets and prudential requirements

MiCA imposes a full reserve requirement: the aggregate value of the reserve must always at least match the aggregate value of ARTs in circulation. The reserve must be segregated from the issuer's own assets, held with an authorised custodian, and composed of assets of a nature and mix that reflect the ART's peg. For a commodity-backed ART this typically means the underlying physical commodity plus a liquid cash reserve to support redemptions. Additionally, the issuer must maintain own funds of at least the higher of EUR 350,000, 2% of the average amount of the reserve, or one-quarter of fixed overheads. For a significant ART (thresholds triggered by scale of holders, market cap, or systemic importance), the requirements are tightened and supervision is escalated to the EBA.

3. Redemption rights and holder protection

Every ART holder has a statutory right under MiCA Article 39 to redeem the ART at any time at market value or at the value of the underlying reference asset, at the holder's choice, paid in funds or in the reference assets. The issuer must publish a redemption policy, must not charge disproportionate fees, and must process redemptions promptly. This is a fundamental difference from many pre-MiCA tokenized products where redemption was contractual and often restricted — MiCA makes it a statutory right of the holder.

CASP Licensing — Ten Regulated Services, National Competent Authority, Passporting

1. Application dossier and competent-authority choice

The CASP application dossier is standardised across the EU by joint EBA/ESMA technical standards. It covers organisational structure, controllers, senior management, capital, systems and controls, risk management, outsourcing, safeguarding of client assets, complaints handling, conflicts of interest, and market-abuse prevention. Applicants choose their home Member State based on preferred regulator style, language capacity, industry proximity and taxation. In practice five domiciles have emerged as the leaders for institutional applicants: Germany (BaFin), France (AMF/ACPR), Ireland (CBI), Malta (MFSA) and the Netherlands (DNB/AFM).

2. Capital requirements by service category

MiCA sets minimum capital by service category. The lightest is class 1 at EUR 50,000 (advice, reception and transmission of orders, execution, placing, transfer services); class 2 at EUR 125,000 (custody, operation of a trading platform in the narrow sense); class 3 at EUR 150,000 (operation of a full trading platform, exchange services). A CASP providing multiple services applies the highest applicable class. Firms must also maintain own funds calculated as the higher of the minimum capital or one-quarter of the previous year's fixed overheads — the same rule that has long applied to MiFID investment firms.

3. Passporting and cross-border activity

A CASP authorised in one Member State may provide services throughout the EU/EEA by means of a notification procedure to the host-state competent authority, without need for a second authorisation. This produces genuine single-market efficiency but also concentrates competition among the national competent authorities: an applicant that finds its home regulator too slow, too conservative or too expensive can select an alternative Member State. In 2025 significant regulatory arbitrage has been observed — ESMA has publicly warned against “forum shopping” and is coordinating supervisory practices through peer reviews and joint on-site inspections.

2025–2026 Developments — ESMA Technical Standards, DLT Pilot Regime, Tokenized Securities

1. ESMA and EBA technical standards

ESMA and EBA have jointly published technical standards covering CASP authorisation content and format, market-abuse reporting under MiCA, complaints handling, marketing communications, conflicts-of-interest management, and the specific content of the crypto-asset whitepaper. Joint guidelines cover the classification of crypto-assets between MiCA categories (a critical practical question for tokenized-real-world-asset issuers), the calculation of ART own-funds, the qualification of significant ARTs and EMTs, and the supervisory approach to reserve-asset composition (ESMA, Crypto-Assets policy hub).

2. DLT Pilot Regime for tokenized securities

Regulation (EU) 2022/858 — the DLT Pilot Regime — established a parallel track for market infrastructures using distributed ledger technology to trade and settle tokenized transferable securities (shares, bonds, units in collective investment schemes). It creates three market-infrastructure types — DLT MTF, DLT SS and DLT TSS — each with limited-scope authorisation and specific volume caps. For a tokenized-metals issuer whose token is a security (rather than an ART), the DLT Pilot Regime offers an alternative structural route, particularly for a European tokenized-metals fund where the fund unit itself is the security being tokenized.

3. Digital euro, DeFi and second-generation regulation

The digital euro legislative proposal, tokenized-fund technical work, DeFi supervision studies (mandated by MiCA Article 142), and second-generation MiCA amendments are all live workstreams through 2026. For a metals-token issuer this second-generation regulation is largely context rather than immediate binding rule — but it signals that the EU intends to complete a full continental digital-asset regulatory perimeter within the current legislative cycle.

Practical Path for a Tokenized-Metals Issuer — ART Authorisation, Domicile Choice, Cost

1. Domicile choice among the leading Member States

For an institutional tokenized-metals issuer the five most credible EU domiciles are Germany, France, Ireland, Malta and the Netherlands. Germany (BaFin) is the largest market and offers the most substantial ecosystem; France (AMF/ACPR) is the most crypto-progressive of the major economies and has hosted several early ART authorisations; Ireland (Central Bank of Ireland) provides English-language regulatory dialogue and strong investment-fund infrastructure; Malta (MFSA) has moved from its pre-MiCA VFA regime into MiCA with early conversions; Netherlands (DNB/AFM) offers a rigorous but predictable process. Each has trade-offs between speed, cost and reputation.

2. ART plus CASP dual authorisation strategy

For a tokenized-metals issuer that also intends to distribute, custody and trade its own token, the practical pattern is to apply for ART issuer authorisation (for the token itself) and CASP authorisation (for the associated services) in parallel, ideally to the same competent authority to avoid split supervisory dialogue. Costs run to advisory fees plus regulator fees plus capital: total pre-revenue budget for a two-year runway is typically in the EUR 3–5 million range depending on scale ambition.

3. Distribution model: institutional first, retail conditional

MiCA opens retail distribution across the EU/EEA by default — there is no dedicated wholesale-only regime as in some Asia-Pacific jurisdictions — but the marketing rules, whitepaper approval, and redemption obligations mean retail distribution requires a mature product with comprehensive investor protection built in. The productive market entry is institutional first (private banks, wealth managers, family offices, tokenized-fund distributors), with retail distribution added later once operational maturity and reserve-management track record are established.

Malta — Regulatory Perimeter: MFSA, the VFA Act and the MiCA Overlay

1. The Financial Instrument Test (FIT) and the four-way asset split

Before any token can be classified, Malta requires issuers and their appointed VFA agent to run the Financial Instrument Test (FIT), a sequential decision tree that sorts every DLT-based asset into one of four buckets: electronic money (regulated under the Financial Institutions Act), a financial instrument (regulated under the Investment Services Act, mirroring MiFID II categories), a virtual token (utility-only, no exchange value outside a limited network, and thus outside the perimeter), or a virtual financial asset (VFA) — the residual, DLT-native category that falls squarely under the VFA Act. Only assets that clear all upstream tests and land in the VFA bucket require an MFSA-approved whitepaper, a registered VFA agent, and, where a service is offered, a VFA Services Licence (MFSA, VFA Rulebook FAQs).

2. The four VFA licence classes

The VFA Act defines eight licensable VFA services — including reception and transmission of orders, execution of orders, dealing on own account, portfolio management, custodian or nominee services, investment advice, placing of VFAs, and operation of a VFA exchange — and groups authorisation into four licence classes of escalating scope and capital requirement: Class 1 (reception/transmission of orders and placing, no client-asset holding), Class 2 (dealing on own account, portfolio management, investment advice and custody, holding client assets but not operating an exchange), Class 3 (all Class 2 activities plus dealing on own account against proprietary capital with client-money exposure), and Class 4 (operation of a VFA exchange, the most capital- and governance-intensive class). Every applicant, regardless of class, must appoint a Malta-based, MFSA-registered VFA agent who acts as gatekeeper and ongoing liaison with the regulator (MFSA, Virtual Financial Assets).

3. ITAS certification and the MDIA's role

Where a VFA service provider's operations rely on a designated Innovative Technology Arrangement (e.g. a smart contract, DLT platform or exchange protocol whose innovative technology feature is material to the service), the MFSA can require — and since 2021 has required as a matter of policy — certification of that arrangement with the MDIA under Article 8 of the ITAS Act. MDIA certification is technology-focused: it audits the software, DLT architecture and change-control processes underlying the service, separately from the MFSA's business-conduct and prudential review of the VFA licence application itself (MFSA, Consultation on ITA Certification with MDIA).

4. MiCA overlay since 30 December 2024

Since the EU Markets in Crypto-Assets Regulation (MiCA) became applicable on 30 December 2024, the VFA Act's scope has narrowed to assets and services that fall outside MiCA's harmonised categories (asset-referenced tokens, e-money tokens and “other” crypto-assets, plus the eight MiCA-defined CASP services), while MiCA-scope crypto-asset service providers now apply directly for an MFSA-issued MiCA CASP authorisation, passportable across all EEA member states. The MFSA published a circular clarifying the transitional treatment of existing VFA licence-holders migrating to MiCA authorisation (MFSA, Circular on VFA Act Amendments in Preparation for MiCA).

Malta Licence Categories: VFA Classes I–IV and the MiCA CASP Authorisation

1. VFA Class I and II — agency and advisory services

Class I licence-holders may receive and transmit client orders and place VFAs, but may not hold client assets or money — the lowest-capital, lowest-risk tier, typically used by introducing brokers and placement agents. Class II licence-holders add portfolio management, investment advice and custodian/nominee services, and may hold client assets, triggering additional segregation, reconciliation and professional-indemnity-insurance obligations. Both classes must appoint a registered VFA agent, a money laundering reporting officer (MLRO), and a systems auditor to review the underlying technology stack (MFSA, Chapter 3 of the VFA Rulebook).

2. VFA Class III and IV — dealing and exchange operation

Class III licence-holders may deal on own account against proprietary capital and carry client-money exposure beyond Class II's custody-only model, requiring materially higher regulatory capital and liquid-asset buffers. Class IV is reserved for VFA exchange operators — the operation of a multilateral trading venue for VFAs — and carries the Act's most demanding governance stack: minimum board composition, segregated client-asset accounts, market-surveillance systems, business-continuity and disaster- recovery planning, and the highest tier of the MFSA's risk-based capital ladder. Since the inception of the VFA Act, the MFSA reports 32 total VFASP licence applications, of which 15 were authorised and 14 withdrawn or refused (MFSA, Publication Highlighting Malta's Progress in Regulation of Virtual Financial Assets).

3. The MiCA CASP authorisation and EEA passporting

Since 30 December 2024, entities offering MiCA-scope services — custody, exchange operation (crypto-to-fiat and crypto-to-crypto), order execution, placing, portfolio management, advice, and transfer services — apply for a single MiCA CASP authorisation from the MFSA rather than a VFA licence. The authorisation is passportable across all 30 EEA member states under a single supervisory relationship, materially simplifying pan-European distribution relative to the VFA-only regime. Malta was the first EU jurisdiction to issue full MiCA CASP licences, granting authorisation to Crypto.com and OKX Europe Limited on 27 January 2025, followed by Bitpanda and Gemini later in 2025 (Times of Malta, Two Malta-based crypto companies receive licences to operate across EU).

Tokenized-Commodity Rules: FIT Classification, Custody and MiCA's Asset-Referenced Token Regime

1. Classifying a metals-backed token under the FIT

A token representing a claim on physical metal, fully backed and redeemable, is analysed under the FIT to determine whether it is e-money (unlikely, absent a fiat-currency peg), a financial instrument (possible if structured as a transferable security or derivative), a virtual token (unlikely given exchange value outside a closed network), or falls to MiCA's asset-referenced token definition — a crypto-asset that references one or more assets, including commodities, to stabilise its value. Where the FIT places the instrument in MiCA's ART category, the issuer must comply with MiCA's ART authorisation, reserve-asset and whitepaper regime rather than the VFA Act's ICO whitepaper process (MFSA, VFA Rulebook FAQs).

2. Custody, reserve assets and redemption mechanics

For a Malta-domiciled tokenized-metals structure, custody of the underlying metal is typically arranged with an LBMA-accredited vault outside Malta (London, Zurich or Singapore), while the issuing entity maintains reserve-asset records, segregation and periodic attestation consistent with MiCA's ART reserve requirements where applicable. Where the structure instead qualifies as a VFA (non-ART), custodian or nominee services require a Class II VFA licence-holder, with the same client-asset segregation principles that apply to fiat-referenced custody businesses under the VFA Rulebook.

