Who We Serve

DeFi & Web3 Formation and Licensing

Admin keys, fee mechanics and upgradability decide your perimeter, and they are cheap to change before the contracts deploy. We write that analysis first.

Talk to us

What a DeFi or Web3 Project Needs

A DeFi or Web3 project needs five sequenced components: a legal wrapper for the protocol or DAO, an operating entity for off-chain activities, a regulatory perimeter analysis under MiCA Recital 22 (and equivalents outside the EU), treasury and fiat on/off-ramp banking, and an ongoing compliance stack covering audits, sanctions screening and DORA. We deliver all five and own the sequencing so nothing stalls.

The expensive mistake: treating the legal wrapper as a tax-optimisation choice and the regulatory perimeter as a Phase 2 question. The architectural choices that determine CASP scope (admin keys, fee mechanics, upgradability) are cheap to make before the contracts deploy and expensive to unwind after. We write the perimeter analysis first.

The wrapper is the first decision. Protocols of meaningful scale operate behind a foundation: most commonly a Cayman Foundation Company, an ADGM DLT Foundation, or a Panama Private Interest Foundation. It holds the treasury, contracts with developers, and provides a counterparty for grants and exchanges. A protocol without a wrapper is just a group of individuals personally exposed to securities, tax and anti-money-laundering liability wherever they reside. We form the wrapper that fits your architecture, and the operating entity that runs the off-chain activity the wrapper rarely touches: developers, front-end, vendor contracts, the fiat float. The operating entity is what the regulator looks at on the CASP question, because it carries the identifiable management, marketing and fee accrual. We draft the service agreement that links the two.

The perimeter analysis determines your position under MiCA Recital 22. The Joint EBA-ESMA Report under Article 142 confirms that very few DeFi systems achieve full decentralisation, and that the exemption is assessed case-by-case; admin keys, a controlled treasury, a named front-end operator and active EU marketing all pull a service back inside MiCA. We write the analysis and tell you, in writing, which side of the line you are on.

Treasury and fiat banking is a supporting step once the structure is set, combining a licensed EU EMI for euro flows, a DLT-friendly bank for token-treasury custody, and a regulated trust company for stablecoin and bitcoin holdings; we arrange it in parallel so it does not become the bottleneck. Ongoing compliance covers smart-contract audits and continuous bug bounty, sanctions screening, transaction monitoring for any CASP-classified surface, DORA controls under Regulation (EU) 2022/2554, and Travel Rule compliance. We build the stack and keep it current as the protocol evolves.

Infrastructure Checklist

ComponentWhat It InvolvesTypical Timeline
Legal wrapper (Foundation)Holds protocol treasury, contracts with developers, provides legal counterparty for grants and exchanges4 to 8 weeks
Operating entityEmploys developers, runs the front-end, contracts with vendors, holds the fiat float1 to 4 weeks
Perimeter analysisDetermines whether MiCA, VARA, or other licensing applies; documents the Recital 22 position in writing2 to 6 weeks (parallel to wrapper formation)
Fiat banking arrangementSEPA and USD operating accounts, token-treasury custody, on/off-ramp2 to 6 months
Smart-contract audit and bug bountyPre-launch security review; competitive audit; continuous bounty4 to 12 weeks initial, then continuous
Compliance stackKYC for the fiat on/off-ramp, sanctions screening, transaction monitoring, DORA, Travel Rule4 to 8 weeks initial, then continuous

Sequence matters: the wrapper and operating entity must exist before banking, audits or compliance onboarding can begin, the perimeter analysis must precede deployment, and fiat banking, the longest-pole item, we start arranging alongside formation rather than after it.

Choosing the Right Jurisdiction

Jurisdiction sets the available wrapper, the regulatory perimeter, the treasury tax treatment, the banking options and the credibility signal to exchanges, custodians and institutional counterparties. The choice is between offshore foundation jurisdictions (Cayman, UAE ADGM, Panama, Saint Kitts & Nevis) and EU MiCA jurisdictions (Cyprus, Czech Republic), each suited to a different protocol profile. We deliver in all six and recommend the fit before any incorporation is filed.

