What a DeFi or Web3 Project Needs
A DeFi or Web3 project needs five sequenced components: a legal wrapper for the protocol or DAO, an operating entity for off-chain activities, a regulatory perimeter analysis under MiCA Recital 22 (and equivalents outside the EU), treasury and fiat on/off-ramp banking, and an ongoing compliance stack covering audits, sanctions screening and DORA. We deliver all five and own the sequencing so nothing stalls.
The wrapper is the first decision. Protocols of meaningful scale operate behind a foundation: most commonly a Cayman Foundation Company, an ADGM DLT Foundation, or a Panama Private Interest Foundation. It holds the treasury, contracts with developers, and provides a counterparty for grants and exchanges. A protocol without a wrapper is just a group of individuals personally exposed to securities, tax and anti-money-laundering liability wherever they reside. We form the wrapper that fits your architecture, and the operating entity that runs the off-chain activity the wrapper rarely touches: developers, front-end, vendor contracts, the fiat float. The operating entity is what the regulator looks at on the CASP question, because it carries the identifiable management, marketing and fee accrual. We draft the service agreement that links the two.
The perimeter analysis determines your position under MiCA Recital 22. The Joint EBA-ESMA Report under Article 142 confirms that very few DeFi systems achieve full decentralisation, and that the exemption is assessed case-by-case; admin keys, a controlled treasury, a named front-end operator and active EU marketing all pull a service back inside MiCA. We write the analysis and tell you, in writing, which side of the line you are on.
Treasury and fiat banking is a supporting step once the structure is set, combining a licensed EU EMI for euro flows, a DLT-friendly bank for token-treasury custody, and a regulated trust company for stablecoin and bitcoin holdings; we arrange it in parallel so it does not become the bottleneck. Ongoing compliance covers smart-contract audits and continuous bug bounty, sanctions screening, transaction monitoring for any CASP-classified surface, DORA controls under Regulation (EU) 2022/2554, and Travel Rule compliance. We build the stack and keep it current as the protocol evolves.
Infrastructure Checklist
| Component | What It Involves | Typical Timeline |
|---|---|---|
| Legal wrapper (Foundation) | Holds protocol treasury, contracts with developers, provides legal counterparty for grants and exchanges | 4 to 8 weeks |
| Operating entity | Employs developers, runs the front-end, contracts with vendors, holds the fiat float | 1 to 4 weeks |
| Perimeter analysis | Determines whether MiCA, VARA, or other licensing applies; documents the Recital 22 position in writing | 2 to 6 weeks (parallel to wrapper formation) |
| Fiat banking arrangement | SEPA and USD operating accounts, token-treasury custody, on/off-ramp | 2 to 6 months |
| Smart-contract audit and bug bounty | Pre-launch security review; competitive audit; continuous bounty | 4 to 12 weeks initial, then continuous |
| Compliance stack | KYC for the fiat on/off-ramp, sanctions screening, transaction monitoring, DORA, Travel Rule | 4 to 8 weeks initial, then continuous |
Sequence matters: the wrapper and operating entity must exist before banking, audits or compliance onboarding can begin, the perimeter analysis must precede deployment, and fiat banking, the longest-pole item, we start arranging alongside formation rather than after it.
Choosing the Right Jurisdiction
Jurisdiction sets the available wrapper, the regulatory perimeter, the treasury tax treatment, the banking options and the credibility signal to exchanges, custodians and institutional counterparties. The choice is between offshore foundation jurisdictions (Cayman, UAE ADGM, Panama, Saint Kitts & Nevis) and EU MiCA jurisdictions (Cyprus, Czech Republic), each suited to a different protocol profile. We deliver in all six and recommend the fit before any incorporation is filed.
