How to Build a DeFi or Web3 Project: Licensing, Banking & Infrastructure

What You Need to Build a DeFi or Web3 Project

A DeFi or Web3 project needs five interlocking components: a legal wrapper for the protocol or DAO, an operating entity for off-chain activities, a regulatory perimeter analysis under MiCA Recital 22 (and equivalent rules outside the EU), fiat on/off-ramp banking for treasury and operations, and an ongoing compliance stack covering smart-contract audits, sanctions screening, and DORA controls. The components are sequenced, not parallel.

First comes the legal wrapper for the protocol. DeFi protocols of meaningful scale operate behind a foundation: most commonly a Cayman Foundation Company under the Foundation Companies Act (2017, as revised), an ADGM DLT Foundation under the Distributed Ledger Technology Foundations Regulations 2023, or a Panama Private Interest Foundation under Law 25 of 12 June 1995. The wrapper holds the protocol treasury, contracts with developers and service providers, and provides a counterparty for grant programmes, exchanges, and counterparties.

Without a legal entity, the individuals who contract or act for a protocol may bear personal liability. Securities, tax, and anti-money-laundering obligations depend on the activities, structure, and applicable law.^[1]

Second comes the operating entity for off-chain activities. Rarely does the wrapper employ developers, run the website, sign SaaS contracts, or hold the fiat float. Those activities run through an operating entity, typically a service-provider company that contracts with the foundation. The operating entity is what the European regulator looks at when asking whether a CASP authorisation is required: it has identifiable management, marketing activity, fee accrual, and counterparty relationships that make it visible to the regulator.

Third comes the regulatory perimeter under MiCA Recital 22. The Joint EBA-ESMA Report under Article 142 of MiCA (ESMA75-453128700-1391 / EBA/Rep/2025/01, published 16 January 2025) notes that MiCA does not specify how to interpret references to “fully decentralised”, so whether the exemption applies turns on the facts of each protocol.^[2] The factors that can bring a service back inside MiCA include an identifiable front-end operator, admin or upgrade keys, fee accrual to a treasury controlled by a named party, active EU marketing, and governance-token concentration.

Partial decentralisation is not a safe harbour. Recital 22 explicitly states that MiCA applies “when part of such activities or services is performed in a decentralised manner.”

Fourth comes fiat on/off-ramp banking. Pure on-chain projects still need fiat for payroll, vendor payments, and the on/off-ramp itself. Banks routinely reject DeFi-adjacent counterparties: counterparty anonymity at the protocol layer, smart-contract operational risk, token-treasury volatility, and Travel Rule obligations under the Transfer of Funds Regulation (Regulation (EU) 2023/1113, applicable since 30 December 2024) all push primary clearing banks toward refusal.

Under the TFR, originator and beneficiary information must accompany every CASP-to-CASP crypto transfer with no de minimis threshold; for transfers to or from self-hosted wallets above €1,000, the CASP must additionally assess whether the wallet is owned or controlled by its customer.^[3] The practical pathway combines an EU-licensed EMI for euro flows, a DLT-friendly bank in a digital-asset-aware jurisdiction for token-treasury custody, and a regulated trust company for stablecoin and bitcoin holdings.

Fifth comes ongoing compliance: smart-contract audits and continuous bug bounty, sanctions screening at the front-end and at the fiat on/off-ramp, transaction monitoring for any CASP-classified surface, DORA controls for ICT third-party risk under Regulation (EU) 2022/2554 (applicable since 17 January 2025), and Travel Rule compliance for any CASP-to-CASP transfer.^[4]

Infrastructure Checklist

Most of this runs in sequence. Before banking can be arranged, before audits can be contracted, and before any compliance vendor can be onboarded, the legal wrapper and operating entity must exist. Perimeter analysis must precede smart-contract deployment, because architectural choices (admin keys, fee accrual mechanics, upgradability) determine whether MiCA applies. Fiat banking is the longest-pole item in most builds: pre-qualification through the partner network typically begins in parallel with the wrapper formation, not after it.

Choosing the Right Jurisdiction

Jurisdiction choice determines the available legal wrapper, the regulatory perimeter, the tax treatment of the protocol treasury, the fiat banking options, and the credibility signal to exchanges, custodians, and institutional counterparties. For DeFi and Web3 projects the choice is between offshore foundation jurisdictions (Cayman, UAE ADGM, Panama, Saint Kitts and Nevis), and EU MiCA jurisdictions (Cyprus, Czech Republic), each suited to a different protocol profile.

