Crypto Exchange Licensing Requirements Worldwide

Eighty-five of 117 jurisdictions surveyed by FATF have passed legislation implementing the Travel Rule, yet only 33% of assessed jurisdictions satisfactorily require VASPs to be licensed or registered. The gap between written law and active enforcement means exchange operators face a patchwork of 8+ distinct licensing regimes, each with different capital, custody, and compliance thresholds. For a broader context on how these regimes shape trading volumes, see our crypto exchange market data. The comparison below maps requirements across the United States, European Union, United Kingdom, Singapore, Hong Kong, Dubai, Japan, and Canada, drawn from regulator filings and FATF survey data.

Key Takeaways

• 49 US states require separate Money Transmitter Licenses for crypto exchanges, with total licensing costs reaching $1 to $3 million over 12-18 months.
• The EU’s MiCA regulation grants passporting rights from a single authorization across all 27 member states, with capital thresholds starting at EUR 50,000.
• 73% of 117 jurisdictions surveyed by FATF have passed Travel Rule legislation as of the 2025 survey, up from 65 jurisdictions in 2024.
• Japan mandates that 95% or more of user funds be held in offline wallets, one of the strictest custody rules globally.
• Hong Kong’s SFC requires licensed platforms to hold client assets through a wholly-owned subsidiary, rejecting all third-party custodians.
• Dubai’s VARA processes exchange licenses in 8 to 16 weeks on average.
• The UK’s FCA plans to replace its current AML-only registration with a full FSMA-based authorization regime expected to commence on October 25, 2027.

Editor’s Choice

• 76 jurisdictions have licensed or registered at least one VASP in practice as of 2025, up from 69 in 2024, according to FATF.
• Germany led the EU with 20 CASP MiCA approvals, representing 30% of the bloc total, per TRM Labs’ policy review.
• New York’s BitLicense requires a minimum $500,000 surety bond, according to NYDFS.
• Hong Kong requires licensed VATPs to maintain at least HK$5 million in paid-up share capital and HK$3 million in liquid capital.
• Singapore’s MAS sets the Major Payment Institution licence threshold at S$250,000 minimum base capital for digital payment token services.
• Operating an unregistered MSB in the United States carries penalties of up to $5,000 per violation per day and up to 5 years in prison, per FinCEN.

Why Crypto Exchange Licensing Exists

FATF’s 2025 survey found that 85 of 117 jurisdictions, representing 73% of respondents, have passed legislation implementing the Travel Rule for virtual asset service providers. FATF extended the Travel Rule to VASPs in June 2019 through Interpretive Note 15 to Recommendation 15, requiring them to meet the same information-sharing standards as traditional financial institutions.

Crypto exchange licensing grew out of anti-money laundering frameworks originally built for banks and money services businesses. When FATF classified VASPs alongside traditional financial institutions, it created a compliance baseline that forced every major economy to either adopt licensing or explain why it had not.

The most significant update came in June 2025 when FATF revised Recommendation 16, expanding the Travel Rule objectives beyond money laundering and terrorist financing to explicitly include fraud prevention and proliferation financing.

The pattern we’ve documented across 18 regulatory events holds here too: enforcement follows collapse, typically within 12 months. Mt. Gox in 2014 preceded New York’s BitLicense in 2015. FTX’s collapse in 2022 accelerated MiCA enforcement and the US GENIUS Act timeline.

Requirements vary across jurisdictions, and cryptocurrency adoption rates by country directly influence how aggressively each regulator enforces them. The US alone has 50 overlapping authorities.

United States Licensing Framework

Licensing a crypto exchange in the United States costs between $1 and $3 million over 12 to 18 months, covering FinCEN MSB registration plus state Money Transmitter Licenses across 49 states, according to regulatory filing estimates. Montana is the only state that does not require a Money Transmitter License, though federal requirements still apply there.

FinCEN’s 2013 guidance (FIN-2013-G001) classified any person that accepts and transmits convertible virtual currency, or buys or sells it as a customer business, as a money transmitter under the Bank Secrecy Act. This classification applies at the federal level and requires FinCEN MSB registration.

Every MSB must register with FinCEN by electronically filing FinCEN Form 107 and renew registration every two-calendar-year period. Failure to comply carries a civil penalty of up to $5,000 for each violation, with each day constituting a separate violation, plus up to 5 years in prison for willful non-compliance.