3. Distribution: EEA passport versus third-country marketing

The principal commercial advantage of a Malta ART or MiCA CASP structure over an offshore fund-wrapper equivalent is the single EEA passport: once authorised by the MFSA, the issuer or service provider can market and distribute across all 30 EEA states without separate national licensing. Distribution outside the EEA (US, Asia, Middle East) still requires local analysis — MiCA confers no third-country passporting rights — but for European institutional and retail distribution, Malta's MiCA-first posture is now materially faster than a VFA-only or non-EU domicile.

2024–26 Developments: MiCA Go-Live, First-Mover CASP Licensing and the FATF Grey-List Recovery

1. MiCA applicability from 30 December 2024 and first-mover licensing

MiCA's crypto-asset service provider provisions became directly applicable across the EU on 30 December 2024. The MFSA had pre-positioned its authorisation pipeline during 2024, enabling it to issue in-principle approval to Crypto.com's Maltese entity in early January 2025 and full MiCA CASP authorisation to both Crypto.com and OKX Europe Limited on 27 January 2025 — the first full MiCA licences granted anywhere in the EU. Bitpanda (also licensed by Germany's BaFin around the same date) and Gemini (relocating its EU hub from Ireland to Malta) followed later in 2025, with Gemini's MFSA authorisation dated 21 August 2025 (OKX, A Regulated Crypto Exchange Under MiCA in Europe).

2. FIAU enforcement history and the shift to MiCA-grade supervision

Malta's AML supervisor, the Financial Intelligence Analysis Unit (FIAU), fined a Malta-licensed Binance-linked entity €373,000 in 2023 for AML/CFT compliance failings, part of a broader wave of FIAU enforcement in the crypto and VFA sector that saw the unit levy over €2.2 million in fines across the first half of 2023 alone. This enforcement period, layered on top of Malta's 2021–22 FATF grey-listing, drove the jurisdiction's compliance infrastructure to a materially higher baseline — a baseline that positioned the MFSA and FIAU to meet MiCA's more demanding EU-wide AML and market-conduct standards ahead of most peer regulators (FIAU, Administrative Measure Publication Notice).

3. FATF grey-list exit (June 2022) and its lasting effect on counterparty access

Malta was placed on the FATF grey list in June 2021 and formally removed exactly twelve months later, in June 2022, following demonstrated AML/CFT remediation across supervision, enforcement and beneficial-ownership transparency. This is now historical: the practical effect through 2023–26 has been a full normalisation of correspondent-banking relationships and EU institutional counterparty comfort, removing what had been a meaningful reputational discount on Malta-domiciled financial and crypto entities during the grey-list window (BDO Malta, Malta removed from FATF grey list).

Practical Path for a Malta Tokenized-Metals Issuer

1. Structure and classification sequencing

The default architecture is a Malta-registered limited liability company engaging a registered VFA agent from day one to run the Financial Instrument Test on the proposed metals-backed token. If the FIT resolves to MiCA's asset-referenced-token category, the issuer proceeds under MiCA's ART whitepaper, reserve-asset and governance regime; if it resolves to a residual VFA, the issuer proceeds under the VFA Act with an appropriate Class I–IV licence depending on whether custody or exchange operation is in scope. Either path requires appointment of a systems auditor, MLRO and, where an ITA is material to the service, MDIA certification (MFSA, Virtual Financial Assets).

2. Filing sequence and timeline

A realistic Malta timeline: Month 0–2 — entity incorporation, engagement of a VFA agent, FIT classification memo, appointment of MLRO and systems auditor; Month 2–5 — MiCA CASP application (or VFA licence application) filed with the MFSA, including business plan, governance documentation, reserve-asset and custody arrangements, AML/CFT programme for FIAU alignment; Month 5–9 — MFSA review, iterative Q&A, MDIA ITA certification if required; Month 9–13 — final authorisation, token issuance, EEA-wide passport notification. This is materially faster than a comparable Cayman Phase 2 VASP-licence timeline, reflecting the maturity of the MFSA's MiCA processing pipeline established through the 2025 first-mover cohort.

3. Distribution posture and cost envelope

Distribution is the clearest advantage of the Malta path: a MiCA CASP authorisation or ART whitepaper notification is passportable across all 30 EEA states without separate national licensing — a structural advantage no offshore domicile can offer for EU distribution. Non-EEA distribution (US, Asia, Middle East) still requires separate local analysis. Two-year all-in build cost sits in the USD 1.2–2.5 million range: legal and VFA-agent fees (USD 250–450k), MFSA filing and authorisation fees (USD 80–180k), systems audit and MDIA certification (USD 100–250k), custody set-up (USD 150–350k), technology and reserve-asset audit (USD 150–350k), governance and compliance staff (USD 350–700k). This is broadly comparable to Cayman on cost, but with the added benefit of a genuine EU single-market passport.

Estonia — Regulatory Perimeter: FIU-EST, the AML Act and the Post-2022 Clean-Up

1. From light-touch registration to a licensing regime

Estonia's original 2017 framework treated virtual-currency services as a registered activity with modest capital and governance requirements, contributing to a rapid build-up of roughly 2,000 licensed entities by 2019–2020, a number wildly disproportionate to Estonia's population and financial-sector size. Recognising the AML/CFT and reputational risk this created, the Estonian parliament amended the AML Act on 10 March 2020, tightening fit-and-proper, governance and substance requirements for both new applicants and the existing licensed population (Silva Hunt, Estonian cryptocurrency licensing laws).

2. The March 2022 substance and capital overhaul

A second, more consequential amendment took effect on 15 March 2022, introducing mandatory share-capital minimums — EUR 250,000 for virtual currency exchange and transfer services, EUR 100,000 for wallet and issuance services, both payable in fiat only — alongside a requirement for a genuine physical office in Estonia and at least one board member with demonstrable local presence and decision-making authority. The FIU-EST licence application fee rose from EUR 3,300 to EUR 10,000 for applications filed after the amendment, and applicants were newly required to submit a two-year business plan (Silva Hunt, Estonian cryptocurrency licensing laws).

3. The resulting market clean-up

The combined effect of the 2020 and 2022 amendments was a dramatic contraction of Estonia's licensed VASP population: FIU-EST revoked or allowed to lapse an estimated 1,900 of the roughly 2,000 licences issued under the original 2017 regime, through a combination of proactive enforcement, failure to meet the new capital and substance bar, and voluntary surrender by entities with no genuine Estonian nexus. By 2022, Estonia's active VASP population had fallen to fewer than 100 entities — a deliberate policy outcome rather than a market failure, reflecting FIU-EST's shift from volume-based registration to substance-based licensing (FIU-EST, Financial Intelligence Unit).

Estonia Licence Categories: VASP Licence Types and the MiCA Transition

1. Exchange and transfer services — the EUR 250,000 tier

Virtual currency exchange service and virtual currency transfer service providers face the higher of the two capital tiers introduced in March 2022: EUR 250,000 in paid-in fiat share capital, held on an ongoing basis rather than as a point-in-time licensing formality. FIU-EST requires continuous evidence that this capital is maintained, alongside a functioning local office and a board member with genuine Estonian presence and authority to bind the company. This tier captures the highest-risk activities — direct fiat/crypto conversion and third-party fund transfer — and draws correspondingly close AML scrutiny (Silva Hunt, Estonian cryptocurrency licensing laws).

2. Wallet and issuance services — the EUR 100,000 tier

Virtual currency wallet service providers and entities engaged in the issuance and trading of virtual currency face a lower — but still substantial — EUR 100,000 capital requirement, alongside the same local-office and board-presence conditions as the exchange/transfer tier. FIU-EST assesses wallet providers on custody-control architecture (whether the provider holds private keys, multisig arrangements, or purely custodial access) as part of the licensing review, given the direct client-asset exposure wallet services carry.

3. AML/CFT programme and the two-year business plan

Every licence category, regardless of capital tier, must submit a two-year forward business plan covering projected client volumes, transaction monitoring architecture, and AML/CFT staffing, plus a documented risk-assessment and reporting framework aligned to FIU-EST's supervisory expectations. Applications filed after 15 March 2022 pay the increased EUR 10,000 state fee (versus EUR 3,300 previously), reflecting the more intensive review FIU-EST now conducts per application relative to the high-volume, lighter-touch 2017–2020 period (Silva Hunt, Estonian cryptocurrency licensing laws).

Tokenized-Commodity Rules: Classification, Custody and the Absence of a Bespoke Regime

1. Classification: virtual currency, security, or MiCA asset-referenced token

A physically-backed metals token issued from Estonia must first be assessed against Finantsinspektsioon's securities test (is the instrument a transferable security or a collective- investment interest, in which case the Securities Market Act framework applies) before falling to the AML Act's virtual-currency issuance category. With MiCA's direct applicability since 30 December 2024, an EU-facing metals-backed token increasingly should be assessed for asset-referenced token status under MiCA rather than the residual national virtual-currency issuance licence, shifting practical authority toward Finantsinspektsioon (Finantsinspektsioon, Estonian Financial Supervision Authority).

2. Custody and capital under the post-2022 regime

Where the structure requires wallet or custody services for the underlying token, the issuer (or an appointed Estonian custody provider) must hold a virtual currency wallet service licence, carrying the EUR 100,000 capital floor, genuine local office and board presence introduced in March 2022. Physical metal custody itself sits outside FIU-EST's remit entirely and would typically be arranged through an LBMA-accredited vault outside Estonia, with the Estonian entity responsible only for the token-issuance and digital-custody layer (Riigi Teataja, Money Laundering and Terrorist Financing Prevention Act).

3. Why Estonia is not a natural primary domicile for this structure

Given the post-2022 substance requirements, the small surviving VASP population, and the absence of any bespoke tokenized-commodity or fund wrapper comparable to Cayman's Mutual Funds Act structures, Estonia does not offer a natural primary-issuance advantage for a metals-backed token. Its EU membership does provide MiCA-passport eligibility once authorised, but Malta's first-mover MiCA infrastructure and Cayman's mature fund-wrapper model both offer more developed pathways for the same underlying structure.

2020–26 Developments: The Licence Clean-Up, MiCA Transposition and a Smaller, Stronger Market

1. The 10 March 2020 amendment and its immediate effect

The first amendment to the Money Laundering and Terrorist Financing Prevention Act, effective 10 March 2020, tightened fit-and-proper standards, beneficial-ownership disclosure and governance requirements for virtual-currency service providers, and gave FIU-EST expanded powers to revoke licences of entities that failed to demonstrate genuine compliance capability. This first wave of tightening began the contraction of Estonia's oversized licensed population, ahead of the more dramatic capital-and-substance overhaul that followed in 2022 (Silva Hunt, Estonian cryptocurrency licensing laws).

2. The 15 March 2022 amendment and the ~1,900-licence revocation wave

The second and more consequential amendment, effective 15 March 2022, introduced the EUR 250,000 / EUR 100,000 capital tiers, the local-office mandate and the local board-member requirement described in the perimeter section above. FIU-EST used the transition period to revoke or decline renewal for an estimated 1,900 of the roughly 2,000 previously-licensed entities, most of which had no genuine Estonian operating presence and existed largely to exploit the jurisdiction's earlier light-touch registration process. This remains the largest single VASP licence clean-up undertaken by any EU member state to date (FIU-EST, Financial Intelligence Unit).

3. MiCA transposition since 30 December 2024

Since MiCA's direct applicability from 30 December 2024, Estonia has been transposing the regulation's harmonised CASP authorisation into domestic supervisory practice, with Finantsinspektsioon positioned as the lead MiCA authority alongside FIU-EST's continuing AML Act role for non-MiCA-scope activity. Estonia has not been among the first-mover MiCA licensing jurisdictions — unlike Malta, no major global exchange has yet obtained its primary EU CASP authorisation through Estonia — reflecting the smaller surviving domestic VASP base left by the 2020–22 clean-up (Finantsinspektsioon, Estonian Financial Supervision Authority).

Practical Path for Estonia: Secondary EU Base Rather Than Primary Domicile

1. Why primary issuance is not recommended

Standing up a new virtual-currency exchange or transfer licence in Estonia today requires EUR 250,000 in paid-in capital, a genuine physical office, and a board member with real local decision-making authority — a materially higher bar than the 2017–2020 registration process that built Estonia's original reputation as a crypto-friendly jurisdiction. Combined with the absence of any bespoke tokenized-commodity or fund-wrapper regime, Estonia does not offer a differentiated primary- issuance advantage relative to Malta's MiCA-first EEA passport or Cayman's mature fund-plus-VASP structure (Silva Hunt, Estonian cryptocurrency licensing laws).