Jurisdiction Comparison

Choose the Cayman Islands if the project is a protocol with a treasury holding governance tokens or stablecoins, expects to be cited by name on third-party platforms, and wants the deepest pool of crypto-fluent professional service providers. The Cayman Foundation Company is a widely used DAO wrapper, because it can become an “orphan” entity with no shareholders, supervised by individuals or service providers (not members), and used by major DeFi protocols including those of the Aave and Compound generations.^[5]

Where the protocol’s front-end is custodial or operates a trading platform, the VASP Act 2020 Phase 2 licensing regime applies.

Cayman is the default for protocols planning institutional integrations; it is not the right base for projects seeking active EU retail distribution. See the full crypto licensing hub.

Choose the United Arab Emirates if the project wants a credible regulated home with onshore market access, MENA institutional flow, and the ability to issue tokens or run a custodial front-end under a recognised framework. Three relevant building blocks are available in the UAE:

• VARA licensing: an eight-category model covers advisory, broker-dealer, custody, exchange, lending, management, transfer, and VA issuance, with application fees from AED 40,000 to AED 100,000 per activity and annual supervision fees of AED 80,000 to AED 200,000 per activity.^[6]
• ADGM DLT Foundations: the 2023 Regulations set up a foundation regime purpose-built for DLT use and DAO governance, requiring minimum initial asset value of USD 50,000 payable in fiat (Section 19), a council of two to sixteen members, and a written charter governing token issuance and treasury rules.^[7]
• Tax and enforcement: UAE corporate income tax is 9% above AED 375,000 of taxable profit for ordinary taxable persons; a Qualifying Free Zone Person pays 0% on qualifying income and 9% on other taxable income. VARA enforcement has intensified: on 7 October 2025, VARA penalised 19 firms for unlicensed virtual-asset activity, with fines ranging from AED 100,000 to AED 600,000.^[8]

See the crypto licensing hub.

Choose Panama if the project wants a low-cost, low-friction wrapper for the protocol treasury, territorial tax treatment, and no Phase 2 licensing overlay. Among the lowest-friction DAO wrappers globally is the Panama Private Interest Foundation under Law 25 of 1995: USD 10,000 endowment minimum, USD 400 annual government fee (tasa única),^[13] Foundation Council consisting of one legal person or at least three individual members, and full asset separation from the founder under Article 11.^[9]

Panama was removed from the FATF grey list on 27 October 2023; its removal from the EU AML high-risk list followed with the Commission’s 10 June 2025 update to the high-risk-third-countries list (Delegated Regulation (EU) 2025/1184, in force 5 August 2025).^[10] Panama remains on Annex I of the EU list of non-cooperative jurisdictions for tax purposes after the Council’s revision of 17 February 2026.^[25] Panama is appropriate for treasury and holding structures, not for protocols that need a regulated licence on the front-end.

Choose Cyprus if the project plans an EU front-end with active marketing into EEA users, intends to operate as a regulated CASP, and wants a Pillar Two-aligned 15% corporate income tax base with deep professional-services infrastructure. CySEC’s CASP authorisation under MiCA carries the standard tiered capital requirements set by Article 67 and Annex IV: €50,000 for Class 1 (advisory, reception, and transmission, order execution, placing, transfer services, portfolio management), €125,000 for Class 2 (custody and administration of crypto-assets, and exchange of crypto-assets for funds and for other crypto-assets), and €150,000 for Class 3 (operation of a trading platform). Where an authorisation spans multiple classes, the highest applicable threshold applies; Article 67(1) further requires CASPs to hold at all times the higher of the statutory minimum and one quarter of the preceding year’s fixed overheads.^[12][26]

Where the safeguards are met through own funds, those funds must qualify under MiCA Article 67(4)(a); a treasury position in BTC or stablecoins does not satisfy the regulatory minimum. CySEC set a 27 February 2026 deadline for legacy CASPs to file MiCA applications, and the EU-wide transitional period ended 1 July 2026. See the full Cyprus crypto licensing guide.

