How to Build a DeFi or Web3 Project: Licensing, Banking & Infrastructure

What You Need to Build a DeFi or Web3 Project

A DeFi or Web3 project needs five interlocking components: a legal wrapper for the protocol or DAO, an operating entity for off-chain activities, a regulatory perimeter analysis under MiCA Recital 22 (and equivalent rules outside the EU), fiat on/off-ramp banking for treasury and operations, and an ongoing compliance stack covering smart-contract audits, sanctions screening, and DORA controls. The components are sequenced, not parallel.

The first decision is the legal wrapper for the protocol. DeFi protocols of meaningful scale operate behind a foundation: most commonly a Cayman Foundation Company under the Foundation Companies Act (2017, as revised), an ADGM DLT Foundation under the Distributed Ledger Technology Foundations Regulations 2023, or a Panama Private Interest Foundation under Law 25 of 12 June 1995. The wrapper holds the protocol treasury, contracts with developers and service providers, and provides a counterparty for grant programmes, exchanges and counterparties. A protocol without a wrapper is not a protocol; it is a group of individuals personally exposed to securities, tax, and anti-money-laundering liability in every jurisdiction where they reside.^[1]

The second decision is the operating entity for off-chain activities. The wrapper rarely employs developers, runs the website, signs SaaS contracts, or holds the fiat float. Those activities run through an operating entity, typically a service-provider company that contracts with the foundation. The operating entity is what the European regulator looks at when asking whether a CASP authorisation is required: it has identifiable management, marketing activity, fee accrual, and counterparty relationships that make it visible to the regulator.

The third decision is the regulatory perimeter under MiCA Recital 22. The Joint EBA-ESMA Report under Article 142 of MiCA (ESMA75-453128700-1391 / EBA/Rep/2025/01, published 13 January 2025) confirms that “very few DeFi systems achieve truly full decentralisation in the manner contemplated by Recital 22” and that the exemption must be assessed case-by-case.^[2] The factors that pull a service back inside MiCA include an identifiable front-end operator, admin or upgrade keys, fee accrual to a treasury controlled by a named party, active EU marketing, and governance-token concentration. Partial decentralisation is not a safe harbour. Recital 22 explicitly states that MiCA applies “when part of such activities or services is performed in a decentralised manner.”

The fourth decision is fiat on/off-ramp banking. Pure on-chain projects still need fiat for payroll, vendor payments, and the on/off-ramp itself. Banks routinely reject DeFi-adjacent counterparties: counterparty anonymity at the protocol layer, smart-contract operational risk, token-treasury volatility, and Travel Rule obligations under the Transfer of Funds Regulation (Regulation (EU) 2023/1113, applicable since 30 December 2024) all push primary clearing banks toward refusal. Under the TFR, originator and beneficiary information must accompany every CASP-to-CASP crypto transfer with no de minimis threshold; for transfers to or from self-hosted wallets above €1,000, the CASP must additionally verify the customer’s ownership or control of the wallet.^[3] The practical pathway combines an EU-licensed EMI for euro flows, a DLT-friendly bank in a digital-asset-aware jurisdiction for token-treasury custody, and a regulated trust company for stablecoin and bitcoin holdings.

The fifth component is ongoing compliance: smart-contract audits and continuous bug bounty, sanctions screening at the front-end and at the fiat on/off-ramp, transaction monitoring for any CASP-classified surface, DORA controls for ICT third-party risk under Regulation (EU) 2022/2554 (applicable since 17 January 2025), and Travel Rule compliance for any CASP-to-CASP transfer.^[4]

Infrastructure Checklist

The components are not parallel. The legal wrapper and operating entity must exist before banking can be arranged, before audits can be contracted, and before any compliance vendor can be onboarded. Perimeter analysis must precede smart-contract deployment, because architectural choices (admin keys, fee accrual mechanics, upgradability) determine whether MiCA applies. Fiat banking is the longest-pole item in most builds: pre-qualification through the partner network typically begins in parallel with the wrapper formation, not after it.

