VASP registration is not a licence: what you get on the Isle of Man

DBROA 2015 is the island's mechanism for putting non-licensed sectors under anti-money-laundering supervision. A business that carries on virtual asset activity from the Isle of Man registers with the IOMFSA as a designated business; the regulator then oversees its AML/CFT compliance - the risk assessments, the customer due diligence, the monitoring and the reporting. The IOMFSA has been aligning its terminology with the FATF definition of a virtual asset service provider, which is why "VASP registration" has become the working label for the regime. The scope, process and file we build for it are covered in our Isle of Man VASP registration overview.

Geography does part of the explaining. The Isle of Man is a Crown Dependency - part of neither the UK nor the EU - so it sits outside MiCA entirely. That cuts both ways, and we state it symmetrically: the regime is lighter than an EU CASP authorisation, and it confers no EU/EEA passporting rights of any kind. A registered Manx VASP serves the markets its own licensing analysis allows it to serve, not the single market.

The honest way to read the regime is as a perimeter of AML/CFT supervision with a lawful operating base attached - not as a badge of prudential approval. The table below is the version we walk clients through before they write a word of marketing copy.

This is where registered businesses most often hurt themselves. A bank or payment provider running onboarding will verify your claimed status against the IOMFSA's public information, and market practitioners report that a mismatch between the website and the register is treated as a credibility problem, not a typo. The island's own editorial rule is the right one to borrow: never use the word "licence" for this status without the qualifier in the same sentence.

Wording that survives review: "registered with the Isle of Man Financial Services Authority as a designated business under DBROA 2015, subject to AML/CFT oversight." Wording that fails: "licensed by the IOMFSA", "Isle of Man crypto licence", or a bare "fully regulated" with no explanation of what the regulation actually covers. And keep one consistent formulation everywhere - website footer, pitch deck, bank application - because compliance teams compare surfaces. Overstating a regulatory status is not just an onboarding risk; it is the kind of conduct a regulator remembers when it assesses the people behind a business.

The open question is whether registration eventually becomes licensing. The IOMFSA has run two public consultations on a full licensing regime for virtual asset businesses; as of July 2026 the direction remains undecided, and the only reliable sources on its status are iomfsa.im and consult.gov.im - verify before you structure around either outcome. The wider supervisory climate points one way, though: a MONEYVAL inspection is expected in 2026, and the island has been tightening AML expectations across sectors, so the compliance bar attached to registration is rising even while the legal form stands still.

What makes the Isle of Man unusual is who a registered VASP shares the island with. The Gambling Supervision Commission has accepted cryptocurrency deposits under its gambling licences for years, so crypto businesses and licensed operators coexist under mature regulators that talk to each other - a genuine structural advantage for groups that span both worlds. Our approach is to scope the perimeter first and register once, cleanly; see how we run the process.