2. Where Estonia fits: secondary base and EU-nexus diversification

The more defensible use case is as a secondary EU operating base — for example, a wallet-service or transfer-service subsidiary supporting a primary MiCA CASP authorisation obtained elsewhere in the EEA (Malta being the natural pairing given its first-mover MiCA infrastructure), or as a jurisdictional diversification hedge for firms that already have EU substance and want a second AML Act licence for redundancy or specific Baltic/Nordic market access. In this configuration, the EUR 100,000 wallet-service capital tier is the relevant entry point rather than the EUR 250,000 exchange/transfer tier.

3. Filing sequence, timeline and cost if pursued

If a secondary Estonian licence is pursued: Month 0–3 — local entity incorporation, lease of genuine Estonian office space, recruitment of a board member with real local presence, engagement of Estonian AML counsel; Month 3–7 — FIU-EST licence application filed (EUR 10,000 state fee), two-year business plan, AML/CFT programme, capital demonstration (EUR 100k or 250k depending on service category); Month 7–12 — FIU-EST review and iterative Q&A; Month 12–15 — licence grant, operational launch. Two-year all-in cost of USD 1.3–2.6 million includes: legal and AML counsel (USD 250–450k), FIU-EST fees and capital carry cost (USD 150–350k), local office and board-member compensation (USD 200–400k), technology and custody set-up (USD 150–350k), governance and compliance staff (USD 350–700k) — broadly comparable to Malta but without the EEA first-mover MiCA advantage.

United Kingdom — FCA: From MLR Registration to Full Financial-Services Perimeter

1. Two overlapping regimes 2026–2027

Until 25 October 2027 the UK operates two parallel regimes. The MLR 2017 registration continues to apply: any firm carrying on cryptoasset exchange or custody business by way of business must be registered with the FCA under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 as amended. In parallel the FSMA general prohibition under section 19 is being extended by the 2026 Regulations to cover a defined set of specified crypto-activities: issuing cryptoassets, dealing as principal or agent, arranging deals, operating a cryptoasset trading platform, safeguarding cryptoassets or the cryptographic keys used to control them, staking, and providing qualifying stablecoins. Firms carrying on any of these activities in the UK after 25 October 2027 will require full FCA authorisation under Part 4A FSMA, not just MLR registration.

2. Regulated Activities Order (RAO) and specified investments

The 2026 Regulations amend the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001 (SI 2001/544, RAO) to add cryptoassets as a category of specified investment. A qualifying cryptoasset is defined broadly as any cryptographically secured digital representation of value or contractual rights that can be transferred, stored or traded electronically using distributed ledger technology, subject to specific exclusions (electronic money, certain fiat digital representations, and certain wholesale-only tokens). A qualifying stablecoin is a subset of qualifying cryptoasset that seeks to maintain a stable value by reference to a fiat currency and is issued in exchange for funds. Tokenized commodities and metals typically fall into the qualifying cryptoasset perimeter as a non-stablecoin instrument, unless they are structured as regulated collective investment schemes or specified investments in their own right (in which case pre-existing FSMA regulation applies) (legislation.gov.uk, Regulated Activities Order 2001).

3. Territorial scope and reverse solicitation

The FCA perimeter under FSMA is activity-based: the general prohibition applies to any person carrying on a regulated activity in the United Kingdom or, in specified cases, targeting UK customers from abroad. Firms established outside the UK that provide crypto-services to UK persons will typically fall inside the perimeter unless the service is offered exclusively on the customer's own exclusive initiative (the traditional reverse-solicitation doctrine, applied conservatively by the FCA). Marketing to UK retail customers is separately restricted by the Financial Promotions Order 2005 as extended in October 2023 to cover qualifying cryptoassets: any communication that invites or induces a UK person to engage in investment activity in relation to cryptoassets must be made or approved by an FCA-authorised person or fall within a specific exemption.

United Kingdom — FCA Authorisation: MLR Registration and Part 4A Permission

1. MLR 2017 registration (current interim regime)

Under Regulation 54A of the MLR 2017, any UK cryptoasset exchange provider or custodian wallet provider must be registered with the FCA before commencing business. The registration standard is high: the FCA has rejected or withdrawn a majority of applications since the regime commenced in January 2020, on grounds of inadequate AML/CFT systems, insufficient beneficial-ownership evidence, or ineffective transaction monitoring. Registration entails ongoing supervisory scrutiny, an annual fee, and reporting obligations under the Sanctions and Anti-Money Laundering Act 2018. As of mid-2026 the number of active MLR-registered cryptoasset firms in the UK sits below 50, reflecting the FCA's restrictive approval bar (FCA, Cryptoassets: AML/CTF regime).

2. Part 4A FSMA permission (post-October 2027 regime)

Full FCA authorisation under Part 4A FSMA is granted only where the applicant meets the Threshold Conditions in Schedule 6 FSMA: legal status, location of offices in the UK, effective supervision (a business model demonstrably subject to supervision), appropriate resources (including capital appropriate to the risks), suitability of directors and controllers, and a business model that the FCA regards as viable and consistent with its statutory objectives. Applications proceed through the FCA's Authorisations division under prescribed forms (SUP 6.3) and typically take 6–12 months. Applicants must submit a full Regulatory Business Plan, ICAAP-equivalent capital assessment, wind-down plan, senior-manager applications under SMCR, and evidence of governance, financial-crime systems, technology resilience, and consumer-outcomes design under the Consumer Duty.

3. Capital and prudential requirements

The 2026 Regulations do not themselves impose a uniform prudential charge on crypto-firms; instead, the FCA will apply Investment Firm Prudential Regime (IFPR) principles to firms authorised as investment firms and dedicated rules to firms authorised only for crypto-services. Draft rules published for consultation in 2025 signal a minimum own-funds requirement of the higher of £150,000 or a K-factor calculation based on assets safeguarded and administered, cleared margin, and daily trading flow. Custodians are expected to hold client cryptoassets on a segregated, bankruptcy-remote basis, with robust key-management standards. The final rules are expected in the Handbook by Q4 2026 to give firms sufficient runway ahead of the October 2027 activation.

United Kingdom — Tokenized Commodities and Metals: Perimeter Analysis

1. Direct claim on physical metal in a UK vault

Where the token gives the holder a direct legal claim on an allocated quantity of physical metal held in a UK-based vault, the token is likely to be a qualifying cryptoasset under the 2026 Regulations (once activated), and the issuance, safeguarding and secondary trading of it will fall within the specified crypto-activities. If the physical claim is documented under a trust or a bailment arrangement, the trust itself is not a specified investment under FSMA, but the token issuance and any exchange-like functionality are. In parallel, the metal-custody arrangement must comply with the FCA's client-assets rules (CASS 6 for safeguarding, CASS 7 for client money if fiat is held) to the extent the issuer holds client property.

2. Pooled or fund-like structure

Where the token represents a pro-rata share in a pool of metal (rather than a specific allocated quantity) and is issued and managed by a manager with discretion, the arrangement is likely to constitute a collective investment scheme under section 235 FSMA, a UCITS or an alternative investment fund (AIF) under the Alternative Investment Fund Managers Regulations 2013. That classification pulls in the full weight of AIFMD-style regulation on the manager (authorisation, depositary requirement, marketing restrictions to retail clients), and the token itself may separately be a transferable security or a unit in a collective investment scheme — both of which are specified investments long pre-dating the 2026 crypto regime. In such cases the crypto-permission adds to, rather than replaces, the pre-existing collective-investment authorisations.

3. Wrapper over an existing ETF

A token that wraps units in an existing exchange-traded product — for example a physical-gold ETF listed on the London Stock Exchange — inherits the securities-law classification of the wrapped instrument. The wrapped units remain transferable securities under FSMA, so the token is likely a specified investment in its own right, and the wrapper issuance is subject to prospectus rules under the UK Prospectus Regulation. The wrapping structure will separately be a specified crypto-activity in the 2026 regime, so the issuer needs both permissions. In October 2025 the FCA lifted its blanket ban on retail cryptoasset exchange-traded notes (cETNs), easing but not eliminating the retail distribution constraints (FCA, press release on lifting cETN retail ban).

United Kingdom — 2025–2026 Developments: Regime Activation and cETN Reversal

1. Lifting of the retail cETN ban (October 2025)

In October 2025 the FCA published a policy statement lifting its January 2021 blanket ban on the sale, marketing and distribution to retail consumers of exchange-traded notes referencing cryptoassets. Retail investors may now access UK-listed cETNs referencing bitcoin, ether and defined cryptoassets, subject to the appropriateness assessment under COBS 10A and the risk warnings mandated by the financial-promotions regime. The change does not extend to unregulated crypto-derivatives, which remain banned for retail clients under COBS 22.6. For a tokenized-metals issuer this is a directional signal that the FCA is moving from prohibition to conduct-based regulation — but it is not a direct authorisation to market tokenized commodities to UK retail.

2. FSM (Cryptoassets) Regulations 2026 (February 2026)

The FSM (Cryptoassets) Regulations 2026 (SI 2026/xxx) were made under section 8 of the Financial Services and Markets Act 2023 and laid before Parliament on 4 February 2026. The Regulations extend Part 2 FSMA to a defined universe of qualifying cryptoassets and specified crypto-activities, amend the Regulated Activities Order 2001 correspondingly, and set commencement dates for the individual activities. Issuing and stablecoin activities commence first (early 2027 subject to Handbook finalisation); dealing, arranging, custody and trading-platform operation commence on 25 October 2027. A transitional regime allows firms with existing MLR registrations or pending applications to continue operating through a modified permissions gateway until Q1 2028.

3. Handbook consultations 2025–2026

The FCA published a suite of consultation papers throughout 2025 and H1 2026 to populate the Handbook with the substantive conduct and prudential rules that will apply from October 2027. CP24/17 addressed stablecoin issuance and backing-asset requirements; CP25/2 dealt with trading platforms and market conduct; CP25/9 covered custody; CP26/1 (March 2026) covered the prudential regime and financial promotions. The Consumer Duty (PRIN 2A), fully applicable to all regulated firms since July 2023, will apply to crypto activities from day one of Part 4A authorisation. Cross-border service provision from outside the UK is being tightened, with the reverse-solicitation gateway narrowed relative to pre-Brexit MiFID II standards.

United Kingdom — Practical Path for a Tokenized-Metals Issuer

1. Path A — Professional-only issuance from a UK entity

Establish a UK Ltd, register with the FCA under MLR 2017 as a cryptoasset business, restrict marketing and issuance to professional clients (per COBS 3.5), and structure the token as a direct claim on allocated metal held in a UK-based LBMA vault. Under this path the token would be a qualifying cryptoasset once the 2027 regime activates, and the issuer would need to convert its MLR registration into a Part 4A permission covering issuance, safeguarding and dealing. Estimated legal and application cost: £250,000–£450,000. Timeline from company formation to MLR registration: 9–15 months. Timeline to Part 4A permission: an additional 9–12 months.

2. Path B — Retail distribution via authorised UK partner

Retain a non-UK issuing entity (for example DIFC or Singapore) and distribute the token to UK retail via a UK-authorised platform holding the appropriate FSMA permissions. The FCA-authorised distributor approves financial promotions under section 21 FSMA, applies the appropriateness test, and takes on the Consumer Duty responsibilities toward UK end-clients. The issuer avoids direct UK authorisation but contractually accepts the distributor's compliance framework. This path minimises regulatory capital for the issuer but concentrates counterparty risk in the UK distributor and requires a robust distribution agreement.

3. Path C — Full UK authorisation with retail permission

Establish a UK Ltd, apply directly for a Part 4A FSMA permission covering issuance, safeguarding, dealing and operating a trading platform, with a retail-consumer permission. This is the most resource-intensive path (own-funds requirement of the higher of £150,000 or a K-factor calculation; senior-manager applications; Consumer Duty implementation; full ICAAP and wind-down plans) but positions the issuer as a UK-domiciled, retail-eligible tokenized-metals provider. Estimated one-off cost: £800,000–£1,500,000. Ongoing supervisory levy and personal accountability under SMCR. Recommended only where the UK retail market is a strategic priority.

4. Financial-promotions and consumer-duty overlay (all paths)

Regardless of path, any communication that invites or induces a UK person to engage in cryptoasset investment must be made or approved by an FCA-authorised person. Non-compliance is a criminal offence under section 21 FSMA. Consumer Duty PRIN 2A applies to all regulated firms serving retail customers and imposes cross-cutting obligations on product design, price and value, consumer understanding, and consumer support. Under the Duty, the FCA will hold firms accountable for demonstrable good outcomes for retail customers — not merely process compliance.