Choose the Czech Republic if the project wants an EU MiCA CASP authorisation from a regulator that is already granting them. Under MiCA and Act No. 31/2025 Coll., the Czech National Bank (ČNB) authorises and supervises CASPs; AML/CFT compliance is supervised by the Financial Analytical Office and the ČNB. The Czech Republic offers a 21% corporate tax rate and EU passporting under a single CASP authorisation. Its review is selective: the ČNB granted 11 authorisations from 251 applications and notifications assessed by 1 July 2026, describing a significant share of the filings as wholly insufficient in content.^[20] See the crypto licensing hub.

Setting Up Your Company

Company formation is the first operational step for a DeFi or Web3 project, because the foundation wrapper, the operating entity, the fiat banking application, and the smart-contract audit engagement all require a registered legal person. Most commonly, the formation mistake is to incorporate the operating entity in the wrong jurisdiction (typically a US LLC or a UK Ltd held personally by the founders), then restructure once it becomes clear the entity cannot host the protocol treasury or contract with regulated counterparties. The cost is 2 to 4 months and €40,000 to €100,000 in restructuring fees.

Formation by Jurisdiction

For most protocols of meaningful scale, the two-entity structure (foundation plus operating entity) is the working architecture. The foundation holds the treasury and the protocol-level intellectual property; the operating entity employs developers, runs the website and front-end, and contracts with third parties. When assessing whether the protocol is “fully decentralised” or whether the operating entity is a CASP, the regulator opens an information request on the service agreement between the two. Drafting that agreement is a regulatory exercise, not a corporate one.

What MiCA does not assess at the protocol layer it assesses at the operating-entity layer: the foundation’s legal-form choice (Cayman Foundation Company, ADGM DLT Foundation, Panama Private Interest Foundation) does not, by itself, resolve the CASP-of-record question, which turns on which entity controls the upgrade keys, accrues the protocol fees, and operates the front-end accessible to EEA users.

Licensing Requirements

A DeFi or Web3 project needs one of three positions, supported by contemporaneous documentation: a “fully decentralised” position under MiCA Recital 22 with no licensing requirement; a CASP authorisation under MiCA in the EU; or a VARA, CIMA, or other equivalent licence outside the EU. Under Article 67 + Annex IV, the MiCA CASP capital floor is €50,000 for Class 1 (advisory, reception, and transmission, order execution, placing, transfer services, portfolio management), €125,000 for Class 2 (custody and administration, and exchange of crypto-assets for funds and for other crypto-assets), and €150,000 for Class 3 (operation of a trading platform).^[12]

MiCA scope and the Recital 22 carve-out

Recital 22 of Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114) states that “where crypto-asset services are provided in a fully decentralised manner without any intermediary, they should not fall within the scope of this Regulation.” Two operative points govern its application. First, Recital 22 is non-binding as a preamble; the operative articles contain no definition of “fully decentralised.” Second, with no statutory test, the exemption turns on the facts of each case rather than a bright-line rule: the Joint EBA-ESMA Report under Article 142 MiCAR notes that MiCA does not specify how to interpret references to “fully decentralised”.^[2]

On our reading, seven indicators of residual centralisation weigh towards MiCA scope; the Joint EBA-ESMA Report of 16 January 2025 points to several of them, such as administrator keys, fee flows to an address a central party controls, and concentrated governance-token holdings:^[2]

• Existence of admin or upgrade keys.
• Fee accrual to a treasury controlled by a named party.
• An identifiable front-end or UI operator.
• Active EU marketing.
• Governance-token concentration in a small number of wallets.
• Treasury management by an identifiable foundation.
• Bridge or oracle dependencies that introduce intermediaries.

Partial decentralisation is not a safe harbour: Recital 22 itself states that MiCA applies “when part of such activities or services is performed in a decentralised manner.” Treating Recital 22 as a binary qualifier rather than an evidentiary file is the common mistake. An upgradable multisig, a foundation-controlled treasury, and a named front-end operator call for case-specific analysis even where the smart contracts themselves are non-custodial. The Joint EBA-ESMA Report sets no decentralisation test and says its terminology is not a view on the level of decentralisation for Recital 22.^[2] The question is whether an identifiable person or undertaking provides a crypto-asset service within MiCA, and that can be the front-end operator, whatever the governance of the protocol layer.

CASP triggers for front-ends and DAOs

CASP activities most likely to apply to a DeFi or Web3 front-end are operation of a trading platform for crypto-assets (where the front-end matches third-party orders), exchange of crypto-assets for funds or for other crypto-assets (where the operator facilitates swaps), custody and administration of crypto-assets (where the front-end controls smart-contract vaults), and transfer services (relevant to bridge front-ends).

