The Legal Stakes for Crypto Market Makers
A crypto market maker (a firm that continuously quotes bid and ask prices on digital-asset venues to provide liquidity) sits at the intersection of trading, custody and payment flows – and that intersection is exactly where regulators look first. Operating without the right authorisations exposes a market maker to enforcement action, frozen banking rails and, in the worst cases, criminal referral. The legal question is not whether to engage with regulation; it is which regimes apply, in which sequence, and how to structure the business so that the answer does not change every quarter.
Legal counsel for crypto market makers covers a defined lifecycle: entity formation, VASP registration (virtual asset service provider registration) or full regulatory authorisation, banking access, ongoing AML/CFT compliance, the Travel Rule (the obligation to pass originator and beneficiary data with each qualifying transfer), and – when something goes wrong – disputes and asset recovery. Each layer carries its own timing risk. A market maker that moves fast on product but slow on licensing requirements will find that exchanges delist it, banks exit, and regulators investigate simultaneously.
This page maps every legal stage of the market-maker lifecycle, identifies where the exposure bites, and explains how OBOLUS structures the counsel engagement to match.
How Are Crypto Market Makers Regulated?
Crypto market makers are regulated differently across jurisdictions, but the pattern is consistent: where the activity amounts to operating a trading facility, dealing on own account or providing a custodial service, a licence or registration is required. No major financial hub now treats market-making activity as outside the regulatory perimeter.
Under MiCA (the EU's Markets in Crypto-Assets Regulation), a firm dealing in crypto-assets on own account as part of a continuous market-making strategy falls within the CASP authorisation (Crypto-Asset Service Provider) regime administered by ESMA and national competent authorities. The CASP framework requires authorisation in the member state of establishment before activity commences; the passport then covers the full EU and EEA. Passporting is available to a CASP authorised in one member state across the entire EU – a structural advantage for firms choosing a gateway jurisdiction such as Malta or Lithuania.
In Dubai, VARA (the Virtual Assets Regulatory Authority) issues activity-based licences covering broker-dealer, exchange and asset management activities. A market maker operating on or through a Dubai-based venue will typically need to assess which VARA activity licence its model triggers. The VARA regime applies to mainland Dubai; the DIFC financial free zone operates its own separate regulatory environment.
In Singapore, the MAS (Monetary Authority of Singapore) supervises digital payment token services under the Payment Services Act. A market maker dealing in digital payment tokens as principal may require a major payment institution licence depending on transaction volumes and balance-sheet footprint. The Hong Kong SFC (Securities and Futures Commission) likewise applies its VATP licensing regime to firms operating on or providing liquidity to licensed virtual-asset trading platforms.
For market makers with US-facing activity, the SEC, CFTC and FinCEN all assert jurisdiction depending on the token classification and the nature of the market-making function. State money-transmitter licensing adds another layer. The NYDFS BitLicense applies to any firm engaging in virtual currency business activity involving New York residents.
In our cross-border practice, we regularly see market makers underestimate how many regimes are simultaneously triggered. The entity sits in one jurisdiction; the venues it quotes on are in three others; the stablecoin settlement leg touches a fourth. Each of those connection points carries its own licensing requirements.
Operating without the right licence risks enforcement, frozen rails and lost banking. That is not a theoretical concern. We have seen exchanges delist market-making counterparties mid-quarter because their AML registration lapsed. The reputational and commercial cost far exceeded the cost of timely counsel.
To map your regulatory perimeter before activity begins, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the venues, the settlement currency, the client base – change the analysis materially. Map your options
Entity Formation and Structural Design for Market Makers
The entity structure a market maker chooses at formation determines the licence path, the banking options and the tax profile for the life of the business. That decision is harder to unwind than most founders expect.
Most institutional market makers operate through a layered structure: a holding entity in a stable, treaty-rich jurisdiction; one or more operating entities in the jurisdictions where trading activity occurs; and, where relevant, a separate custody or payment entity. The holding layer provides capital efficiency and investor familiarity. The operating layer carries the licence and interacts with exchanges and counterparties. The custody layer – where maintained separately – holds client or proprietary assets under a regime that provides both regulatory comfort and legal protection in insolvency.