Individual state licenses cost between $5,000 and $150,000 each, with processing timelines of 6 to 18 months per state. New York’s BitLicense, established under 23 NYCRR Part 200, requires a minimum $500,000 surety bond.

The US patchwork contrasts sharply with the EU’s single-license model.

Don't chase the news. Let us curate it.

You get one weekly briefing with only the stories that matter. If the market is quiet, we skip it.

Email address

Get the Weekly Briefing - it's free!

✅ Join readers from Visa, Vanguard, and the FDIC.

European Union MiCA CASP Authorization

Under the Markets in Crypto-Assets Regulation, a single CASP authorization in any one EU member state grants passporting rights across all 27 countries, with no separate application per country and no local subsidiary required for each market, according to MiCA provisions. This is the single biggest operational divide in global crypto regulation: one application versus 49 in the US.

MiCA entered into force on June 29, 2023, and fully applies since December 30, 2024, providing a comprehensive regulatory framework for crypto-assets, issuers, and CASPs. The regulation includes optional grandfathering provisions allowing entities already providing crypto-asset services before December 30, 2024, to continue operations until July 1, 2026, or until authorization approval or denial.

Capital requirements vary by service type: CASPs providing advisory services must maintain a minimum capital of EUR 50,000, custody and exchange services require EUR 125,000, and trading platforms require EUR 150,000.

By the numbers: According to TRM Labs’ Global Crypto Policy Review, Germany led the EU with 20 CASP MiCA approvals, representing 30% of the bloc total, while the Netherlands issued 18 MiCA licenses, representing over 20% of the EU total. These two countries account for half of EU-wide CASP authorizations, reflecting their established fintech ecosystems.

MiCA’s substance requirements effectively end the mailbox-company structures that proliferated under earlier national regimes, where firms obtained licenses in one jurisdiction while operating entirely from another.

The UK chose a different path after Brexit.

United Kingdom FCA Cryptoasset Registration

The FCA requires cryptoasset businesses to register under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (MLRs) if they provide exchange services, custody services, or operate crypto ATMs in the UK. This AML-focused registration is narrower than MiCA’s full authorization model.

All registered firms must submit a REP-CRIM return within 60 business days of the business’s Accounting Reference Date. The UK regime does not include passporting rights. Post-Brexit, a UK registration does not grant access to any EU market, and EU-authorized CASPs cannot serve UK customers without separate FCA registration.

A new FSMA-based authorization regime is expected to commence on October 25, 2027, replacing the current MLR registration system. The shift would bring crypto exchanges under the same supervisory framework as traditional financial services firms, covering conduct rules, capital adequacy, and consumer protection.

Singapore takes a third approach, embedding crypto into existing payment law.

Singapore MAS Digital Payment Token License

Singapore’s Monetary Authority requires crypto exchanges to obtain either a Standard Payment Institution (SPI) or Major Payment Institution (MPI) licence under the Payment Services Act 2019, with the SPI threshold set at S$3 million in monthly transactions, according to MAS. MPI applicants must hold a minimum base capital of S$250,000 and must be a Singapore-incorporated company or a Singapore branch of a foreign corporation.

Entities conducting digital payment token services must have an in-house local compliance officer. At least one director must be a Singapore citizen or permanent resident. The framework integrates crypto alongside other payment services like e-money and cross-border transfers under a single licensing act.

Hong Kong’s model is stricter on custody than any other jurisdiction covered here.

Hong Kong SFC VATP Licensing Regime

Hong Kong’s Securities and Futures Commission requires licensed Virtual Asset Trading Platforms to maintain at least HK$5 million in paid-up share capital and liquid capital of at least HK$3 million, according to SFC regulatory requirements. Licensed operators must also hold assets equivalent to at least 12 months of their actual operating expenses, calculated on a rolling basis.

The SFC does not accept custody of client assets by third-party custodians; assets must be held by a wholly-owned subsidiary of a licensed VATP. This custody model is the strictest among the 8 jurisdictions reviewed here, eliminating the counterparty risk that contributed to losses in past exchange failures.

Retail access in Hong Kong is available only through licensed Virtual Asset Trading Platforms. Understanding who invests in crypto helps explain why regulators focus heavily on retail protections.

Dubai takes the opposite approach on the timeline, with licensing in weeks rather than years.

Dubai VARA Virtual Asset License

Dubai’s Virtual Assets Regulatory Authority (VARA) requires paid-up capital ranging from AED 100,000 for advisory services up to AED 1,500,000 for exchanges that self-custody client assets, established under Law No. 4 of 2022. On average, the licensing process takes 8 to 16 weeks.