Jurisdiction Comparison

FactorCayman IslandsUAE (VARA + ADGM)PanamaCyprusCzech Republic
Primary licence / wrapperVASP Act 2020 registration or Phase 2 licence; Foundation Company for DAO wrapperVARA VASP licence (8 categories); ADGM DLT Foundation for DAO wrapperPrivate Interest Foundation (Law 25 of 1995); no VASP regime in forceMiCA CASP authorisation under CySECMiCA CASP authorisation under ČNB
Minimum capitalNone statutory (business-plan adequacy)VARA: AED 100k to 1.5m+ by activity≈ $27K–408K+; ADGM DLT Foundation: USD 50k initial asset value (Section 19)USD 10,000 endowment€50k / €125k / €150k (Article 67 MiCA)€50k / €125k / €150k (Article 67 MiCA)
Application / state feeApprox. USD 1,200 to 6,000AED 40k to 100k + 50% per additional activity≈ $11K–27KUSD 300 government + Resident Agent€10,000 (non-refundable)Approx. CZK 50,000≈ $2K
Realistic timeline3 to 9 months6 to 12 months (two-stage VARA process)2 to 4 weeks (Foundation only)6 to 12 months6 to 12 months
EU passportingNoNoNoYesYes
Corporate tax0%9% above AED 375k profit; 0% in qualifying free zones≈ $102KTerritorial: 0% on foreign-source income15% (raised from 12.5% effective 1 January 2026); 8% flat on crypto-asset disposals21%
Local presenceRegistered office; CIMA-acceptable directors; Foundation Secretary requiredPhysical office in DWTC free zone or onshore; resident senior managementResident Agent (Panamanian lawyer); no employee requirementCyprus office; majority EU-resident board; MLROCzech office; EU-resident management body; MLRO
Banking accessDifficultModerateModerate to DifficultModerateModerate

Choose the Cayman Islands if the protocol holds a treasury of governance tokens or stablecoins, expects to be cited by name on third-party platforms, and wants the deepest pool of crypto-fluent service providers. The Foundation Company is the dominant DAO wrapper globally because it can become an “orphan” entity with no shareholders, supervised by service providers rather than members; the VASP Act 2020 Phase 2 regime applies where the front-end is custodial or runs a trading platform. It is the default for institutional integrations, but not the base for active EU retail distribution.

Choose the United Arab Emirates if the project wants a credible regulated home with onshore market access, MENA institutional flow and the ability to issue tokens or run a custodial front-end. VARA licensing is an eight-category model with activity-specific fees, and the ADGM DLT Foundation is purpose-built for DAO governance. We hold the VARA application and incorporate the Foundation for you.

Choose Panama if the project wants a low-friction treasury wrapper with territorial tax and no licensing overlay. The Private Interest Foundation under Law 25 of 1995 offers a modest endowment, a Council of at least three members, full asset separation from the founder, and clean standing now that Panama is off the FATF grey list and the EU AML high-risk list. It suits treasury and holding structures, not protocols that need a regulated front-end licence.

Choose Cyprus if the project plans an EU front-end actively marketing to EEA users and intends to operate as a regulated CASP. CySEC’s authorisation carries the Article 67 capital tiers, the highest applicable threshold where it spans classes, and a floor of one quarter of the preceding year’s fixed overheads; capital must sit in qualifying own-funds instruments, so a BTC or stablecoin treasury does not count. CySEC’s filing deadline for legacy CASPs is 27 February 2026, with the transitional period ending 1 July 2026. We prepare, file and deal with CySEC directly. See the Cyprus crypto licensing guide.

Choose the Czech Republic if the project wants an EU MiCA CASP authorisation with a more efficient regulator interface than the larger member states. The Czech National Bank (ČNB) supervises CASPs under MiCA, with full EU passporting under a single authorisation and no tier-1 supervisory backlog. We file with the ČNB on your behalf. See the crypto licensing hub.

Recital 22 enforcement risk. As of May 2026 no DeFi protocol has formally tested the exemption against an EU enforcement file. A protocol that grows past de facto centralisation thresholds without updating its position paper is exposed to a retroactive CASP-scope determination by the home NCA of any jurisdiction where the front-end is accessible. We document your position at deployment and keep it current so that does not happen.

Setting Up Your Company

Formation is the first thing we deliver, because the wrapper, the operating entity, the banking application and the audit engagement all require a registered legal person. The common mistake is incorporating the operating entity in the wrong jurisdiction, then restructuring once it becomes clear the entity cannot host the treasury or contract with regulated counterparties, at a cost of months and substantial fees. We get the structure right the first time.