5. Timeline and cost summary

A professional-only Path A build (MLR + preparatory Part 4A application) requires 18–24 months and £250k–£450k in legal, compliance and application costs. A distribution Path B can go live in 6–9 months and £40k–£80k in legal setup, contingent on finding a willing FCA-authorised distributor. A full retail Path C requires 24–30 months and £800k–£1,500k in one-off costs plus material ongoing prudential capital and supervision costs.

Gibraltar — Regulatory Perimeter: the DLT Framework and the GFSC

1. The DLT Framework's scope: storing or transmitting value for others

A firm is a DLT Provider if it carries on, by way of business, in or from Gibraltar, the use of distributed ledger technology for storing or transmitting value belonging to another person. In-scope activities typically include custodial virtual-asset wallet providers, virtual-asset exchanges and derivatives exchanges, OTC and brokerage desks, escrow providers, and lending or managed-investment platforms that take control of client virtual assets. Firms that never take custody or control of client virtual assets — for example, pure token issuers selling from their own inventory, or non-custodial wallet software providers — generally fall outside the DLT Framework, though they may still need to register under Gibraltar's separate AML/CFT regime (Gibraltar Financial Services Commission, official site).

2. Statutory basis: FSA 2019 and the DLT Providers Regulations

The regulated activity is anchored in section 15(a) of the Financial Services (Regulatory) Act 2019, which designates “value belonging to another which is stored or transmitted by means of a database system” as a regulated activity under Schedule 2 of the Act. The subsidiary Financial Services (Distributed Ledger Technology Providers) Regulations 2020 (which replaced the original 2017 Regulations) sets out the licensing process, ongoing obligations and the core principles a DLT Provider must satisfy. Firms already authorised by the GFSC under another FSA 2019 permission — banking, e-money, payment services — do not need a separate DLT authorisation for DLT activity that is incidental to that primary licence (Laws of Gibraltar, Financial Services Act 2019).

3. AML/CFT overlay for activity outside the DLT Framework

Virtual-asset activity that falls outside the DLT Framework — principally bare token issuance and simple exchange arrangements — is captured instead by the Proceeds of Crime Act 2015 and its (Relevant Financial Business) (Registration) Regulations 2021, which require registration with the GFSC for AML/CFT, CTF and counter-proliferation-finance supervision before tokens are sold from Gibraltar. This gives Gibraltar a two-track model: a full DLT Provider authorisation for custody- and transmission-type business, and a lighter AML-only registration for issuance-only business (Gibraltar Financial Services Commission, official site).

Gibraltar Licence Categories: DLT Provider Authorisation, VASP/POCA Registration and VAA Permission

1. Full DLT Provider authorisation

A firm seeking full authorisation must satisfy the GFSC's staged application process: an initial assessment (non-refundable application fee), followed by categorisation into one of three complexity categories with escalating fees — historically ranging from roughly GBP 10,000 for the lowest category to GBP 30,000 for the highest, on top of an initial assessment fee. Applications are assessed against the framework's core principles and typically take nine to eighteen months from initial engagement to licence grant, with GFSC interviews, on-site reviews and detailed policy submissions required throughout. A licensed DLT Provider must maintain a genuine Gibraltar presence, with mind and management exercised locally (Ramparts, Gibraltar Crypto Assets and DLT Law and Regulation).

2. POCA/VASP registration for token issuers

A firm that issues or sells its own token — without taking custody of virtual assets belonging to others — registers under the Proceeds of Crime Act 2015 (Relevant Financial Business) (Registration) Regulations 2021 rather than seeking full DLT authorisation. This registration is materially faster and cheaper than the full DLT process, focusing on AML/KYC procedures, customer due diligence and suspicious-activity reporting to the Gibraltar Financial Intelligence Unit, rather than prudential capital and systems requirements (CMS, Expert Guide to Crypto Regulation — Gibraltar).

3. Part 7 permission for virtual asset arrangements (2025 update)

Since the Financial Services (Regulated Activities) (Amendment) Regulations 2025, providing virtual asset arrangements — exchanging virtual assets for fiat, fiat for virtual assets, or one virtual asset for another — is a formally regulated activity under Part 16 of Schedule 2 to the FSA 2019, requiring a Part 7 permission from the GFSC rather than mere POCA registration. Firms previously operating only under POCA registration had to notify the GFSC within 14 days of the change and submit a full Part 7 application within six months; certain institutional dealers (collective investment schemes, pension funds and their depositaries/managers dealing on their own account) are excluded (Hassans, Gibraltar Regulatory Update on Virtual Asset Arrangements).

Tokenized-Commodity Rules: The Nine Core Principles, Client-Asset Protection and Governance

1. The nine core principles applied to a metals-backed token

The GFSC assesses DLT Provider applicants against nine principles: honesty and integrity; customer care (fair, clear treatment of clients); adequate financial resources; effective risk management; robust protection of client assets and money; sound corporate governance; secure systems and access controls; systems to prevent, detect and disclose financial crime; and operational resilience. For a tokenized-metals provider, principle five (client-asset protection) is typically the most heavily scrutinised — the GFSC expects daily reconciliation of client holdings, clear segregation of client and proprietary assets, and documented safeguarding arrangements for the underlying metal or metal claim (Gibraltar DLT Regulatory Framework brochure, Nine Core Principles).

2. Structuring options: DLT Provider, VASP issuer, or crypto fund

A tokenized-metals sponsor structuring through Gibraltar generally chooses among three patterns: (i) a DLT Provider licence where the Gibraltar entity itself custodies client metal claims and operates redemption/trading infrastructure; (ii) a VASP/POCA-registered issuer that issues tokens representing a claim on metal custodied by a separately regulated third party, keeping the Gibraltar entity outside full DLT authorisation; or (iii) a Gibraltar crypto fund structure, pooling investor capital into a regulated collective-investment vehicle that holds the metal and issues tokenized units. Each path carries a materially different authorisation timeline and cost, and sponsors frequently start on the issuer-only track before graduating to full DLT authorisation as trading volume grows.

3. Client-asset segregation and redemption mechanics

Where the Gibraltar entity holds full DLT authorisation, GFSC guidance requires segregation of customer crypto-assets from company assets, daily reconciliation, and detailed record-keeping of all client holdings. Redemption into physical metal depends on the underlying custody chain — Gibraltar itself has no domestic bullion-vaulting infrastructure at institutional scale, so redemption typically routes through a London, Zurich or Singapore vault under a separate custody agreement, with the Gibraltar DLT Provider or issuer acting as the on-chain record-keeper and counterparty rather than the physical custodian.

2025–26 Developments: Virtual Asset Arrangements, Derivatives Clearing and Post-Brexit Positioning

1. Virtual Asset Arrangements brought within Part 7 (2025)

The Financial Services (Regulated Activities) (Amendment) Regulations 2025 formally classified virtual-asset exchange arrangements as a regulated activity requiring a Part 7 permission, moving firms that previously relied solely on POCA/AML registration into a fuller GFSC authorisation track. Token issuers that only issue or sell their own native token remain on the lighter POCA registration path, preserving Gibraltar's comparative advantage for pure issuance structures even as exchange-type intermediaries face tighter scrutiny (Hassans, Gibraltar Regulatory Update on Virtual Asset Arrangements).

2. World-first Digital Clearing and Settlement framework

In May 2025, the Gibraltar Government announced development — working with the GFSC and virtual-asset exchange Bullish — of what it described as the world's first comprehensive regulatory framework for clearing and settlement of virtual-asset derivatives through regulated central counterparties. The framework is intended to align market-risk, counterparty-exposure and settlement-finality standards with traditional derivatives markets while reflecting virtual-asset-specific technology. As of mid-2026 this remains a drafting and industry-consultation workstream rather than a fully implemented regime, and the associated Token Regulation first flagged back in 2018 for market-abuse-specific rules also remains pending (HM Government of Gibraltar, Digital Clearing and Settlement Framework announcement).

3. Post-Brexit positioning: outside UK MLR and EU MiCA

Gibraltar sits outside both the UK's domestic money-laundering-regulations crypto regime and the EU's Markets in Crypto-Assets Regulation (MiCA), following the UK's exit from the EU and Gibraltar's own distinct constitutional position. In practice, Gibraltar-licensed DLT Providers seeking UK or EU market access rely on bilateral recognition and passporting-style arrangements negotiated between Gibraltar and the UK, rather than automatic MiCA equivalence or UK MLR registration. This leaves Gibraltar-domiciled structures needing a separate UK or EU-authorised distribution affiliate for any onshore marketing into those markets, similar in substance to the offshore-domicile-plus-onshore-distribution pattern used by Cayman and BVI vehicles.

Practical Path for a Gibraltar Tokenized-Metals Pilot

1. Structure and vehicle choice

The default architecture is a Gibraltar-incorporated company that issues tokenized certificates representing a claim on metal held by a separately regulated custodian (typically London, Zurich or Singapore vaulted). If the issuer's activity is limited to issuance and does not involve taking custody of client virtual assets or running an exchange, it registers under the POCA (Relevant Financial Business) (Registration) Regulations 2021 — the lightest-touch path surveyed across these jurisdictions. If the operating plan later requires the Gibraltar entity to custody client tokens or operate its own trading venue, a full DLT Provider authorisation or, for exchange-type dealing, a Part 7 permission becomes necessary.

2. Filing sequence and timeline

A realistic issuance-only Gibraltar timeline: Month 0–2 — company incorporation, engagement of Gibraltar legal counsel, negotiation of the third-party custody agreement for the underlying metal; Month 2–4 — POCA/VASP registration filed with the GFSC, AML/KYC policy suite finalised, MLRO-equivalent compliance officer appointed; Month 4–7 — GFSC registration confirmed, banking and custody relationships finalised; Month 7–9 — first token issuance. Should the team pursue full DLT Provider authorisation instead, budget nine to eighteen months for the staged three-category assessment process, GFSC interviews and on-site reviews.

3. Distribution posture, cost envelope and jurisdiction trade-offs

Distribution requires separate onshore vehicles for any UK or EU marketing, since Gibraltar sits outside both the UK MLR crypto-asset regime and MiCA; non-UK/EU distribution follows the standard Reg S / 144A pattern common to every offshore domicile in this survey. Two-year all-in cost for the issuance-only path sits in the USD 0.6–1.5 million range: legal (USD 150–300k), GFSC registration and annual fees (USD 20–60k), third-party custody set-up (USD 150–400k), technology (USD 150–350k), and compliance staff (USD 200–450k); full DLT authorisation adds GFSC application fees of roughly GBP 10,000–30,000 plus a materially larger legal and compliance build-out. Gibraltar's advantage is regulatory maturity and tenure at the issuance-only end; its disadvantage is scale — it is best used as a pilot, secondary listing, or European foothold alongside a larger primary domicile such as Cayman or Switzerland, not as the sole jurisdiction for an institutional-scale programme.

United States — SEC, CFTC, FinCEN and 50 State Regimes: The Most Fragmented Framework

1. SEC jurisdiction and the Howey test

Under the four-prong Howey test from SEC v. W.J. Howey Co. 328 U.S. 293 (1946), an investment-contract security exists where there is (a) an investment of money (b) in a common enterprise (c) with a reasonable expectation of profits (d) derived from the efforts of others. A tokenized metal that is structured as a direct claim on physical metal held on the holder's behalf, with no promotional promise of profit driven by the issuer's efforts, is generally not a security under Howey. A tokenized metal that is issued in a scheme that promises appreciation driven by the issuer's management (staking rewards, active trading, discretionary rebalancing) is likely to be a security. The SEC has pursued numerous enforcement actions against token issuers that misclassified their instruments, and the burden of proving non-security status sits on the issuer (SEC, press releases and enforcement announcements).

2. CFTC jurisdiction and the actual-delivery test

The CFTC has statutory jurisdiction over commodities and derivatives on commodities. Cryptoassets have been held to be commodities within the meaning of the Commodity Exchange Act since CFTC v. McDonnell (E.D.N.Y. 2018). A retail commodity transaction on a leveraged, margined or financed basis is subject to CFTC oversight unless actual delivery of the commodity to the retail purchaser occurs within 28 days. The CFTC finalised its interpretive guidance on actual delivery of digital assets in March 2020 (Interpretive Guidance CFTC No. 20-05), specifying that actual delivery requires the customer to have full possession and control (including the ability to use the commodity commercially or transfer it to a third party) with no continuing seller ownership or lien (CFTC, actual delivery guidance press release).

