Licensed to Operate: The 2026 Crypto License Map

• There is no single best jurisdiction. The right one depends on your business model: exchange, custody, token issuance, payments, or DeFi.
• The EU’s MiCA is the closest thing to a real passport. One CASP license covers all 27 Member States. Nothing in the US or Asia gives you that.
• Capital requirements swing wildly. Under MiCA, EU CASP minimum capital generally runs from €50,000 to €150,000 by service class, while Japan asks ¥50 million, Singapore payment institutions start from S$100,000 or S$250,000 depending on license type, and offshore hubs can start in the tens of thousands.
• Almost everyone now demands local substance. A registered company, a resident director or agent, a physical office, and a local AML officer are close to universal.
• Regulatory arbitrage is narrowing. The cheap “crypto haven” is getting scrutinized, enforcement is sharpening, and future laws can change a jurisdiction’s status fast.

The global crypto-licensing landscape in 2026 is a patchwork of frameworks that are still evolving and still inconsistent. Some jurisdictions run strict licensing regimes like the EU’s MiCA or New York’s BitLicense. Others still rely heavily on AML registration or financial-services overlays, although places like Australia are already expanding from narrow digital-currency-exchange registration toward broader virtual-asset-service-provider coverage. Others run bespoke fintech sandboxes. For a business deciding where to incorporate, the honest answer is that there is no universal best choice. The right jurisdiction depends on what you actually do, exchange, custody, token issuance, payments, or DeFi, and on how much regulatory weight and cost you are willing to carry.

What follows is a working map: regulators, license types, eligible activities, capital and fit-and-proper requirements, timelines and fees, local-presence rules, and tax and AML treatment, region by region, plus the trends and strategy that should shape the decision.

The future of finance is here. Trade crypto and more

Disclaimer: This is general information, not legal or financial advice. Crypto licensing rules change quickly and vary by jurisdiction, so consult qualified local legal counsel before making incorporation or licensing decisions.

North America

The United States has no single national crypto license. Crypto firms that accept and transmit convertible virtual currency, or otherwise operate as money transmitters, generally must register with FinCEN as Money Services Businesses and comply with AML, recordkeeping, reporting, and Travel Rule obligations where applicable. The SEC enforces securities law on tokens it deems investment contracts, and crypto exchanges trading security tokens may need to register as exchanges or broker-dealers. The CFTC treats major tokens like Bitcoin as commodities and oversees derivatives.

At the state level, New York’s BitLicense is the strict outlier. The NYDFS requires any firm engaged in virtual currency business activity, transmitting, buying, selling, custody, to hold a BitLicense, with a $5,000 non-refundable application fee, DFS-determined minimum net capital, and a New York agent or officer, and approval can take many months. Texas treats crypto, except redeemable stablecoins, as not “money” under its 2023 Money Services Modernization Act, so generic crypto transfers do not need a money transmitter license, though the MSMA introduced a still-developing digital-asset service provider license. Florida does not have a single BitLicense-style crypto regime, but crypto businesses may still face federal MSB obligations and state money-transmission analysis depending on their activity. Many other states require money transmitter licenses with varying capital and surety bond requirements. In the US, crypto is taxed as property by the IRS, and the main ongoing risk is aggressive SEC enforcement.

Canada has no crypto-specific licensing, and oversight is split. FINTRAC requires crypto exchanges and withdrawal services to register as MSBs and run AML and KYC, while provincial securities regulators require platforms trading security tokens to register as dealers or exchanges. FINTRAC registration can be done online in weeks with no capital requirement beyond AML compliance, and securities registration takes longer. Crypto is taxed under income tax as capital gains or business income, and an OSC regulatory sandbox is available for testing. The approach is relatively light, focused on AML and securities compliance.

European Union and the UK

The EU’s MiCA, effective late 2024, now governs crypto across Member States and lets licensed CASPs passport services EU-wide. Post-MiCA, a CASP license in any EU country grants EU-wide service access, which is the single biggest structural advantage in the global map. During the transitional period, some national regimes still matter for grandfathered firms, but long-term CASP authorization now sits under MiCA and uses EU-level capital classes.

Malta now operates inside the MiCA CASP framework for long-term EU market access. Under MiCA, CASP minimum capital is €50,000, €125,000, or €150,000 depending on the service class, although legacy Malta VFA references may still appear in older materials or transitional discussions.

