Exchange founders
Teams launching spot exchange, broker, OTC, or order-routing models that need a lawful route for onboarding clients and connecting fiat rails.
RUE Global Licensing Hub
A crypto license is the legal authorization required to provide services like exchange, custody, and payments. In 2026, the right path (MiCA, VASP, or MSB) depends on your business model and target market. RUE helps founders select the right jurisdiction and build a licensing strategy that is not just compliant on paper, but bankable and scalable in practice.
This page is for general informational purposes only and does not constitute legal, tax, or regulatory advice. Licensing outcomes depend on the exact activity, structure, and target market.
These are the jurisdictions most often shortlisted by founders balancing regulatory credibility, speed, cost, banking access, and long-term scaling options.
Europe
Europe
Europe
Europe
Europe
A crypto license is the legal basis that allows a business to carry out regulated crypto activity in a given jurisdiction. In strict legal terms, that basis may be a license, registration, authorization, or a combination of approvals. The commercial market still uses the phrase crypto license because founders usually care about one practical question: can the company lawfully operate, onboard clients, access banking, and scale into target markets.
That distinction matters. In the EU, the relevant concept is usually CASP authorization under Regulation (EU) 2023/1114 (MiCA). In the UK, many crypto firms deal with FCA registration under the Money Laundering Regulations 2017, which is not the same as a full financial services license. In the US, FinCEN MSB registration is only one layer and often does not replace state-level Money Transmitter Licenses or product-specific analysis under SEC, CFTC, or NYDFS rules.
For founders, the real value of a cryptocurrency license is not the certificate itself. It is the ability to build a compliant operating stack: bank accounts, fiat on-ramp and off-ramp, PSP relationships, institutional counterparties, Travel Rule readiness, governance, and defensible cross-border distribution. A cheap setup that fails bank onboarding or cannot support your actual product is usually more expensive than a stronger route chosen correctly from day one.
At RUE, we treat crypto licensing as a strategic structuring exercise, not a filing exercise. The correct starting point is your activity map, client geography, custody exposure, and growth plan. The jurisdiction comes second.
Teams launching spot exchange, broker, OTC, or order-routing models that need a lawful route for onboarding clients and connecting fiat rails.
Businesses holding client crypto-assets or private keys and therefore facing stronger prudential, governance, and security expectations.
Companies combining crypto conversion, merchant settlement, payroll, treasury, or on-ramp services with banking or EMI relationships.
Teams structuring utility tokens, stablecoin-adjacent models, RWA tokenization, or issuer-side offerings that may fall under MiCA or securities rules.
Depending on the country, you may need a registration, authorization, approval, or layered structure rather than a single standalone permit.
Regulation (EU) 2023/1114 created a single EU framework for CASPs, with most provisions applying from 30 December 2024 and passporting as the main scaling mechanism.
A jurisdiction can be easy to incorporate and still fail in practice because banks, EMIs, merchant acquirers, or institutional partners do not accept the structure.
AML tooling, MLRO function, audits, sanctions screening, Travel Rule infrastructure, and governance maintenance can exceed the initial filing budget.
Crypto-Asset Service Provider is the MiCA term for firms providing regulated crypto-asset services in the EU. A CASP authorization can support passporting across the EU and EEA after notification.
Virtual Asset Service Provider is the FATF term used across many non-EU jurisdictions for exchange, transfer, safekeeping, and related virtual asset activities.
Money Services Business is a registration concept used in North America. It is often a baseline AML registration, not a complete answer to state, securities, or product-specific licensing questions.
Money Transmitter License is a state-level US licensing concept. Many crypto businesses need to assess MTL exposure state by state in addition to FinCEN registration.
Virtual Asset Trading Platform is the Hong Kong licensing framework supervised by the SFC for qualifying trading platform activity.
Major Payment Institution is a Payment Services Act category under MAS that can become relevant where digital payment token services and payment flows intersect.
Digital Asset Service Provider is the term used in El Salvador for regulated digital asset activity under its digital assets framework.