3. FinCEN money-services business registration

FinCEN's May 2019 guidance Application of FinCEN's Regulations to Certain Business Models Involving Convertible Virtual Currencies classifies any person that accepts and transmits convertible virtual currency (CVC), or that buys or sells CVC, as a money transmitter and therefore a money-services business (MSB) subject to registration with FinCEN, AML/CFT programme requirements, Suspicious Activity Reporting (SAR) and Currency Transaction Reporting (CTR) obligations. The 2019 guidance treats a stablecoin issuer (including a commodity-backed token) as an MSB where the issuer redeems tokens for the underlying value on demand (FinCEN, CVC business-models guidance 2019).

United States — Licence Categories: Federal Registration and State Money Transmission

1. FinCEN MSB registration (federal)

Any person doing business as a money-services business must register with FinCEN under 31 CFR 1022.380 within 180 days of commencing business. Registration is a light-touch federal filing (Form 107), but it triggers substantial ongoing obligations: written AML/CFT programme (31 CFR 1022.210), designation of a compliance officer, ongoing training, independent testing, Suspicious Activity Reports (31 CFR 1022.320) and Currency Transaction Reports (31 CFR 1022.310), and record-keeping under the Travel Rule (31 CFR 1010.410). Registration must be renewed every two years.

2. State money-transmitter licences

Money transmission is regulated at the state level under state-specific statutes derived (in most cases) from the 1994 Uniform Money Services Act as amended by the 2021 Model Money Transmission Modernization Act (MTMA). As of 2026, 26 states have adopted the MTMA in whole or part, providing some harmonisation of the licence application, capital requirements and permissible-investments framework. The remaining states retain bespoke regimes. Application fees range from $3,000 to $25,000 per state, minimum tangible net worth requirements range from $25,000 to $1,000,000, and surety bonds range from $25,000 to $7,000,000. Total capital tied up in bonds and net-worth requirements for a nationwide operator commonly exceeds $10 million.

3. New York BitLicense (NYDFS)

The Department of Financial Services of New York State (NYDFS) requires a Virtual Currency Business Activity Licence, commonly called a BitLicense, under 23 NYCRR Part 200, for any person conducting virtual currency business activity involving a New York resident. The BitLicense is widely considered the most stringent US crypto authorisation: an application fee of $5,000, typical legal and compliance costs of $1–2 million, review time of 18–36 months, and ongoing supervisory expectations comparable to those for a state-chartered bank. NYDFS also operates a limited-purpose trust charter under New York Banking Law § 102-a which some crypto-firms have obtained instead of the BitLicense.

4. SEC registration paths (if the token is a security)

If the Howey analysis produces a security classification, the issuer must either (i) register the offering under the Securities Act 1933 (typically Form S-1, expensive and rare in crypto), (ii) rely on a private-placement exemption (Regulation D 506(b) or 506(c), Regulation A+, Regulation S for non-US offers, Regulation Crowdfunding), or (iii) list on an alternative trading system operating as a registered broker-dealer. Secondary trading of security tokens generally requires trading on a national securities exchange or an alternative trading system with the appropriate registration. Custody of security tokens is a highly restricted activity in the US and typically requires either a qualified custodian (typically a state-chartered trust company) or specific SEC relief.

United States — Tokenized Commodities and Metals: Federal Analysis

1. Actual-delivery structuring

A token that grants the holder legal ownership of an allocated quantity of physical metal held in an insured, third-party vault, with the holder having the right to demand physical delivery at any time, typically satisfies the CFTC's actual-delivery test. The holder must have (a) the ability to take possession of the specific metal within 28 days, and (b) the ability to control commercial use of the metal (sell, transfer, pledge, or otherwise dispose of it). Cash-settled or purely notional structures fail the test and pull the arrangement into CFTC-regulated retail-commodity-transaction status, requiring registration as a futures commission merchant, retail foreign exchange dealer, or swap dealer, and execution only on a designated contract market or swap execution facility.

2. FinCEN classification and Travel Rule

FinCEN treats a tokenized-metals issuer that accepts fiat in exchange for tokens, and that redeems tokens for fiat or physical metal on demand, as a money transmitter under 31 CFR 1010.100(ff)(5) and therefore an MSB. The AML/CFT programme requirements under 31 CFR 1022.210 apply, together with the Travel Rule (31 CFR 1010.410) for transactions of $3,000 or more. FinCEN has issued guidance that the Travel Rule applies to CVC transactions between MSBs, and the industry has developed a set of technical protocols (IVMS 101, TRP) to comply. The proposed FinCEN rule from December 2020, if finalised, would extend enhanced diligence to transactions involving unhosted wallets.

3. Commodity-backed stablecoin analysis

A tokenized-metals product that is issued at a stable ratio (for example, one token per one troy ounce of gold) shares design features with fiat-backed stablecoins that have been the subject of intense federal legislative attention. Several proposed federal stablecoin bills (GENIUS Act, Clarity for Payment Stablecoins Act, Lummis-Gillibrand framework) have been introduced during 2024–2026, but none has yet been enacted. In the absence of a federal stablecoin statute, commodity-backed tokens default into the SEC/CFTC/FinCEN/state overlay described above. If a federal stablecoin statute is enacted, its scope may or may not extend to commodity-backed tokens depending on the definition of “payment stablecoin” adopted — a definition centred on a fiat-currency peg would likely exclude commodity-backed tokens, keeping them in the current framework.

United States — 2025–2026 Developments: Enforcement, Stablecoin Bills and State Modernisation

1. SEC pivot from enforcement to rulemaking

Since January 2025 the SEC under Chair Paul Atkins has substantially recalibrated the agency's cryptoasset approach: several long-running enforcement matters against exchanges and issuers were withdrawn or settled, and the Commission established a Crypto Task Force led by Commissioner Hester Peirce to develop rulemaking on token classification, custody, staking and trading platforms. As of mid-2026 no final rules have been issued, but interpretive guidance on token classification and broker-dealer custody of digital assets is expected in late 2026 or early 2027.

2. Federal stablecoin legislation

Three federal bills addressing stablecoins have progressed materially: the Guiding and Establishing National Innovation for US Stablecoins Act (GENIUS Act), the Clarity for Payment Stablecoins Act, and the Payment Stablecoin Act. All three broadly propose a federal framework for the issuance and prudential supervision of USD-backed payment stablecoins, with parallel state and federal issuer charters and reserve-asset requirements. None has been enacted as of mid-2026, and their scope with respect to commodity-backed tokens is not settled. A stablecoin definition centred on a fiat peg would exclude commodity-backed tokens; a broader definition would sweep them in.

3. State money-transmitter modernisation

The Conference of State Bank Supervisors' Money Transmission Modernization Act (MTMA) has been adopted or is under consideration in over 30 states. The MTMA harmonises key definitions, tangible-net-worth requirements (a floor of $100,000 rising with transaction volume), permissible investments (a list including certain digital assets), and the concept of a single-state examination coordinated through the Nationwide Multistate Licensing System (NMLS). The practical effect for a nationwide crypto-firm is a modest reduction in per-state variation and a lower marginal cost of adding new state licences — but the base cost of nationwide licensing remains high.

4. Wyoming Special Purpose Depository Institution

The Wyoming Division of Banking has chartered several Special Purpose Depository Institutions (SPDIs) that hold customer digital assets on a 100% reserve basis and are eligible for Federal Reserve Master Account access. This charter has become an alternative to state money-transmitter licensing for certain custody-focused business models and has been used by both stablecoin issuers and digital-asset custodians. Whether an SPDI is a viable structure for a tokenized-metals issuer depends on the physical-metal custody arrangement and the SPDI's own activities menu.

United States — Practical Path for a Tokenized-Metals Issuer

1. Path A — Institutional-only via qualified purchasers (Rule 144A / Reg D 506(c))

Structure the token as a Reg D 506(c) offering restricted to accredited investors and qualified purchasers, or as a Rule 144A offering to qualified institutional buyers. This path avoids the need for full SEC registration, avoids most state money-transmitter licensing because the offering is not a retail money-transmission activity, and can be executed on an alternative trading system operating as a broker-dealer. The offering document (Rule 144A private placement memorandum) must contain full disclosure of the metal-backing, custody, and redemption mechanics. Estimated cost: $500,000–$1,200,000. Timeline: 6–9 months.

2. Path B — State-by-state retail rollout

Register with FinCEN as an MSB, obtain money-transmitter licences in the most attractive states first (typically Florida, Texas, California, New York via BitLicense, Illinois, Pennsylvania), and expand progressively. This path requires substantial front-loaded capital — typical minimum tangible net worth for a nationwide plan is $5–10 million, surety bonds another $5–8 million — and takes 24–36 months to build coverage of the majority of US retail demand. NYDFS BitLicense alone typically requires 18–36 months and $1–2 million in legal and compliance investment.

3. Path C — Wyoming SPDI-anchored structure

Charter a Wyoming SPDI (or partner with an existing SPDI) as the custody and reserve-holding vehicle for the tokenized-metals product. The SPDI holds the metal (or the client fiat), operates on a 100% reserve basis, and gives the structure a bank-adjacent regulatory posture that may reduce the need for state-by-state money-transmitter licensing in some states. This path remains experimental for commodity-backed tokens and requires bespoke legal analysis. Estimated cost: $2–4 million (largely the SPDI charter). Timeline: 12–24 months.

4. Path D — Deferred retail entry via federal stablecoin framework

Wait for the federal stablecoin legislation to clarify the treatment of commodity-backed tokens, and design entry once the perimeter is fixed. This path minimises regulatory build-out but sacrifices first-mover position and depends on unpredictable legislative timing. A reasonable expectation is that federal stablecoin rules will be enacted in 2026–2027, with implementing rules through 2027–2028.

5. Timeline and cost summary

Path A (institutional Reg D / Rule 144A) is the fastest and least expensive US entry route: 6–9 months and $500k–$1.2m. Path B (nationwide retail) is by far the most expensive: 24–36 months and $10–15 million all-in for 40+ state licences plus BitLicense. Path C (SPDI) sits in the middle and has strategic optionality. Path D (wait) is a strategic choice about entry timing rather than a technical structuring choice.

Canada — Regulatory Perimeter: the CSA, Provincial Regulators and FINTRAC

1. Securities-law perimeter: crypto contracts and the platform itself

The CSA's foundational position, set out in CSA Staff Notice 21-327 and refined across subsequent notices, is that a crypto-asset trading platform (CTP) offering client access to crypto assets typically creates a contractual right or claim against the platform (a “crypto contract”) that is itself a security and/or derivative, even where the underlying crypto asset is not itself a security. This means most Canadian CTPs must register as investment dealers (via the Canadian Investment Regulatory Organization, CIRO) or under a bespoke restricted dealer category, regardless of how the underlying token itself is classified (OSC, Crypto businesses — registration and compliance).

2. FINTRAC and MSB registration for virtual-currency dealers

Separately from securities law, any entity dealing in virtual currency as a business — exchanging, transferring, or providing custody-adjacent services — is treated as a money services business (MSB) under the PCMLTFA and must register with FINTRAC, implement a compliance programme (risk assessment, policies and procedures, a compliance officer, ongoing training and independent review), conduct client identification and maintain records, and file large-transaction and suspicious-transaction reports. Foreign entities directing services at persons in Canada must also register with FINTRAC even without a Canadian physical presence (FINTRAC, home page).

3. Commodity-token analysis: the Pacific Coin Exchange test

Where a token represents a claim on a physical commodity rather than an investment in a common enterprise, Canadian courts and regulators apply a fact-specific investment-contract test derived from Pacific Coast Coin Exchange v. Ontario Securities Commission (1978) — itself Canada's adaptation of the US Howey test. A token is more likely to fall outside securities law where it represents a straightforward, redeemable claim on an identifiable, deliverable quantity of a physical commodity with no pooled managerial effort or profit-sharing expectation; it is more likely to fall inside securities law where returns depend on the efforts of a promoter, the commodity is not individually earmarked, or the token carries yield, staking or trading-profit features layered on top of the metal exposure.