A non-custodial smart contract that the operator cannot upgrade is the strongest defence against CASP scope; an upgradable contract controlled by a multisig with named signers does not by itself make the operator a CASP, but it identifies who controls the protocol and makes it harder to show that the service runs without any intermediary.

Token issuance under MiCA Title II

For in-scope crypto-assets that are neither asset-referenced tokens (Title III) nor e-money tokens (Title IV), MiCA Title II governs offers to the public and admission to trading in the EU, subject to its exemptions. Where a white paper is required, the offeror or person seeking admission to trading draws it up under Annex I and notifies it to the competent authority of its home Member State at least 20 working days before publication (Article 8); marketing communications must be consistent with the white paper (Article 7), and the offeror or person seeking admission must act honestly, fairly, and professionally (Article 14).

On 23 December 2025 the iXBRL machine-readable formatting requirement entered into application, with the ESMA XBRL taxonomy published on 5 August 2025.^[14] Most DeFi governance tokens sit in this Title II category, so the Title II rules above apply when such a token is offered to the public or admitted to trading, unless an exemption applies.

Non-EU licensing pathways

VARA (Dubai): eight activity-specific licences under the Virtual Assets and Related Activities Regulations 2023, supported by 2024 to 2025 Rulebooks. Application fees are AED 40,000 for Advisory and VA Transfer and Settlement Services, and AED 100,000 for Broker-Dealer, Category 1 VA Issuance, Custody, Exchange, Lending and Borrowing, and VA Management and Investment Services.

Annual supervision fees per activity are AED 80,000 for Advisory and VA Transfer and Settlement Services, and AED 200,000 for Broker-Dealer, Category 1 VA Issuance, Custody, Exchange, Lending and Borrowing, and VA Management and Investment Services, payable per activity per year in advance. Multi-activity applications attract a Licence Extension Fee of 50% of the lower of the two application fees. The licensing process is two-stage: an Initial Disclosure Questionnaire leading to an Approval to Incorporate, followed by the full VASP application leading to a licence. Typical end-to-end timeline is 6 to 12 months.^[6]

Cayman Islands VASP Act 2020: Phase 1 registration applies to AML and cybersecurity for any virtual asset service provided to the public. Phase 2 licensing for trading platforms and custodians commenced on 1 April 2025. Following the February to April 2024 Ministry of Financial Services consultation, the Virtual Asset (Service Providers) (Amendment) Act 2024 broadened the “Owner/Operator” definition to capture trading platforms and DAOs without an identifiable managing group.^[15]

Private sales (per the Virtual Asset (Service Providers) Regulations 2020, “not advertised and made available to a limited number of persons or entities”) fall outside the Act, as do gratuitous airdrops. No statutory capital floor: adequacy is assessed against the business plan.

ADGM DLT Foundations Regulations 2023: the wrapper-only regime. Minimum initial asset value USD 50,000 payable in fiat (Section 19), paid up within six months of incorporation; Foundation Council of at least 2 and at most 16 councillors; mandatory Charter setting out objects, token-issuance rules, and asset rules; optional Guardian role overseeing Council compliance with the Charter; annual audited accounts published on the foundation’s website; periodic security audits of data-protection and IT systems shared with the Registrar; Company Service Provider engagement mandatory unless granted “exempt foundation” status.^[7]

Saint Kitts and Nevis Virtual Asset Act 2020, Cap. 21.29 (as amended through the Virtual Asset (Amendment) Act No. 8 of 2026, assented 18 June 2026): VASP registration with the Financial Services Regulatory Commission (federation regulator, administered through its St. Kitts Branch). The 2024 amendment brought controlling shareholders within the significant-shareholder fit-and-proper test,^[11] and the 2026 amendment added a mandatory independent AML/CFT/CPF audit (section 9(11)).^[23] The operative subsidiary legislation is now the Virtual Asset Business Regulations, SR&O 13 of 2026, which repealed SRO 25 of 2022 and requires a decision within 90 days of a complete application.^[24]

Saint Lucia Virtual Asset Business Act, No. 24 of 2022: assented 15 December 2022; commenced 28 December 2022. On 4 August 2025 the FSRA issued its General Circular on VASPs, confirming that the FSRA is the supervisory authority.^[18] The FSRA stated on 16 June 2026 that it had not commenced issuing licences under the Act, so no entity is licensed yet.^[21] The Act requires a licensee to place in escrow assets equivalent to a minimum of 15% of the total value of client funds held (section 12(1)).