Choosing the Right Jurisdiction

The jurisdiction choice determines the available legal wrapper, the regulatory perimeter, the tax treatment of the protocol treasury, the fiat banking options, and the credibility signal to exchanges, custodians and institutional counterparties. For DeFi and Web3 projects the choice is between offshore foundation jurisdictions (Cayman, UAE ADGM, Panama, Saint Kitts & Nevis), and EU MiCA jurisdictions (Cyprus, Czech Republic), each suited to a different protocol profile.

Jurisdiction Comparison

Choose the Cayman Islands if the project is a protocol with a treasury holding governance tokens or stablecoins, expects to be cited by name on third-party platforms, and wants the deepest pool of crypto-fluent professional service providers. The Cayman Foundation Company is the dominant DAO wrapper globally because it can become an “orphan” entity with no shareholders, supervised by individuals or service providers (not members), and used by major DeFi protocols including those of the Aave and Compound generations.^[5] The VASP Act 2020 Phase 2 licensing regime applies where the protocol’s front-end is custodial or operates a trading platform. Cayman is the default for protocols planning institutional integrations; it is not the right base for projects seeking active EU retail distribution. See the full crypto licensing hub.

Choose the United Arab Emirates if the project wants a credible regulated home with onshore market access, MENA institutional flow, and the ability to issue tokens or run a custodial front-end under a recognised framework. The UAE offers three relevant building blocks:

• VARA licensing: an eight-category model covers advisory, broker-dealer, custody, exchange, lending, management, transfer and VA issuance, with application fees from AED 40,000 to AED 100,000 per activity and annual supervision fees of AED 80,000 to AED 200,000 per activity.^[6]
• ADGM DLT Foundations: the 2023 Regulations are the only foundation regime in the world purpose-built for DLT use and DAO governance, requiring minimum initial asset value of USD 50,000 payable in fiat (Section 19), a council of two to sixteen members, and a written charter governing token issuance and treasury rules.^[7]
• Tax and enforcement: UAE corporate income tax is 9% above AED 375,000 of taxable profit, with 0% in qualifying free zones. VARA enforcement has intensified: on 7 October 2025, VARA penalised 19 firms for unlicensed virtual-asset activity, with fines ranging from AED 100,000 to AED 600,000.^[8]

See the crypto licensing hub.

Choose Panama if the project wants a low-cost, low-friction wrapper for the protocol treasury, territorial tax treatment, and no Phase 2 licensing overlay. The Panama Private Interest Foundation under Law 25 of 1995 is among the lowest-friction DAO wrappers globally: USD 10,000 endowment minimum, USD 300 annual government fee, Foundation Council of at least three members, and full asset separation from the founder under Article 11.^[9] Panama was removed from the FATF grey list on 27 October 2023 and from the EU AML high-risk list on 14 March 2024; the Commission’s subsequent Delegated Regulation on the AML high-risk-third-countries list reinforced its exit.^[10] Panama is appropriate for treasury and holding structures, not for protocols that need a regulated licence on the front-end.

Choose Cyprus if the project plans an EU front-end with active marketing into EEA users, intends to operate as a regulated CASP, and wants a Pillar Two-aligned 15% corporate income tax base with deep professional-services infrastructure. CySEC’s CASP authorisation under MiCA carries the standard tiered capital requirements set by Article 67 and Annex IV: €50,000 for Class 1 (advisory, reception and transmission, order execution, placing, transfer services, portfolio management), €125,000 for Class 2 (custody and administration of crypto-assets, and exchange of crypto-assets for funds and for other crypto-assets), and €150,000 for Class 3 (operation of a trading platform). Where an authorisation spans multiple classes, the highest applicable threshold applies; Article 67(3) further requires CASPs to hold the higher of the statutory minimum or one quarter of the preceding year’s fixed overheads.^[12]

Capital must be held in qualifying own-funds instruments; a treasury position in BTC or stablecoins does not satisfy the regulatory minimum. CySEC has set a 27 February 2026 deadline for legacy CASPs to file MiCA applications, with the EU-wide transitional period ending 1 July 2026. See the full Cyprus crypto licensing guide.