Canada Licence Categories: Restricted Dealer, CIRO Investment Dealer and MSB Registration

1. Restricted dealer registration (historical bridge)

Before mid-2024, CTPs seeking to operate in Canada while awaiting full registration typically obtained time-limited restricted dealer registration from their principal regulator, subject to terms and conditions covering custody and segregation of client crypto assets, prohibitions on rehypothecation, and restrictions on offering margin or leverage. CSA Staff Notice 21-330 (joint with IIROC, now CIRO) additionally set requirements around advertising, marketing and social-media use for crypto-trading platforms, given retail-investor exposure to promotional claims (CSA/IIROC, Staff Notice 21-330, Guidance for Crypto-Trading Platforms).

2. Full CIRO investment dealer / marketplace registration

The durable end-state for a Canadian CTP is registration as an investment dealer with membership in CIRO, or as a recognised marketplace, subject to capital, proficiency, insurance, custody-segregation and reporting requirements comparable to a conventional broker-dealer. Bitbuy, Netcoins and Kraken Canada are among the platforms that have obtained registered/exemptive-relief status to operate as CTPs offering crypto products to Canadian investors, listed on the OSC's public crypto-businesses registry alongside the terms and conditions attached to each platform's registration (OSC, Crypto businesses — registration and compliance).

3. FINTRAC MSB registration and the AML compliance programme

Independently of securities registration, any dealer in virtual currency must register as an MSB with FINTRAC, implement a five-pillar AML/ATF compliance programme (risk assessment; policies and procedures; compliance officer; ongoing training; effectiveness review), conduct know-your-client identity verification, and file records and reports (large virtual-currency transaction reports, suspicious transaction reports) in the prescribed FINTRAC format. Registration is mandatory whether or not the entity has a physical Canadian presence, provided it directs services at persons in Canada (FINTRAC, home page).

Tokenized-Commodity Rules: Disclosure Notice 51-363, VRCAs and the TSX Venture Exchange Nexus

1. CSA Staff Notice 51-363 — disclosure by crypto-asset reporting issuers

Published in March 2021 and still the operative CSA guidance on issuer-level crypto disclosure, Notice 51-363 sets expectations for reporting issuers that hold or deal in crypto assets: safeguarding disclosure (custody arrangements, whether assets sit with a third-party CTP or are self-custodied), risks of relying on a trading platform that does not hold assets as agent, and clear disclosure of valuation methodology. A tokenized-metals issuer that is a Canadian reporting issuer, or cross-lists into Canada, would apply this disclosure lens to its metal-backing custody chain and any crypto-asset exposure on its balance sheet (CSA, Staff Notice 51-363, Observations on Disclosure by Crypto Assets Reporting Issuers).

2. Value-referenced crypto assets (VRCA) interim framework

The CSA's interim approach to value-referenced crypto assets — tokens whose value is designed to track a reference asset, such as fiat currency or, by extension, a commodity price — requires issuers to provide an undertaking to the CSA covering reserve backing, redemption rights and disclosure, published on the OSC's crypto-businesses page. While the VRCA framework was designed principally with fiat-referenced stablecoins in mind, its reserve-backing and redemption-disclosure logic maps closely onto a metals-backed token, and Canadian platforms listing a tokenized-metals product would likely need to treat it analogously pending dedicated commodity-token guidance (OSC, Crypto businesses — registration and compliance).

3. Physical-commodity securities analysis under Pacific Coast Coin Exchange

For the underlying token itself (as opposed to the trading-platform contract), Canadian regulators apply the Pacific Coast Coin Exchange investment-contract test: a token redeemable for a specifically identifiable, deliverable quantity of allocated metal, without pooled managerial effort or profit expectation, sits closer to a commodity than a security. Layering in yield, staking rewards, or profit-sharing from active trading of the metal pool pulls the analysis back toward securities treatment, triggering prospectus or exemption requirements under the applicable provincial Securities Act.

2025–26 Developments: End of Pre-Registration Undertakings and the CIRO Direct-Registration Era

1. End of new pre-registration undertakings (August 2024)

Since 2021, the CSA's interim approach allowed unregistered CTPs meeting eligibility criteria to continue operating in Canada by filing a PRU with their principal regulator — committing to custody segregation, no rehypothecation, no margin/leverage, and restrictions on proprietary-token promotion — while registration was reviewed. As of August 2024 the CSA no longer accepts new PRUs; new platforms must apply directly to CIRO, closing off the softer bridge status for any new entrant, including a new tokenized-metals trading venue (OSC, Crypto businesses — registration and compliance).

2. CIRO consolidation and direct crypto-platform oversight

The 2023 merger of IIROC and the Mutual Fund Dealers Association into the single Canadian Investment Regulatory Organization (CIRO) consolidated day-to-day supervisory responsibility for crypto-trading platforms into one self-regulatory body working under CSA policy oversight, replacing the prior split between IIROC-supervised dealers and provincial commissions. This gives applicants a single supervisory point of contact for trading-platform registration, distinct from the separate provincial/CSA process for prospectus and continuous- disclosure obligations.

3. Continued VRCA undertaking activity and stablecoin scrutiny

Through 2025–26, the CSA has continued publishing individual VRCA issuer undertakings on the OSC's crypto-businesses page as new stablecoin-style tokens seek Canadian distribution, reinforcing that any fiat- or commodity-referenced token distributed on a Canadian platform needs either a VRCA-style undertaking or a bespoke exemptive-relief order tailored to its reserve and redemption mechanics (OSC, Crypto businesses — registration and compliance).

Practical Path for a Canada-Linked Tokenized-Metals Issuer

1. Two viable structures

Option A — disclosure/reserve anchor only: incorporate an offshore issuer (e.g. Cayman or Bermuda, per the parallel deep-dives) and contract with Canadian mining-industry service providers — NI 43-101 qualified persons, TSXV-adjacent assayers and auditors — for reserve verification and disclosure standards, without registering any Canadian trading platform or MSB. Option B — full Canadian trading venue: establish a Canadian entity, register as an MSB with FINTRAC, and pursue CIRO registration (or an exemptive-relief order from the principal regulator) to operate a Canadian-facing tokenized-metals trading platform, subject to the full CTP custody, segregation, insurance and disclosure stack.

2. Filing sequence and timeline (Option B)

Month 0–2 — Canadian entity incorporation, FINTRAC MSB registration filing, AML/ATF compliance programme build (risk assessment, policies, compliance officer); Month 2–7 — CIRO registration application (business plan, proficiency, capital, custody-segregation arrangements) filed with the principal provincial regulator, Notice 51-363-aligned disclosure package prepared if the entity will be a reporting issuer; Month 7–12 — regulator review, VRCA-style undertaking negotiated if the token is treated as value-referenced; Month 12–16 — registration granted, platform launch, first listing, ongoing CIRO and FINTRAC reporting cadence begins.

3. Distribution posture and cost envelope

A CIRO-registered Canadian CTP can distribute directly to Canadian retail and institutional investors — a genuine retail on-ramp that Cayman and Bermuda structures cannot offer without a separate onshore vehicle. Two-year all-in cost for the full Option B build sits in the USD 1.5–3.5 million range: legal and provincial filings (USD 300–600k), CIRO registration and ongoing dues (USD 150–400k), FINTRAC compliance programme and reporting infrastructure (USD 150–300k), custody and segregation technology (USD 200–450k), NI 43-101-aligned reserve verification and disclosure (USD 100–250k), and governance/compliance staffing (USD 500–900k). The lighter Option A (disclosure/reserve-anchor only) costs roughly USD 200–500k over the same period and can run in parallel with an offshore issuance vehicle (OSC, Crypto businesses — registration and compliance).

Cayman Islands — Regulatory Perimeter: CIMA, the VASP Act and Phase 2 Licensing

1. VASP Act scope and the seven VASP activities

The VASP Act defines a virtual asset service provider as any entity that, in the course of business, conducts one or more of the following seven activities for or on behalf of another person: exchange between virtual assets and fiat, exchange between one or more forms of virtual assets, transfer of virtual assets, safekeeping or administration of virtual assets or instruments enabling control, participation in and provision of financial services related to a virtual asset issuance, virtual asset issuance, and operation of a virtual asset trading platform. An entity incorporated in Cayman that carries on any of these activities in or from Cayman falls inside the perimeter and must register or, for custody and trading, obtain a full CIMA licence (Collas Crill, VASP Regulatory Policy overview).

2. Registration versus licensing after Phase 2

Before 1 April 2025, all seven VASP activities were captured through registration with CIMA. Phase 2 elevates two activity categories to a full licence: virtual asset custody services and operation of a virtual asset trading platform. All existing VASPs providing these services had until 29 June 2025 to file a licence application. Other activity types (exchange, transfer, issuance, participation in issuance) continue under a registration regime. CIMA retains residual power to require any registered VASP to convert to a licensed VASP where risk profile, client-asset volume or systemic footprint warrants closer supervision.

3. Adjacent regimes for tokenized funds and securities

A Cayman tokenized-commodity vehicle typically sits at the intersection of the VASP Act and the investment-funds framework. Where the token represents a participation in a collective investment vehicle, the vehicle itself is regulated under the Mutual Funds Act (2025 Revision) or the Private Funds Act (2025 Revision), and the on-chain unit is treated as a tokenized fund interest. Where the fund's virtual-asset activity is incidental to its regulated fund purpose — e.g. tokenized share class of an otherwise conventional metals fund — CIMA's guidance clarifies that the fund does not additionally require a full VASP registration. Broker-dealer and advisory activity around such tokens continues to be captured by SIBA (CIMA, Regulatory and Legislative Overview).

Cayman Licence Categories: VASP Registration, VASP Licence and Sandbox Licence

1. VASP registration — the default permission

A registered VASP conducting exchange, transfer, issuance or participation activities must maintain a Cayman-registered entity (typically an exempted company incorporated under the Companies Act), file fit-and-proper assessments for all senior officers and controllers, adopt AML/CFT policies and appoint an Anti-Money Laundering Compliance Officer (AMLCO), a Money Laundering Reporting Officer (MLRO) and a Deputy MLRO. A registered VASP must file audited financial statements annually and notify CIMA of material changes in ownership, control, product or systems. CIMA's registration fee ladder starts at USD 6,100 for annual renewal (higher for larger balance-sheet entities).

2. VASP licence — custody and trading platforms

A licensed VASP must satisfy elevated requirements: a minimum of three directors, at least one of whom is independent; a comprehensive business plan supported by a documented enterprise risk assessment; robust segregation of client assets (with clear disclosures around loss allocation, insurance cover and liability limits); cyber-security controls (multi-signature or hardware-secured custody, disaster recovery, penetration testing); and capital adequacy proportionate to operating scale. CIMA retains the power to require audited interim financials, issue cease-and-desist orders, impose remediation and, in extreme cases, revoke the licence. Licensing fees materially exceed registration fees and vary by activity (custody typically higher than trading).

3. Sandbox licence — novel activities

Where a proposed virtual-asset activity does not yet fit a defined VASP category, the sandbox licence permits time-limited operation (up to one year, renewable at CIMA's discretion) under bespoke conditions. CIMA typically imposes a client-cap, activity-cap, restricted product perimeter, and enhanced reporting cadence. The sandbox is used for novel tokenization structures (e.g. programmable settlement rails, DLT-native fund servicing, novel custody topologies) and functions as a supervised on-ramp to a full registration or licence. It is not a shortcut — applicants must satisfy the same fit-and-proper and AML/CFT baseline as any VASP applicant.

Tokenized-Commodity Rules: Fund Structures, Client-Asset Segregation and Governance

1. Structuring a tokenized-metals product in Cayman

The dominant pattern is a Cayman exempted company or segregated portfolio company (SPC) established as a fund under the Mutual Funds Act (2025 Revision) or Private Funds Act (2025 Revision), holding physical metal (or fully-backed metal claims) as investment property, and issuing tokenized participating shares or fund interests on a permissioned or public ledger. The fund vehicle is subject to CIMA registration under the applicable Funds Act, appoints a Cayman-licensed fund administrator and independent auditor, and files audited financial statements annually. Where the fund also operates its own on-chain trading facility, or provides custody to third parties, a separate VASP licence is required for that operating layer.

2. Client-asset segregation and delivery mechanics

Segregation is enforced at three levels: legal (fund vehicle owns metal, investors own tokenized fund interests, not the metal directly — identical to a conventional ETP); operational (CIMA rules on client-asset commingling and reconciliation apply to the licensed custodian if custody is Cayman-domiciled); and on-chain (multisig or MPC controls, custody segregation between fund assets and platform working capital, disclosed insurance cover). Redemption for physical metal is contractual and depends on the underlying custody chain — typical structures use London/Zurich/Singapore vaulted metal with LBMA- accredited refiners and delivery via allocated withdrawal at a listed vault.