The BVI and Cayman Islands remain common for holding-layer formation, given their established fund and corporate law regimes under the BVI FSC and CIMA respectively. The VASP Act frameworks in both jurisdictions provide a registration pathway for firms that need a regulated entity at the holding layer. For EU-facing operations, a Malta MFSA-regulated or Lithuania Bank of Lithuania-registered entity provides the CASP authorisation and the MiCA passport. For Gulf operations, a VARA-licensed mainland Dubai entity or an ADGM/FSRA entity in Abu Dhabi provides the access point.
A common structural mistake is forming the operating entity first and the holding entity later – once investors are involved. Restructuring around an existing licence is costly and, in some regimes, requires a fresh application. We recommend designing the full structural map before the first entity is incorporated.
Which Licence Does a Crypto Market Maker Actually Need?
The answer turns on what the market maker does, not what it calls itself. Regulators across MiCA, VARA, MAS and the SFC all apply a substance-over-label test: the rights and obligations created by the activity determine the licence category, not the firm's marketing description.
A market maker that quotes prices on a third-party venue and settles bilaterally – without holding client assets – has a narrower regulatory footprint than one that also operates a custody account, provides financing, or issues its own stablecoin for settlement. The distinction matters because each additional function can trigger a separate licence category.
The key activity categories to analyse are:
- Dealing on own account in crypto-assets (the core market-making function).
- Operating or participating in a multilateral or bilateral trading facility.
- Providing custody or safekeeping of client assets.
- Issuing or managing stablecoins or other crypto-assets used for settlement.
- Providing payment or money-transmission services in connection with settlement flows.
Under MiCA, each of these maps to a defined CASP activity. Under VARA, each maps to an activity-based licence type. Under the MAS Payment Services Act, the payment and custody functions each have their own licence track. A market maker routinely triggers two or three categories simultaneously.
In our licensing practice, we map every activity the firm performs – current and planned – against the regime matrix before advising on jurisdiction selection. The most expensive licensing mistake is choosing a jurisdiction first and discovering only later that its regime does not accommodate the intended activity model.
What Does the Licence Application Process Look Like?
The licence application process for a crypto market maker follows a predictable structure across the major regimes, even though timelines vary significantly by jurisdiction and licence category.
The core stages are: (1) pre-application engagement with the regulator or a formal pre-application meeting; (2) preparation of the application pack, including the business plan, AML/CFT programme, governance documentation and fit-and-proper materials for controllers and senior managers; (3) submission and the regulator's completeness review; (4) substantive review, including possible requests for information; and (5) determination and, where successful, licence conditions.
Timelines in the major hubs vary – from a matter of weeks for registration-track regimes to many months for full authorisation – and depend heavily on application quality and the complexity of the business model. Applications that arrive incomplete, or that describe a business model the regime does not cleanly accommodate, routinely take far longer than the stated statutory clock. We have seen market-maker applications where a single structural ambiguity – an unclear custody flow, an undisclosed beneficial owner – added months to the process.
The cross-border dimension matters here as well. If the market maker needs licences in multiple jurisdictions simultaneously – for example, a VARA licence in Dubai alongside a CASP authorisation in an EU member state – the sequencing of applications affects the timeline materially. Filing concurrently is sometimes appropriate; filing sequentially, using the first approval as a credibility anchor for the second, is often more efficient.
If a prior application stalled or a banking relationship closed, a structural review can identify the underlying cause and map the route forward. Contact OBOLUS at info@oboluslaw.com or message us at t.me/oboluslaw. Map your options
AML, the Travel Rule and Ongoing Compliance Obligations
Ongoing compliance for a licensed crypto market maker is a continuing operational cost, not a one-time project. Regulators across every major hub apply FATF Recommendation 15 standards to virtual asset service providers, which means AML/CFT programmes must be living documents reviewed against updated guidance.
The Travel Rule – the obligation under FATF guidance to transmit originator and beneficiary information alongside qualifying virtual asset transfers – applies to market makers in most licensed jurisdictions. The threshold above which the Travel Rule applies, and the technical standards for transmission, vary by jurisdiction and are subject to ongoing regulatory development. The practical burden is significant: a market maker settling hundreds or thousands of transfers daily must have automated Travel Rule compliance infrastructure in place at the point of licensing, not retrofitted after authorisation.
