Substance means the licence has to sit on a company a supervisor can actually inspect. Under MiCA that is statutory: a registered office in a Member State where you genuinely provide services, effective management in the Union, at least one EU-resident director, and capital set by service class.
Most substance guidance stops at a list — local director, registered address, AML officer, minimum capital — and leaves the reader no way to check whether their own arrangement would survive contact with a regulator. This piece takes the same four elements and asks a harder question of each one: what is the rule, where is it written, what document proves it, and what does the file look like when the element is missing?
Why is substance a legal requirement rather than good practice?
Because the international standard makes the obligation attach to a place. Paragraph 3 of the Interpretive Note to Recommendation 15 in the FATF Recommendations states that virtual asset service providers "should be required to be licensed or registered", and that at a minimum they should be licensed or registered in the jurisdiction or jurisdictions where they are created — the accompanying footnote confirms that references to creating a legal person include incorporation. The same paragraph allows jurisdictions to go further and require registration by providers that offer products or services to customers in, or conduct operations from, their territory, and it tells competent authorities to take measures preventing criminals or their associates from holding a significant or controlling interest, or a management function, in a VASP.
FATF's own virtual assets page explains what those duties consist of in practice: providers "need to carry out the same preventive measures as financial institutions, such as customer due diligence (CDD), record keeping and suspicious transaction reporting (STR)". Substance is simply the mechanism that gives those duties an owner, an address and a supervisor. Every jurisdiction below implements the same idea differently.
Directors: residency, repute and available time
The EU rule is the most explicit of the three. Article 59(2) of Regulation (EU) 2023/1114 (MiCA) requires an authorised crypto-asset service provider to have "a registered office in a Member State where they carry out at least part of their crypto-asset services", to have "their place of effective management in the Union", and provides that "at least one of the directors shall be resident in the Union". These are cumulative conditions, and Article 59(4) requires the provider to meet the conditions for its authorisation at all times — not merely on the day the file is submitted.
Article 68(1) adds the qualitative test. Members of the management body must be of sufficiently good repute and possess appropriate knowledge, skills and experience "both individually and collectively", must not have been convicted of money laundering or terrorist financing offences or other offences affecting good repute, and must "demonstrate that they are capable of committing sufficient time to effectively perform their duties". That last clause is where nominee arrangements fail on the face of the regulation, before anyone reaches a judgement about intent.
Article 63(10) turns the test into refusal grounds: the competent authority must refuse authorisation where the management body poses a threat to sound and prudent management, where its members do not meet Article 68(1), or where shareholders with qualifying holdings do not meet the repute requirement in Article 68(2).
Switzerland and El Salvador reach the same place through process rather than a residency clause. VQF's published admission procedure routes a complete file through an in-depth legal and compliance review and then an admission interview before any membership decision is taken. In El Salvador, CNAD runs a pre-registration evaluation, may request further information, and issues a reasoned "objection" or "no objection" before an applicant may move to definitive registration at all.
The office: registered office is not place of effective management
Article 59(2) contains two distinct requirements that are routinely collapsed into one. The registered office must sit in a Member State where the firm carries out at least part of its services — which rules out incorporating in a state where nothing is actually done. Separately, the place of effective management must be in the Union, which is a question about where decisions are really taken.
There is a counterpart provision worth knowing before you budget for offices. Article 59(7) permits authorised providers to operate throughout the Union under the right of establishment or the freedom to provide services, and states that providers serving clients cross-border "shall not be required to have a physical presence in the territory of a host Member State". MiCA therefore asks for home-state substance, not a footprint in every market. One properly staffed establishment is closer to the regulation than five mailboxes.
The address is not decorative, either. Article 62(2)(a) puts the applicant's legal and commercial names, legal entity identifier, website, contact email address, contact telephone number and physical address into the application file itself — the details a supervisor later uses to make contact and to verify.
The AML officer: a function, not a job title
MiCA describes the role by its outputs rather than its name. Article 62(2)(i) requires a description of internal control mechanisms, policies and procedures to identify, assess and manage risks "including money laundering and terrorist financing risks", plus a business continuity plan. Article 68(5) requires the firm to employ personnel with the knowledge, skills and expertise necessary for the responsibilities allocated to them, in proportion to the scale, nature and range of services provided.
In Switzerland the function is the whole architecture. FINMA states that professional financial intermediaries under Article 2 paragraph 3 of the Anti-Money Laundering Act "must join an SRO recognised by FINMA", that such intermediaries "are supervised by the SROs where they are affiliated, and not by FINMA", and that "SRO regulations and any amendments to them must be approved by FINMA". Those regulations set out how members implement the legal requirements — including "the requirement to establish the identity of all contractual partners and beneficial owners and the duty to report any suspicion of money laundering". VQF, one such FINMA-recognised organisation, also runs basic and advanced AMLA training for members.
Read together, the point is that an AML officer is a set of actions that must leave a trail: identify, record, monitor, escalate, report. A person who never signs anything, never appears in the audit trail and cannot describe the product cannot perform that function, whatever the org chart says.
