A St Vincent and the Grenadines (SVG) crypto licence is, formally, a certificate of registration as a virtual asset business issued by the SVG Financial Services Authority (FSA) under the Virtual Asset Business Act 2022. The FSA states that the Act became effective on 31 May 2025, and the Virtual Asset Business Regulations 2026, gazetted on 18 February 2026, now set out the detailed application, capital, custody and cybersecurity requirements. Any SVG Business Company or Limited Liability Company offering virtual asset services must register, wherever its customers are.
This guide explains the regime from the perspective that usually decides whether an application is credible: the operational and security controls behind the paperwork. It is not legal advice, and fee or capital figures should always be checked against the FSA's current publications before you budget for them.
What Changed in St Vincent and the Grenadines
The Virtual Asset Business Act 2022 (the VAB Act) introduced a dedicated registration regime and made it an offence to offer or operate virtual asset business in or from SVG without registration. Section 19 of the Act lists the offences, including operating without registration and making false declarations in an application, and provides for a fine and imprisonment of two years on summary conviction.
The FSA describes its own role as regulating and supervising virtual asset service providers, monitoring their anti-money laundering and counter-financing of terrorism measures, carrying out on-site inspections, and exchanging information with other supervisors and law enforcement. The 2026 Regulations then fill in what the Act left general: the form of application, the documents that must accompany it, capital and liquidity, custody of client assets, market abuse controls, the Travel Rule, and a dedicated regulation on cybersecurity and operational risk.
The FSA is also explicit that businesses operating before the Act came into force cannot simply continue. Its published FAQ states that Business Companies and LLCs providing virtual asset services before commencement must apply for registration, and that those operating after the transition period without a complete application face enforcement, including striking off and penalties.
Who Must Register
According to the FSA, a virtual asset business is an entity offering or operating any of the following services:
- Exchange between virtual assets and fiat currencies.
- Exchange between different virtual assets.
- Transfer of virtual assets.
- Custody or administration of virtual assets, or of instruments enabling control over them.
- Financial services related to the issuance or sale of a virtual asset.
Only Business Companies and LLCs are eligible to apply. Two points in the FSA's guidance catch out international groups. First, an SVG company needs registration even if all of its virtual asset services are delivered from outside SVG. Second, registration in SVG does not authorise activity elsewhere: the FSA expects registrants to confirm, before offering services in a foreign jurisdiction, whether a licence is needed there and to obtain it.
The FSA lists three exemptions: a company that only provides technology (its example is cloud storage for crypto data), a private individual making personal transfers, and a business using cryptocurrency only for its own transactions. Teams building wallets, custody tooling or infrastructure should be careful with the technology exemption. If the business holds or can exercise control over client keys, it is much closer to custody or administration than to pure technology provision.
Is It a DASP Licence? SVG Terminology Explained
Searches for an "SVG DASP licence" are common, and the terminology causes real confusion. "Digital Asset Service Provider" (DASP) is the term used in El Salvador, where providers register with the Comisión Nacional de Activos Digitales (CNAD). SVG's legislation uses "virtual asset business", and the FSA uses "virtual asset service provider" interchangeably on its website. They are different regimes, run by different authorities, with different capital, governance and security requirements.
If you are comparing the two, our guide to DASP compliance under El Salvador's CNAD covers the El Salvador process in detail. The practical lesson is the same in both jurisdictions: the regulator wants evidence that the people, systems and key management controls described in the application actually exist.
The Registration Process
Applications are not submitted directly by the business. The FSA states that they must go through a Registered Agent licensed by the FSA. The sequence it describes is:
- Establish an SVG Business Company or LLC.
- Complete the application form, which is set out in the Schedule to the 2026 Regulations.
- Provide due diligence documents and references for directors, managers, shareholders and beneficial owners.
- Submit a business plan and financial statements.
- Pay the application fee.