Applicants must be Maltese-registered with a local board, AML officer, and audited accounts, on a 6 to 12 month timeline. Estonia, historically permissive, now operates under MiCA for CASP authorization, with EU-level CASP capital classes and stricter local expectations around governance, AML, and substance. Germany’s BaFin treats crypto custody as a banking service, with a custody license requiring €125k in own funds and a MiCA CASP license needed for trading and exchange, on a roughly 6 to 12 month timeline with strict fit-and-proper checks. France mandates DASP registration with the AMF for custody, fiat-crypto exchange, crypto-crypto exchange, and trading platforms, with an optional full AMF license for firms that want to hold customer assets in trust and solicit investors. The Netherlands now requires an AFM license for crypto-asset services under MiCA, on a 5 to 8 month timeline with a rigorous business plan. Lithuania’s central bank issues CASP licenses in three classes with capital of €50k, €125k, and €150k, and carries a license-friendly reputation. Most EU states are now moving through the MiCA CASP framework, although legacy AML registrations may still matter during transitional periods or for firms already operating under national law.

Skip the wait. Buy a licensed company.

The UK currently requires all crypto providers to register with the FCA for AML and CFT, and crypto promotions to retail consumers must be FCA-approved. There is no dedicated crypto license yet. The UK has now set the shape of its future crypto regime. Crypto firms will be able to start applying for FCA authorization from September 2026, and the new regime is expected to come into force on 25 October 2027. Until then, crypto remains largely regulated through AML registration, financial promotions, and financial-crime rules. Until then, firms rely on AML registration. The UK offers English common law and a strong fintech market, but no EU passport and heavy tax on gains.

Asia-Pacific

Under Singapore’s Payment Services Act, any business dealing in digital payment tokens to Singaporeans needs a PSA license, either Major or Standard Payment Institution. Base capital must be at least S$100,000 for an SPI or S$250,000 for an MPI, with moderate application and annual fees. Firms must be Singapore-incorporated with a local office and at least one local resident director, directors must pass fit-and-proper checks, and a designated compliance officer is mandatory, on a 3 to 6 month timeline. Singapore offers a stable, clear regulator and a favorable tax regime with no capital gains tax, against high compliance standards and no passporting.

Hong Kong’s 2023 regime requires all centralized crypto exchanges, Virtual Asset Trading Platforms, to obtain an SFC license, with pre-existing platforms given until February 2024 to apply. Requirements include strict fit-and-proper checks, robust AML controls, an external compliance auditor, and capital comparable to securities firms, and the SFC limits retail crypto trading to a few approved products. Hong Kong offers access to the Greater China market and a strong legal system, with very strict rules and a limited consumer market.

Japan requires crypto exchanges to register with the FSA under the Payment Services Act, with ¥50 million minimum capital, mandatory segregation of client assets, compliance officers, and security audits. At least two directors, one a resident, and a physical Tokyo office are required, and FSA approval can take 6 to 12 months. South Korea requires virtual asset service providers to register with the KoFIU and FSC, with a real-name bank account for customer fiat deposits, thorough vetting of shareholders and employees, a Korean local CEO, and domestic major shareholders; many sources cite roughly W500 million in capital for exchanges, and AML and KYC are extremely stringent. Australia is not a MiCA-style prudential crypto licensing regime, but it is no longer just a narrow Digital Currency Exchange registration story. Under AUSTRAC’s reforms, virtual-asset services with an Australian link, including exchange, virtual-asset exchange, safekeeping, transfer services, and certain token-sale services, fall under AML/CTF obligations from 1 July 2026. VASPs must be registered with AUSTRAC, with no general capital requirement under the AML/CTF registration model. New Zealand requires exchanges to register as financial service providers with the FMA under AML laws, with no further crypto licensing.

Middle East and Africa

In the UAE, Abu Dhabi’s ADGM has the FSRA issue Virtual Asset Services licenses, with categories including asset trading, custodian, and derivatives, requiring US$100k to US$250k or more in capital, a business plan, strict AML measures, and an Abu Dhabi-registered company with local approved directors. In Dubai, VARA licenses crypto firms, exchanges, custodians, token offerings, and wallet providers, with paid-up capital often around US$250k. Outside the free zones, the UAE has been building federal crypto regulation. The UAE offers innovation hubs, no crypto tax, and a strategic location, against a complex multi-zone framework.