Worth knowing: the wrapper and operating-entity jurisdictions need not match. A Cayman Foundation Company can hold the treasury while a Czech Republic CASP operates the front-end, the two linked by a service agreement. We set that architecture before anything is filed and form both entities through our in-country teams. See company formation.

Formation by Jurisdiction

JurisdictionEntity TypeTimelineStatutory Minimum Capital
Cayman IslandsFoundation Company; Exempted Company for operating entityFoundation: 4 to 8 weeks; Exempted Company: 2 to 4 weeksNone statutory
United Arab EmiratesADGM DLT Foundation; ADGM private company limited by shares; or DIFC LLC for operating entityDLT Foundation: 8 to 14 weeks; LLC: 4 to 8 weeksUSD 50,000 initial asset value (DLT Foundation, Section 19)
PanamaPrivate Interest Foundation (Law 25 of 1995); Sociedad Anónima for operating entity2 to 4 weeksUSD 10,000 endowment (Foundation)
Saint Kitts & NevisNevis Business Corporation (BC) or International Business Company (IBC); for VASP applications, a locally-domiciled entity1 to 2 weeksNone statutory
CyprusPrivate limited company2 to 4 weeks€1,000 share capital; €50k to €150k CASP own-funds at authorisation
Czech RepublicSpolečnost s ručením omezeným (s.r.o.)2 to 4 weeksCZK 1 minimum share capital; €50k to €150k CASP own-funds at authorisation

Capital figures above are statutory regulatory minima, not our fees. For a fixed quote on forming your structure, book a free consultation.

The service agreement between the two entities is the document the regulator scrutinises when assessing decentralisation, so drafting it is a regulatory exercise, not a corporate one, and we draft it as such. The CASP-of-record question turns not on the foundation’s legal form but on which entity controls the upgrade keys, accrues the fees and operates the front-end accessible to EEA users.

Licensing Requirements

A DeFi or Web3 project ends up in one of three positions, each supported by documentation we prepare: a “fully decentralised” position under MiCA Recital 22 with no licensing requirement; a CASP authorisation under MiCA in the EU (Article 67 capital floor of €50,000 / €125,000 / €150,000 by class); or a VARA, CIMA or equivalent licence outside it. We work out which applies, then file for it and deal with the regulator directly.

MiCA scope and the Recital 22 carve-out

Recital 22 is a non-binding preamble; the operative articles define no “fully decentralised” standard, and the common mistake is treating it as a binary qualifier rather than an evidentiary file. A protocol with an upgradable multisig, a foundation-controlled treasury and a named front-end operator fails the EBA-ESMA factor analysis even where the smart contracts are non-custodial, and the home NCA can treat the front-end as the operative CASP. We build the file that supports your position, or tell you plainly when the honest answer is that you need a licence.

CASP triggers and token issuance

The CASP activities most likely to apply to a front-end are operation of a trading platform (matching third-party orders), exchange of crypto-assets for funds or other crypto-assets (facilitating swaps), custody and administration (controlling smart-contract vaults), and transfer services (bridge front-ends). A non-custodial contract the operator cannot upgrade is the strongest defence against CASP scope; an upgradable contract controlled by a named-signer multisig pulls the operator in. Separately, for tokens that are neither asset-referenced (Title III) nor e-money tokens (Title IV), MiCA Title II applies: a white paper meeting Annex I requirements, notification to the home NCA at least 20 working days before publication, and the Article 14 honesty standard, with iXBRL formatting required from 23 December 2025. Most governance tokens fall here. We assess your architecture against each trigger and prepare the white paper as part of the build.

Non-EU licensing pathways

VARA (Dubai): eight activity-specific licences under the Virtual Assets and Related Activities Regulations 2023, via a two-stage process (Initial Disclosure Questionnaire and Approval to Incorporate, then the full VASP application), typically 6 to 12 months. We run both stages and manage the VARA interface. Cayman Islands VASP Act 2020: Phase 1 registration covers AML and cybersecurity; Phase 2 licensing for trading platforms and custodians runs from 2024, and the 2024 amendment broadened the “Owner/Operator” definition to capture DAOs without an identifiable managing group. No statutory capital floor; adequacy is assessed against the business plan, which we prepare with you. Saint Kitts & Nevis Virtual Asset Act 2020 (as amended 2024): VASP registration with the Financial Services Regulatory Commission, aligned to FATF Recommendation 15, which we hold on your behalf.