Jurisdiction Comparison
| Factor | Cayman Islands | UAE (VARA + ADGM) | Panama | Cyprus | Czech Republic |
|---|---|---|---|---|---|
| Primary licence / wrapper | VASP Act 2020 registration or Phase 2 licence; Foundation Company for DAO wrapper | VARA VASP licence (8 categories); ADGM DLT Foundation for DAO wrapper | Private Interest Foundation (Law 25 of 1995); no VASP regime in force | MiCA CASP authorisation under CySEC | MiCA CASP authorisation under ČNB |
| Minimum capital | None statutory (business-plan adequacy) | VARA: AED 100k to 1.5m+ by activity≈ $27K–408K+; ADGM DLT Foundation: USD 50k initial asset value (Section 19) | USD 10,000 endowment | €50k / €125k / €150k (Article 67 MiCA) | €50k / €125k / €150k (Article 67 MiCA) |
| Application / state fee | Approx. USD 1,200 to 6,000 | AED 40k to 100k + 50% per additional activity≈ $11K–27K | USD 300 government + Resident Agent | €10,000 (non-refundable) | Approx. CZK 50,000≈ $2K |
| Realistic timeline | 3 to 9 months | 6 to 12 months (two-stage VARA process) | 2 to 4 weeks (Foundation only) | 6 to 12 months | 6 to 12 months |
| EU passporting | No | No | No | Yes | Yes |
| Corporate tax | 0% | 9% above AED 375k profit; 0% in qualifying free zones≈ $102K | Territorial: 0% on foreign-source income | 15% (raised from 12.5% effective 1 January 2026); 8% flat on crypto-asset disposals | 21% |
| Local presence | Registered office; CIMA-acceptable directors; Foundation Secretary required | Physical office in DWTC free zone or onshore; resident senior management | Resident Agent (Panamanian lawyer); no employee requirement | Cyprus office; majority EU-resident board; MLRO | Czech office; EU-resident management body; MLRO |
| Banking access | Difficult | Moderate | Moderate to Difficult | Moderate | Moderate |
Choose the Cayman Islands if the protocol holds a treasury of governance tokens or stablecoins, expects to be cited by name on third-party platforms, and wants the deepest pool of crypto-fluent service providers. The Foundation Company is the dominant DAO wrapper globally because it can become an “orphan” entity with no shareholders, supervised by service providers rather than members; the VASP Act 2020 Phase 2 regime applies where the front-end is custodial or runs a trading platform. It is the default for institutional integrations, but not the base for active EU retail distribution.
Choose the United Arab Emirates if the project wants a credible regulated home with onshore market access, MENA institutional flow and the ability to issue tokens or run a custodial front-end. VARA licensing is an eight-category model with activity-specific fees, and the ADGM DLT Foundation is purpose-built for DAO governance. We hold the VARA application and incorporate the Foundation for you.
Choose Panama if the project wants a low-friction treasury wrapper with territorial tax and no licensing overlay. The Private Interest Foundation under Law 25 of 1995 offers a modest endowment, a Council of at least three members, full asset separation from the founder, and clean standing now that Panama is off the FATF grey list and the EU AML high-risk list. It suits treasury and holding structures, not protocols that need a regulated front-end licence.
Choose Cyprus if the project plans an EU front-end actively marketing to EEA users and intends to operate as a regulated CASP. CySEC’s authorisation carries the Article 67 capital tiers, the highest applicable threshold where it spans classes, and a floor of one quarter of the preceding year’s fixed overheads; capital must sit in qualifying own-funds instruments, so a BTC or stablecoin treasury does not count. CySEC’s filing deadline for legacy CASPs is 27 February 2026, with the transitional period ending 1 July 2026. We prepare, file and deal with CySEC directly. See the Cyprus crypto licensing guide.
Choose the Czech Republic if the project wants an EU MiCA CASP authorisation with a more efficient regulator interface than the larger member states. The Czech National Bank (ČNB) supervises CASPs under MiCA, with full EU passporting under a single authorisation and no tier-1 supervisory backlog. We file with the ČNB on your behalf. See the crypto licensing hub.
Setting Up Your Company
Formation is the first thing we deliver, because the wrapper, the operating entity, the banking application and the audit engagement all require a registered legal person. The common mistake is incorporating the operating entity in the wrong jurisdiction, then restructuring once it becomes clear the entity cannot host the treasury or contract with regulated counterparties, at a cost of months and substantial fees. We get the structure right the first time.