Bahrain’s Central Bank set up a Virtual Asset Module under a 2020 regulation, licensing Crypto-Asset Service Providers in categories 3 and 4, with firms meeting bank-like requirements, minimum capital often cited around US$100k, strong AML controls, and contingency plans; Bahrain has run a regulatory sandbox for VASPs since 2021. Mauritius requires FSC licenses for VASPs under its 2021 Virtual Asset and Initial Token Offering Services Act, with capital requirements that are substantial, roughly MUR2 million (about US$50k) for a broker-dealer, MUR5 million (about US$125k) for a custodian, and MUR6.5 million (about US$160k) for marketplaces, plus a Mauritius corporate structure and fit-and-proper principals. Seychelles rolled out a VASP Act effective September 2024, requiring all crypto providers to be licensed, with minimum paid-up capital running from US$25k for an investment advisor to US$100k for an exchange, government fees in the range of US$10k to US$27k, and a Seychelles IBC with one local director and an office as the typical vehicle. South Africa requires crypto asset service providers to obtain FSCA authorization where they provide financial services in relation to crypto assets, and those firms also face FIC AML/CTF obligations. So the regime is no longer just AML registration.

Latin America and the Caribbean

Brazil’s crypto regulation has moved beyond the early transition phase. Law 14,478/2022 created the national virtual-asset framework, and in November 2025 the Central Bank of Brazil released regulations for Virtual Asset Service Providers, known locally as SPSAVs. The rules took effect in February 2026 and require authorization, governance, internal controls, compliance standards, and consumer-protection measures. The CVM still oversees tokens that qualify as securities. Currently, crypto exchanges register as payment institutions with the Central Bank, and the CVM treats many tokens as securities. The tax authority applies a 30% income tax on crypto gains above a monthly threshold. Brazil offers a huge economy and growing adoption, against regulatory uncertainty and a high tax rate.

Buy bitcoin and stocks. Signup to Coinbase today

The Cayman Islands’ Virtual Asset (Service Providers) Act of 2020 requires all VASP businesses, exchange, custodian, dealer, broker, manager, to obtain a license from the Cayman Islands Monetary Authority, with two license classes carrying increasing capital, roughly US$100k for Class A and US$250k for Class B, plus a Cayman-resident AML compliance officer and a local office. Application fees run roughly US$10k to US$20k with annual fees on top. Cayman offers no direct crypto tax and a strong reputation as a financial center, against strict KYC and AML and substantial compliance. Bermuda’s Digital Asset Business Act of 2018 requires a BMA license for any digital asset business, classified by activity, with capital varying by class, an issuer offering its own token may need none, a custodian BD$50k, an exchange BD$25k to BD$50k, a broker BD$5k, plus certified directors and compliance officers. Bermuda was a first mover with 0% corporate tax and strong regulatory clarity, against an isolated market. The Bahamas implemented its Digital Assets and Registered Exchanges Act in 2020, licensing crypto exchanges and wallet providers with minimum capital around US$100k.

The comparison at a glance

A handful of regulators, license types, and capital floors are worth keeping side by side. New York’s NYDFS issues the BitLicense with a $5,000 application fee and DFS-set capital, on a 6 to 12-plus month timeline. Germany’s BaFin remains one of the stricter supervisors, while MiCA sets CASP minimum capital across the EU at €50,000, €125,000, or €150,000 depending on service class. Malta should now be read through that MiCA CASP framework for EU passporting, not through old VFA-class capital figures. Estonia sits at €100k to €150k, Lithuania at €50k to €150k, France with no fixed cap for registration and MiFID-like capital for the full license. Singapore’s MAS asks S$100k for an SPI and S$250k for an MPI. Japan’s FSA requires ¥50 million, roughly $350k. The UAE’s ADGM and Dubai’s VARA both land around $100k to $250k. Mauritius runs MUR2m to 6.5m, Seychelles $25k to $100k plus fees, Cayman around $100k to $250k by class, Bermuda BD$25k to 50k by class. Australia’s AUSTRAC regime is AML/CTF-focused rather than capital-based, but the country is moving from the older DCE registration model toward broader VASP registration and supervision, so the cost and scope should be checked against current AUSTRAC rules before relying on a fixed filing-fee number. Timelines cluster between three and six months for the smaller centers and six to twelve for the larger regulators.

The structural point that overrides the table: passporting only really exists in the EU under MiCA. The UK, US, and Asian regimes have no mutual recognition with each other. Offshore licenses are respected in financial markets but still require separate local approvals elsewhere. Always run a local legal analysis before entering any jurisdiction.

Trends, risks, and strategy

The global direction is toward formalized crypto licensing. MiCA is the most influential model, requiring crypto-asset white papers for many public offerings and CASP authorization for regulated services. Singapore and Hong Kong are tightening rules on exchanges and wallets, FATF’s Travel Rule is now broadly enforced, and stablecoins draw special attention everywhere. Many countries are running or expanding regulatory sandboxes to keep room for innovation.