A legal opinion is not a license. It is a jurisdiction-specific legal analysis used to assess whether a business falls inside or outside a licensing perimeter.
A crypto exchange license usually covers the operation of a platform or service that converts crypto to fiat, fiat to crypto, or one crypto-asset to another. In serious regimes, the exact scope still depends on whether you execute orders, operate a venue, hold client assets, or merely arrange transactions.
Spot exchange, brokerage execution, crypto-fiat conversion, crypto-crypto conversion, order reception and transmission.
A crypto trading license in practice may refer to brokerage, agency execution, proprietary trading, market making, or portfolio management. These are not the same activity, and regulators often treat them differently.
Brokerage, agency execution, OTC dealing, proprietary trading, market making, order routing.
Custody is one of the most sensitive crypto business models because the firm controls client assets or private keys. It usually triggers stronger scrutiny around governance, segregation, wallet architecture, incident response, and outsourcing.
Safekeeping, custodial wallets, institutional custody, key management, settlement support.
Wallet services can be regulated or unregulated depending on whether the provider is custodial. Transfer services are also a core VASP/CASP trigger because they usually sit directly inside AML and Travel Rule scope.
Custodial wallet, transfer execution, hosted wallet infrastructure, settlement routing.
Crypto payments often sit at the boundary between crypto regulation and payment regulation. Once fiat settlement, merchant acquiring, stored value, or payment execution enters the model, a separate EMI, PI, or payments analysis may be required.
Merchant settlement, checkout, payroll, treasury conversion, fiat on-ramp and off-ramp, payment orchestration.
Token issuance does not follow one universal crypto licence route. The legal classification of the token determines whether the project falls under MiCA whitepaper rules, ART or EMT rules, securities law, e-money law, or a case-specific hybrid analysis.
Utility token issuance, RWA tokenization, issuer-side distribution, stablecoin structuring, token sale support.
Compare the main crypto licensing jurisdictions by market access, regulator model, timeline, capital expectations, local substance, and practical operating quality after approval.
| Jurisdiction | Regulator | Price | Period | State fee | Annual fee | Capital | Staff | Office | Passporting | Audit |
|---|---|---|---|---|---|---|---|---|---|---|
| BVI | British Virgin Islands Financial Services Commission (BVI FSC) | from EUR 20,000 | From 3 months | 10,000 USD (~EUR 8,650) | 10000 USD (~EUR 8,650) | Not required | No | No | No | Required |
| Canada | Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) | from EUR 22,300 | From 2 months | No | No annual fee | Not required | Required | No | No | No |
| Cayman Islands | Cayman Islands Monetary Authority (CIMA) | from EUR 25,900 | From 3 months | 1000 USD (~EUR 865) | 15000 USD (~EUR 12,975) | Not required | No | No | No | Required |
| Costa Rica | Superintendencia General de Entidades Financieras (SUGEF) | from EUR 9,900 | From 1 months | No | No annual fee | Not required | No | No | No | No |
| Czech Republic | Czech National Bank (CNB) | from EUR 18,900 | From 6 months | CZK 20,000 (~€800) | Variable (based on AUM) | From €50,000 | Required | Required | Yes | Required |
| Dubai | Virtual Assets Regulatory Authority (VARA) | from EUR 24,500 | From 6 months | 100 000 AED (~EUR 23,553) | 200 000 AED (~EUR 47,106) | 100000 AED | Required | Required | No | Required |
| El Salvador | National Commission of Digital Assets (CNAD) | from EUR 19,900 | From 3 months | 5,000 USD (~EUR 4,325) | 10,000 USD (~EUR 8,650) | 2,000 USD | No | Required | No | Required |
| Estonia | Estonian Financial Supervision Authority (FIU) | from EUR 19,900 | From 6 months | 10000 EUR | 10000 EUR | From 50 000 EUR | Required | Required | Yes | Required |
