Crypto Licences by Jurisdiction: A Map of Twelve Regimes

The Token Leg Is Always a Separate Permission

Almost every regime in the world now splits a crypto business into two permissions. The fiat leg — holding customer balances, moving money, issuing an IBAN or a card — sits in the payment perimeter and is compared, across seventeen regimes and eight axes, in the map of financial licences by jurisdiction. The token leg is a second authorisation with its own regulator, its own capital, its own custody rules and, in four jurisdictions, its own statute. Nothing about holding a payment licence in a country tells you whether you may run an order book, hold client keys or sell to a retail customer there.

This page compares the token leg: twelve regimes on twelve axes, from the European CASP to the Korean two-layer regime, with the entry conditions in one table and the operating conditions in the next.

Four Exclusions That Cut the List Before Capital Does

Capital is the last question, not the first. Four conditions remove most of the map before a budget is written.

Does the product need retail. A platform admitting retail clients in Hong Kong may only list a token issued at least twelve months earlier and included in a minimum of two acceptable indices from two different index providers — paragraphs 7.6(c) and 7.8 of the SFC's Guidelines for VATP operators. In New York the menu is an eight-coin Greenlist. Both constraints bind the product, not the balance sheet.

Does it need a passport. Exactly one regime on this map travels: a MiCA CASP authorisation in any EEA state reaches the other twenty-nine by notification. Everything else is territorial, and Dubai is territorial twice over — a VARA licence does not reach the DIFC, which has its own regulator.

Does fiduciary status matter. A custodian serving trusts, estates or a US "qualified custodian" requirement cannot do it under a New York BitLicense: 23 NYCRR 200.3(d) bars a BitLicensee from exercising fiduciary powers, and the route is a trust charter instead — the fork is set out in the note on BitLicense and the New York trust charter.

Is the regulator issuing at all. Singapore's DTSP licence for outbound token services exists, and MAS says in terms that it has set the bar high and will generally not issue one; the regime and its four routes are unpacked in the analysis of Singapore's DTSP perimeter. A statute is not an invitation.

The Matrix: Twelve Crypto Regimes on Twelve Axes

Twelve axes plus an identifier do not fit one readable row, so the grid runs as two tables over the same twelve regimes — what it takes to get in, then what the licence does once it exists.

What the licence does once it exists is the other half of the grid, and it is where the regimes diverge most.

What the Grid Actually Decides

Capital is the weakest signal on the page. Four of the twelve regimes publish no headline figure at all — the BitLicense leaves it to the superintendent under 200.8, the UK has not yet set one, Japan asks for ¥10M of stated capital and nothing more, and Korea replaces capital with an insurance floor. Where a figure does exist it is often the smallest number in the project: AED 100,000 buys a VARA advisory licence and US$10,000 a DFSA Category 4 base, and neither pays for the compliance function, the custody stack or the bank that has to agree to hold the fiat. Published capital measures the regulator's minimum tolerance for a shell, not the cost of a business.

The figures that move a budget are the recurring ones. The AIFC prices its digital asset trading facility openly: US$98,000 to be authorised and US$30,000 a year in fixed supervision fees plus a variable quarterly component, against a US$200,000 capital floor. Hong Kong charges HK$4,740 per service type at the door and then requires twelve months of operating expenses in liquid non-crypto assets — for a platform with a HK$40M annual cost base, eight times the HK$5M of paid-up capital. New York's $5,000 filing fee is noise next to an FSL §206 assessment invoiced five times a year.

Timelines are published almost nowhere. The European CASP regime is the only one on the grid with a statutory clock — 25 working days for completeness and 40 to decide under article 63 — and even there the practical calendar is longer because most competent authorities expect a pre-application meeting, as the guide to the MiCA CASP licence sets out. New York's 90 days under 200.6 run from an application the superintendent deems complete, which makes package quality the only variable an applicant controls. Dubai, Abu Dhabi, the DIFC, Hong Kong, Singapore, Switzerland, Kazakhstan, Japan and Korea publish no target at all. The single hard date on the map belongs to a regime that does not yet exist: the FCA's gateway opens on 30 September 2026, the window closes on 28 February 2027, and the regime commences on 25 October 2027.

