Pause Is Penalty: Crypto License Suspension vs Revocation

• MiCA and AUSTRAC can suspend on reasonable suspicion, and withdrawal needs a listed statutory ground.
• Maximum suspensions run 30 working days per occasion under MiCA, three months plus one extension at AUSTRAC, and six months in Japan.
• New York requires a hearing on ten days’ notice before any BitLicense suspension, while California and the UK can make an order bite first.
• Cryptolink, CoinBest, Bsquared and Genesis Global Trading each reached suspension or exit after failures in AML controls, reporting or candor with the regulator.
• Withdrawals during a suspension depend on the order’s carve-outs and segregated custody.

AUSTRAC suspended Cryptolink’s registration for three months from 9 August 2026. The operator had to switch off all 96 of its crypto ATMs the same day, and no court had ruled on anything. AUSTRAC cited ongoing concerns about how the company handled high-risk transactions, missing reports and an unanswered information request, and said it judged the business too risky to keep running for now. In May, the Monetary Authority of Singapore had gone further with Bsquared Technology and revoked its license outright.

Both powers stop the business, and suspension gets there faster. MiCA and AUSTRAC let a regulator suspend on reasonable suspicion within a fixed clock, and the UK and California let a suspension take effect before the firm is heard. Where suspension and revocation share the same statutory grounds, as in Singapore, Japan and New York, suspension is the lighter order a regulator can make on the same findings. For a crypto firm that earns its revenue from one regulated activity, a suspension does most of the commercial damage by itself. A revocation that follows often formalizes an exit already under way. Compliance teams should plan around how fast each regulator can switch a business off and what it takes to switch it back on.

Buy bitcoin and stocks. Signup to Coinbase today

What suspension and revocation do to an authorization

A suspension leaves the authorization in existence and bars the firm from using it, in whole or in part, for a period. Singapore‘s Payment Services Act puts the effect plainly. From the date a suspension or revocation takes effect, the licensee must stop carrying on payment service business, and every day it continues after conviction adds a further fine. A revocation ends the authorization, and coming back means a fresh application under whatever fitness test the regulator applies at the time.

The license labels differ by regime, and so does the word for the terminal step. MiCA calls it withdrawal, the UK Money Laundering Regulations and AUSTRAC call it cancellation, and New York, Singapore, Japan and Dubai’s VARA call it revocation. Several of these regimes are registrations in law, and canceling a mandatory registration ends the regulated business as completely as revoking a license.

Both powers can also be partial. Japan’s Payment Services Act lets the regulator suspend all or part of a crypto-asset exchange business for up to six months, and MiCA lets a competent authority limit a withdrawal to one crypto-asset service. A partial order keeps the entity alive and the unaffected services running. Firms that can show which revenue line sits under which permission are in a far better position to argue for a narrow order.

Withdrawal and suspension under MiCA Articles 64 and 94

Article 94 lets a national competent authority suspend crypto-asset services for up to 30 consecutive working days on any single occasion where it has reasonable grounds to suspect an infringement. The same article lets it suspend services where the provider’s situation would harm clients, particularly retail holders, and prohibit a service once it finds an infringement. An unauthorized provider can be ordered to stop immediately, without warning or a deadline. The text caps each occasion at 30 working days and sets no limit on the number of occasions.

Withdrawal under Article 64 runs on findings. The authority must withdraw a CASP’s authorization in seven cases. The firm has not used it within 12 months, has renounced it, or has provided no services for nine consecutive months. It obtained the authorization by irregular means such as false statements, or no longer meets the conditions and missed the authority’s remediation deadline. It lacks effective AML and CTF systems, or it has seriously infringed MiCA. Withdrawal is discretionary where the firm breaches national AML law, or loses a payment or e-money institution authorization and fails to fix it within 40 calendar days.

Before withdrawing, the home authority must consult another Member State’s authority when the CASP is a subsidiary of, or controlled by the same people as, a CASP authorized there. After withdrawing, it notifies ESMA, and the change goes into the register that records every MiCA CASP authorization and its permissions.

MiCA leaves notice periods, hearings and appeals to national administrative law. A CASP passporting across the Union answers to its home state’s procedural code, and no single EU-wide notice period exists to quote.

The end of the transitional period on 1 July 2026 moved firms without authorization into the immediate cessation power. ESMA said it expected unauthorized providers serving EU clients to stop and to have executed credible wind-down plansby that date, including transfers of client crypto-assets to an authorized CASP or a self-hosted wallet.

Suspension periods, hearings and appeals by regulator

Under the AML/CTF Rules 2025, the AUSTRAC CEO can suspend a registration for up to three months on reasonable suspicion of a listed ground. One extension of up to three more months is allowed, having regard to whether that suspicion continues. The longest continuous suspension therefore runs six months, and the CEO can revoke one early. AUSTRAC tells the business of a suspension or cancellation in a notice that sets out its internal or external review options.