| Georgia | National Bank of Georgia (NBG) | from EUR 24,700 | From 2 months | No | No annual fee | Not required | No | No | No | No |
| Germany | Federal Financial Supervisory Authority (BaFin) | from EUR 29,900 | From 6 months | 10750 EUR | From 10000 EUR | From 50 000 EUR | Required | Required | Yes | Required |
| Gibraltar | Gibraltar Financial Services Commission (GFSC) | from EUR 34,500 | From 4 months | 10,000 GBP (~EUR 11,535) | 10,000 GBP (~EUR 11,535) | 20 000 GBP | No | Required | No | Required |
| Hong Kong | Securities and Futures Commission (SFC) | from EUR 29,000 | From 6 months | 4740 HKD (~EUR 524) | 2740 HKD (~EUR 303) | Not required | Required | No | No | Required |
| Liechtenstein | Financial Market Authority Liechtenstein (FMA) | from EUR 27,900 | From 6 months | 1500 EUR | From 2000 EUR | From 50 000 EUR | Required | Required | Yes | Required |
| Lithuania | Bank of Lithuania | from EUR 19,900 | From 6 months | 2,500 EUR | From 3000 EUR | From 50 000 EUR | Required | Required | Yes | Required |
| Malta | Malta Financial Services Authority (MFSA) | from EUR 23,900 | From 6 months | From 10,000 EUR | From 10000 EUR | From 50 000 EUR | Required | Required | Yes | Required |
| Panama | Superintendencia de Bancos de Panamá (SBP) | from EUR 14,900 | From 3 months | No | No annual fee | 10 000 USD | No | No | No | No |
| Poland | Polish Financial Supervision Authority (KNF) | from EUR 18,900 | From 6 months | 4,500 EUR | No annual fee | From 50 000 EUR | Required | Required | Yes | Required |
| Singapore | Monetary Authority of Singapore (MAS) | from EUR 31,000 | From 6 months | 1000 SGD (~EUR 675) | 5000 SGD (~EUR 3,376) | Not required | Required | Required | No | Required |
| Switzerland | Swiss Financial Market Supervisory Authority (FINMA) | from EUR 19,500 | From 8 months | From 1750 EUR | From 3500 EUR | From 300000 EUR | Required | Required | No | Required |
| United Kingdom | Financial Conduct Authority (FCA) | from EUR 44,000 | From 9 months | From 2,350 EUR | From 2000 GBP (~EUR 2,307) | Not required | No | No | No | No |
Non-EUR state and annual fees include approximate EUR equivalents based on reference rates used on March 11, 2026.
Official fees can range from modest registration charges to substantial authorization fees in stricter jurisdictions. They are rarely the main cost driver.
A serious application requires tailored legal analysis, business model scoping, policy drafting, governance documents, and regulator-facing explanations. Recycled templates are a common cause of remediation rounds.
Capital is not always an expense, but it affects liquidity. Under MiCA, common own-funds bands often referenced are EUR 50,000, EUR 125,000, and EUR 150,000 depending on the crypto-asset services provided.
Office, resident management logic, local directors, compliance presence, and board governance can materially change the budget. Some cheap jurisdictions become expensive once real substance is added.
MLRO or AML officer support, KYC/KYB, sanctions screening, blockchain analytics, Travel Rule infrastructure, case management, and training are core operating costs.
The recurring budget often includes audit, reporting, policy updates, penetration testing, incident handling, legal review, and outsourced control functions. This is where many founders underbudget.
Use the selector to narrow the field by target market, custody exposure, budget, timeline, bankability requirements, and whether you need EU passporting or a non-EU operating hub.
For most founders targeting the EU, the commercially relevant answer is CASP authorization under MiCA, not the old patchwork of national VASP-style regimes.
MiCA is the core framework for a crypto license in Europe. The legal basis is Regulation (EU) 2023/1114, published in the Official Journal on 9 June 2023 and in force from 29 June 2023. The rules for asset-referenced tokens (ARTs) and e-money tokens (EMTs) applied from 30 June 2024, while most of the remaining MiCA framework became applicable from 30 December 2024.