DORA and DAC8

DORA (Regulation (EU) 2022/2554) applies to MiCA CASPs from 17 January 2025, requiring an ICT risk-management framework, incident reporting, penetration testing for significant entities, a third-party risk register and provider contracts covering audit and exit, with penalties up to 2% of worldwide turnover. Separately, DAC8 (Directive (EU) 2023/2226), in force since 1 January 2026, imposes automatic exchange of crypto-asset transaction data on any provider serving EU-resident users, wherever established, and full decentralisation does not by itself displace its reach. We build both into the structure from the outset. See the Cyprus CASP guide and the crypto licensing hub.

Banking (Supporting Step)

Banking is a supporting part of the build, arranged once the structure and licence position are set, but the part founders most often underestimate. Primary clearing banks routinely reject DeFi-adjacent counterparties, and a foundation wrapper, a published audit and a clear regulatory position do not move the rejection rate much. Fiat on/off-ramp banking is a multi-institution exercise: a licensed EU EMI for operational euro flows, a DLT-friendly bank for token-treasury custody, and where applicable a regulated trust company for stablecoin and bitcoin holdings. We arrange this and never name an institution until it is the right fit.

Banks decline DeFi mandates because of counterparty anonymity at the protocol layer, smart-contract exploit liability, token-treasury volatility, Travel Rule accountability under Regulation (EU) 2023/1113, and DORA third-party risk on any API integration. The foundation wrapper alone does not unlock banking; what the credit committee underwrites is the operating entity’s KYC posture toward front-end users, the upgrade-key custody arrangements, and the oracle and bridge dependencies, because those are where the bank inherits residual AML and operational liability. We package the application so the committee can say yes.

How we handle it: we arrange the operational-bank confirmation before the licence application is filed, because it is one of the documents the regulator asks about once the file lands. We work with a controlled network of licensed EMIs, DLT-friendly banks and regulated trust companies we deal with directly. See the banking overview and the crypto and fiat settlement guide.

Ongoing Compliance

Compliance is a permanent operating function, not a one-time licensing cost, and a regulated CASP carries a materially heavier run-rate than a registration-only offshore VASP. We build the stack during licensing and can run or supervise it afterwards, so the obligations are met from day one.

The permanent obligations for any CASP-classified surface are AML controls and Travel Rule compliance; transaction monitoring and sanctions screening at the front-end; DORA controls (ICT third-party risk register, incident reporting, penetration testing for significant entities); a smart-contract audit cadence; and external audit of financial statements and ICT controls. We coordinate each through specialists we work with directly. The real audit constraint is not the finite pre-launch review but the obligation to re-audit on every material upgrade alongside a continuous bug bounty, a permanent security line rather than a one-time spend. We set the cadence up front.

Two deadlines concentrate the timing: CySEC’s filing deadline for legacy CASPs is 27 February 2026, and the MiCA legacy-VASP transitional period ends 1 July 2026. If you intend to be authorised cleanly, the time to start is now.

Realistic Timeline

From first scoping call to operational front-end, the timeline is typically 6 to 12 months for an offshore registration build and 9 to 18 months for an EU MiCA CASP build. We run the workstreams in parallel: audits and front-end development alongside the licensing file, and banking arranged early because it is the critical-path item in most schedules.

Build Phases and Timeline

PhaseTimelineWhat We Do
Wrapper & operating entity setup4 to 12 weeksForm the foundation and the operating company, draft the service agreement between them
Licensing & perimeter analysis3 to 12 monthsWrite the Recital 22 position paper or file the VASP registration or MiCA CASP application, dealing with the regulator directly
Treasury & fiat banking2 to 6 monthsArrange operating and treasury accounts across the right institutions, in parallel with licensing
Smart-contract audits & launch tech6 to 16 weeksCoordinate pre-launch audit, competitive audit and continuous bug bounty through vetted specialists

Every project is different, so we quote on the specifics of your architecture rather than publishing a price list. Book a free consultation and we will scope your build, give you a realistic timeline and a fixed quote, and tell you candidly where the risks and slow points are.

Frequently Asked Questions

Working With Us & Timeline
What does Tomberg & Partners do for a DeFi or Web3 project?