The FSA indicates that the process typically takes around 90 days where documentation is complete and accurate. Approved firms receive a certificate of registration that is valid until 31 December of the year of issue and must be renewed by 31 January of the following year. Foreign entities without a physical presence must appoint a Principal Representative who is resident in SVG and maintain a local business address.
Regulation 3 of the 2026 Regulations lists what must accompany the application. Beyond personal details, criminal records and qualifications for officers, directors, shareholders and beneficial owners, it requires a business plan covering systems and controls, internal control procedures and organisational structure; evidence of capital and liquidity; evidence of sufficient human and technological resources; business rules; internal systems and controls to maintain market integrity; and evidence of risk mitigation measures for money laundering and terrorist financing, including controls for user access. Existing businesses must also provide audited financial statements or management accounts for the last three years.
Fees, Statutory Deposit, Capital and Insurance
The FSA publishes its fee schedule in Eastern Caribbean dollars (XCD). The key financial requirements from the FSA's guidance, the Act and the Regulations are summarised below.
| Requirement | Amount or rule | Source |
|---|---|---|
| Application fee | XCD 4,000 | FSA fee schedule |
| Registration fee | XCD 12,000 | FSA fee schedule |
| Annual renewal fee | XCD 12,000 | FSA fee schedule |
| Statutory deposit | XCD 100,000 or 25% of financial obligations to clients, whichever is greater | VAB Act, section 11 |
| Capital | The FSA may require minimum paid-up capital of 50,000 and authorised capital of 300,000, based on the nature, size and risk of the business | 2026 Regulations, regulation 6 |
| Professional indemnity insurance | Minimum cover of XCD 300,000 per the FSA's guidance; regulation 25 requires insurance on terms set by the FSA | FSA FAQ; regulation 25 |
The statutory deposit is the item most often underestimated. Because it scales with client obligations, a growing custodial business will see the required deposit rise with its balances, and the deposit is retained for a period the FSA determines after the business stops operating.
Cybersecurity and Custody Requirements
The 2026 Regulations contain several provisions that translate directly into security engineering work. Read together, they describe a control environment rather than a set of policies.
Regulation 18: cybersecurity and operational risks
A registrant must establish and maintain appropriate systems and controls for managing cybersecurity and operational risks, allocate the resources to do so, and ensure that suppliers, agents and other third parties maintain appropriate controls too. It must ensure the adequacy of the controls that safeguard its information "having regard to established security standards", and it must obtain external testing and audits by suitably qualified external experts at least annually, more often if the size and nature of the business warrant it.
Regulation 10: custody and protection of client assets
A registrant holding client virtual assets must hold an amount larger than its obligations to clients. Those assets must be held for the client, must not be the property of the registrant or a third-party custodian, must not be available to their creditors, and must not be pledged as collateral. In practice this requires segregated wallet structures, an accurate client ledger and frequent reconciliation between the ledger and on-chain balances.
Regulations 15 and 16: technology and safeguarding
Regulation 15 requires technological resources that are secure and maintain the confidentiality of the data they contain. Regulation 16 requires the technology platform to safeguard client assets through data management and protection, security access control and cyber security safeguards.
Other provisions with a security dimension
- Regulation 11 requires systems and controls covering the recording, storing, protection and transmission of information, transaction monitoring, safeguarding of assets, and business continuity in the event of disruption.
- Regulations 12 and 13 implement the Travel Rule, requiring originator and beneficiary information to be obtained, held and securely transmitted.
- Regulation 27 requires records to be kept for at least seven years.
- Regulation 28 requires arrangements for employees to report actual or potential breaches to the FSA, with protection from retaliation.
Building the Security Evidence Pack
The FSA's guidance lists "IT and cyber security" among the policies an applicant must provide, and the business plan must describe data management, security access control and cyber security safeguards. A policy document on its own does little to show that regulation 18 is met. The applications that hold up under questioning tend to include evidence for each of the following.
- Key management architecture. A diagram and narrative showing where every key that controls client or company assets is generated, stored and used, whether in hardware security modules, MPC or multisig, and who can approve a transaction. Our guide to HSM private key management sets out what a defensible design looks like.