MiCA matters because it replaced fragmented national approaches with a single authorization logic for Crypto-Asset Service Providers (CASPs). Once a CASP is authorized in one EU home state and the notification process is completed, the firm can generally passport relevant services into other EU and EEA markets. That is the main reason many founders search for a crypto license in Europe rather than a standalone local registration.
MiCA is broader than many competitor pages suggest. It does not only regulate service providers. It also creates separate rules for crypto-assets admitted to trading, issuer disclosures, whitepapers, market abuse involving crypto-assets, and the special treatment of ARTs and EMTs. A founder launching a token, a custody product, and an exchange interface may therefore face several overlapping workstreams rather than one single filing.
MiCA is also not the whole compliance perimeter. EU crypto businesses must assess Transfer of Funds Regulation (EU) 2023/1113 for Travel Rule obligations and, depending on the structure, the operational resilience perimeter shaped by Regulation (EU) 2022/2554 (DORA). In practice, a viable EU setup is a three-layer exercise: authorization under MiCA, AML data exchange under TFR, and ICT resilience under DORA-related expectations.
RUE usually advises founders to start with the service map first: exchange, custody, order execution, transfer, placement, advisory, or token issuance. Only after that should you compare Lithuania, Poland, the Czech Republic, Cyprus, Germany, France, Malta, or other EU routes. The best CASP jurisdiction is not the one with the lowest filing cost. It is the one that fits your product, timeline, governance capacity, and post-license operating model.
Best for businesses targeting EU retail or institutional clients, needing credible market access, planning fiat integrations, or wanting a scalable route through passporting under a recognizable framework.
Less suitable for teams seeking minimal substance, purely offshore positioning, or a low-friction structure with no intention to serve regulated European markets.
29 June 2023 entry into force, 30 June 2024 application for ART and EMT provisions, and 30 December 2024 for most remaining provisions.
A CASP authorized in one EU home state can generally notify into the wider EU and EEA rather than rebuild licensing country by country.
The framework also covers issuer-side obligations, crypto-asset whitepapers, ARTs, EMTs, and market abuse rules.
EU crypto compliance in 2026 should be assessed through the combined lens of MiCA + TFR + DORA, not MiCA alone.
Start with the most commercially relevant country pages, then expand into specialist or offshore routes once the business model and target market are clear.
12 jurisdictions
4 jurisdictions
7 jurisdictions
2 jurisdictions
10 jurisdictions
A successful crypto license application is a coherent operating file. Regulators expect documents that match the actual business model, not a generic policy bundle.
A precise description of services, client types, geography, revenue model, outsourcing, custody exposure, and three-year operating assumptions.
Articles, shareholder structure, organization chart, board or management composition, CVs, proof of address, outsourcing register, and internal control allocation.
CDD, EDD, sanctions screening, suspicious activity reporting, transaction monitoring, Travel Rule handling, and escalation procedures tailored to the risk profile.
Operational onboarding rules for individuals and legal entities, including UBO verification, source of funds, source of wealth triggers, and periodic review.
A documented assessment of product risk, customer risk, geographic risk, delivery channel risk, sanctions exposure, and mitigating controls.
Access control, encryption, key management, backup, logging, incident response, business continuity, disaster recovery, and vendor risk controls.
Retention logic, access governance, GDPR alignment where relevant, audit trails, complaints handling, and evidence preservation for regulator review.
Evidence of share capital, funding sources, prudential planning, and the ability to sustain the business through the licensing and launch period.
The core requirements for a cryptocurrency license are governance, AML/CFT, internal controls, fit-and-proper management, capital, and technical resilience. In 2026, regulators also expect evidence that these controls can operate day to day, not only exist on paper.
Customer due diligence is a baseline requirement in every serious regime. Regulators expect identity verification, UBO analysis, sanctions screening, source-of-funds logic, and risk scoring that reflects the actual customer base.