Choose the Czech Republic if the project wants an EU MiCA CASP authorisation with a more efficient regulator interface than the larger member states. The Czech National Bank (ČNB) supervises CASPs under MiCA, with the local AML Act 2024 implementing transposition. Czech Republic offers a 21% corporate tax rate and EU passporting under a single CASP authorisation. The Czech Republic is appropriate for projects that want EU regulatory status without the supervisory backlog visible in Germany, the Netherlands and other tier-1 EU member states.^[13] See the crypto licensing hub.

Setting Up Your Company

Company formation is the first operational step for a DeFi or Web3 project, because the foundation wrapper, the operating entity, the fiat banking application, and the smart-contract audit engagement all require a registered legal person. The most common formation mistake is incorporating the operating entity in the wrong jurisdiction (typically a US LLC or a UK Ltd held personally by the founders), then restructuring once it becomes clear the entity cannot host the protocol treasury or contract with regulated counterparties. The cost is 2 to 4 months and €40,000 to €100,000 in restructuring fees.

Formation by Jurisdiction

The two-entity structure (foundation plus operating entity) is the working architecture for most protocols of meaningful scale. The foundation holds the treasury and the protocol-level intellectual property; the operating entity employs developers, runs the website and front-end, and contracts with third parties. The service agreement between the two is the document the regulator opens an information request on when assessing whether the protocol is “fully decentralised” or whether the operating entity is a CASP. The drafting of that agreement is a regulatory exercise, not a corporate one. What MiCA does not assess at the protocol layer it assesses at the operating-entity layer: the foundation’s legal-form choice (Cayman Foundation Company, ADGM DLT Foundation, Panama Private Interest Foundation) does not, by itself, resolve the CASP-of-record question, which turns on which entity controls the upgrade keys, accrues the protocol fees, and operates the front-end accessible to EEA users.

Licensing Requirements

A DeFi or Web3 project needs one of three positions, supported by contemporaneous documentation: a “fully decentralised” position under MiCA Recital 22 with no licensing requirement; a CASP authorisation under MiCA in the EU; or a VARA, CIMA, or other equivalent licence outside the EU. The MiCA CASP capital floor under Article 67 + Annex IV is €50,000 for Class 1 (advisory, reception and transmission, order execution, placing, transfer services, portfolio management), €125,000 for Class 2 (custody and administration, and exchange of crypto-assets for funds and for other crypto-assets), and €150,000 for Class 3 (operation of a trading platform).^[12]

MiCA scope and the Recital 22 carve-out

Recital 22 of Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114) states that “where crypto-asset services are provided in a fully decentralised manner without any intermediary, they should not fall within the scope of this Regulation.” Two operative points govern its application. First, Recital 22 is non-binding as a preamble; the operative articles contain no definition of “fully decentralised.” Second, ESMA has stated that the exemption “remains uncertain” and must be applied case-by-case (ESMA Second Consultation Package, paragraph 108).^[2]

The Joint EBA-ESMA Report on DeFi (published 13 January 2025) identifies seven indicators of residual centralisation that pull a service back inside MiCA:^[2]

• Existence of admin or upgrade keys.
• Fee accrual to a treasury controlled by a named party.
• An identifiable front-end or UI operator.
• Active EU marketing.
• Governance-token concentration in a small number of wallets.
• Treasury management by an identifiable foundation.
• Bridge or oracle dependencies that introduce intermediaries.

Partial decentralisation is not a safe harbour: Recital 22 itself states that MiCA applies “when part of such activities or services is performed in a decentralised manner.” DeFi represents approximately 4% of global crypto-asset market value, with European Economic Area users representing above-average adoption. The common mistake is treating Recital 22 as a binary qualifier rather than an evidentiary file: a protocol with an upgradable multisig, a foundation-controlled treasury, and a named front-end operator fails the “fully decentralised” test on the EBA-ESMA factor analysis even where the smart contracts themselves are non-custodial, and the home NCA can determine the front-end is the operative CASP regardless of how the protocol layer is governed.

