Buy a Licensed Company 
Explore VASP Data 
Talk to an Expert 
Atis Shala
Atis is a senior analyst and community lead with four years of experience in crypto. He has a bachelor from the Rochester Institute of Technology.
Regulatory Fit-and-Proper Tests for Buyers and Key Persons
- A fit and proper test checks that a licensed firm’s owners and senior staff are honest, competent and financially sound, and every major crypto hub runs one.
- Under the EU’s Markets in Crypto-Assets Regulation (MiCA), buying 10% or more of a crypto-asset service provider, or crossing 20%, 30% or 50%, triggers a regulatory review of 60 working days plus any pauses.
- Buyers are judged on reputation, future management, financial soundness, ongoing compliance and money laundering risk.
- Buyers funding a stake in an EU crypto firm with crypto-assets must disclose the wallets, service providers and ledger addresses behind the money.
- The European Securities and Markets Authority (ESMA) expects a crypto firm’s chief executive to work full time for it as a rule, and executive directors to give at least half their time.
- The UK’s Financial Conduct Authority (FCA) asks whether candidates have been “candid and truthful” with regulators, so hiding past problems backfires.
- The UK opens its crypto application window on 30 September 2026, and its Senior Managers and Certification Regime (SM&CR) will cover authorised crypto firms from 25 October 2027.
Why a Signed Deal Can Still Stall at the Regulator
Picture a buyer who has just signed for 60% of an exchange authorised under MiCA, paying partly with bitcoin held in a hardware wallet since 2017. The deal still cannot close until a regulator has examined the buyer’s past, the directors the buyer plans to appoint, and the addresses those coins passed through.
That review is a fit-and-proper test, the assessment a regulator runs to decide whether a person may own a significant stake in, or hold a senior role at, a licensed firm. The test has carried more weight since MiCA’s transitional period ended on 1 July 2026. Unauthorised firms must now apply from scratch or buy an authorised crypto-asset service provider (CASP), and any purchase of 10% or more triggers the assessment. Across the Channel, the FCA opens its crypto application window on 30 September 2026.
This guide covers who gets tested, what regulators ask for, how long approval takes and how six crypto hubs compare.
What Regulators Mean by “Fit and Proper”
Regulators use the phrase “fit and proper” for a simple idea: a licence deserves only as much trust as the people who own and run the firm holding it. The questions behind the phrase are remarkably consistent across rulebooks.
The Criteria Behind Every Test
Almost every regime tests the same three qualities: integrity, competence and financial soundness. The FCA’s version is honesty, integrity and reputation; competence and capability; and financial soundness. MiCA requires a CASP’s management body to be “of sufficiently good repute” and to have the knowledge, skills and experience to do the job, individually and collectively. Hong Kong’s Securities and Futures Commission (SFC) weighs solvency, qualifications, competence, reputation and financial integrity, while Dubai’s Virtual Assets Regulatory Authority (VARA) adds virtual asset sector experience and knowledge of the regulatory framework.
Two further checks depend on the role. Directors must show that they can commit enough time and manage conflicts of interest. Buyers must explain where their money came from, because regulators also test whether a deal carries money laundering or terrorist financing risk.
Who counts as a buyer
A buyer, in regulatory terms, is anyone who acquires enough of a licensed firm to influence it, directly or through a chain of companies. MiCA calls this a qualifying holding: a direct or indirect stake of at least 10% of a CASP’s capital or voting rights, or any stake that allows significant influence over its management. A buyer who plans to reach or pass 20%, 30% or 50%, or to make the CASP a subsidiary, must notify the regulator again at each step.
Other hubs mostly set their triggers at 10% or 25%, as the comparison table later in this guide shows. Buyers can be individuals, companies, trusts, investment funds or sovereign wealth funds, and EU rules set a separate information list for each type.
Who Counts as a Key Person
Key persons are the individuals who run a licensed firm or oversee its safeguards. Under MiCA, the core group is the management body, which sets a CASP’s strategy, oversees its management and includes the people who effectively direct the business. At least one director must be resident in the EU.
Most regimes reach beyond the board. The FCA requires the officers, managers and beneficial owners of registered crypto firms to be fit and proper and assesses money laundering reporting officers (MLROs) individually. Hong Kong requires SFC-approved responsible officers, and VARA approves every board member of a Dubai virtual asset service provider (VASP). The map below shows where each group sits inside a typical licensed crypto firm.
How Regulators Test Buyers of a Licensed Crypto Firm
Once the people in scope are known, a buyer’s assessment follows a script written into law. The EU version is the most detailed and the UK’s mirrors it closely, so MiCA serves as the reference point here.