Beyond the Travel Rule, a licensed market maker must maintain: a customer due diligence programme for counterparties that are not themselves licensed VASPs; transaction monitoring calibrated to the market-making activity pattern (which looks different from retail flows); sanctions screening against OFAC and applicable domestic designations; and a suspicious activity reporting function. The MFSA, VARA, MAS and Bank of Lithuania all conduct periodic supervisory reviews of these programmes.
A point we raise consistently with market makers we advise: AML programme failures are the most common cause of enforcement action against licensed crypto firms. A technically sound licence application that is followed by a weak compliance programme creates the worst outcome – the firm bears the cost of authorisation and then loses it.
How Do Licensed Market Makers Access Banking and Settlement Infrastructure?
Banking access is, in our experience, the most consistently underestimated challenge for licensed crypto market makers. Obtaining a licence does not guarantee a bank account. Many market makers emerge from the authorisation process and discover that traditional correspondent banking relationships remain difficult to establish, regardless of regulatory status.
The practical banking strategy for a market maker has three components. First, select a jurisdiction for the operating entity that has a developed crypto-friendly banking environment – jurisdictions where licensed VASPs have established relationships with local banks. Malta, Lithuania, the DIFC ecosystem and the Singapore fintech community have more developed banking access for licensed crypto firms than many alternative hubs. The specific availability of correspondent banking access in Malta, for example, reflects the MFSA's developed VASP framework and the presence of established payment institutions in that market.
Second, structure settlement to reduce traditional banking dependency where possible. Stablecoin settlement on licensed platforms reduces the volume of fiat flows that require correspondent banking infrastructure, though it introduces its own regulatory considerations under MiCA's ART and EMT frameworks.
Third, maintain account relationships across multiple institutions and jurisdictions. A market maker that relies on a single banking relationship for fiat settlement is one account closure away from an operational halt. Diversification is a compliance function, not just a treasury preference.
In our cross-border practice, we work through allied counsel in the relevant jurisdiction to map banking options for each operating entity before the entity is incorporated. The banking reality in a given jurisdiction is often a better guide to entity placement than the headline licence cost.
Disputes and Asset Recovery for Market Makers
Market makers face a distinctive disputes profile. Exchange-level disputes – over margin calls, settlement failures or account freezes – can move from contract dispute to frozen assets within hours. On-chain asset recovery adds a further layer: when proprietary assets are misappropriated, the recovery window is measured in hours, not days.
In a recent recovery matter, a market-making firm discovered that proprietary stablecoin balances had been misappropriated through a compromised API key. We engaged allied counsel in a leading common-law forum and secured a worldwide freezing order (an injunction freezing assets across all jurisdictions) supported by a disclosure order against the exchange holding the counterparty account. The stablecoin issuer was notified in parallel, and a contract-level freeze was applied before the assets could be withdrawn to an unhosted wallet. The matter resolved within the initial recovery window.
For market makers, the key asset recovery levers are: court orders from English & Wales courts or the DIFC Courts for worldwide freezing injunctions; Norwich Pharmacal and Bankers Trust disclosure orders compelling exchanges to identify account holders; and direct engagement with stablecoin issuers – Tether (USDT) and Circle (USDC) both hold contract-level freeze authority, which they generally exercise on foot of a court order or law-enforcement designation. The CFAAR (Crypto Fraud and Asset Recovery network, launched in London in September 2021) provides a further coordination mechanism for cross-border recovery.
Exchange-level disputes – including disputes over unfair liquidations, erroneous margin calls and platform outages causing trading losses – are increasingly brought before the DIFC Courts and Singapore courts, both of which have developed sophisticated digital-asset jurisprudence.
Decision Matrix: Legal Priority by Stage of the Market Maker Lifecycle
The legal priorities for a crypto market maker shift as the business develops. A staged decision matrix prevents firms from spending on counsel at the wrong level for their current position.
Stage A – Pre-launch, entity and structure design. The market maker is forming its first entities and selecting jurisdictions. Priority: structural design (holding layer, operating layer, custody layer separation), jurisdiction selection against the activity model, and early engagement with banking. Indicative instrument: entity formation advice and jurisdiction analysis. Key risk: selecting a jurisdiction that does not accommodate the intended trading model or that lacks viable banking infrastructure for the entity type.
