Crypto Exchange License

The US has no single federal crypto exchange license. Instead, exchanges must stack multiple authorizations:

FinCEN MSB registration. Any firm that transmits value on behalf of customers is a money services business (MSB) under the Bank Secrecy Act. FinCEN registration is mandatory and non-negotiable. The legal definition of a Money Services Business sits in 31 CFR 1010.100(ff), while the initial registration requirement and 180-day post-establishment deadline are governed by 31 CFR 1022.380(a)(2). Registration is an administrative filing, not a discretionary regulatory approval, and must be completed prior to offering MSB services.

State money transmitter licenses. Forty-nine states require a money transmitter license (MTL) for firms that move customer value. Montana is the exception. Each state has its own application, capital requirement, and surety bond. Full 50-state coverage takes 12 to 24 months. Most exchanges start with 3 to 5 key states, such as New York, California, Texas, Florida, and Illinois.

New York BitLicense. New York’s Department of Financial Services (NYDFS) runs a separate virtual-currency license under 23 NYCRR 200. It is the most expensive US state license: application fees, ongoing capital requirements, and a surety bond set on a case-by-case basis by NYDFS (pursuant to 23 NYCRR § 200.8 based on volume and risk profile) apply. Processing takes 12 to 24 months. Many exchanges skip New York entirely rather than absorb the cost.

SEC and CFTC jurisdiction. If your exchange lists tokens that qualify as securities, you need broker-dealer or ATS registration with the SEC. If you offer derivatives or list commodity tokens such as Bitcoin, the CFTC has jurisdiction. The SEC’s position is determined token by token. The CFTC has stated that Bitcoin is a commodity under the Commodity Exchange Act. Spot exchanges face one regulatory path. Derivatives platforms face another. Most US exchanges separate the two and license each activity independently.

The US is the hardest market to enter. It is also the largest. A phased approach (start in 3 to 5 states, expand as compliance scales) is standard.

The EU now operates under a single framework: Markets in Crypto-Assets (MiCA, Regulation (EU) 2023/1114). If your exchange provides crypto-asset services to EU clients, you need authorization as a crypto-asset service provider (CASP).

MiCA defines ten crypto-asset services. For an exchange, three matter most:

• Operating a trading platform (Article 3(1)(16)(b)) - running the matching engine. This is the highest capital tier (Class 3, EUR 150,000). Only 21 of 331 licensed CASPs hold this authorization.
• Exchanging crypto-assets for funds or other crypto-assets (Article 3(1)(16)(c) and (d)) - dealing at your own prices using proprietary capital. Most broker and on-ramp apps hold this service.
• Executing orders on behalf of clients (Article 3(1)(16)(e)) - placing trades on a client’s behalf through someone else’s platform. Requires less capital than operating the platform itself.

Derivatives are a separate story. MiCA does not cover derivatives on crypto-assets. If your exchange offers futures, options, or leveraged products, MiFID II applies instead. You need authorization as an investment firm, not just a CASP.

How authorization works. Your home national competent authority (NCA) authorizes you. Once authorized, you passport to all 30 EEA states through a notification procedure (Article 60). Under Article 63 of Regulation (EU) 2023/1114 (MiCA), the National Competent Authority (NCA) has 25 working days to assess application completeness, followed by 40 working days from the completeness confirmation date to issue a decision.

Capital requirements. CASP authorization tiers capital by service class:

• Class 1 (advice, placement, transmission): EUR 50,000
• Class 2 (exchange, execution, custody, transfers): EUR 125,000
• Class 3 (trading platform operation): EUR 150,000

Most crypto exchanges need a MiCA license Class 2 or Class 3.

The transitional phase has concluded. While Article 143(3) allowed Member States to grant grandfathering windows up to 18 months (ending 1 July 2026), several jurisdictions implemented shorter transitional periods. 

Operating as a crypto-asset service provider in the EU without CASP authorization is now a breach of EU law across all Member States. Operating as a crypto-asset service provider in the EU without CASP authorization is now a breach of EU law.

For a full breakdown of CASP authorization classes and the transition, see our MiCA license guide.

The UK does not have a dedicated crypto exchange license. Instead, exchanges must register with the Financial Conduct Authority (FCA) under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017).

The FCA registration covers AML and counter-terrorist financing (CTF) compliance. It is not a full prudential license. The FCA assesses your AML program, governance, controls, and fit-and-proper requirements for directors and beneficial owners.

The broader crypto regime arrives on 25 October 2027. The UK government is finalizing rules that will bring crypto exchanges, custodians, and certain crypto-asset activities under a regulated activities framework. Until that date, FCA MLR registration is the required entry point.

The FCA assigns a case officer to assess the application. Once the FCA has all the information it needs, it has 3 months to reach a decision. In practice, the full process typically takes 12 to 18 months.

In Singapore, a crypto exchange providing digital payment token (DPT) services needs a license from the Monetary Authority of Singapore (MAS) under the Payment Services Act 2019 (PSA).

Two license tiers exist:

• Standard Payment Institution (SPI): for firms with monthly transaction volume below SGD 3 million in any single payment service, or below SGD 6 million for two or more payment services, and with average daily e-money float below SGD 5 million
• Major Payment Institution (MPI): for firms exceeding the SPI thresholds

Most crypto exchanges exceed the SPI thresholds and apply for an MPI license.

Key requirements under the PSA include:

• AML/CFT compliance program
• Safeguarding of customer assets (custody services)
• Risk management frameworks
• Technology risk management

The PSA was amended in April 2024 (Amendment Act 2021). The changes widened the definition of regulated DPT activities and added stricter requirements for crypto custody. Our Payment Services Act guide covers the full regime.

The UAE offers two licensing routes for crypto exchanges:

Dubai: Virtual Assets Regulatory Authority (VARA). VARA regulates virtual asset service providers in Dubai (excluding the DIFC). It issues four license categories depending on the activity: advisory, brokerage, custody and settlement, and exchange operations. Each license carries specific capital, governance, and compliance requirements. VARA requires KYC/AML compliance, cybersecurity standards, and audited financial statements.

Abu Dhabi: Financial Services Regulatory Authority (FSRA) under ADGM. The Abu Dhabi Global Market (ADGM) is a financial free zone with its own regulator, the FSRA. Crypto exchanges operating within ADGM apply for a Financial Services Permission covering “dealing in investments” or “accepting and custody of assets” depending on the business model. Capital requirements and compliance standards are rigorous and align with international best practices.

Both regulators accept applications from foreign-incorporated entities, but both require local substance: a registered office and compliance personnel within the UAE.

Hong Kong requires mandatory licensing for all centralized crypto exchanges operating in the jurisdiction. Since 1 June 2023, the Securities and Futures Commission (SFC) requires every centralized virtual asset trading platform carrying on business in Hong Kong or actively marketing to Hong Kong investors to hold an SFC license.

The license depends on your model:

• Platforms trading security tokens need Type 1 (dealing in securities) and Type 7 (providing automated trading services) licenses under the Securities and Futures Ordinance (SFO)
• Platforms trading non-security tokens need a VA service license under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO)
• Platforms offering derivatives or leveraged products need a Type 2 (dealing in futures contracts) license under the SFO

The SFC encourages dual licensing under both regimes. Exchanges that only list non-security tokens (such as Bitcoin and Ethereum) may qualify for a VA service license under AMLO. Stablecoin-related activities face additional requirements once Hong Kong’s stablecoin regime takes effect.

The SFC requires minimum capital, segregation of client assets, cybersecurity controls, and AML/KYC procedures.