3. Marketing, distribution and cross-border reach

Cayman-domiciled tokenized-commodity funds are typically distributed to non-US professional and institutional investors under Reg S, and to US-based qualified purchasers under Rule 144A or Section 3(c)(7) side pockets. MiCA-scope European distribution requires a MiCA-authorised affiliate; UK distribution requires FCA overseas-fund recognition or professional-only marketing. Cayman offers no direct passport into the EU, UK, US or Asia — it is a global holding domicile paired with local distribution vehicles. Broker-dealers and portfolio managers dealing in Cayman tokenized fund interests must hold the relevant SIBA registration or an SIBA exemption.

2025–26 Developments: Phase 2 Licensing, Regulatory Policy Update and Post-FATF Grey-List Momentum

1. Phase 2 licensing effective 1 April 2025

The most consequential single change in the Cayman crypto rulebook. Custody and trading-platform VASPs are now fully licensed rather than registered, with independent-director, business-plan, capital-adequacy, segregation, insurance and cyber-security obligations elevated to line up with international regulator expectations. All existing VASPs in these two categories were required to file a licence application by 29 June 2025; CIMA is publicly processing applications, with the first Phase 2 licences issued in the second half of 2025.

2. Revised VASP Regulatory Policy (May 2025)

Published on 23 May 2025, the revised policy expands governance and disclosure requirements across both registered and licensed VASPs: a formal comprehensive business plan covering products, target markets, capital, delivery, redemption and wind-down; documented enterprise risk assessments; explicit client-asset segregation disclosures with insurance cover, liability limits, and loss-allocation policies; and mandatory reporting of material operational incidents within defined windows. CIMA also clarified how the policy applies to tokenized funds: where virtual-asset activity is incidental to a regulated fund purpose, the fund itself is regulated under the Mutual Funds Act (2025 Revision) or Private Funds Act (2025 Revision) rather than separately registered as a VASP.

3. Post-grey-list normalisation and correspondent access

Cayman was removed from the FATF grey list in October 2023, with the EU's own AML high-risk list adjusted shortly afterwards. The practical effect through 2024–26 has been a marked normalisation of correspondent-bank access, USD funding relationships and fiat on/off ramps. Combined with Phase 2 licensing, this positions Cayman as a serious institutional domicile for tokenized-commodity structures targeting US and European institutional demand, and no longer subject to the reputational discount that constrained the jurisdiction in the 2020–22 window.

Practical Path for a Cayman Tokenized-Metals Issuer

1. Structure and vehicle choice

The default architecture is a Cayman exempted company (or segregated portfolio company where multiple metal buckets or strategies are contemplated) registered as a Private Fund under the Private Funds Act (2025 Revision). Physical metal (or fully-backed metal claims) sits on the fund balance sheet; tokenized participating shares are issued on a public or permissioned ledger with a Cayman-licensed administrator and auditor. Where the operating team runs its own on-chain trading facility or provides custody to third parties, a separate VASP licence is required for that operating layer — often held in a subsidiary that segregates operational risk from the fund.

2. Filing sequence and timeline

A realistic Cayman timeline: Month 0–2 — entity incorporation, board composition, appointment of AMLCO/MLRO/DMLRO, engagement of Cayman legal counsel, fund administrator, auditor and Cayman-licensed custody counterparty; Month 2–5 — VASP registration or Phase 2 licence application filed with CIMA, fund registration filed under the Private Funds Act (2025 Revision), full documentation stack (business plan, risk assessments, AML/CFT policies, segregation and cyber-security policies) submitted; Month 5–10 — CIMA review, iterative Q&A, remediation; Month 10–14 — final approvals, launch of tokenized share class, first NAV, first redemption. Custody and trading-platform (Phase 2 licensed) VASPs sit at the longer end of this range; pure issuance/exchange (registered) VASPs at the shorter end.

3. Distribution posture and cost envelope

Distribution is non-Cayman-driven: Cayman is a domicile, not a distribution market. Placement typically runs into non-US professional and institutional investors under Reg S, into US qualified purchasers via 3(c)(7) side-pockets or Rule 144A, and into MiCA-scope European investors via a MiCA-authorised affiliate. UK distribution requires FCA overseas-fund recognition or professional-only marketing under FSMA. Two-year all-in build cost sits in the USD 1.5–3 million range: legal (USD 300–600k), CIMA filing and licensing fees (USD 100–250k depending on Phase 2 status), fund administrator and auditor (USD 200–400k), custody set-up (USD 150–400k), technology and audit (USD 200–500k), governance and compliance staff (USD 400–800k). This is materially below Switzerland or a MiCA-authorised EU entity, and modestly above pure BVI or offshore-only structures.

Bermuda — Regulatory Perimeter: the BMA, DABA and the Digital Asset Issuance Act

1. DABA scope and the five (now six) digital asset business activities

DABA defines digital asset business as, in the course of business, carrying on one or more of: issuing, selling or redeeming virtual coins, tokens or any other form of digital asset; operating a payment service business utilising digital assets, including transfer of funds; operating as an electronic exchange; providing digital asset custodial wallet services; and operating as a digital asset services vendor (execution of client transactions or market making). A later amendment added digital asset lending and repurchase transactions (including staking-type products) to the perimeter. Any entity carrying on these activities in or from Bermuda — whether or not incorporated locally — must hold a BMA licence unless a specific exemption applies (intra-group services, licensed fund structures with a licensed investment manager, and pure data-storage/security services) (Bernews, Digital Asset Business Act 2018 (consolidated text)).

2. DAIA and the ICO Act — capital-raising issuance

Where a token is issued primarily to raise capital for a venture or project, the activity falls under the Digital Asset Issuance Act 2020 rather than DABA: an issuer must be an authorised undertaking under DAIA, satisfy disclosure obligations to acquirers, and segregate acquirer funds until the issuance completes. The 2018 ICO Act amendment to the Companies Act was the first vehicle for this activity and remains on the books, empowering the Minister (in consultation with the FinTech Advisory Committee) to issue an ICO Code of Conduct covering client identification, record-keeping and internal reporting (Bermuda Laws Online, Companies and LLC (Initial Coin Offering) Amendment Act 2018). Where a token instead has the characteristics of an ongoing business — continuous issuance for profit — the activity is captured as DABA business rather than DAIA issuance.

3. Segregated Accounts Companies Act — asset ring-fencing

The Segregated Accounts Companies Act 2000 allows a single Bermuda company to maintain legally ring-fenced segregated accounts, each with its own assets and liabilities protected from the creditors of other accounts within the same entity. This is the standard Bermuda tool for isolating a metals-backing pool (or multiple metal buckets — gold, silver, platinum) inside one operating company without needing a separate legal entity per pool, provided the company maintains separate records, financial statements and account-owner registers for each segregated account and discloses SAC status to counterparties (Appleby, Segregated Account Companies in Bermuda).

Bermuda Licence Categories: Class F, Class M and Class T Under the DABA

1. Class F — full digital asset business licence

A Class F licensee may provide any or all of the digital asset business activities defined under DABA — issuance/sale/redemption, payment services, exchange operation, custodial wallet services and services-vendor activity — on an indefinite basis, subject to regular supervisory visits from the BMA's FinTech, AML and cyber-risk units. Minimum net-asset requirement is USD 100,000 (or higher, at BMA discretion, based on nature, size and complexity); application fee is USD 2,266. Annual fees follow a formula — the lower of USD 450,000 or 0.00075 of estimated client receipts, subject to activity-based minimums (custody of client private keys carries a USD 150,000 minimum annual fee). HashKey Bermuda obtained a Class F digital asset business licence in the 2023–2024 window, and Circle was the first major crypto-finance firm to receive a Class F licence covering payments, custody, exchange and trading, in 2019 (Circle, Bermuda Digital Assets Business License announcement).

2. Class M — modified/transitional licence

The Class M licence lets an applicant move from a Class T proof-of-concept into commercial-scale operation while it builds out its compliance programme, typically for a 12-month period subject to BMA-imposed restrictions and supervisory visits. Application fee is USD 2,266, with the same USD 100,000 minimum net-asset requirement as Class F. Class M is the practical route for a new issuer or custodian that has outgrown sandbox testing but is not yet ready for the full ongoing-supervision cadence of Class F.

3. Class T — test/sandbox licence

The Class T licence is Bermuda's regulatory sandbox: a restricted, time-limited permission for testing a novel digital-asset business model under close BMA oversight, with a lower application fee of USD 1,000 and the same USD 100,000 net-asset floor. Class T licensees operate under caps on client numbers, transaction volume and product scope, with enhanced reporting to the BMA's FinTech Department. All three classes require a comprehensive application pack — business plan, fit-and-proper controller disclosures, AML/ATF policies, cybersecurity framework — submitted for review by the BMA's Assessment and Licensing Committee (ALC) (Charltons Quantum, Overview of the Regulation of Digital Assets in Bermuda).

Tokenized-Commodity Rules: Custody Code, Segregated Accounts and Client-Asset Protection

1. Digital Asset Custody Code of Practice

Issued under section 6 of DABA, the Digital Asset Custody Code of Practice sets out detailed technical standards across three domains — Custody Safekeeping (key generation, seed and wallet management), Custody Transaction Handling (multi-signature or MPC authorisation, transaction monitoring) and Custody Operations (hot/cold storage ratios, incident reporting, disaster recovery, penetration testing). A custodian must maintain client assets segregated from its own assets, held either in trust with a qualified custodian, or backed by a surety bond or indemnity insurance sufficient to make clients whole on insolvency or theft (Bermuda Monetary Authority, Digital Asset Custody Code of Practice).

2. 2025 Custody of Client Assets Rules

On 20 February 2025, the BMA published the Digital Asset Business (Custody of Client Assets) Rules 2025, taking immediate effect for all DABA licensees providing custodial wallet services. The Rules require an annual independent expert review of controls over client assets, prompt crediting of client assets on receipt into a segregated client account, and a defined priority waterfall on default — costs of the pooling exercise first, then client claims pari passu, then the provider's own claims last. On certain “pooling events” (provider default, or a BMA direction), all client assets across accounts must be pooled and made available to meet client claims proportionately (Rees Davies (Ogier), BMA publishes new rules for digital asset custody).

3. Segregated Accounts for metal-backing pools

A tokenized-metals issuer typically pairs its DABA/DAIA licence with a Segregated Accounts Company (SAC) structure: the operating company maintains one segregated account per metal or per share class (e.g. allocated gold account, allocated silver account), each with its own asset register, financial statements and creditor ring-fence. This avoids the cost of multiple subsidiaries while giving investors in one token class legal insulation from losses in another. Vaulting and delivery mechanics sit outside Bermuda law — typical structures use LBMA-accredited vaults in London, Zurich or Singapore with allocated withdrawal rights (Appleby, Segregated Account Companies in Bermuda).

2025–26 Developments: Custody Rules, HashKey Entry and the Circle Tokenized-Fund Build-Out

1. Digital Asset Business (Custody of Client Assets) Rules 2025

Published 20 February 2025 after industry consultation, these Rules represent the most significant custody-specific rulemaking since the original 2019 Custody Code, adding a mandatory annual independent controls review, a defined client-asset priority waterfall, and immediate-crediting obligations on receipt of client assets. All existing custodial-wallet DABA licensees had to demonstrate compliance without a grace period, given the Rules' immediate-effect commencement (Rees Davies (Ogier), BMA publishes new rules for digital asset custody).

2. HashKey Bermuda and continued Asian-issuer interest

HashKey, the Hong Kong- and Asia-focused digital-asset group, established a BMA-licensed Bermuda presence in the 2023–2024 window, part of a broader pattern of Asian and Middle Eastern digital-asset groups using Bermuda as a Western-hemisphere-compatible, English-common- law domicile with a mature regulator and no separate distribution passport requirement into any single bloc. The BMA continues to publish licensing guidance aimed at prospective applicants, most recently updated in September 2025 (Bermuda Monetary Authority, Digital Asset Business Guidance for Prospective Applicants).

3. Circle's Hashnote tokenized money-market fund under its existing DABA licence

In March 2025, Circle announced it intends to bring its Hashnote tokenized money- market fund (TMMF) product under its existing Bermuda DABA licence rather than seeking a fresh permission, illustrating how the BMA's activity-based licence categories flex to cover new tokenized-asset structures without new primary legislation. Circle's Bermuda DABA licence (No. 54786) remains listed among its active global licences (Circle, Circle Intends to Bring Hashnote TMMF Under Existing DABA License).