Formation by Jurisdiction
| Jurisdiction | Entity Type | Timeline | Statutory Minimum Capital |
|---|---|---|---|
| Cayman Islands | Foundation Company; Exempted Company for operating entity | Foundation: 4 to 8 weeks; Exempted Company: 2 to 4 weeks | None statutory |
| United Arab Emirates | ADGM DLT Foundation; ADGM private company limited by shares; or DIFC LLC for operating entity | DLT Foundation: 8 to 14 weeks; LLC: 4 to 8 weeks | USD 50,000 initial asset value (DLT Foundation, Section 19) |
| Panama | Private Interest Foundation (Law 25 of 1995); Sociedad Anónima for operating entity | 2 to 4 weeks | USD 10,000 endowment (Foundation) |
| Saint Kitts & Nevis | Nevis Business Corporation (BC) or International Business Company (IBC); for VASP applications, a locally-domiciled entity | 1 to 2 weeks | None statutory |
| Cyprus | Private limited company | 2 to 4 weeks | €1,000 share capital; €50k to €150k CASP own-funds at authorisation |
| Czech Republic | Společnost s ručením omezeným (s.r.o.) | 2 to 4 weeks | CZK 1 minimum share capital; €50k to €150k CASP own-funds at authorisation |
Capital figures above are statutory regulatory minima, not our fees. For a fixed quote on forming your structure, book a free consultation.
The service agreement between the two entities is the document the regulator scrutinises when assessing decentralisation, so drafting it is a regulatory exercise, not a corporate one, and we draft it as such. The CASP-of-record question turns not on the foundation’s legal form but on which entity controls the upgrade keys, accrues the fees and operates the front-end accessible to EEA users.
Licensing Requirements
A DeFi or Web3 project ends up in one of three positions, each supported by documentation we prepare: a “fully decentralised” position under MiCA Recital 22 with no licensing requirement; a CASP authorisation under MiCA in the EU (Article 67 capital floor of €50,000 / €125,000 / €150,000 by class); or a VARA, CIMA or equivalent licence outside it. We work out which applies, then file for it and deal with the regulator directly.
MiCA scope and the Recital 22 carve-out
Recital 22 is a non-binding preamble; the operative articles define no “fully decentralised” standard, and the common mistake is treating it as a binary qualifier rather than an evidentiary file. A protocol with an upgradable multisig, a foundation-controlled treasury and a named front-end operator fails the EBA-ESMA factor analysis even where the smart contracts are non-custodial, and the home NCA can treat the front-end as the operative CASP. We build the file that supports your position, or tell you plainly when the honest answer is that you need a licence.
CASP triggers and token issuance
The CASP activities most likely to apply to a front-end are operation of a trading platform (matching third-party orders), exchange of crypto-assets for funds or other crypto-assets (facilitating swaps), custody and administration (controlling smart-contract vaults), and transfer services (bridge front-ends). A non-custodial contract the operator cannot upgrade is the strongest defence against CASP scope; an upgradable contract controlled by a named-signer multisig pulls the operator in. Separately, for tokens that are neither asset-referenced (Title III) nor e-money tokens (Title IV), MiCA Title II applies: a white paper meeting Annex I requirements, notification to the home NCA at least 20 working days before publication, and the Article 14 honesty standard, with iXBRL formatting required from 23 December 2025. Most governance tokens fall here. We assess your architecture against each trigger and prepare the white paper as part of the build.
Non-EU licensing pathways
VARA (Dubai): eight activity-specific licences under the Virtual Assets and Related Activities Regulations 2023, via a two-stage process (Initial Disclosure Questionnaire and Approval to Incorporate, then the full VASP application), typically 6 to 12 months. We run both stages and manage the VARA interface. Cayman Islands VASP Act 2020: Phase 1 registration covers AML and cybersecurity; Phase 2 licensing for trading platforms and custodians runs from 2024, and the 2024 amendment broadened the “Owner/Operator” definition to capture DAOs without an identifiable managing group. No statutory capital floor; adequacy is assessed against the business plan, which we prepare with you. Saint Kitts & Nevis Virtual Asset Act 2020 (as amended 2024): VASP registration with the Financial Services Regulatory Commission, aligned to FATF Recommendation 15, which we hold on your behalf.
