Crypto Licences by Jurisdiction: A Map of Twelve Regimes

Crypto Services Always Need a Separate Permission

Almost every regime in the world now splits a crypto business into two permissions. The payment side — holding customer balances, moving money, issuing an IBAN or a card — sits in the payment perimeter and is compared in the map of financial licences by jurisdiction. Crypto services need a second authorisation with its own regulator, its own capital, its own custody rules and, in four jurisdictions, its own statute. Holding a payment licence in a country says nothing about whether a firm may run an order book, hold client keys or sell to retail customers there.

This page compares the crypto authorisation itself: twelve regimes, from the European CASP to Korea, on entry and operating conditions, followed by the second league of offshore and budget EU regimes, the routes that tend to end badly, and the position of founders with Russian passports. The general logic of choosing a financial licence is set out in the financial licences hub.

Four Exclusions That Cut the List Before Capital Does

Capital is the last question. Four conditions remove most of the map before a budget is written.

Does the product need retail. A platform admitting retail clients in Hong Kong may offer them only a token with at least a twelve-month track record that is included in a minimum of two acceptable indices from two different index providers — paragraphs 7.6(c) and 7.8 of the SFC's Guidelines for VATP operators. Since 3 November 2025 an SFC circular has lifted the twelve-month requirement for professional investors and for stablecoins issued by HKMA-licensed issuers; for other tokens offered to retail it still applies. In New York the menu is set by the DFS Greenlist and a DFS-approved coin-listing policy. Both constraints bind the product, and no balance sheet removes them.

Does it need a passport. Exactly one regime on this map travels: a MiCA CASP authorisation in any EEA state reaches the other twenty-nine by notification. Everything else is territorial, and Dubai is territorial twice over — a VARA licence does not reach the DIFC, which has its own regulator. An offshore licence gives no EU passport either; why serving EU clients "at their own initiative" rarely works is explained in the note on offshore crypto licences.

Does fiduciary status matter. A custodian serving trusts, estates or a US "qualified custodian" requirement cannot do it under a New York BitLicense: 23 NYCRR 200.3(a) bars a BitLicensee from exercising fiduciary powers, and the route is a trust charter instead — the fork is set out in the note on BitLicense and the New York trust charter.

Is the regulator issuing at all. Singapore's DTSP licence for outbound token services exists, and MAS says in terms that it will generally not issue one; the regime is unpacked in the analysis of Singapore's DTSP perimeter. A statute providing for a licence does not make the licence available.

The Matrix: Twelve Crypto Regimes

The grid runs as four tables over the same twelve regimes: regulator, perimeter and capital; timelines and fees; custody, presence and the travel rule; retail access and territory. The first column repeats so that each table can be read on its own.

Entry: Regulator, Perimeter and Capital

Entry: Timelines and Fees

What the licence does once it exists is the other half of the grid, and it is where the regimes diverge most.

Operation: Custody, Presence and the Travel Rule

Operation: Retail Access and Territory

What the Grid Actually Decides

Capital is the weakest signal on the page. Four of the twelve regimes publish no headline figure at all — the BitLicense leaves it to the superintendent under 200.8, the UK has not yet set one, Japan asks for ¥10M of stated capital and nothing more, and Korea replaces capital with an insurance floor. Where a figure does exist it is often the smallest number in the project: AED 100,000 buys a VARA advisory licence and US$30,000 a DFSA Category 4 base, and neither pays for the compliance function, the custody stack or the bank that has to agree to hold the fiat. Published capital measures the regulator's minimum tolerance for an empty company; it does not show what the business costs. How regulators calculate capital, and why the minimum rarely binds, is set out in the note on regulatory capital.

The figures that move a budget are the recurring ones. The AIFC prices its digital asset trading facility openly: US$98,000 to be authorised and US$30,000 a year in fixed supervision fees plus a variable quarterly component, against a US$200,000 capital floor. Hong Kong charges HK$4,740 per service type at the door and then requires twelve months of operating expenses in liquid non-crypto assets — for a platform with a HK$40M annual cost base, eight times the HK$5M of paid-up capital. Dubai publishes its schedule as well: under Schedule 2 of the Virtual Assets and Related Activities Regulations 2023 a VARA licence costs AED 40,000 or AED 100,000 to apply, depending on the activity, and AED 80,000 or AED 200,000 a year in supervision for each licensed activity. How such lines add up to a full cost of holding a licence is set out in the note on licence total cost of ownership.