Practical Path for a Bermuda Tokenized-Metals Issuer

1. Structure and licence sequencing

The recommended structure is a Bermuda exempted company with a Segregated Accounts Company (SAC) election, holding physical metal (or fully-backed metal claims) in one or more segregated accounts. The operating entity applies for a Class T licence to test the issuance-plus-custody model at limited scale, then transitions to Class M for roughly 12 months while building out its full compliance programme, and finally to Class F for indefinite operation covering both DAIA-style issuance and DABA custodial wallet services. A physical Bermuda presence with senior decision-makers on the island is mandatory throughout (BMA, Digital Assets Regulation).

2. Filing sequence and timeline

A realistic Bermuda timeline: Month 0–2 — entity incorporation, SAC election, Bermuda office lease and senior-officer relocation/appointment, engagement of Bermuda counsel and a qualified custodian or MPC-custody vendor; Month 2–6 — Class T or Class M application filed with the BMA's FinTech Department (business plan, controller fit-and-proper files, AML/ATF policy suite, Custody Code compliance mapping, cybersecurity policy suite), reviewed by the Assessment and Licensing Committee; Month 6–10 — BMA review and iterative Q&A, appointment of a locally qualified custodian if outsourcing rather than self-custody; Month 10–15 — licence grant, first token issuance, first redemption cycle, transition planning toward Class F.

3. Distribution posture and cost envelope

Bermuda, like Cayman, is a domicile rather than a distribution passport: onward marketing into the US, EU, UK or Asia requires separate local compliance (Reg S/Rule 144A for the US, a MiCA-authorised affiliate for the EU, FCA-compliant marketing for the UK). Two-year all-in cost sits in the USD 1.2–2.5 million range: legal and incorporation (USD 250–450k), BMA application and annual fees (USD 100–450k depending on licence class and client-receipts formula, with a USD 150,000 annual minimum if self-custodying), custody technology and Custody Code compliance build (USD 200–400k), AML/ATF and cyber-risk programme (USD 150–300k), and governance/compliance staffing including a Bermuda-resident presence (USD 400–800k). This is broadly comparable to Cayman's Phase 2 licensing cost and modestly below a full MiCA-authorised EU entity (Cryptoverse Legal Consultancy, Bermuda Digital Asset License 2025).

British Virgin Islands — Regulatory Perimeter: the VASP Act 2022 and the BVI FSC

1. VASP Act scope and the three regulated activities

The VASP Act defines a virtual assets service provider as a person who, by way of business, carries on one or more of three regulated activities in or from the Virgin Islands: virtual asset custody services, operation of a virtual asset trading platform, and the broader residual category of virtual asset services (which captures exchange, transfer and issuance-related activity not otherwise carved out). The Act also expressly excludes certain activities from scope — for example, persons dealing solely on their own account, or activity that is incidental to another BVI-regulated financial-services licence. Any entity incorporated under the BC Act that performs one of the three activities from BVI must register with the FSC before commencing business (BVI FSC, Legislation Library — Virtual Assets).

2. Registration architecture and the FSC's supervisory role

Unlike Cayman's tiered registration-versus-licence model, the BVI VASP Act operates a single registration gateway for all three activities, with the FSC applying differentiated conditions depending on activity risk — custody and trading-platform operators face materially higher requirements (client-asset segregation, systems audits, minimum capital) than pure issuance or advisory-adjacent activity. The FSC retains ongoing supervisory powers: it can impose licence conditions, demand remedial action, and, in serious cases, suspend or cancel a VASP's registration. Registered VASPs must appoint an authorised representative resident in the BVI, an FSC-approved auditor, and maintain measures to protect client assets from commingling with the VASP's own operating funds (BVI FSC, Virtual Assets Service Providers Act, 2022).

3. Corporate wrapper and adjacent fund infrastructure

The default vehicle for a BVI VASP or token issuer is a company incorporated under the BVI Business Companies Act — the same flexible, low-friction corporate statute that underpins the jurisdiction's broader role as a holding-company domicile. Where the structure also involves pooled investment (rather than pure token issuance), the Approved Manager regime under SIBA lets a BVI-domiciled manager or adviser operate under a lighter self-certification process rather than a full Part I SIBA licence, subject to asset-under-management caps. The BVI is FATCA and CRS compliant, giving BVI vehicles the tax-information exchange credentials expected by institutional counterparties and correspondent banks (Harneys, Guide to the BVI Approved Manager Regime).

BVI Licence Categories: VASP Registration by Activity, Approved Manager and Fund Recognition

1. VASP registration — services, custody and trading

A VASP performing the residual virtual asset services category (exchange, transfer, issuance-support activity) faces the FSC's baseline conditions: fit-and-proper vetting of directors and controllers, a BVI-resident authorised representative, an FSC-approved auditor, AML/CFT policies, and ongoing reporting to the Commission. Applicants seeking to provide virtual asset custody or to operate a trading platform face additional, activity-specific conditions covering client-asset segregation, systems-and-controls audits, cyber-security standards and minimum capital — conceptually similar to Cayman's licensed tier, but administered as enhanced conditions within the same VASP Act registration rather than as a categorically separate licence (BVI FSC, Virtual Assets Service Providers Act, 2022).

2. AML/CFT overlay: AMLR and the Proceeds of Criminal Conduct Act

Every registered VASP is a relevant person for AML/CFT purposes under the Anti-Money Laundering Regulations (AMLR) and the Proceeds of Criminal Conduct Act, requiring appointment of a Money Laundering Reporting Officer (MLRO), documented customer due diligence, ongoing transaction monitoring, and suspicious-activity reporting to the BVI's Financial Investigation Agency. This AML/CFT overlay applies irrespective of which of the three VASP Act activities the entity performs, and is enforced jointly by the FSC (prudential supervision) and the FIA (financial-intelligence and enforcement).

3. Approved Manager and fund-recognition categories under SIBA

Where a BVI structure pools investor capital — rather than issuing a bare utility or payment token — the manager or adviser can typically register under the Approved Manager regime: a self-certification process available seven days after filing, subject to caps of USD 400 million in assets under management for open-ended funds and USD 1 billion for closed-ended funds. The underlying fund itself is recognised under SIBA as an incubator fund, approved fund, private fund or professional fund, each with its own investor-number and minimum-investment thresholds. This combination gives a fast, low-cost path to a regulated fund wrapper that can hold tokenized commodity exposure, separate from the VASP Act's activity-based registration (Harneys, Guide to the BVI Approved Manager Regime).

Tokenized-Commodity Rules: Issuance-Only Structures, Custody Carve-Outs and Fund Wrappers

1. Structuring a tokenized-metals issuer in the BVI

The typical pattern is a BVI business company incorporated under the BC Act that holds physical metal (or a fully-backed metal claim held via a custody agreement with a third-party vault or bullion bank) and issues tokenized certificates or fund interests representing a claim on that metal. If the BVI entity's only VASP Act-relevant conduct is the act of issuance — with custody performed by a separately licensed custodian in another jurisdiction (e.g. a Swiss or Singapore vault) and trading conducted on third-party venues — the BVI issuer itself may fall within the lighter end of the VASP Act's registration conditions rather than the custody or trading-platform tier. Where the manager pools investor capital into a fund vehicle, the Approved Manager and SIBA fund-recognition categories apply in parallel.

2. Client-asset segregation where the BVI entity is issuance-only

Segregation in an issuance-only BVI structure is achieved primarily through contractual and legal separation rather than BVI FSC custody rules: the metal sits with a third-party custodian under its own regulatory regime, the BVI issuer holds a claim against that custodian, and token holders hold a claim against the BVI issuer. This is a materially thinner segregation chain than Cayman's fund-plus-VASP-licence model, where CIMA's client-asset rules apply directly to a Cayman-domiciled custodian. Any BVI entity that instead takes on direct custody of client virtual assets must meet the VASP Act's custody-specific segregation, reconciliation and insurance-disclosure conditions in full.

3. Marketing, distribution and reputational considerations

BVI-domiciled tokenized-commodity structures are distributed on essentially the same cross-border basis as Cayman vehicles — Reg S placement to non-US investors, Rule 144A or private-placement routes into the US, and MiCA-authorised or FCA-recognised affiliates for EU and UK distribution. The BVI carries no direct passport into any major market. Institutional counterparties' diligence teams will typically flag that the BVI's virtual-asset regime, in force only since February 2023, has a materially shorter supervisory track record than Cayman's VASP Act (in force since 2020) and lacks a Phase-2-equivalent custody/trading licensing upgrade, which can matter for prime-broker and custodian onboarding.

2025–26 Developments: Steady-State Supervision, AML Alignment and Competitive Positioning

1. Transitional period closure and steady-state registration

The VASP Act's six-month transitional period closed on 31 July 2023, after which every in-scope operator was required to hold FSC registration or cease business. Since then the FSC has operated a steady-state registration and supervision programme, with no major statutory amendment to the three-activity taxonomy through 2025–26. This contrasts with Cayman's active 2024–25 upgrade cycle and suggests the BVI regime, while functional, has not kept pace with the elevated governance and capital standards now expected by global institutional counterparties (BVI FSC, Virtual Assets Service Providers Act, 2022).

2. Continued FATCA/CRS and AML/CFT alignment

The BVI has maintained its FATCA and CRS compliance posture and its AML/CFT framework under the AMLR and Proceeds of Criminal Conduct Act, both of which apply to registered VASPs alongside the FSC's activity-based conditions. This gives BVI vehicles the baseline tax-information-exchange and AML credentials expected by correspondent banks, but the jurisdiction has not published an equivalent to Cayman's May-2025 VASP Regulatory Policy refresh, leaving governance, disclosure and segregation expectations comparatively less detailed on paper.

3. Competitive positioning against Cayman and other offshore centres

Through 2025–26, the BVI has continued to compete primarily on speed and cost of incorporation and fund set-up rather than on regulatory depth — the Approved Manager regime's seven-day self-certification path remains materially faster than any Cayman equivalent. For pure holding-company and SPV work, the BVI Business Companies Act continues to be a globally recognised, low-friction corporate statute. For virtual-asset activity specifically, however, the jurisdiction has ceded ground to Cayman's more institutionally credible, deeper-bench VASP framework, particularly for custody and trading-platform use cases.

Practical Path for a BVI Tokenized-Metals Issuer

1. Structure and vehicle choice

The default architecture is a BVI business company incorporated under the BC Act, holding a contractual claim on physical metal custodied by a separately regulated third-party vault or bullion bank (Switzerland, Singapore or London are the common custody venues), and issuing tokenized certificates against that claim. The BVI entity registers under the VASP Act for the services category if its activity is limited to issuance and issuance-support; if the team later wants to run its own custody or trading venue, that function should sit in a separate entity — either a BVI entity registered under the custody/trading-platform conditions, or an entity in a jurisdiction with a deeper custody track record such as Cayman or Switzerland. Where capital is pooled, an Approved Manager manages a SIBA-recognised private or professional fund holding the tokenized metal exposure.

2. Filing sequence and timeline

A realistic BVI timeline: Month 0–2 — BC Act incorporation, appointment of a BVI-resident authorised representative, engagement of BVI legal counsel and an FSC-approved auditor, negotiation of the third-party custody agreement; Month 2–4 — VASP Act registration filed with the FSC (services category), AML/CFT policy suite and MLRO appointment finalised, Approved Manager self-certification filed if a fund wrapper is used; Month 4–7 — FSC review and any conditions imposed, fund-recognition filing under SIBA completed; Month 7–10 — registration confirmed, first token issuance, first NAV calculation if fund-wrapped. Custody or trading-platform registration, if pursued in-house, extends this timeline materially and should be budgeted closer to the Cayman range.

3. Distribution posture, cost envelope and trade-offs versus Cayman

Distribution follows the same Reg S / 144A / MiCA-affiliate / FCA-recognition pattern as any offshore vehicle — the BVI offers no direct market passport. Two-year all-in build cost sits in the USD 0.8–1.8 million range: legal (USD 150–350k), FSC registration and annual fees (USD 30–80k), auditor and authorised representative (USD 80–150k), third-party custody set-up (USD 150–400k, largely paid to the custody jurisdiction rather than the BVI), technology (USD 150–350k), and compliance staff (USD 250–500k). This is meaningfully below Cayman's build cost, but the trade-off is a shorter regulatory track record, a thinner bench of BVI-based fund administrators and custodians, and weaker prime-broker familiarity — factors that matter more as assets under management and institutional counterparty count grow.