- Wallet segregation and reconciliation. Separate client and house wallets, a documented hot, warm and cold split, and a reconciliation procedure that proves regulation 10 is being met every day rather than at year end. The cold storage policy guide covers the operational detail.
- Access control. Role-based access to production, signing and back-office systems, with joiner, mover and leaver processes and periodic access reviews.
- Third-party oversight. Regulation 18(2) extends cybersecurity expectations to suppliers and agents. That means due diligence on custodians, cloud providers, KYC vendors and Travel Rule providers, with contractual security obligations.
- Annual external testing. A scoped penetration test and security audit plan that covers the exchange or custody platform, its APIs and its signing infrastructure, performed by qualified external testers and repeated at least annually.
- Incident response and continuity. A tested plan for key compromise, platform outage and data breach, including who notifies the FSA and clients. See our incident response plan guide.
The question a supervisor is really asking is simple: if this firm lost control of its keys tomorrow, would it know quickly, could it contain the loss, and would client assets still exceed client obligations? The evidence pack should answer that question directly.
Ongoing Obligations After Registration
Registration is the start of supervision rather than the end of the process. The FSA lists the following recurring obligations for registered virtual asset businesses:
- Yearly audited financial statements and IT and cyber security audit reports.
- Yearly updates to all policy documents.
- Quarterly reports on the number and value of accounts held.
- Quarterly and annual AML/CFT compliance reports.
- Annual proof of valid professional indemnity insurance.
- Compliance with the Travel Rule on transfers made for third parties.
Registrants must also comply with SVG's Anti-Money Laundering and Countering the Financing of Terrorism Regulations, and regulation 17 requires an annual documented review of risk management against the FSA's requirements, submitted within four months of the financial year end. The annual IT and cyber security audit report is where weak operational controls become visible to the supervisor, so it is worth building the audit trail from the first day of operation.
SVG in a Wider Licensing Strategy
SVG registration suits groups that want an SVG-incorporated entity to be properly regulated, but it does not passport services into other markets. Firms serving European clients will still need to consider authorisation under MiCA, and firms comparing offshore and emerging-market options often look at Panama, Brazil and El Salvador's DASP regime alongside SVG.
Across all of these regimes the security expectations are converging: segregated custody, documented key management, external testing and an incident response capability. Building those controls once, to a standard that satisfies the strictest regulator you are likely to face, is usually cheaper than rebuilding them for each application.
Frequently Asked Questions
Is a St Vincent and the Grenadines crypto licence a licence or a registration?
Under the Virtual Asset Business Act 2022 it is a certificate of registration issued by the SVG Financial Services Authority. The FSA describes virtual asset businesses as being licensed in SVG, but the legal instrument is registration, and it is valid until 31 December of the year of issue, renewable by 31 January.
How much does SVG virtual asset business registration cost?
The FSA fee schedule lists an application fee of XCD 4,000, a registration fee of XCD 12,000 and an annual renewal fee of XCD 12,000. The Act also requires a statutory deposit of XCD 100,000 or 25% of financial obligations to clients, whichever is greater, and the FSA can impose capital and insurance requirements.
Do SVG companies operating abroad need to register?
Yes. The FSA states that an SVG Business Company or LLC must register even if its virtual asset services are performed outside SVG, and that it must also obtain any licence required in the foreign jurisdictions where it offers services.
What cybersecurity requirements apply to SVG virtual asset businesses?
Regulation 18 of the Virtual Asset Business Regulations 2026 requires systems and controls for cybersecurity and operational risk, oversight of third parties, controls that reflect established security standards, and external testing and audits by qualified experts at least annually. The FSA also expects yearly IT and cyber security audit reports.
Is SVG registration the same as an El Salvador DASP licence?
No. DASP is the term used in El Salvador, where providers register with the CNAD. SVG uses the term virtual asset business and is supervised by the SVG Financial Services Authority. The regimes have different requirements and one does not authorise activity under the other.