Inside the EU the tariff is national and not harmonised, and Bulgaria publishes the clearest one. CASPs there are licensed by the Financial Supervision Commission (FSC), which since 07.08.2026 has been the MiCA competent authority for everyone except banks and e-money token issuers. The FSC charges €5,112.92 to €30,677.51 for the licence by class, with priced class change and surrender and an annual fee assembled service by service, as the note on the Bulgarian CASP licence sets out.

Timelines are published almost nowhere. The European CASP regime is the only one on the grid with a statutory clock — 25 working days for completeness and 40 to decide under article 63 — and even there the practical calendar is longer because most competent authorities expect a pre-application meeting, as the guide to the MiCA CASP licence sets out. New York's 90 days under 200.6 run from an application the superintendent deems complete, which makes package quality the only variable an applicant controls; how the package is built is covered in the note on the regulatory business plan. Dubai, Abu Dhabi, the DIFC, Hong Kong, Singapore, Switzerland, Kazakhstan, Japan and Korea publish no target at all. The single hard date on the map belongs to a regime that has not yet commenced: the FCA's gateway has been open since 30 September 2026, the window closes on 28 February 2027, and the regime commences on 25 October 2027.

Custody separates a real licence from a label, and the regimes fall into four groups. Two of them put client assets into a statutory or trust structure and prescribe a cold-storage share. Japan requires users' money in a money trust with a trust company under article 26(1) of the Cabinet Office Order, and under article 27(2) no more than 5% of users' cryptoassets may be held other than offline — at least 95% in cold storage. Korea requires customer money with a bank as custodian plus 80% or more of customers' virtual assets in cold wallets, on the FSC's own figures — stricter than most regimes, softer than Japan.

Two other groups write segregation into conduct rules without a percentage. MiCA makes custodial CASPs liable for loss of crypto-assets or means of access from an incident attributable to them, with liability capped at the lost asset's market value at the time of loss and requires client assets to be separately identifiable, and New York's guidance of 30 September 2025 demands on-chain and ledger segregation, client-name wallets or an F/B/O omnibus, and prior DFS approval for sub-custody. Hong Kong and Dubai push custody outside the licensed entity: Hong Kong holds client assets through an associated entity, and VARA's paid-up capital rule cuts a broker-dealer's floor from AED 600,000 to AED 400,000 when an approved custody provider is used. The Swiss article 1b fintech licence states the limit of protection outright: on bankruptcy client assets are neither privileged nor covered by depositor protection, and clients must be told.

One regime has moved in the opposite direction from all the others. Since 12 January 2026 the DFSA no longer publishes a list of Recognised Crypto Tokens: each firm must decide, on a reasoned and documented basis, whether a token meets the suitability criteria across five heads — its characteristics, its regulatory status elsewhere, market size and liquidity, the underlying technology, and the compliance impact. That is the inverse of New York's Greenlist and of Hong Kong's index test, and it moves the listing decision from the regulator to the firm's own board.

Two features shape the company and barely touch the price. Territory is absolute outside the EEA, and the four Gulf and Asian centres compound it: a firm that wants Dubai and the DIFC needs two licences from two regulators, and a firm that also wants Abu Dhabi needs a third, each with its own licensee substance requirements. The travel rule then splits the same business across incompatible thresholds — zero in the EU and Japan, verification of every external wallet in Switzerland, S$1,500 in Singapore, HK$8,000 in Hong Kong and KRW 1M in Korea, USD 3,000 in the United States, and a UK hybrid at £800. One licensee compliance stack has to carry all of them; the field-level consequences are set out in the analysis of the travel rule.

Choosing by Product

The licence follows the product, and five products cover most of the practical range. The pattern that repeats is that the heaviest regimes are the ones where the platform both matches orders and holds the keys.

Cost and Horizon on One Set of Numbers

Take an exchange with a HK$40M — roughly €4.6M — annual cost base that wants retail clients and two markets. In the EEA the entry is a class 3 CASP: under article 67 of MiCA the requirement is the higher of €150,000 and a quarter of fixed overheads, and in the first year the quarter is taken from the projected overheads in the business plan. If the whole cost base is fixed, the quarter comes to about €1.15M, and that is what binds. In return the firm gets one authorisation covering thirty states and an article 63 clock of 25 plus 40 working days that the pre-application stage stretches well past a quarter.