Minimum capital: the figure, and the part that moves
Article 67(1) requires providers to hold, at all times, prudential safeguards equal to at least the higher of two amounts: (a) the permanent minimum capital in Annex IV for the type of services provided; and (b) one quarter of the fixed overheads of the preceding year, reviewed annually. Budgets almost always model (a) and ignore (b) — yet (b) is the figure that rises as the firm hires, licenses software and takes on premises.
| Element | The rule | Where it is written | What evidences it |
|---|---|---|---|
| Directors | At least one director resident in the Union; management body of good repute, competent, with sufficient time | MiCA Arts. 59(2), 68(1); refusal grounds in Art. 63(10) | Proof of repute, knowledge, skills and experience under Art. 62(2)(g) |
| Office | Registered office in a Member State where part of the services are actually carried out; effective management in the Union | MiCA Art. 59(2), with Art. 59(7) on host-state presence | Physical address, website and contact details under Art. 62(2)(a) |
| AML function | Controls, policies and procedures covering ML/TF risk; identification of contracting parties and beneficial owners; suspicion reporting | MiCA Art. 62(2)(i); FINMA-approved SRO regulations in Switzerland | The internal control description filed with the application; SRO audit in Switzerland |
| Capital | Higher of the Annex IV class amount and one quarter of the prior year's fixed overheads | MiCA Art. 67(1), Annex IV | Proof of prudential safeguards under Art. 62(2)(e) |
Annex IV sets three classes. Class 1 — execution of orders on behalf of clients, placing of crypto-assets, transfer services on behalf of clients, reception and transmission of orders, advice, and portfolio management — carries EUR 50 000. Class 2 adds custody and administration on behalf of clients, exchange of crypto-assets for funds, and exchange of crypto-assets for other crypto-assets, at EUR 125 000. Class 3 adds the operation of a trading platform, at EUR 150 000. Because the classes track service permissions, widening the business model widens the capital requirement with it.
Two further provisions are worth having in the model. Article 67(2) makes a firm in its first year use the projected fixed overheads it submitted with the application — so an optimistic cost projection raises your own floor. Article 67(4) allows the safeguard to take the form of own funds (Common Equity Tier 1 items under Regulation (EU) No 575/2013), or an insurance policy covering the Union territories where services are provided, or a combination of both; Article 67(5) requires such a policy to run for at least a year with a cancellation notice period of at least 90 days, and to be disclosed publicly on the provider's website.
Switzerland sets no MiCA-style prudential floor for SRO membership; capital follows the corporate form. The Swiss federal SME portal run by SECO gives a minimum of CHF 100,000 for a company limited by shares (AG), of which at least half must be paid in at incorporation (Aktiengesellschaft), and a minimum of CHF 20,000 for a GmbH under Article 773 of the Code of Obligations, fully paid up at incorporation (GmbH). El Salvador publishes a fee rather than a capital threshold: CNAD's registration procedure requires payment of an initial registration fee of USD 5,475 within ten days of notification of a favourable resolution. A fee is not capital, and the two belong on separate budget lines.
How does a regulator verify any of this?
Article 62(2) is effectively a deliverables list for everything above: legal and commercial names, LEI, website, contact email, telephone and physical address; legal form; articles of association; a programme of operations setting out the services and how they will be marketed; proof of the Article 67 prudential safeguards; a description of governance arrangements; proof that management body members are of good repute with the right knowledge, skills and experience; the identity of direct and indirect holders of qualifying holdings, the size of those holdings and proof of their repute; internal control mechanisms and risk policies including ML/TF risk, plus a business continuity plan; technical documentation of ICT systems and security arrangements together with a plain-language description; a description of the procedure for segregating clients' crypto-assets and funds; complaints-handling procedures; and, where relevant, a custody and administration policy or trading-platform documentation.
Each of the four substance elements maps onto at least one item in that list. Substance is not asserted; it is evidenced, and a supervisor can question any single document in the bundle.
Where do substance arrangements actually come apart?
- An EU-resident director who cannot demonstrate time. Article 68(1) is explicit about committing sufficient time, and Article 63(10)(b) makes failure to meet Article 68(1) a mandatory refusal ground.
- A registered office in a state where nothing happens. Article 59(2) requires the office to be where at least part of the services are carried out, so this fails at the threshold rather than on judgement.
- A policy suite with no operator. In Switzerland this tends to surface through the SRO's own supervision rather than at admission, which is later and more expensive.
- Capital modelled once. Article 67(1)(b) reviews annually against the prior year's fixed overheads, so a firm that grows and does not revisit the calculation can drift out of compliance without doing anything wrong commercially.
- A registration duty nobody planned for. CNAD defines a DASP as a person whose ordinary business is providing digital asset services and who is either domiciled in El Salvador or not domiciled there but "actively promotes or markets its services to potential clients in the country" — a marketing decision can create the obligation.
A closing caveat
This is a description of published rules and published procedures, not legal advice. CryptoLicense is the licensing advisory brand of CL GLOBAL SDN BHD (1421939-T); it is neither a regulator nor a law firm. No route can guarantee an outcome — granting an authorisation, or admitting a member, is entirely at the discretion of the relevant authority or self-regulatory organisation under its own rules.
If you are now translating these four elements into named people, a real address and a budget, read Substance, Cost and Risk for how the cost categories break down, the three-route comparison to confirm you are building substance for the right regime, and post-licence compliance maintenance for what these obligations look like in year two.
本文属于系列指南：完整指南见 落地与风险.