The 90 days after VARA licence issuance are the most consequential for any newly-licensed VASP. The framework is now live; the regulator has accepted the application and is now watching how the entity operates in real conditions; the operational discipline and reporting cadence established now sets the tone for every supervisory engagement that follows.

What I see most often in VASPs I support post-licence: a celebration period, followed by 2-3 months of focused growth-building, followed by an emerging realisation around month 4 that the regulatory cadence has fallen behind. That trajectory is avoidable. The right 90-day playbook is the foundation.

Week 1: Operational kickoff.

  1. Confirm licence conditions. Review the licence and any specific conditions or undertakings attached. Map every condition to a named owner.
  2. Confirm Responsible Individuals. Both designated RIs should be in role, with documented mandates and named accountability allocations.
  3. Internal launch communication. Brief the team on what changes operationally now the licence is live — regulatory cadence, escalation paths, marketing constraints.
  4. Banking confirmation. Confirm operational banking is in place — corporate operating account, client-money / client-asset accounts (if applicable), payment-rail relationships.
  5. Customer-facing launch readiness. Confirm the customer-onboarding flow, KYC framework and contractual terms are all properly aligned with the licence scope.

Weeks 2-4: Compliance operating system.

  1. Stand up the regulatory calendar. Every monthly, quarterly, semi-annual and annual obligation mapped to a calendar with named owners and lead-time alerts.
  2. AML/CFT operational discipline. Transaction-monitoring framework, sanctions screening, customer-risk-rating, SAR/STR reporting workflow.
  3. Customer onboarding integrity. Source-of-funds, source-of-wealth, beneficial-ownership and enhanced-due-diligence triggers all running operationally.
  4. Reporting framework. Test-run the monthly reporting templates and reconciliation processes. Submit any initial-period reports on time.
  5. Marketing perimeter. Confirm all customer-facing marketing is compliant with VARA Marketing Regulations 2024. Withdraw any marketing that pre-dated the licence and doesn't align.

Weeks 4-8: Governance discipline.

  1. Board cadence. First post-licence board meeting with proper pack — capital, AML, risk, technology, customer metrics, regulatory engagement.
  2. Risk register refresh. Update the risk register against operational reality; identify gaps between the application-stage risk picture and the live position.
  3. Conflicts management. Ensure conflicts register is current and procedurally functioning.
  4. Complaints framework. The customer complaints framework operational; first complaints (typically arise within 30 days of going live) handled within prescribed timeframes.
  5. Vendor / outsourcing. Confirm vendor agreements include the regulatory obligations VARA expects (audit rights, data-protection, business-continuity coverage, exit assistance).

Weeks 8-12: Prudential and technology.

  1. NLA monitoring. Live monthly NLA calculation, with 110% pre-alert threshold operational. Documented escalation framework.
  2. Capital and treasury. Capital position above the regulatory minimum with healthy headroom. Treasury function reconciling all client-asset and operational positions on the required cadence.
  3. Custody segregation. Client-asset segregation operational and reconciled. Cold-storage vs hot-wallet allocation aligned with policy.
  4. TGRAF framework. Self-assessment process kicking off for the first annual cycle. Internal audit / assurance plan in place.
  5. Wind Down Plan activation. Plan reviewed, updated to reflect live operations, owner named.
  6. Cyber-resilience. First incident-response tabletop exercise conducted. Findings documented; remediation plan in place.
The single biggest distinction between VASPs that become well-supervised and those that don't isn't capital, technology or product. It's whether the compliance, reporting and governance cadence becomes a real operating discipline by day 90 — or whether it remains an aspirational document.

Reporting in the first 90 days.

Specific reports newly-licensed VASPs typically face in the first 90 days:

  • Commencement notification — confirming the VASP has commenced operations under the licence.
  • Initial-period AML/CFT report — covering customer onboarding, transaction monitoring and any SARs / STRs.
  • First monthly prudential / NLA report — due at the end of the first calendar month of operation.
  • Initial complaints register submission — even if zero complaints, the framework is documented.
  • Key-personnel attestation — confirming RIs and senior officers continue to satisfy fit-and-proper criteria.

The cultural posture VARA reads.

Beyond specific deliverables, VARA reads the first 90 days for cultural signals:

  • Proactive vs reactive. Does the VASP self-identify issues and notify, or does it wait until VARA asks?
  • Senior-officer engagement. Is the senior team genuinely engaged in compliance, or has it been delegated to a compliance officer who's not heard at the senior level?
  • Documentation discipline. Are decisions, escalations and remediations being documented in a way that survives review?
  • Tone of communication. Are responses to VARA queries comprehensive, prompt, and constructive?

The cultural read in the first 90 days shapes how every later supervisory engagement is approached.

The common 90-day failure modes.

  • Reporting falls behind. The first 1-2 monthly reports go in clean; by month 3 the cadence slips.
  • NLA monitoring is quarterly, not monthly. The finance team treats NLA as a year-end exercise rather than an ongoing prudential measure.
  • TGRAF self-assessment never starts. The first annual TGRAF cycle is supposed to begin in the first 90 days but commonly slips to month 6+.
  • Marketing perimeter drift. Pre-licence marketing campaigns continue running on third-party platforms without review.
  • Board not properly briefed. Senior management is engaged but the board isn't getting the right reporting packs.
  • Wind Down Plan untouched. Plan from the application file is never refreshed, never tested.

What I'd build into every 90-day plan.

  1. Named regulatory-calendar owner with backup.
  2. Pre-meeting board packs for every board / committee meeting.
  3. Standing monthly all-hands compliance update.
  4. Monthly capital and NLA report distributed across senior team.
  5. Quarterly tabletop exercise testing operational resilience.
  6. Documented decision log of every regulatory interaction with VARA.

Conclusion.

The first 90 days establish the supervisory trajectory for every newly-licensed VASP. Done properly, they put the entity on a calm operating footing that supports years of clean supervision. Done poorly, they create the patterns that produce the first regulatory letter at month 6. Neo Legal supports licensed VASPs through the post-licence operational launch and the ongoing monthly supervision retainer that keeps the regulatory cadence running.