The Five Questions in a Change-In-Control Review
Article 84 of MiCA limits a regulator to five criteria when assessing a proposed acquisition of a CASP, and each works as a question the buyer’s file must answer:
- Is the buyer of good reputation?
- Do the people who will run the business have the reputation, knowledge, skills and experience to do so?
- Is the buyer financially sound for the type of business involved?
- Will the CASP be able to comply, and keep complying, with MiCA?
- Are there reasonable grounds to suspect money laundering or terrorist financing linked to the deal, or a risk that it could increase?
A regulator may oppose only on reasonable grounds tied to those criteria, or when information is incomplete or false, and may not judge a deal by the economic needs of the market. The UK asks the same questions under section 186 of the Financial Services and Markets Act 2000 and adds one more: whether any group the firm joins can be supervised effectively.
What Every Buyer Must Disclose
Answering those questions takes documents, and since 20 April 2025 the EU’s regulatory technical standards (RTS) in Commission Delegated Regulation (EU) 2025/414 have listed them. An individual buyer supplies a detailed CV and a statement covering themselves and any business they directed or controlled over the last 10 years, from criminal proceedings and sanctions to insolvencies, refused licences and dismissals. Official certificates must be less than three months old at filing, and corporate buyers add three years of financial statements.
The source of funds draws the closest attention. Buyers must describe the activity that generated the money, name any lenders and explain the payment route. When crypto-assets fund the deal, the file must also identify the assets and ledger technology used, the wallets that held them and whether each was custodial, the service providers involved, and the originator and beneficiary addresses. For the buyer in the opening example, that means rebuilding a wallet history that stretches back almost a decade.
How the File Changes With the Size of the Stake
Stake size also changes what a buyer must explain about its plans, as the table below shows.
| Buyer’s situation | What the file must add | Legal basis |
|---|---|---|
| Up to 20% | Strategy document on the holding period, the buyer’s minority shareholder role and its willingness to provide extra financing | RTS 2025/414, Art. 9 |
| More than 20% and up to 50% | The same, plus the influence the buyer intends to exercise over dividends, strategy and resources | Art. 10 |
| More than 50%, or a subsidiary | Three-year business plan with estimated financial statements and the governance impact | Art. 11 |
| Assessed by the same regulator in the past two years | Only new or changed information, plus a signed declaration | Art. 12(1) |
| Already authorised and supervised by the same regulator | Only acquisition-specific information, plus a signed declaration | Art. 12(2) |
Table 1. What a buyer’s file must add as the stake grows. Source: Commission Delegated Regulation (EU) 2025/414.
Two practical points follow from the table. A majority buyer is effectively writing the firm’s next business plan, while a repeat buyer already known to the same authority has far less to prepare.
The Approval Clock, and the Cost of Skipping It
Under Article 83 of MiCA, a regulator has 60 working days, roughly 12 weeks, to assess a proposed acquisition after acknowledging the notification in writing, which it must do within two working days. Requests for more information, allowed until the 50th working day, pause the clock for up to 20 working days. That pause can be extended by up to 30 working days for buyers based outside the EU or regulated under non-EU law.
Two features protect the buyer. An opposition must be notified in writing, with reasons, within two working days of the decision and before the deadline. A regulator that does not oppose in time is deemed to have approved the deal, as the figure below shows.
Skipping the process is costly. Breaches of Article 83 are among the MiCA infringements for which EU countries must allow maximum fines of at least €5 million or 5% of annual turnover for companies, and at least €700,000 for individuals. Regulators can also suspend the voting rights of shareholders whose influence threatens sound and prudent management, and in the UK, acquiring control without approval is a criminal offence.
How Regulators Test Directors, Mlros and Other Key Persons
Buyers face the test once per deal, while key persons face it on appointment and for as long as they hold the role, against supervisory expectations that have become increasingly specific.
Reputation: What Counts Against a Candidate
MiCA requires proof that each member of a CASP’s management body has no criminal record and no penalties under commercial, insolvency or financial services law, or relating to money laundering, terrorist financing, fraud or professional liability. ESMA’s supervisory briefing on CASP authorisation of 31 January 2025 goes further. It tells national regulators to weigh ongoing criminal proceedings inside or outside the EU and to investigate past violations, such as operating without the necessary registration. Regulators should also interview those board members and judge whether they have learned from the transgressions.