DORA and DAC8
DORA (Regulation (EU) 2022/2554) applies to MiCA CASPs from 17 January 2025, requiring an ICT risk-management framework, incident reporting, penetration testing for significant entities, a third-party risk register and provider contracts covering audit and exit, with penalties up to 2% of worldwide turnover. Separately, DAC8 (Directive (EU) 2023/2226), in force since 1 January 2026, imposes automatic exchange of crypto-asset transaction data on any provider serving EU-resident users, wherever established, and full decentralisation does not by itself displace its reach. We build both into the structure from the outset. See the Cyprus CASP guide and the crypto licensing hub.
Banking (Supporting Step)
Banking is a supporting part of the build, arranged once the structure and licence position are set, but the part founders most often underestimate. Primary clearing banks routinely reject DeFi-adjacent counterparties, and a foundation wrapper, a published audit and a clear regulatory position do not move the rejection rate much. Fiat on/off-ramp banking is a multi-institution exercise: a licensed EU EMI for operational euro flows, a DLT-friendly bank for token-treasury custody, and where applicable a regulated trust company for stablecoin and bitcoin holdings. We arrange this and never name an institution until it is the right fit.
Banks decline DeFi mandates because of counterparty anonymity at the protocol layer, smart-contract exploit liability, token-treasury volatility, Travel Rule accountability under Regulation (EU) 2023/1113, and DORA third-party risk on any API integration. The foundation wrapper alone does not unlock banking; what the credit committee underwrites is the operating entity’s KYC posture toward front-end users, the upgrade-key custody arrangements, and the oracle and bridge dependencies, because those are where the bank inherits residual AML and operational liability. We package the application so the committee can say yes.
Ongoing Compliance
Compliance is a permanent operating function, not a one-time licensing cost, and a regulated CASP carries a materially heavier run-rate than a registration-only offshore VASP. We build the stack during licensing and can run or supervise it afterwards, so the obligations are met from day one.
The permanent obligations for any CASP-classified surface are AML controls and Travel Rule compliance; transaction monitoring and sanctions screening at the front-end; DORA controls (ICT third-party risk register, incident reporting, penetration testing for significant entities); a smart-contract audit cadence; and external audit of financial statements and ICT controls. We coordinate each through specialists we work with directly. The real audit constraint is not the finite pre-launch review but the obligation to re-audit on every material upgrade alongside a continuous bug bounty, a permanent security line rather than a one-time spend. We set the cadence up front.
Two deadlines concentrate the timing: CySEC’s filing deadline for legacy CASPs is 27 February 2026, and the MiCA legacy-VASP transitional period ends 1 July 2026. If you intend to be authorised cleanly, the time to start is now.
Realistic Timeline
From first scoping call to operational front-end, the timeline is typically 6 to 12 months for an offshore registration build and 9 to 18 months for an EU MiCA CASP build. We run the workstreams in parallel: audits and front-end development alongside the licensing file, and banking arranged early because it is the critical-path item in most schedules.
Build Phases and Timeline
| Phase | Timeline | What We Do |
|---|---|---|
| Wrapper & operating entity setup | 4 to 12 weeks | Form the foundation and the operating company, draft the service agreement between them |
| Licensing & perimeter analysis | 3 to 12 months | Write the Recital 22 position paper or file the VASP registration or MiCA CASP application, dealing with the regulator directly |
| Treasury & fiat banking | 2 to 6 months | Arrange operating and treasury accounts across the right institutions, in parallel with licensing |
| Smart-contract audits & launch tech | 6 to 16 weeks | Coordinate pre-launch audit, competitive audit and continuous bug bounty through vetted specialists |
Every project is different, so we quote on the specifics of your architecture rather than publishing a price list. Book a free consultation and we will scope your build, give you a realistic timeline and a fixed quote, and tell you candidly where the risks and slow points are.
Frequently Asked Questions
What does Tomberg & Partners do for a DeFi or Web3 project?
We form the foundation wrapper and the operating entity, write the MiCA perimeter analysis, and file for the licence your architecture needs, dealing with the regulator directly. Where banking is required we arrange treasury and operating accounts as a supporting step. We deliver through our own team and a controlled network of vetted in-country specialists we work with directly, and we stand behind the outcome. Book a free consultation and we will scope your build and give you a fixed quote.
How long does it take to form and license a DeFi or Web3 project?