Custody is the axis that separates a real licence from a label, and the regimes fall into four groups. Two of them put client assets into a statutory or trust structure: Japan requires users' money in a money trust with a trust company under article 26(1) of the Cabinet Office Order, and Korea requires customer money with a bank as custodian plus 80% or more of customers' virtual assets in cold wallets, on the FSC's own figures. Two write segregation into conduct rules without a percentage: MiCA makes the CASP liable for loss and requires client assets to be separately identifiable, and New York's guidance of 30 September 2025 demands on-chain and ledger segregation, client-name wallets or an F/B/O omnibus, and prior DFS approval for sub-custody. Two push custody outside the licensed entity: Hong Kong holds client assets through an associated entity, and VARA's paid-up capital rule cuts a broker-dealer's floor from AED 600,000 to AED 400,000 when an approved custody provider is used. And one is explicit that nothing is protected at all — the Swiss article 1b licence states that on bankruptcy client assets are neither privileged nor covered by depositor protection, and that clients must be told.

One regime has moved in the opposite direction from all the others. Since 12 January 2026 the DFSA no longer publishes a list of Recognised Crypto Tokens: each firm must decide, on a reasoned and documented basis, whether a token meets the suitability criteria across five heads — its characteristics, its regulatory status elsewhere, market size and liquidity, the underlying technology, and the compliance impact. That is the inverse of New York's Greenlist and of Hong Kong's index test, and it shifts the listing decision from the regulator's file to the firm's own board minutes.

Two axes decide the shape of the company rather than the price. Territory is absolute outside the EEA, and the four Gulf and Asian centres compound it: a firm that wants Dubai and the DIFC needs two licences from two regulators, and a firm that wants Abu Dhabi needs a third. The travel rule then splits the same business across three incompatible thresholds — zero in the EU and Switzerland, roughly a thousand across Asia, USD 3,000 in the United States, with Korea joining the zero camp on 20 February 2027 and the UK running a hybrid at £800. One compliance stack has to carry all of them; the field-level consequences are set out in the analysis of the travel rule.

Choosing by Product

The licence follows the product, and five products cover most of the practical range. The pattern that repeats is that the heaviest regimes are the ones where the platform both matches orders and holds the keys.

Cost and Horizon on One Set of Numbers

Take an exchange with a HK$40M — roughly €4.6M — annual cost base that wants retail clients and two markets. In the EEA the entry is a class 3 CASP at €150,000 of capital plus a quarter of the previous year's fixed overheads from year two, one authorisation covering thirty states, and an article 63 clock of 25 plus 40 working days that the pre-application stage stretches well past a quarter. In Hong Kong the same business needs HK$5M of paid-up capital, HK$3M of liquid capital, and HK$40M — twelve months of operating expenses — in liquid assets that may not be virtual assets, for one market and with retail limited to tokens with a twelve-month history in two indices. The capital gap is €150,000 against roughly €5.5M of tied-up value, and the territorial gap is thirty states against one.

Now move the keys out of the business. A broker-dealer model in Dubai using an approved custody provider sits at AED 400,000 — about €100,000 — instead of AED 600,000, and an exchange at AED 800,000 instead of AED 1.5M. The same logic runs through MiCA, where class 1 at €50,000 becomes class 2 at €125,000 the moment custody is added, and through Hong Kong, where custody sits with an associated entity by design. The cheapest crypto licence in every regime is the one where someone else holds the private keys — and the price of that saving is a custodian in the critical path of the product.

Where the Choice Goes Wrong

Four mistakes recur, and each of them is a category error rather than a bad estimate.

Treating one licence as covering both legs is the most expensive. A CASP does not give the right to hold customer fiat; a payment licence does not give the right to run an order book. The European answer is an EMI paired with a CASP under one regulator, which is why the Luxembourg pattern exists; Hong Kong splits it between an MSO and a VATP, and Singapore keeps the DPT service inside a payment licence while pushing outbound token services into a separate statute.

Reading a capital figure as a budget is the second. AED 100,000, US$10,000 and ¥10M are floors for a corporate shell. The numbers that matter are Kazakhstan's US$30,000 a year, Hong Kong's twelve months of operating expenses in liquid non-crypto assets, and New York's standing assessment.

Assuming a statute means a licence is available is the third, and Singapore is the clearest case: the DTSP regime is real, in force since 30 June 2025, with no transition period, and MAS says it will generally not grant one. The published outcome so far includes a revocation.

Treating the Gulf as one jurisdiction is the fourth. VARA, the FSRA and the DFSA are three regulators with three rulebooks, three capital structures and no mutual recognition, and the five doors of the UAE are laid out separately in the UAE licence map; the AIFC in Kazakhstan is a fourth free-zone regime that competes with all of them on published price, as the note on Kazakhstan's crypto licences shows.