Crypto businesses are expected to screen counterparties and wallets against sanctions and adverse-risk indicators. In practice this often means combining KYC tools with blockchain analytics and KYT-style transaction monitoring.
Travel Rule compliance is no longer a theoretical obligation. CASPs and VASPs increasingly need operational data exchange for originator and beneficiary information, often using standards such as IVMS101 and vendor or protocol-based connectivity.
Serious regulators assess whether management understands the product, risk profile, outsourcing, and control framework. Local presence, decision-making logic, and management competence matter more than nominee structures.
Where client assets or keys are held, regulators expect segregation logic, wallet governance, access control, incident response, and resilience planning. Controls such as MPC, HSM, cold storage, key ceremony procedures, and privileged access logging are increasingly relevant.
After approval, the company usually enters a live supervision cycle: suspicious activity reporting, annual or periodic reviews, governance maintenance, training, incident reporting, audit, and policy updates.
There is no single global crypto regulator. The market is split between registration-based AML regimes, full authorization models, and layered systems where crypto, payments, securities, derivatives, and sanctions law overlap.
In the EU, CASP authorization is granted by the home-state national competent authority under MiCA, while ESMA and EBA shape technical standards, supervisory convergence, and prudential interpretation around the regime.
The Financial Conduct Authority supervises cryptoasset business registration under the UK Money Laundering Regulations. This is a high-scrutiny AML registration route, not a universal UK crypto exchange license in the continental sense.
The US framework is layered. FinCEN handles federal MSB registration and BSA obligations; state regulators handle money transmission; NYDFS applies the BitLicense regime in New York; and SEC or CFTC exposure depends on the product and token characterization.
The UAE offers several distinct regulatory centers, including VARA in Dubai, ADGM FSRA in Abu Dhabi Global Market, and DFSA in DIFC for relevant financial activities. These are different regimes, not interchangeable labels.
Hong Kong's SFC supervises the VATP regime, while MAS in Singapore applies the Payment Services Act framework and related financial services perimeter analysis. Both are high-credibility Asian hubs with demanding review standards.
FINMA in Switzerland, FINTRAC in Canada, AUSTRAC in Australia, and other national authorities each apply their own mix of AML, licensing, and product-perimeter analysis.
A crypto company becomes commercially usable only when licensing, banking, and payment connectivity work together. Many founders discover too late that a formally valid structure is still unattractive to banks, EMIs, merchant acquirers, or institutional counterparties.
Banks assess jurisdiction quality, ownership transparency, source of funds, customer profile, transaction typology, sanctions exposure, and whether management can explain the control environment.
The cheapest crypto license may fail later because banks or PSPs treat the jurisdiction as weak, unfamiliar, or operationally high-risk.
Where possible, bank and EMI onboarding should begin during the licensing process. Waiting for formal approval can add months to launch.
If the business handles merchant settlement, client money, stored value, or payment execution, a crypto license alone may not satisfy banking or payments counterparties.
Liquidity providers, custodians, market makers, and B2B clients often ask for licensing evidence, AML architecture, Travel Rule readiness, and sanctions controls before onboarding.
The licensing path is a sequence of legal, operational, and compliance workstreams. In most credible jurisdictions, the regulator is testing whether the business can operate safely after approval, not whether it can file a nice application.
Define the exact services: exchange, custody, transfer, brokerage, payments, token issuance, staking, or advisory. Match those services to target markets and shortlist only the jurisdictions that fit the real perimeter.
Incorporate the entity, disclose UBOs, set governance, prepare constitutional documents, and align ownership with fit-and-proper expectations and banking reality.
Confirm share capital, prudential funding, local office logic, management presence, and whether the jurisdiction expects internal staff or accepts some outsourcing.
Prepare the business plan, AML/CFT framework, KYC procedures, risk assessment, safeguarding logic, IT security package, outsourcing controls, complaints handling, and financial projections.