Schedule 2 of SI No. 37 of 2025 prescribes a non-refundable application fee of EC$1,000 and a flat licence fee of EC$15,000 covering all activity scopes, payable again on annual renewal.

DORA application to MiCA CASPs

From 17 January 2025, the Digital Operational Resilience Act (Regulation (EU) 2022/2554) applies to MiCA CASPs. Obligations include:

• a comprehensive ICT risk management framework;
• classification and reporting of major ICT incidents within hours;
• resilience testing including threat-led penetration testing every three years for significant entities;
• an ICT third-party risk register (first submission 30 April 2025);
• contracts with ICT providers including audit rights, exit strategies, and subcontracting controls (Commission Delegated Regulation (EU) 2025/532 on subcontracting of ICT services supporting critical or important functions, in force 22 July 2025).

On 18 November 2025, the European Supervisory Authorities designated 19 critical ICT third-party providers, including AWS, Microsoft Azure, Google Cloud, Oracle, SAP, and Deutsche Telekom.^[4] DORA itself sets no penalty amount for financial entities: under Article 50(3), Member States lay down the administrative penalties and remedial measures for breaches.

Critical ICT third-party providers face periodic penalty payments of up to 1% of average daily worldwide turnover in the preceding business year, imposed daily for no more than six months, under Article 35(6)–(8).^[4]

The eighth update to the Directive on Administrative Cooperation, Directive (EU) 2023/2226 (DAC8), has applied since 1 January 2026.^[19] DAC8 imposes automatic exchange of crypto-asset transaction data on reporting crypto-asset service providers (RCASPs) that provide services to EU-resident users, irrespective of where the RCASP is established.

A non-EU operator with EU customers is captured; full decentralisation under MiCA Recital 22 does not by itself displace DAC8 reach where an identifiable operator, front-end, or treasury counterparty exists. The first reporting period is calendar year 2026. DAC8 leaves the deadline for filing with the competent authority of the RCASP’s nexus Member State to that State’s transposing law; competent authorities must then exchange the information within nine months after the end of the calendar year (Article 8ad(6)).

Penalty exposure is set by each Member State: Article 25a of Directive 2011/16/EU, as replaced by DAC8, requires effective, proportionate and dissuasive penalties but sets no amount or band, so the level and any daily continuance fine depend on the nexus Member State’s transposing law.

See the full Cyprus CASP authorisation guide and the crypto licensing hub.

Banking

Fiat banking is the single most underestimated component of a DeFi or Web3 build. Primary clearing banks routinely reject DeFi-adjacent counterparties, and the rejection rates do not fall meaningfully even when the project has a foundation wrapper, a published audit, and a clear regulatory position. As of May 2026, fiat on/off-ramp banking is in practice a multi-institution exercise: an EU-licensed EMI for operational euro flows, a DLT-friendly bank in a digital-asset-aware jurisdiction for token-treasury custody, and where applicable a regulated US trust company for stablecoin and bitcoin holdings.

Most banks decline DeFi mandates for five reasons:

• Counterparty anonymity: DeFi end-users are typically unidentifiable to the protocol, so the bank cannot perform meaningful Source-of-Wealth or Source-of-Funds analysis on the protocol’s effective customers.
• Smart-contract operational risk: an exploit creates liability exposure for any bank funding operations or holding treasury.
• Token-treasury volatility: protocol treasuries denominated in native governance tokens can swing 70% within a quarter, complicating creditworthiness.
• Travel Rule exposure: Regulation (EU) 2023/1113, applicable since 30 December 2024, makes banks accountable for the originator and beneficiary information their CASP-classified counterparties send and receive.^[3]
• DORA third-party risk: banks treat any DeFi-adjacent counterparty integrating via APIs as an ICT-risk node.

In practice, the foundation wrapper alone does not unlock banking; what the credit committee underwrites is the operating entity’s ability to evidence its KYC posture toward the front-end users, the upgrade-key custody arrangements over the smart contracts, and the oracle and bridge dependencies that route value through identifiable intermediaries, because those are the points where the bank inherits residual AML and operational liability.