We form the foundation wrapper and the operating entity, write the MiCA perimeter analysis, and file for the licence your architecture needs, dealing with the regulator directly. Where banking is required we arrange treasury and operating accounts as a supporting step. We deliver through our own team and a controlled network of vetted in-country specialists we work with directly, and we stand behind the outcome. Book a free consultation and we will scope your build and give you a fixed quote.

How long does it take to form and license a DeFi or Web3 project?

Operational readiness is typically 6 to 12 months for an offshore registration build (Cayman, Panama, Saint Kitts & Nevis) and 9 to 18 months for an EU MiCA CASP build (Cyprus, Czech Republic). Smart-contract audits run in parallel with the regulatory file. Treasury banking is the longest-pole item, so we arrange it early, in parallel with formation and audit work, so it does not stall the application. We give you a realistic timeline before we start, and we tell you where the slow points are.

Licensing
What licence do I need to operate a DeFi or Web3 project?

It depends on the architecture and the marketing perimeter. A fully decentralised protocol with no identifiable operator, no admin keys, no fee accrual to a controlled treasury, and no active EU marketing may rely on Recital 22 of Markets in Crypto-Assets Regulation and operate without a licence. Most protocols of meaningful scale do not meet that standard. Where a front-end is operated, a treasury is controlled by a foundation, or fees accrue to a named party, a CASP authorisation is typically required, with minimum capital depending on the activity class. Outside the EU, the equivalent is a VARA licence in the UAE, a Cayman VASP registration or Phase 2 licence, or a Saint Kitts & Nevis VASP registration. The first thing we deliver is a written perimeter analysis, not a smart contract.

Does MiCA apply to my DeFi protocol?

MiCA applies unless the service is provided in a fully decentralised manner without any intermediary (Recital 22), and the Joint EBA-ESMA Report confirms very few DeFi systems achieve that. ESMA assesses decentralisation case-by-case, looking for residual-centralisation indicators: admin or upgrade keys, fee accrual to a controlled treasury, an identifiable front-end operator, active EU marketing, governance-token concentration, and bridge or oracle dependencies. Partial decentralisation is not a safe harbour. A DAO that operates a front-end with admin keys, a fee mechanism and active EU marketing will typically need a CASP authorisation even where the smart contract is non-custodial. We document your position and keep it current as the protocol evolves.

Domicile & Banking
Where can a Web3 project be domiciled?

We deliver DeFi and Web3 builds in Cayman Islands (Foundation Company plus optional VASP), the UAE (VARA licence plus ADGM DLT Foundation wrapper), Panama (Private Interest Foundation), Saint Kitts & Nevis (VASP registration), Cyprus (MiCA CASP), and the Czech Republic (MiCA CASP). Cayman is the dominant DAO wrapper for protocols with institutional integrations; the UAE suits MENA market access and onshore presence; Panama suits treasury-only structures; Cyprus and the Czech Republic are the routes for EU passporting. Other jurisdictions sometimes cited (Switzerland, BVI, Marshall Islands, Wyoming, Liechtenstein) we reference as comparators, but we only make delivery commitments in the jurisdictions we serve.

Can you arrange fiat on/off-ramp banking?

Yes, as a supporting step once the structure is set. Fiat banking for a DeFi or Web3 project is a multi-institution exercise, not a single-bank application: a licensed EU EMI for operational euro flows, a DLT-friendly bank for token-treasury custody, and where applicable a regulated trust company for stablecoin and bitcoin holdings. Primary clearing banks reject DeFi-adjacent counterparties at the first application in most cases, so the path through is preparing carefully across the right institutions before anything is filed. We arrange this in parallel with the licensing file, because the operational-bank confirmation is one of the documents the regulator asks about once the application lands.

Start Your DeFi or Web3 Build

We form the wrapper and operating entity, write the perimeter analysis, file for the licence, arrange treasury banking and build the compliance stack, across six jurisdictions. One accountable firm, and we stand behind the outcome.

Free initial consultation · Response within 24 hours

Banking & Payments A company and a licence still need a bank account

Banking is one of our three core services. We help high-risk and regulated businesses open the bank and payment accounts that others refuse: we work directly with EU EMIs, payment institutions and crypto-aware banks, confirm appetite before you apply, and make the introduction. Take it with your company and licence, or on its own.

Explore banking & payments →

Tomberg & Partners

Tell us what you need to build.

Speak with our team about formation, licensing, banking, or the operating structure your business needs.

Book a free consultation