The future of finance is here. Trade crypto and more

The UK still supervises crypto exchanges and custodian wallet providers through registration under the Money Laundering Regulations. The FCA must normally give notice that it intends to suspend or cancel, state its reasons, and allow at least 28 days for representations, unless it states that the public interest requires immediate effect. Appeals go to the Upper Tribunal, and filing one leaves the FCA’s decision running. Gidiplus lost its temporary registration when the FCA refused its application in November 2021. It asked the Tribunal to suspend that decision pending appeal and lost the application in February 2022, with the judge putting the burden on the firm to show that customers and markets would not be prejudiced.

New York is the outlier. Part 200 lets the superintendent suspend or revoke a BitLicense on any ground that would have justified denial, for any violation of the regulation, or for good cause. Good cause covers a licensee that has defaulted or is likely to default, and conduct that is unlawful, dishonest, wrongful or inequitable. The same section bars both suspension and revocation without a hearing, on at least ten days’ written notice. Suspension gives DFS no procedural shortcut over revocation. Its other routes are a court application for a preliminary injunction, which section 200.6 preserves, and negotiated consent orders.

California runs the opposite way. The Digital Financial Assets Law normally requires notice and an opportunity for a hearing. DFPI can still act after notice and without a prior hearing, or without notice at all, when the circumstances require action first, and the firm then gets an expedited hearing. MAS gives a hearing in the ordinary case, and a licensee has 30 days to appeal a suspension or revocation in writing to the Minister, whose decision is final.

Dubai‘s VARA can suspend all or part of a license on any refusal ground, for a material breach, for good cause, on insolvency, or for an unpaid judgment. A suspended VASP also needs VARA’s prior approval to restart even after the suspension period ends, unless the notice provides for automatic resumption.

The US has no federal crypto license to suspend. A crypto firm registered as a broker-dealer faces Exchange Act section 15(b)(4), under which the SEC can censure, limit, suspend for up to twelve months or revoke the registration. Section 15(b)(5) allows suspension while revocation is pending. State licensing sits on top, through state money transmitter licenses, New York’s BitLicense and California’s DFAL.

Suspension cases from VARA, Japan’s FSA and AUSTRAC

The longest episode among these cases came in Dubai. BitOasis held an MVP operational license from VARA, which issued two market alerts on supervisory controls against the exchange on 10 July 2023. VARA suspended the license and declared BitOasis non-operational for failing key mandatory conditions. The firm could wind down existing positions and process withdrawals, and could neither serve customers nor onboard new ones. VARA lifted the suspension on 12 April 2024 after remedial work, nine months after the alerts, and BitOasis returned with permission to offer broker-dealer services.

Japan used a narrower order on CoinBest. On 14 June 2024 the Kanto Local Finance Bureau suspended only the exchange’s IEO business, the sale of tokens on behalf of issuers, until 13 December 2024. It also issued a business improvement order across the company and left the rest of the exchange business running. The inspection found a board that never deliberated on entering IEO business, no internal audit under company rules since December 2020, and an empty AML officer post. CoinBest had also filed an IEO review application naming a former officer as the executive in charge.

The FTX Japan orders of 10 November 2022 were built around getting customers out. The Kanto bureau suspended the exchange business until 9 December 2022 and carved out custody of customer assets and settlements it approved case by case. The suspension could end early once the company could promptly return customers’ cash and crypto. The bureau also issued an asset retention order under the Financial Instruments and Exchange Act, requiring FTX Japan to keep assets in Japan.

In October 2025 AUSTRAC accepted an enforceable undertaking from the operator over late threshold transaction reporting and weak risk assessments, and issued an A$56,340 infringement notice that Cryptolink paid. Ten months later the reports and the information response were still missing, and AUSTRAC moved to suspension. Its register of virtual asset registration actions lists two other suspensions in 2026, Worldwide Money Transfer on 12 August and Aquarius Age Solutions on 7 April, beside a run of cancellations.

Buy bitcoin and stocks. Signup to Coinbase today

In September 2026 AUSTRAC said it had canceled, suspended or refused to renew 45 registrations across remittance and VASP businesses over the previous year. It cited firms that lacked the capacity to trade, sat dormant, went insolvent, held the wrong registration, failed to report significant changes or posed serious illicit finance risk.

Revocations, surrenders and forced exits

MAS licensed Bsquared Technology as a major payment institution for digital payment token services on 1 January 2025 and revoked that license with effect from 14 May 2026. A 2025 onsite inspection found weak risk management and conflict-of-interest policies, and related-entity outsourcing that fell short of MAS guidelines. Bsquared had also given MAS false or misleading information in material particulars on multiple occasions, starting with its application. The firm told MAS it held no outstanding customer money or assets, and it still has to file an auditor’s closure certificate while MAS reviews its key officers.