VARA requires a local office with physical presence in Dubai, 2 responsible individuals who must be UAE residents or citizens meeting Fit and Proper criteria, and a Compliance Officer or MLRO.

The speed of VARA’s licensing process reflects Dubai’s strategic positioning as a crypto hub. However, faster timelines do not mean lower standards; the substance requirements (local office, resident officers, annual renewals) mirror the anti-shell-company provisions in MiCA.

Japan offers one of the strictest custody regimes globally.

Japan FSA Crypto Exchange Registration

Japan’s Financial Services Agency requires crypto exchanges to register as Crypto Asset Exchange Service Providers (CAESPs), a process that takes 18 to 24 months on average and costs between $500,000 and $1 million, according to industry analysis.

Key finding: According to Japan’s FSA regulatory framework, custodial wallets must be segregated, with at least 95% of user funds held in offline wallets, and user assets must be audited annually. This represents the most prescriptive custody requirement among the jurisdictions reviewed.

Japan’s Financial Services Agency announced in September 2025 a shift in crypto asset regulation, aiming to bring digital assets under the Financial Instruments and Exchange Act (FIEA), moving from the current Payment Services Act framework, with the shift anticipated to take effect around 2027.

Canada rounds out the major licensing jurisdictions with a dual federal-provincial model.

Canada CIRO and Provincial MSB Registration

Canada’s regulatory framework requires crypto exchanges to register as Investment Dealers and obtain membership with CIRO (Canadian Investment Regulatory Organization), with minimum capital starting from CAD 50,000 for restricted dealers, according to CIRO requirements.

The framework integrates digital assets into the existing financial system with anti-money laundering compliance supervised by FINTRAC, crypto exchanges and tokens under the jurisdiction of CSA, dealer licensing regulated by CIRO, and banking oversight handled by OSFI.

Provincial requirements add another layer. Quebec administers its own MSB Act through Revenu Quebec, while British Columbia passed the Money Services Businesses Act in May 2023.

Global Licensing Comparison Table

Passporting, Custody, and Shell Structures Compared

MiCA’s passporting mechanism allows a single CASP authorization in any one EU member state to cover operations across all 27 countries, with no separate application per country and no local subsidiary required, according to MiCA provisions. No other major jurisdiction offers an equivalent.

• Passporting: The EU (MiCA) provides true cross-border passporting. The US requires 49 separate state licenses. The UK lost passporting post-Brexit. Singapore, Hong Kong, Dubai, Japan, and Canada each operate standalone regimes with no mutual recognition.
• Custody models: Jurisdictions are split into three approaches, each affecting self-custody wallet adoption differently. Japan mandates at least 95% of user funds in offline wallets by statute. Hong Kong requires custody through a wholly-owned subsidiary, rejecting all third-party custodians. MiCA requires asset segregation by regulation but allows more flexibility in custody structure. The US model varies by entity type: broker-dealers follow SEC Rule 15c3-3, while state-chartered trust companies operate under state banking law.
• Shell-structure prevention: MiCA’s substance requirements effectively block the mailbox-company structures common under earlier national regimes. Dubai’s VARA achieves a similar result through its local office requirement and resident officers.

Frequently Asked Questions (FAQs)

Conclusion

Eighty-five of 117 jurisdictions have passed legislation implementing the Travel Rule, yet only 33% of assessed jurisdictions satisfactorily require VASPs to be licensed or registered, according to FATF’s 2025 assessment. The 8 jurisdictions covered here represent the most active licensing regimes globally, each built on different foundations.

The EU stands alone in offering regulation and compliance through MiCA, while the US demands the highest total licensing cost at $1 to $3 million across 49 states. Japan and Hong Kong impose the strictest custody rules, with Japan mandating 95%+ offline storage and Hong Kong requiring wholly-owned subsidiary custody. Dubai’s VARA offers the fastest path at 8 to 16 weeks.

Regulators, compliance teams, and exchange operators planning cross-border expansion will find that these differences define their market-entry strategy. Three regulatory transitions ahead, the UK’s FSMA authorization (expected this year), Japan’s shift from PSA to FIEA (anticipated around 2027), and the GENIUS Act’s federal rulemaking deadline, will reshape licensing requirements further.

Based on the patterns we’ve documented, licensing complexity will continue to increase. The question is no longer whether exchanges need licenses, but how many they can realistically maintain.