CASP triggers for front-ends and DAOs

The CASP activities most likely to apply to a DeFi or Web3 front-end are operation of a trading platform for crypto-assets (where the front-end matches third-party orders), exchange of crypto-assets for funds or for other crypto-assets (where the operator facilitates swaps), custody and administration of crypto-assets (where the front-end controls smart-contract vaults), and transfer services (relevant to bridge front-ends). A non-custodial smart contract that the operator cannot upgrade is the strongest defence against CASP scope; an upgradable contract controlled by a multisig with named signers pulls the operator into scope.

Token issuance under MiCA Title II

For tokens that are neither asset-referenced tokens (Title III) nor e-money tokens (Title IV), MiCA Title II applies. The issuer must draft a white paper meeting Annex I requirements, notify the home national competent authority at least 20 working days before publication, ensure marketing communications are consistent with the white paper, and act honestly, fairly and professionally (Article 14). The iXBRL machine-readable formatting requirement entered into application on 23 December 2025, with the ESMA XBRL taxonomy published on 5 August 2025.^[14] Most DeFi governance tokens fall under Title II.

Non-EU licensing pathways

VARA (Dubai): eight activity-specific licences under the Virtual Assets and Related Activities Regulations 2023, supported by 2024 to 2025 Rulebooks. Application fees are AED 40,000 for Advisory, VA Issuance, and VA Transfer and Settlement Services, and AED 100,000 for Broker-Dealer, Custody, Exchange, Lending and Borrowing, and VA Management and Investment Services. Annual supervision fees per activity are AED 80,000 for Advisory and VA Transfer and Settlement Services, and AED 200,000 for Broker-Dealer, Custody, Exchange, Lending and Borrowing, and VA Management and Investment Services, payable per activity per year in advance. Multi-activity applications attract a Licence Extension Fee of 50% of the lower of the two application fees. The licensing process is two-stage: an Initial Disclosure Questionnaire leading to an Approval to Incorporate, followed by the full VASP application leading to a licence. Typical end-to-end timeline is 6 to 12 months.^[6]

Cayman Islands VASP Act 2020: Phase 1 registration applies to AML and cybersecurity for any virtual asset service provided to the public. Phase 2 licensing for trading platforms and custodians commenced incrementally from 2024. Following the February to April 2024 Ministry of Financial Services consultation, the Virtual Asset (Service Providers) (Amendment) Act 2024 broadened the “Owner/Operator” definition to capture trading platforms and DAOs without an identifiable managing group.^[15] Private sales (per the Virtual Asset (Service Providers) Regulations 2020, “not advertised and made available to a limited number of persons or entities”) fall outside the Act, as do gratuitous airdrops. No statutory capital floor: adequacy is assessed against the business plan.

ADGM DLT Foundations Regulations 2023: the wrapper-only regime. Minimum initial asset value USD 50,000 payable in fiat (Section 19), paid up within six months of incorporation; Foundation Council of at least 2 and at most 16 councillors; mandatory Charter setting out objects, token-issuance rules, and asset rules; optional Guardian role overseeing Council compliance with the Charter; annual audited accounts published on the foundation’s website; periodic security audits of data-protection and IT systems shared with the Registrar; Company Service Provider engagement mandatory unless granted “exempt foundation” status.^[7]

Saint Kitts & Nevis Virtual Asset Act 2020 (as amended by Act 9 of 2024): VASP registration with the Financial Services Regulatory Commission (Nevis division). The 2024 amendment aligns the Act with FATF Recommendation 15 standards.^[11] Capital and fees are prescribed by subsidiary SRO.