In Hong Kong the same business needs HK$5M of paid-up capital, HK$3M of liquid capital, and HK$40M — twelve months of operating expenses — in liquid assets that may not be virtual assets, for one market and with retail limited to tokens with a twelve-month history in two indices. The gap in tied-up funds is about €1.15M against more than €5M, and the territorial gap is thirty states against one.

Moving the keys out of the business changes the picture. A broker-dealer model in Dubai using an approved custody provider sits at AED 400,000 — about €100,000 — instead of AED 600,000, and an exchange at AED 800,000 instead of AED 1.5M. The same logic runs through MiCA, where the €50,000 class 1 minimum becomes the €125,000 class 2 minimum the moment custody is added, and through Hong Kong, where custody sits with an associated entity by design. The cheapest crypto licence in every regime is the one where someone else holds the private keys — and the price of that saving is a custodian in the critical path of the product.

The Second League: Offshore Regimes and the Budget EU

Behind the twelve main regimes sit jurisdictions that are asked about more often than they are chosen for a retail exchange. Since 1 April 2025 the Cayman Islands have issued separate licences to virtual asset custodians and trading platforms: phase two of the Virtual Asset (Service Providers) Act was brought into force by a commencement order. Other services — brokerage-style exchange, transfers, token issuance — remain on registration, and the Act sets no fixed minimum capital: CIMA weighs capital when licensing. The Cayman Islands, the BVI, Bermuda and the Seychelles are compared in the note on offshore crypto licences.

An offshore licence does not open EU clients. Without CASP authorisation they can be served only at their own exclusive initiative, and the ESMA guidelines of 17 December 2024 read solicitation broadly — websites, social media, apps, affiliate campaigns and even general brand advertising. The budget route to the EU market therefore runs inside the EU: a small jurisdiction with a published tariff, such as Bulgaria, gives the same passport as the large regulators.

Where the Choice Goes Wrong

Four mistakes recur, and each of them is a category error.

The most expensive is treating one licence as covering both sides of the business. CASP authorisation does not replace payment-services permission; received client fiat is safeguarded under MiCA Article 70. A payment licence does not give the right to run an order book. For a broad service range, an EU option is an EMI paired with a CASP under one regulator; an EMI also has the narrower Article 60(4) notification route for custody and transfer of its own EMTs. This explains the Luxembourg pattern; Hong Kong splits it between an MSO and a VATP, and Singapore keeps the DPT service inside a payment licence while pushing outbound token services into a separate statute. (MiCA Art.60; Art.70).

The second is reading a capital figure as a budget. AED 100,000, US$30,000 and ¥10M are floors for a corporate shell. The numbers that matter are Kazakhstan's US$30,000 a year, Hong Kong's twelve months of operating expenses in liquid non-crypto assets, and the EU's quarter of fixed overheads.

The third is assuming a statute means a licence is available. Singapore is the clearest case: the DTSP regime has been in force since 30 June 2025 with no transition period, and MAS says it will generally not grant one.

The fourth is treating the Gulf as one jurisdiction. VARA, the FSRA and the DFSA are three regulators with three rulebooks, three capital structures and no mutual recognition; the five UAE regimes are laid out in the UAE licence map, and the AIFC in Kazakhstan is a fourth free-zone regime that competes with all of them on published price, as the note on Kazakhstan's crypto licences shows.

Popular Routes That End Badly

Renting someone else's licence. Operating under another firm's licence as an agent or white label looks like a quick entry, but the licensee answers to the regulator while the clients and the business stay with the tenant; how such arrangements end for both sides is set out in the note on licence rental.

Running on an expired transitional period. The MiCA transitional regime for firms holding national VASP registrations ended no later than 1 July 2026 (art. 143(3)). After that date services within MiCA require CASP authorisation or an applicable Article 60 notification by an eligible financial entity, and art. 111 requires Member States to set maximum fines of at least €5M or 5% of turnover for the core infringements. A firm without a lawful basis to continue its services is left with an orderly exit, covered in the note on licence wind-down. (MiCA Art.60).

An offshore registration for an EU client base. Island registration is cheaper, but it does not open EU clients: ESMA reads the own-initiative exemption narrowly and names refusing new EU accounts and geo-blocking as precautions.

Buying a ready-made licensee. A licensed shell saves authorisation time, but a change of control needs the regulator's consent and a review of the new owner; the route is set out in the note on change of control of a licensee.