Accepting institutions divide, in practice, into four archetypes. First is an EU-licensed Electronic Money Institution with a documented digital-asset onboarding policy, used for SEPA in/out, payroll, and vendor payments; typically a tier-two EMI in a digital-asset-aware jurisdiction with a crypto-fluent compliance team. Second is a licensed bank offering digital-asset services, for example in Liechtenstein, used for DAO treasury custody and stablecoin operational balances. Registration as a TT service provider under Liechtenstein’s TVTG is not a banking licence; Switzerland’s DLT trading-facility licence is a separate permission.

Third is a regulated US trust company operating under New York or Wyoming supervision, used for institutional bitcoin and stablecoin holdings with monthly attestation. Fourth is a UAE onshore commercial bank with a non-objection to hold accounts for a VARA-licensed VASP.

Ongoing Compliance

Compliance is a permanent operating expense, not a one-time licensing cost. For a Class 3 MiCA CASP-classified DeFi front-end, the annual run-rate is typically €500,000 to €1.2 million, plus prudential safeguards equal to the higher of €150,000 and one quarter of prior-year fixed overheads; for a registration-only Cayman or Saint Kitts and Nevis VASP, the annual run-rate is closer to USD 150,000 to USD 400,000.

Five permanent obligations attach to any CASP-classified surface: anti-money-laundering controls and Travel Rule compliance under the Transfer of Funds Regulation; transaction monitoring and sanctions screening at the front-end (with vendor pricing from approximately USD 25,000 to USD 80,000 per annum); DORA controls including the ICT third-party risk register, incident classification, and reporting, and threat-led penetration testing for significant entities; smart-contract audit cadence (initial pre-launch audit plus every material upgrade plus competitive audit plus continuous bug bounty); and external audit of the financial statements and ICT controls.

Smart-contract audit cost ranges as of 2025 to 2026 break down by complexity:

• Simple module: an ERC-20 or staking contract costs USD 8,000 to USD 50,000.
• Moderate DeFi primitive: lending, AMM or governance protocols cost USD 50,000 to USD 150,000.
• Complex protocol: a new L1/L2 chain costs USD 150,000 to USD 600,000 or more for formal verification.

Top-tier engineer rates are approximately USD 25,000 per engineer-week at Trail of Bits and OpenZeppelin (Arbitrum Research and Development Committee proposals, 2024 to 2025), with retainer-model engagements common at protocols with treasury size above USD 100 million.^[16] Industry best practice for protocols with TVL above USD 100 million is two independent audits, a competitive contest on a platform such as Code4rena or Sherlock, and a continuous bug bounty on Immunefi (which had paid USD 100.21 million across more than 3,000 bug-bounty reports as of September 2024, with 77.5% going to smart-contract vulnerabilities; the single largest payout was USD 10 million for a Wormhole cross-chain bridge vulnerability).^[17]

What constrains the build is not the pre-launch audit budget, which is finite, but the obligation to re-audit on every material upgrade plus the continuous bug-bounty programme; protocols that treat the first audit as a one-time spend rather than as the opening cost of a permanent security operating line typically discover the gap at the point of an upgrade-driven incident, where remediation typically costs far more than the recurring audit cadence they declined to fund.

Two MiCA transitional deadlines have now passed: the MiCA legacy-VASP transitional period ended 1 July 2026, and CySEC’s filing deadline for legacy CASPs was 27 February 2026. Looking ahead, the European Commission had not published its report under MiCA Article 142, due by 30 December 2024, when checked on 25 August 2026; that report must assess decentralised finance and may lead to dedicated DeFi legislation.

Realistic Timeline and Costs

End-to-end timeline from initial scoping to operational front-end is typically 1 to 9 months for an offshore wrapper or registration build, depending on whether the structure is a Panama foundation or a Cayman or Saint Kitts and Nevis registration, and 8 to 18 months for an EU MiCA CASP build. Technology development (smart-contract audits, front-end, infrastructure) runs in parallel with the licensing file; banking onboarding is the critical-path item in most schedules.

Cost Breakdown by Phase

As of May 2026, the figures above are Jagelski & Partners’ planning estimates (actual fees are quoted per case) and include professional fees, government fees, audit fees, and own funds held for regulatory safeguards where applicable. They do not include founder salaries, marketing spend, the protocol token-distribution event, or post-launch security incident response. Currency convention: EUR for EU phases; USD for non-EU phases; AED where VARA-specific.

Frequently Asked Questions

References