Operational readiness is typically 6 to 12 months for an offshore registration build (Cayman, Panama, Saint Kitts & Nevis) and 9 to 18 months for an EU MiCA CASP build (Cyprus, Czech Republic). Smart-contract audits run in parallel with the regulatory file. Treasury banking is the longest-pole item, so we arrange it early, in parallel with formation and audit work, so it does not stall the application. We give you a realistic timeline before we start, and we tell you where the slow points are.
What licence do I need to operate a DeFi or Web3 project?
It depends on the architecture and the marketing perimeter. A fully decentralised protocol with no identifiable operator, no admin keys, no fee accrual to a controlled treasury, and no active EU marketing may rely on Recital 22 of Markets in Crypto-Assets Regulation and operate without a licence. Most protocols of meaningful scale do not meet that standard. Where a front-end is operated, a treasury is controlled by a foundation, or fees accrue to a named party, a CASP authorisation is typically required, with minimum capital depending on the activity class. Outside the EU, the equivalent is a VARA licence in the UAE, a Cayman VASP registration or Phase 2 licence, or a Saint Kitts & Nevis VASP registration. The first thing we deliver is a written perimeter analysis, not a smart contract.
Does MiCA apply to my DeFi protocol?
MiCA applies unless the service is provided in a fully decentralised manner without any intermediary (Recital 22), and the Joint EBA-ESMA Report confirms very few DeFi systems achieve that. ESMA assesses decentralisation case-by-case, looking for residual-centralisation indicators: admin or upgrade keys, fee accrual to a controlled treasury, an identifiable front-end operator, active EU marketing, governance-token concentration, and bridge or oracle dependencies. Partial decentralisation is not a safe harbour. A DAO that operates a front-end with admin keys, a fee mechanism and active EU marketing will typically need a CASP authorisation even where the smart contract is non-custodial. We document your position and keep it current as the protocol evolves.
Where can a Web3 project be domiciled?
We deliver DeFi and Web3 builds in Cayman Islands (Foundation Company plus optional VASP), the UAE (VARA licence plus ADGM DLT Foundation wrapper), Panama (Private Interest Foundation), Saint Kitts & Nevis (VASP registration), Cyprus (MiCA CASP), and the Czech Republic (MiCA CASP). Cayman is the dominant DAO wrapper for protocols with institutional integrations; the UAE suits MENA market access and onshore presence; Panama suits treasury-only structures; Cyprus and the Czech Republic are the routes for EU passporting. Other jurisdictions sometimes cited (Switzerland, BVI, Marshall Islands, Wyoming, Liechtenstein) we reference as comparators, but we only make delivery commitments in the jurisdictions we serve.
Can you arrange fiat on/off-ramp banking?
Yes, as a supporting step once the structure is set. Fiat banking for a DeFi or Web3 project is a multi-institution exercise, not a single-bank application: a licensed EU EMI for operational euro flows, a DLT-friendly bank for token-treasury custody, and where applicable a regulated trust company for stablecoin and bitcoin holdings. Primary clearing banks reject DeFi-adjacent counterparties at the first application in most cases, so the path through is preparing carefully across the right institutions before anything is filed. We arrange this in parallel with the licensing file, because the operational-bank confirmation is one of the documents the regulator asks about once the application lands.
Start Your DeFi or Web3 Build
We form the wrapper and operating entity, write the perimeter analysis, file for the licence, arrange treasury banking and build the compliance stack, across six jurisdictions. One accountable firm, and we stand behind the outcome.
Free initial consultation · Response within 24 hours
Banking & Payments A company and a licence still need a bank account
Banking is one of our three core services. We help high-risk and regulated businesses open the bank and payment accounts that others refuse: we work directly with EU EMIs, payment institutions and crypto-aware banks, confirm appetite before you apply, and make the introduction. Take it with your company and licence, or on its own.
Related Services
- Crypto Licensing Overview: VASP, CASP and MiCA authorisation we file and manage directly
- Banking Overview: treasury and on/off-ramp banking for crypto-native businesses
- Crypto and Fiat Settlement: on/off-ramp architecture for DeFi protocols and token issuers
- Cyprus Crypto Licensing: the CySEC route under MiCA CASP
- European Company Formation: EU and EEA entity formation, including MiCA-compatible jurisdictions