The risks cut the other way. Regulatory arbitrage is narrowing, and the cheap “crypto haven” gets scrutinized now. Firms face real enforcement risk, US SEC and CFTC litigation, Hong Kong SFC fines, France AMF delistings, MAS warnings, and AML non-compliance penalties run high under FATF pressure. Jurisdiction risk is dynamic, since future laws like the UK’s FSMA crypto regime or US stablecoin bills can change a jurisdiction’s status quickly. And DeFi protocols remain largely unregulated, though FATF and various agencies are signaling that on-ramps, off-ramps, and protocol operators may eventually be pulled in.

A few strategic points hold across all of this. Match the jurisdiction to the business model: exchanges and custodians favor well-regulated but crypto-friendly places, token issuers should weigh securities law carefully, and payment processors may look at EU EMI licenses, though crypto is often excluded. Consider tax and KYC cost, since Singapore and the UAE have no personal crypto gains tax while others tax heavily. Structure for multiple jurisdictions, using holding companies for multi-jurisdiction presence and leveraging the MiCA passport for EU clients, because global service often needs several licenses, an MSB in the US plus an EU CASP plus an Asia license, so plan local substance early. Build AML and CFT from day one, even where it is not strictly mandated, because it is now the baseline, and prepare Travel Rule infrastructure. Use sandboxes where they exist to shorten time-to-market under supervision, and keep exit options open, since corporate structures should stay flexible enough to pivot. Banks de-banking crypto clients remains a real operational risk, so secure banking partners early.

The honest summary is that global legal harmonization through FATF and IOSCO is advancing, but fragmentation is still the reality. A sensible licensing strategy hedges across high-compliance jurisdictions like the US and EU and more permissive ones in the Middle East or offshore, rather than betting everything on one.

Try the leading VASP data free for 1 month. No card required.

Frequently Asked Questions (FAQ)

Which jurisdiction has the quickest crypto licensing process? 

Smaller financial centers like Bermuda and Mauritius generally process licenses in roughly 3 to 6 months. Larger regulators like the NYDFS, BaFin, and MAS often take 6 to 12 months. Early planning and complete applications shorten timelines, and sandboxes can speed entry where available.

Is a BitLicense required outside New York? 

No. The BitLicense is unique to New York State. Other states treat crypto under general money transmitter laws. Elsewhere, firms register as MSBs with FinCEN and with individual states as required.

Can I passport a crypto license to other countries? 

EU MiCA licenses passport across EU Member States. Singapore and MAS licenses do not automatically cover other countries, and US and UK licenses have no global passport. Offshore licenses are respected in financial markets but still require separate local approvals.

What are the capital requirements for a crypto exchange license? 

They vary widely. Under MiCA, EU CASP minimum capital is generally €50,000, €125,000, or €150,000 depending on the service class. Japan requires ¥50 million for crypto exchanges, Singapore requires S$100,000 for an SPI or S$250,000 for an MPI, and offshore jurisdictions vary by activity and regulator. Capital should always be checked against the exact license type.

Do I need a physical office or director in the chosen jurisdiction? 

Almost always. Most jurisdictions require a local company or branch with at least one resident director or agent, an office, and a local AML officer. Some allow nominee services, but regulators usually want verifiable physical presence.

How much does AML and KYC compliance cost? 

Compliance setup, policies, software, and reporting systems, can run 10% to 20% of the total license application cost. Ongoing costs include transaction monitoring, KYC and KYB vendor services, and compliance staff.

What about taxation on crypto? 

Tax regimes vary. Many treat crypto gains as capital gains or income, some exempt long-held assets, some apply VAT to crypto transactions. The UAE and Singapore have no personal crypto gains tax. Always check local crypto tax law.

The future of finance is here. Trade crypto and more

Are DeFi protocols regulated? 

As of 2026, pure DeFi largely escapes direct licensing. But jurisdictions are scrutinizing on-ramps and off-ramps, and staking services, yield platforms, and exchange-operated DeFi offerings may need VASP licenses. AML rules are expected to reach protocol operators over time.

Which is the cheapest jurisdiction to get started? 

Offshore locales like Seychelles or Mauritius have low capital, in the tens of thousands, and moderate fees. But cheapest often means a smaller local market and banking challenges. Gibraltar and the Isle of Man may offer reputational proximity to European or UK-style financial markets, but they do not give automatic EU or UK passporting.

Should I prioritize one license or multiple? 

It depends on geography and services. Global operations often need several registrations, FinCEN plus several US states plus an EU MiCA license. Some firms set up a holding company licensed in one jurisdiction and operate branches under it where allowed. Build a compliance matrix for your services and customer locations with legal counsel.