Other hubs draw similar lines. The FCA’s guidance counts spent convictions where UK rehabilitation exceptions allow and asks whether a person has been “candid and truthful” in all dealings with any regulatory body. Since 1 September 2026, it also explains how non-financial misconduct, including bullying, harassment and violence, forms part of the test at FSMA-authorised firms. An MLRO with an unspent conviction listed in Schedule 3 of the Money Laundering Regulations automatically fails the FCA’s fit and proper test. In the US, the GENIUS Act bars anyone convicted of a felony involving insider trading, embezzlement, cybercrime, money laundering, terrorist financing or financial fraud from serving as an officer or director of a payment stablecoin issuer.
Competence and crypto knowledge
Competence is judged for each person and for the board as a whole. The joint guidelines of the European Banking Authority (EBA) and ESMA on management body suitability (EBA/GL/2024/09), applicable since 4 February 2025, list the knowledge areas regulators should weigh. They include financial markets regulation, crypto-assets such as asset-referenced and e-money tokens, risk management and the EU’s Digital Operational Resilience Act. ESMA’s briefing then sets a floor: every executive board member needs at least a good level of understanding of the technical workings of crypto-assets and the firm’s services.
The same scrutiny applies below board level. The FCA’s feedback on crypto registration applications describes a strong MLRO as appropriately qualified, knowledgeable about cryptoassets and their risks, and competent at interview. It has flagged interim MLROs, which prevent it from assessing the permanent appointee, and looks closely at MLROs who regularly resign once an applicant is registered and then join another applicant.
Time Commitment and Local Presence
Time commitment can undo a strong CV, since a director spread across several roles may be unavailable when needed. EU application rules require each board member to state the minimum time per year and per month they will give the CASP and to list their other directorships. ESMA’s benchmark is clear: the chief executive should as a rule devote 100% of their time to the CASP, and executive board members at least half.
Presence matters as much as hours. Going beyond MiCA’s EU residency rule, ESMA expects, as a rule, at least one executive board member to be resident in the authorising country. The FCA’s general expectation is that a firm’s “mind and management” sits in the UK, and it looks carefully at MLROs based abroad, while Hong Kong requires a responsible officer who ordinarily resides there. A new directorship after approval should trigger a fresh time assessment.
When the Assessment Happens, and When It Happens Again
Under the EU guidelines, the CASP itself is primarily responsible for keeping its board suitable at all times. It should assess members before appointment, or within one month afterwards in justified cases, and regulators should finish their own review within four months of notification. Material changes to the board or business, and new concerns about a member’s suitability, reputation or links to money laundering, call for a fresh assessment.
Other hubs set different rhythms. The Money Transmission Modernization Act (MTMA), a model law enacted in full or in part by 31 US states, requires notice within 15 days of appointing a key individual and full information within 45 days, and lets the regulator disapprove within 90 days of a complete notice. VARA requires each Dubai VASP’s board to reconfirm every member’s fitness at least annually.
Fit-and-Proper Rules Across Six Crypto Hubs
Those principles travel well, but the numbers attached to them change at almost every border. The table below compares six regimes that matter for crypto businesses in 2026.
| Regime | Buyer approval trigger | Key persons in scope | Decision clock | Core test |
|---|---|---|---|---|
| EU: MiCA (CASPs) | 10% qualifying holding, then 20%, 30%, 50% or subsidiary | Management body; qualifying shareholders | 60 working days plus any pause; deemed approved without opposition | Reputation, management, financial soundness, compliance, money laundering risk |
| UK: FCA | 25% for beneficial owners of registered crypto firms; bands from 10% or 20% for authorised firms | Officers, managers, beneficial owners; SM&CR senior managers | Up to 60 working days from a complete notice | Honesty, integrity and reputation; competence and capability; financial soundness |
| US: New York BitLicense | Control presumed at 10% of voting stock | Directors, principal officers, principal stockholders and beneficiaries | 120 days from a complete application, extendable | Financial condition, experience, character and fitness; public interest |
| US: MTMA states | 25% control, presumed from 10% unless passive | Key individuals | 60 days after the application is complete, then approved by default | Financial condition, experience, competence, character and fitness |
| Hong Kong: SFC (trading platforms) | Approval to become a substantial shareholder | Two or more responsible officers, one an executive director, one ordinarily resident in Hong Kong | No fixed period in the licensing handbook | Solvency, qualifications, competence, honesty, reputation, financial integrity |
| UAE: Dubai VARA | Control presumed at 25%, or the right to appoint or dismiss most of the board or senior management | Board members, approved by VARA and reconfirmed annually | 30 working days from a complete application | Qualifications, sector experience, integrity, regulatory knowledge, financial soundness |
Table 2. Fit-and-proper rules for buyers and key persons in six crypto hubs, as of 16 September 2026. Sources: MiCA; FCA; FSMA 2000; 23 NYCRR Part 200; CSBS MTMA; SFC; VARA.