Saint Lucia Virtual Asset Business Act, No. 24 of 2022: assented 15 December 2022; commenced 28 December 2022. The FSRA issued its General Circular on VASPs on 4 August 2025, confirming that the FSRA is the supervisory authority.^[18] The Act requires a licensee to place in escrow assets equivalent to a minimum of 15% of the total value of client funds held (section 12(1)). Application and licence fees are not yet prescribed by subsidiary legislation as of May 2026.

DORA application to MiCA CASPs

The Digital Operational Resilience Act (Regulation (EU) 2022/2554) applies to MiCA CASPs from 17 January 2025. Obligations include a comprehensive ICT risk management framework, classification and reporting of major ICT incidents within hours, resilience testing including threat-led penetration testing every three years for significant entities, an ICT third-party risk register (first submission 30 April 2025), and contracts with ICT providers including audit rights, exit strategies and subcontracting controls (Commission Delegated Regulation (EU) 2025/532 on subcontracting of ICT services supporting critical or important functions, in force 22 July 2025). On 18 November 2025, the European Supervisory Authorities designated 19 critical ICT third-party providers, including AWS, Microsoft Azure, Google Cloud, Oracle, SAP and Deutsche Telekom.^[4] Penalties reach 2% of annual worldwide turnover for financial entities; critical ICT third-party providers additionally face daily periodic penalty payments of up to 1% of average daily worldwide turnover under Article 35(6).

The eighth update to the Directive on Administrative Cooperation, Directive (EU) 2023/2226 (DAC8), has applied since 1 January 2026.^[19] DAC8 imposes automatic exchange of crypto-asset transaction data on reporting crypto-asset service providers (RCASPs) that provide services to EU-resident users, irrespective of where the RCASP is established. A non-EU operator with EU customers is captured; full decentralisation under MiCA Recital 22 does not by itself displace DAC8 reach where an identifiable operator, front-end, or treasury counterparty exists. The first reporting cycle covers calendar-year 2026 transactions, filed by 31 January 2027 to the competent authority of the RCASP’s nexus Member State. Penalty exposure is set by each Member State within the harmonised band of Article 25a of Directive 2011/16/EU; in practice, national transpositions cluster at €20,000 to €150,000 per breach with daily continuance fines.

See the full Cyprus CASP authorisation guide and the crypto licensing hub.

Banking

Fiat banking is the single most underestimated component of a DeFi or Web3 build. Primary clearing banks routinely reject DeFi-adjacent counterparties, and the rejection rates do not fall meaningfully even when the project has a foundation wrapper, a published audit, and a clear regulatory position. The practical reality, as of May 2026, is that fiat on/off-ramp banking is a multi-institution exercise: an EU-licensed EMI for operational euro flows, a DLT-friendly bank in a digital-asset-aware jurisdiction for token-treasury custody, and where applicable a regulated US trust company for stablecoin and bitcoin holdings.

Most banks decline DeFi mandates for five reasons:

• Counterparty anonymity: DeFi end-users are typically unidentifiable to the protocol, so the bank cannot perform meaningful Source-of-Wealth or Source-of-Funds analysis on the protocol’s effective customers.
• Smart-contract operational risk: an exploit creates liability exposure for any bank funding operations or holding treasury.
• Token-treasury volatility: protocol treasuries denominated in native governance tokens can swing 70% within a quarter, complicating creditworthiness.
• Travel Rule exposure: Regulation (EU) 2023/1113, applicable since 30 December 2024, makes banks accountable for the originator and beneficiary information their CASP-classified counterparties send and receive.^[3]
• DORA third-party risk: banks treat any DeFi-adjacent counterparty integrating via APIs as an ICT-risk node.

In practice, the foundation wrapper alone does not unlock banking; what the credit committee underwrites is the operating entity’s ability to evidence its KYC posture toward the front-end users, the upgrade-key custody arrangements over the smart contracts, and the oracle and bridge dependencies that route value through identifiable intermediaries, because those are the points where the bank inherits residual AML and operational liability.