Select onboarding vendors, sanctions screening, blockchain analytics, Travel Rule tooling, case management, and internal escalation workflows before filing or during review where permitted.
Submit the file to the competent authority, answer Q&A, remediate scope issues, and demonstrate that management understands the business and control environment.
Run bank and EMI onboarding in parallel where possible. In many cases, payment connectivity takes as long as or longer than the licensing review itself.
After approval, finalize passporting where relevant, complete operational testing, train staff, and move into the ongoing compliance cycle with reporting and governance controls live.
Regulated United Europe OÜ (RUE) is a European legal consulting firm specializing in financial licensing, company formation, and regulatory compliance. Since 2016, we have helped hundreds of businesses obtain crypto, gambling, forex, and EMI/PSP licenses across 35+ jurisdictions.
With offices in four EU countries and a team of experienced lawyers, we provide end-to-end support — from initial consultation and company registration to license acquisition and ongoing compliance management.
500+
Clients Served
35+
Jurisdictions
Since 2016
Years in Business
4
EU Offices
Fully registered and regulated EU company with partnerships across major financial centers.
Our experts speak English, German, Russian, Chinese, and 12+ other languages for global client support.
From company registration to license acquisition and compliance — we handle the entire process end-to-end.
Personal consultant assigned to each client. Direct communication channels, no call centers.
Tax should be assessed as part of the operating model, not as a headline rate on a comparison table. For crypto businesses, the relevant questions usually include corporate income tax, VAT treatment, withholding, permanent establishment risk, transfer pricing, and how substance aligns with management reality.
A low-tax structure without workable substance can create tax, banking, and regulatory fragility at the same time. In practice, tax planning for a crypto-licensed company should be tested against where management decisions are made, where staff sit, where key contracts are performed, and where the regulator expects real control.
A low CIT rate can be outweighed by higher substance cost, weaker treaty access, or difficulty opening and maintaining operational accounts.
In the EU, exchange-related services may benefit from VAT treatment influenced by the CJEU Hedqvist line of reasoning, but ancillary services, software, consulting, and some token-related services may be treated differently.
If management, development, sales, or treasury decisions are effectively made in another country, the tax outcome may not follow the incorporation jurisdiction alone.
Groups using separate IP, technology, treasury, and operating entities should document intercompany pricing carefully, especially where licensing, custody, or exchange functions are split.
Issuer-side tokenization, treasury token holdings, staking revenue, and fee models may each produce different accounting and tax treatment requiring jurisdiction-specific analysis.
The correct comparison is total after-tax operating outcome over time, including compliance cost, banking friction, and substance burn, not just the nominal corporate rate.
A crypto license is not a universal legal category. In practice, founders need to distinguish four different concepts.
License usually refers to a formal permission to carry on a regulated activity under a supervisory regime. Authorization is often the more precise term in EU financial regulation, including the MiCA CASP context. Registration usually means the business is entered into a regulatory register for AML supervision, but the regime may be narrower than a full prudential authorization. Legal opinion is not permission at all; it is a legal analysis of whether a specific activity falls inside or outside the perimeter.
Examples matter. In the EU, the relevant route is generally CASP authorization. In the UK, many firms rely on FCA registration under the MLRs. In Canada, the baseline concept is often FINTRAC registration. In the US, a crypto business may need FinCEN MSB registration plus one or more state MTLs, and still face separate analysis under securities or derivatives law.
The practical implication is simple: two companies may both say they have a crypto license, while one has passportable EU authorization and the other has a limited AML registration with no cross-border effect. That is why RUE starts every project with perimeter mapping before jurisdiction selection.
RUE advises founders, compliance leads, and legal teams on jurisdiction selection, MiCA and CASP strategy, VASP registration, document preparation, banking readiness, and post-license compliance design. If you want a route that is legally sound and commercially usable, we can help you structure it end to end.
Our specialists will analyze your specific case, recommend the optimal jurisdiction and license type, and provide a detailed roadmap with timeline and costs.