What the Comparison Shows
Three patterns stand out in the table. Ownership triggers cluster at 10% and 25%, so a 15% stake can need approval in the EU or New York while sitting below Dubai’s presumption. In MTMA states, a passive investor can rebut the 10% presumption. Clocks also run in different units, and Hong Kong’s handbook sets no fixed period at all. Finally, silence favours the buyer in the EU and MTMA states, where an application the regulator fails to oppose or decide in time counts as approved.
The UK column will change the most. The FCA’s application window runs from 30 September 2026 to 28 February 2027, and firms authorised under the new regime will apply the SM&CR in full from 25 October 2027. Groups seeking UK and EU licences should plan for two overlapping reviews of many of the same people, and our 2026 Crypto License Map helps sequence them.
How to Prepare a Fit-And-Proper File That Passes
Knowing the rules is half the work. The other half is assembling evidence that answers a regulator’s questions before they are asked.
Before Signing or Appointing
Seven steps cover most of the groundwork.
- Confirm the target’s authorisation and permissions in the official register, or across jurisdictions with our Global VASP App, which tracks more than 30,000 registered crypto companies.
- Map the ownership chain up to the ultimate beneficial owners, flagging every holder at or above the lowest applicable threshold and anyone acting in concert.
- Collect 10 years of criminal, regulatory and insolvency records from every country where each buyer and key person has lived or worked, with certificates under three months old at filing.
- Disclose adverse history in full, with context and remediation, because regulators weigh candour and learning alongside the events themselves.
- Trace the source of funds to the activity that generated it, including wallets, service providers and ledger addresses for crypto wealth.
- Record each director’s expected time commitment, other directorships and residence.
- Make regulatory approval a condition of closing, allow 60 working days plus pauses before the long-stop date, and book a pre-application meeting where offered, as the FCA does free of charge.
After Approval
Approval opens an ongoing obligation. The CASP must reassess its board whenever roles, the business or reputations change, and shareholders must notify the regulator in writing before reducing a stake below 10%, 20%, 30% or 50%.
For the buyer with the 2017 bitcoin, preparation sets the pace. A complete wallet history, a candid disclosure file and a board that meets ESMA’s time and residency expectations give the review its best chance of finishing on schedule. Our MiCA licence document checklist and guide to getting a MiCA licence cover the documents regulators expect from a CASP’s owners and managers.
Frequently Asked Questions (FAQ)
What is a fit and proper test in crypto regulation? +
A fit and proper test is a regulator's assessment of whether a crypto firm's owners and senior staff are honest, competent and financially sound. It applies when a firm seeks a licence, when someone buys a significant stake, and when a key person is appointed.
Who has to pass a fit and proper assessment at a crypto company? +
Significant shareholders, board members and senior executives usually have to pass. Many regimes also test control functions: the UK assesses MLROs and beneficial owners, Hong Kong requires approved responsible officers, and Dubai's VARA approves every board member of a licensed virtual asset service provider.
What is a qualifying holding under MiCA? +
A qualifying holding is a direct or indirect stake of at least 10% of a crypto-asset service provider's capital or voting rights, or any stake giving significant influence over its management. Acquiring one, or crossing 20%, 30% or 50%, requires notifying the regulator first.
How long does a change in control approval take under MiCA? +
The regulator has 60 working days, roughly 12 weeks, from acknowledging the notification. The clock can pause for up to 20 working days while the buyer answers questions, longer for non-EU buyers, and a deal the regulator does not oppose in time is deemed approved.
Can a person with a criminal record run a licensed crypto firm? +
It depends on the offence and the jurisdiction. MiCA excludes directors convicted of money laundering, terrorist financing or other offences affecting good repute. The UK automatically fails MLROs with certain unspent convictions, and the US GENIUS Act bars some convicted felons from stablecoin issuer leadership roles.
What happens if a buyer completes a deal without approval? +
The consequences can be serious. Acquiring or increasing control of a UK authorised firm without approval is a criminal offence. MiCA requires EU countries to allow maximum fines of at least €5 million or 5% of annual turnover for companies that breach its acquisition rules.
What happens if someone fails a fit and proper assessment? +
The regulator can block the appointment or the deal. MiCA requires authorisation to be refused when board members or qualifying shareholders fail its suitability criteria, and acquisitions can be opposed on similar grounds. In the UK, a refused senior manager applicant can take the decision to the Upper Tribunal.