The practical universe of accepting institutions divides into four archetypes. The first is an EU-licensed Electronic Money Institution with a documented digital-asset onboarding policy, used for SEPA in/out, payroll, and vendor payments; typically a tier-two EMI in a digital-asset-aware jurisdiction with a crypto-fluent compliance team. The second is a DLT-licensed bank in a small EU jurisdiction (the DLT Act in Liechtenstein and its peers), used for DAO treasury custody and stablecoin operational balances. The third is a regulated US trust company operating under New York or Wyoming supervision, used for institutional bitcoin and stablecoin holdings with monthly attestation. The fourth is a UAE onshore commercial bank with a non-objection to hold accounts for a VARA-licensed VASP.

Ongoing Compliance

Compliance is a permanent operating expense, not a one-time licensing cost. For a Class 3 MiCA CASP-classified DeFi front-end, the annual run-rate is typically €500,000 to €1.2 million, plus the €150,000 own-funds floor; for a registration-only Cayman or Saint Kitts & Nevis VASP, the annual run-rate is closer to USD 150,000 to USD 400,000.

The five permanent obligations for any CASP-classified surface are anti-money-laundering controls and Travel Rule compliance under the Transfer of Funds Regulation; transaction monitoring and sanctions screening at the front-end (with vendor pricing from approximately USD 25,000 to USD 80,000 per annum); DORA controls including the ICT third-party risk register, incident classification and reporting, and threat-led penetration testing for significant entities; smart-contract audit cadence (initial pre-launch audit plus every material upgrade plus competitive audit plus continuous bug bounty); and external audit of the financial statements and ICT controls.

Smart-contract audit cost ranges as of 2025 to 2026 break down by complexity:

• Simple module: an ERC-20 or staking contract costs USD 8,000 to USD 50,000.
• Moderate DeFi primitive: lending, AMM or governance protocols cost USD 50,000 to USD 150,000.
• Complex protocol: a new L1/L2 chain costs USD 150,000 to USD 600,000 or more for formal verification.

Top-tier engineer rates are approximately USD 25,000 per engineer-week at Trail of Bits and OpenZeppelin (Arbitrum Research and Development Committee proposals, 2024 to 2025), with retainer-model engagements common at protocols with treasury size above USD 100 million.^[16] Industry best practice for protocols with TVL above USD 100 million is two independent audits, a competitive contest on a platform such as Code4rena or Sherlock, and a continuous bug bounty on Immunefi (which had paid USD 100.21 million across more than 3,000 bug-bounty reports as of September 2024, with 77.5% going to smart-contract vulnerabilities; the single largest payout was USD 10 million for a Wormhole cross-chain bridge vulnerability).^[17]

The real constraint is not the pre-launch audit budget, which is finite, but the obligation to re-audit on every material upgrade plus the continuous bug-bounty programme; protocols that treat the first audit as a one-time spend rather than as the opening cost of a permanent security operating line typically discover the gap at the point of an upgrade-driven incident, where the marginal cost of remediation runs five to ten times the recurring audit cadence they declined to fund.

Upcoming regulatory milestones within 12 months: the MiCA legacy-VASP transitional period ends 1 July 2026; the European Commission is expected to publish its mid-2026 assessment under MiCA Article 142, potentially leading to dedicated DeFi legislation; and CySEC’s filing deadline for legacy CASPs is 27 February 2026.

Realistic Timeline and Costs

End-to-end timeline from initial scoping to operational front-end is typically 6 to 12 months for an offshore registration build, and 9 to 18 months for an EU MiCA CASP build. Technology development (smart-contract audits, front-end, infrastructure) runs in parallel with the licensing file; banking onboarding is the critical-path item in most schedules.

Cost Breakdown by Phase

As of May 2026, figures above include professional fees, government fees, audit fees, and minimum regulatory capital where applicable. They do not include founder salaries, marketing spend, the protocol token-distribution event, or post-launch security incident response. Currency convention: EUR for EU phases; USD for non-EU phases; AED where VARA-specific; figures are converted at the prevailing rate where required for comparability.

Frequently Asked Questions

References