The same Act produced a second revocation in September. Sir Money Changer, a major payment institution whose announcement mentions no crypto business, let a third party run a cross-border money transfer business under its nameand gave MAS false or misleading information. MAS made the revocation effective on 15 September 2026 and announced it on 14 October. Both Singapore revocations cite false or misleading information given to MAS alongside the underlying conduct.

New York reached the same end through a settlement. In January 2024 DFS fined Genesis Global Trading $8 million over BSA/AML and cybersecurity failures, and the firm surrendered its BitLicense. The consent order gives that surrender the same force and effect as a revocation after a hearing, and it keeps the firm’s earlier lookback obligation alive. DFS found a transaction monitoring system that was never validated, alerts closed as low risk without review, and a BSA/AML officer appointed informally by email.

Binance Australia Derivatives took a similar route with its AFS license in 2023. ASIC had reviewed how the firm classified retail and wholesale clients and issued a notice of hearing on 29 March to consider canceling or suspending the license. Binance asked for cancellation, and ASIC granted it on 6 April, eight days after the hearing notice. Clients had until 21 April to close their derivative positions before Binance closed the rest.

California shows the exit without any license to revoke. In a settlement resolving its September 2025 enforcement order, DFPI required Hermes Bitcoin to shut all 42 of its Southern California kiosks by 20 May 2026. The settlement also bars it from any digital financial asset business in the state. The violations ran from cash deposits above the $1,000 daily limit and excessive fees to missing disclosures and receipts, and a BSA/AML program that failed to collect and verify basic customer identification. DFAL’s licensing requirement began on 1 July 2026, weeks after the shutdown. DFPI reached the exit through DFAL’s conduct rules and the California Consumer Financial Protection Law.

Customer assets during suspension and withdrawal

The terms of a suspension order decide whether customers can leave. BitOasis could still process withdrawals. FTX Japan’s order carved out custody and tied an early end to its ability to return assets. An order that freezes withdrawals along with trading turns a compliance event into a run with the doors shut.

MiCA writes the exit into the authorization. Article 64 requires every CASP to maintain procedures for the timely and orderly transfer of client crypto-assets and funds to another CASP if its authorization is withdrawn. Article 94 lets the authority require existing contracts to move to another provider when the clients and the receiving CASP agree.

New York’s September 2025 custody guidance approaches the same moment from the insolvency side. DFS expects custodians to segregate customer virtual currency from corporate assets on-chain and on internal ledgers, with records that show each customer’s interest at all times. Beneficial interest stays with the customer, and custodians keep customer assets out of their own use. A new sub-custody arrangement now counts as a material change that needs DFS approval before it starts.

The future of finance is here. Trade crypto and more

Segregated custody decides whether a suspended firm can hand assets back on a regulator’s timetable or ends up arguing with creditors over who owns them. Singapore adds a contractual floor. A suspension or revocation under the Payment Services Act leaves existing agreements, rights and liabilities intact, so customers keep their claims while the business stops.

Preparing for a suspension notice

The cases above point to a short list of work that is cheaper before a notice arrives.

• Map every service to the permission it relies on, entity by entity. CoinBest’s IEO-only suspension and MiCA’s service-level withdrawal both depend on that map existing.
• Know each clock in advance. Suspensions run up to 30 working days per occasion under MiCA, three months plus one extension at AUSTRAC and six months in Japan. On procedure, the FCA allows at least 28 days for representations, a Singapore appeal to the Minister has a 30-day deadline, and New York gives ten days’ notice of a hearing.
• Treat information requests and regulatory filings as licensing events. Cryptolink’s suspension followed missing reports and an unanswered request, and Bsquared, Sir Money Changer and CoinBest all gave their regulators inaccurate information, which feeds straight into any fit and proper assessment.
• Decide which functions must survive a suspension, usually withdrawals, custody and the settlement of open positions, and have the evidence ready to ask for those carve-outs.
• Budget for the restart. VARA requires approval before a suspended VASP resumes, and an FCA decision keeps running during an appeal unless the Upper Tribunal suspends it.

Open questions under MiCA, the FCA regime and DFAL

MiCA withdrawals go into ESMA’s CASP register, and the procedure behind each one runs under the home state’s administrative law. Firms with several EU entities should expect notice periods, hearing rights and appeal routes to differ between their home authorities.

The MLR registration regime stays in place until the FSMA cryptoasset regime, which the FCA expects to come into force on 25 October 2027. The FCA had opened applications for authorization under the new regime by 30 September 2026. Until commencement, regulation 60 governs suspension and cancellation for registered cryptoasset firms.

DFAL licenses now exist, and section 3405 lets DFPI act against a licensee before a hearing when circumstances require it. Hermes predates licensing, so the first suspension of an issued DFAL license will show how DFPI uses that power against a firm it has already approved.