Check whether the company signing your crypto services contract has the legal basis to perform the work you need. Licentium’s partner verification review connects the contracting entity, official records, permitted activities and proposed operating arrangement. The resulting pack identifies what supports onboarding, what must change and what remains unresolved.
Before appointing a crypto service provider
The review is for founders, compliance teams and procurement leads selecting a crypto counterparty for business use. It also fits a proposed renewal, a move to another group entity or an extension into another country.
A familiar brand can present several legal entities across its website, account application and service terms. The decision concerns the entity responsible for each service, the users it will serve and the countries involved. A group’s licence announcements need to be reconciled with that arrangement.
This scope examines the proposed partner and services. An investment or acquisition involving the wider project calls for Web3 legal due diligence, which also examines ownership, historic liabilities and the project’s other activities.
Match the entity to the activity and destination
The identity check compares the legal name, company number, trading names and regulatory reference with the contract and account-opening documents. It also checks the website domain, contact details and any regulator warning about impersonation. Contact should be verified through the regulator’s published details where available. A copied registration number can belong to a different business. (FCA, How to check a firm or individual is authorised, sections on unauthorised firms and firm information.)
The activity review follows who exchanges the assets, holds or controls them, executes instructions and makes transfers. It distinguishes a supplier handling technical operations from a provider performing a regulated service. An affiliate needs an identified legal basis for its own role. Contract wording alone cannot supply a missing permission.
Countries are checked separately. The provider’s operating location, the destination of the service and the customer category can change the answer. A home-country permission does not settle the destination’s requirements.
EU authorisation and cross-border services
For services within MiCA, check the exact crypto-asset service provider and its permitted activities against ESMA and the home regulator’s records. An eligible financial institution may use the Article 60 notification route instead of obtaining a separate CASP authorisation. Services in another EU Member State also require the Article 65 cross-border procedure. (Regulation (EU) 2023/1114, Articles 59–60, 65 and 109.)
The maximum MiCA grandfathering period ended on 1 July 2026. An old national registration cannot support continued service through that expired transition. A third-country firm relying on a customer’s exclusive initiative needs a separate Article 61 assessment; solicitation by the firm or someone acting for it defeats that route. (MiCA, Articles 61 and 143(3).)
UK registration and the coming authorisation regime
FCA cryptoasset registration covers the anti-money-laundering regime for in-scope exchange and custodian wallet businesses carried on in the UK. It does not itself establish product approval or compensation protection. The review also checks any separate regulated activity and the lawful route for qualifying cryptoasset promotions. (Money Laundering Regulations 2017 (SI 2017/692), regulations 8, 14A, 56 and 60A; Financial Services and Markets Act 2000, sections 19 and 21.)
For a contract extending into the new regime scheduled for 25 October 2027, obtain the provider’s authorisation plan. Existing registration does not convert automatically. Any reliance on saving or transitional provisions needs its own conditions checked. (Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, regulation 1 and Part 7.)
Dubai VARA licensing
A VARA check concerns Dubai outside the Dubai International Financial Centre. It does not resolve permissions elsewhere in the UAE. Review the full licence, listed activities, permitted client categories and conditions. VARA expressly distinguishes a full VASP licence from in-principle approval, which does not permit operations or client service. (VARA, Virtual Assets and Related Activities Regulations 2023, regulations III.A and IV.B.1; Market Conduct Rulebook, rule IV.A.1; Public Register, introductory notice.)
Exchange, broker-dealer, custody, and transfer and settlement services require separate activity analysis. Where another group company provides custody, check its role and legal basis against the custody rules. (VARA, Regulations, Schedule 1; Custody Services Rulebook, rules III.B.5–6.)
Singapore MAS permissions
Check the exact entity and Digital Payment Token service in MAS’s Financial Institutions Directory, alongside its licence class and conditions. A payment institution listing for a different service does not establish the required DPT scope. If the provider relies on an exemption, obtain evidence of that exemption and the activities it covers. (MAS, Licensing for Payment Service Providers; Financial Institutions Directory; list of entities notified under the Transitional Regulations 2024.)
Customer restrictions also matter. A corporate account should not be assumed to qualify for treatment reserved for accredited or institutional investors. The review identifies the applicable customer category before assessing access to the proposed service. (MAS, Guidelines on the Provision of Consumer Protection Safeguards by Digital Payment Token Service Providers, section 2.)
A Singapore company serving only overseas customers also needs its home-country position checked under the separate overseas digital-token service regime. Destination permissions remain a separate question. (MAS, MAS Clarifies Regulatory Regime for Digital Token Service Providers, 6 June 2025.)
The partner verification pack
The agreed review produces:
- An identity reconciliation connecting the brand, legal entities, corporate identifiers, domains and contractual roles.
- Findings for each activity, destination and customer category, with the permission or exemption relied on and its restrictions.
- Dated official-register evidence, including the source, status, permitted services and any relevant warning or mismatch.
- Questions and proposed contract changes covering responsibility, custody, outsourcing and service boundaries.
- An action list naming the owner, required evidence or change, and the condition that must be met before the affected activity proceeds.
Custody needs evidence beyond a register entry. The review examines who controls keys, whose records identify the customer’s entitlement, and who owes the return obligation. It also checks segregation, use of assets, subcustodians, liability and the consequences of termination or insolvency.
For a MiCA custodian, outsourcing does not remove responsibility. Article 75(9) requires an authorised provider for outsourced custody and disclosure of its use to clients. The custody contract must also address the matters required by Article 75(1). (MiCA, Articles 73 and 75.)
The report separates binding duties, supervisory guidance and proposed contractual protections. A request for advance notice of a subcontractor change should identify whether it follows from law or is proposed for this contract.
Documents to provide
Start with the proposed contracting entity, website, draft agreement and intended services. Include the provider’s operating countries, the countries of the intended users, and whether the account holds business assets or assets for others.
The supporting documents should include:
- Corporate extracts, regulatory references, licence schedules, conditions and relevant regulator correspondence.
- Service terms, account-opening documents and the provider’s explanation of any exemption.
- The asset and payment flow, including each entity that receives money, controls assets or executes transfers.
- Custody and subcustody terms, outsourcing arrangements, segregation records and the applicable customer classification.
A missing document becomes a specific evidence request. A certificate supplied by the provider is checked against the issuing authority and current restrictions.
From the first check to an onboarding decision
The first stage fixes the entities, services, territories and customer categories in scope. The second tests the official records and governing rules. The third compares those findings with the contract and operating flow, then assigns the required actions.
Proceeding requires sufficient evidence for the specified arrangement. If the proposed signatory is wrong, the provider must supply the correct contract and show that the responsible entity will perform the service. If a permission excludes an activity or customer group, the business must remove that part of the arrangement or obtain a supported alternative before launch.
An unexplained mismatch should pause the affected onboarding decision. A confirmed impersonation, prohibited activity or refusal to substantiate the necessary legal basis can justify declining the relationship. An unsuccessful register search alone does not establish illegality: a different name, reporting delay or applicable exemption may require further checks.
Register evidence records the position on its stated date. The pack identifies what to refresh before signing and activation, and the changes that call for another review. A new entity, domain, country, service or subcustodian can alter the conclusion. Wider financial, cybersecurity, sanctions or insolvency work is scoped where the findings require it.
Request a partner verification scope
Send the proposed contract, provider’s legal name and website, intended services and user countries. Request a partner verification scope to define the entity, permission and contract checks needed for the onboarding decision.