Stage B – Licence application. The market maker is ready to apply for VASP registration or regulatory authorisation. Priority: application preparation, fit-and-proper documentation, AML/CFT programme drafting, and regulator engagement strategy. Key risk: an incomplete application that extends the timeline and draws regulatory attention to structural issues that could have been resolved pre-submission.
Stage C – Licensed and operational. The market maker holds its licence and is trading. Priority: ongoing compliance (AML programme maintenance, Travel Rule implementation, supervisory engagement), banking diversification, and commercial contract review for exchange agreements. Key risk: compliance programme attrition – programmes that were strong at authorisation but are not maintained against evolving regulatory expectations.
Stage D – Scaling or entering a new jurisdiction. The market maker is expanding to a new venue or geography. Priority: new jurisdiction analysis, licence stacking (assessing which additional licences the new activity triggers), and tax structuring review for the expanded group. Key risk: assuming that the existing licence covers the new activity without a fresh regulatory perimeter assessment.
Stage E – Dispute or enforcement. A dispute with an exchange, a counterparty default, or a regulatory inquiry. Priority: immediate engagement with disputes counsel, evidence preservation, and – where assets are at risk – emergency recovery measures. Key risk: delay. Recovery windows for on-chain assets are short.
A Common Assumption About Offshore Licensing
A common assumption among early-stage market makers is that a single offshore registration – in a jurisdiction with a light-touch VASP regime – is sufficient to operate globally. It is not.
The principle that regulators apply is territorial nexus: a regulator asserts jurisdiction over activity that affects its market or its residents, regardless of where the service provider is incorporated. A market maker registered in a low-supervision offshore jurisdiction but quoting prices on exchanges used by EU residents, Singapore residents or US residents simultaneously triggers MiCA, the MAS Payment Services Act and US federal obligations. The offshore registration provides no shelter from those requirements.
The practical implication is that the licence stack for a global market maker is almost always multi-jurisdictional. The question is not whether multiple licences are needed, but which combination is most efficient for the business model, the user base and the banking relationships. We map that combination before the client commits to a structure, not after.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – the full scope of VASP authorisation across major hubs, from application to ongoing supervision.
- Economic Substance for Licensed VASPs and Regulated Entities – substance requirements that apply to licensed entities and how to satisfy them efficiently.
- Correspondent Banking Access in Malta – how licensed crypto firms in Malta approach banking infrastructure and what the MFSA framework enables.
FAQ
How long does a crypto licence take to obtain?
Timeline varies significantly by jurisdiction and licence category. Registration-track regimes in some jurisdictions can be completed in a matter of weeks; full CASP authorisation under MiCA or a VARA activity licence in Dubai typically takes longer, measured in months. Application quality is the single greatest variable within the firm's control. An incomplete or structurally ambiguous application materially extends the timeline in every jurisdiction we work across.
Which jurisdiction is best for licensing my crypto business?
There is no universally optimal jurisdiction. The right choice depends on your activity model, your target user base, your banking requirements and your tax structure. A market maker serving EU venues needs a MiCA-passport-eligible CASP authorisation. One focused on Gulf venues needs VARA or ADGM/FSRA access. The jurisdiction decision is an output of the activity and commercial analysis, not an input. We assess that matrix before recommending a structure.
Do I need a separate custody licence?
In most major regimes, yes – if you hold client assets. Under MiCA, custody of crypto-assets on behalf of clients is a defined CASP activity requiring authorisation. Under VARA, custody is a separately licensed activity. Under the MAS Payment Services Act, safeguarding is its own regulatory category. If your market-making model involves holding counterparty assets even briefly, a custody analysis is required before you begin operations.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than 70 jurisdictions, on disputes and on-chain asset recovery across more than 25 forums, and on the tax, banking and compliance that sit around those activities. We map the licence stack across operating, custody and payment layers before you commit – identifying exposure before it becomes an enforcement event. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing and Jurisdictions Analyst – specialises in multi-jurisdictional VASP authorisation strategy and licence-stack design for trading and market-making businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.