Founders with Russian Passports

For an applicant with Russian ultimate beneficial owners (UBOs) the map narrows before capital is discussed: eligibility decides, economics comes second.

The European route is closed from two sides. On the client side, article 5b(2) of Council Regulation (EU) 833/2014, as amended by Regulation (EU) 2025/2033, prohibits providing any crypto-asset service within the meaning of MiCA — from wallets and custody to exchange, order execution and transfers — to Russian nationals, natural persons residing in Russia and legal persons established in Russia, with no value threshold. On the owner side, article 5b(2a), as amended by Regulation (EU) 2026/1848, prohibits Russian nationals and residents from directly or indirectly owning, controlling or sitting on the management body of an EU CASP: for wallet, account and custody services since 18 January 2024, and for all other crypto-asset services since 25 August 2026. Article 5b(3) exempts nationals of an EU Member State, an EEA state or Switzerland and holders of a temporary or permanent residence permit there.

Two more provisions close the workarounds. Since 24 May 2026 article 5bb prohibits direct and indirect transactions with CASPs and crypto platforms established in Russia, and article 5bc extends the same prohibition to providers in third countries the Council lists in Annex LVII; as of 24 July 2026 the annex is empty. The result is that a Russian UBO without article 5b(3) status cannot own a licensed EEA CASP, and the licence itself will not open a Russian client base. For an owner who falls within the exemption, MiCA requires a fit-and-proper assessment of controlling persons — the mechanics are set out in the note on qualifying holdings and fit and proper — and national authorities read the owner's sanctions profile as part of it. The wider picture of restrictions is in the sanctions map, and how a file with a Russian passport passes through financial institutions is covered in the note on Russian applicants in investment migration.

The Kazakhstan route remains the most predictable on eligibility and one of the few with a fully published price — VARA publishes a full fee schedule as well. The cost of entry is stated in full — US$98,000 once, US$30,000 of fixed supervision fees a year plus a variable quarterly component, capital of at least US$200,000 — and the governance requirements (CEO, Finance Officer, Compliance Officer, MLRO, CITO, internal and external auditors) mean real local staff. The regime in detail, including the line between the AIFC and the National Bank and Alatau City, is in the note on Kazakhstan's crypto licences.

The UAE route accepts the applicant but moves the bottleneck to banking. VARA, the FSRA and the DFSA assess structures with Russian UBOs under their general rules, and their rulebooks contain no formal bar by the owner's nationality; the practical constraint appears when the licensed company needs an operating account and correspondent relationships. That decision belongs to the bank, under its own risk appetite and sanctions screening, so the usual sequence is to agree banking first and apply for the licence second. How banks view licensees is covered in the notes on banking for payment companies and on correspondent banking and safeguarding; the five UAE regimes are in the UAE licence map.

Inside Russia, Federal Law No. 282-FZ of 4 August 2026 "On Digital Currencies and Digital Rights" has applied since 1 September 2026, and the crypto provisions of Law No. 259-FZ lapsed on the same date. The new law keeps the ban on accepting digital currency as payment for goods, work and services (art. 1(6)) and carves out settlements under foreign-trade contracts between residents and non-residents (art. 1(7)). Mining is regulated by chapter 2 of the same law.

For this map the more important change is domestic licensing. Only a Russian company entered by the Bank of Russia in its register, with own funds of at least RUB 15M, may operate a digital currency exchange (arts. 18, 44 and 52). From 1 July 2027 only a trading organiser, a broker, a trust manager, a digital depositary and an exchange organisation may organise the circulation of digital currencies (art. 1(3), arts. 14–18 and 56), and art. 21 on restricting payments and transfers where circulation is organised unlawfully applies from the same date. The tax side — transactions in digital currency and mining — is governed by Federal Law No. 418-FZ of 29 November 2024; rates by country are compared in the crypto tax map.

The practical conclusion for a Russian founder comes down to three steps. The licence is chosen where eligibility is real — the AIFC or the UAE — and the cheapness of formal capital comes second. The client footprint is planned on the basis that the European market is closed by article 5b wherever the licence sits. From 1 July 2027 the Russian market is open only to entities on the Bank of Russia's registers, so for a foreign licensee the Russian side reduces to foreign-trade settlements and tax. Personal status and reporting are covered in the Russia hub and the overview of relocation from Russia.