Choosing the wrong jurisdiction for a crypto licence (a regulatory authorisation permitting a business to offer digital-asset services to customers) costs operators more than time and filing fees. It costs banking relationships, correspondent access and, in the worst cases, the ability to serve customers at all. The question of how to choose a crypto licensing jurisdiction is therefore a structural business decision, not an administrative formality.
The right jurisdiction depends on four converging factors: where your customers are located, what services you actually offer, where your capital and banking will sit, and how aggressively regulators in your target market will scrutinize a foreign licence. A licence in one hub does not automatically permit you to serve users in another. That is the foundational reality every operator must confront before committing to a regulatory path.
This guide walks through each decision step in sequence, names the common mistake at each stage, and identifies the cross-border pressure points that most frequently cause structuring errors.
Step 1: Map Your Regulated Activities Before You Look at a Map
The first step is identifying precisely which activities your business performs, because regulatory authorisation (a formal licence or registration permitting specified activities) is always activity-specific, not entity-specific. A single platform may simultaneously provide exchange, custody, lending and payment transfer services – each of which may constitute a separately regulated activity in most leading jurisdictions.
Under MiCA (the EU Markets in Crypto-Assets Regulation, administered by ESMA and national competent authorities), the term CASP (crypto-asset service provider) covers a defined list of services, and an applicant must specify the exact services it seeks authorisation for. Similarly, VARA in Dubai issues activity-based licences across advisory, broker-dealer, custody, exchange, lending, management and transfer/settlement functions. Requesting the wrong set of activities either over-scopes your application – inflating capital and compliance requirements – or under-scopes it, leaving you operating unlicensed in a material function.
The common mistake at this step is conflating the product roadmap with the legal activity map. What the marketing deck calls "yield" may be lending for regulatory purposes. What the technical team calls "self-custody onboarding" may involve regulated custody or safeguarding functions depending on whether the business holds keys, co-signs transactions or merely interfaces with a third-party wallet provider.
Cross-border note: If your platform operates across jurisdictions, each jurisdiction's definition of "exchange", "custody" and "transfer" may differ. An activity that sits below the licensing threshold in one hub may be fully regulated in another. Map activities against the destination regime, not your home jurisdiction's definitions.
Step 2: Identify Where Your Customers Are – And Where Regulators Say They Are
The customer's location determines which regulatory regime governs the relationship, regardless of where your entity is incorporated. This is the step where the myth of the single offshore licence is most clearly exposed.
A common assumption is that registering in a low-friction offshore hub is enough to serve a global user base. It is not. The FCA in the United Kingdom, MAS in Singapore, the SFC in Hong Kong and ESMA under MiCA all apply territorial scope rules that reach foreign entities where those entities actively solicit, or are accessible to, users in their jurisdiction. A VASP registration (the registration or licence required of a virtual asset service provider under a given regime) obtained in, say, the British Virgin Islands under the BVI FSC's VASP Act 2022 does not confer permission to serve UK retail clients or EU customers requiring MiCA-authorized services.
The consequence of misjudging territorial scope is not merely regulatory – it is commercial. UK banking counterparties typically require FCA registration before onboarding a crypto business. EU banks expect MiCA authorisation or an equivalent national transitional status. Getting the customer geography wrong at the outset means rebuilding the structure under time pressure and often at greater cost.
The common mistake is treating geo-blocking as a legal substitute for licensing. Blocking an IP address range is a technical control, not a jurisdictional exemption. Regulators evaluate the economic reality of who was served, not the IP log.
Cross-border note: If your business has material user concentrations in more than two jurisdictions, the structuring question is almost always whether to obtain multiple licences, use a MiCA passport across the EU/EEA, or adopt a holding structure with licensed subsidiaries in each target market. Each approach has distinct capital, governance and banking implications.
The process above describes the standard path. Your facts – the entity structure, the user distribution, the banking relationships – change the analysis materially. For a scoped assessment of where your licensing obligations actually arise, contact OBOLUS at info@oboluslaw.com.
Step 3: Assess the Licensing Requirements by Hub Against Your Operational Reality
Once you know your activities and customer geographies, you can evaluate which hubs offer a viable regulatory authorisation path for your specific profile. Viability is not just a function of the filing process – it is a function of capital adequacy, governance requirements, substance expectations and the regulator's current processing posture.
The major licensing hubs each have a distinct profile. MiCA offers EU-wide passporting for a CASP authorised in any member state; Lithuania has historically been used as an EU entry point because of its accessible supervisory process, though MiCA alignment is tightening standards. Malta's MFSA operates the transitioning VFA framework, with the VFA agent concept as a structural feature of the application process. VARA in Dubai requires real operational presence in the emirate and applies detailed rulebooks for each licensed activity. The ADGM-FSRA regime in Abu Dhabi operates on a recognised virtual-assets list concept, with its own capital and governance expectations. MAS in Singapore licenses DPT (digital payment token) service providers under the Payment Services Act across three institution tiers. The SFC in Hong Kong operates the VATP (virtual-asset trading platform) licensing regime with demanding capital and vetting requirements.
The common mistake at this step is optimizing purely for speed or cost of authorisation, while underweighting the banking dimension. A licence obtained in a jurisdiction where no major bank will open a corporate account for a crypto business – or where correspondent banks routinely decline – produces a licensed entity that cannot operate commercially. The licensing requirements and the banking environment must be assessed together.
Cross-border note: FINMA in Switzerland, the FCA in the UK and AUSTRAC in Australia each have different relationships with their domestic banking sectors. The practical ability of a newly licensed entity to access payment rails in those jurisdictions varies and should be stress-tested in the structuring phase, not after authorisation.
Step 4: Evaluate the AML/CFT and Travel Rule Posture of Each Candidate Jurisdiction
A jurisdiction's AML/CFT regime and its implementation of the Travel Rule (the obligation under FATF Recommendation 15 to pass originator and beneficiary data alongside a virtual asset transfer) are material factors in assessing operational fit. They determine your onboarding costs, your transaction screening burden and your relationships with counterparty VASPs.
FATF's Recommendation 15 framework applies across all major hubs, but implementation varies in its detail and strictness. MiCA implements Travel Rule obligations directly into the EU regime. Singapore's MAS imposes Travel Rule compliance as a condition of DPT licensing. The FCA's UK regime similarly requires VASP-to-VASP data transmission, and the FATF mutual evaluation process means that jurisdictions graded poorly on VASP supervision attract elevated correspondent-banking scrutiny for entities licensed there.
The practical effect is this: if you license in a jurisdiction with weak AML/CFT credibility in the eyes of FATF and the Financial Action Task Force's mutual evaluation reports, your banking counterparties in the EU, UK and US will apply enhanced due diligence to your entity, increasing the cost and reducing the stability of your payment rails. A strong licence in a credible hub is a banking asset. A licence in a jurisdiction on a FATF grey or black list is a liability – even if the licence itself was legally obtained.
The common mistake is treating AML compliance as a post-licensing operational matter. Travel Rule infrastructure – the software solution, the counterparty network integration and the jurisdiction-specific de-minimis thresholds – must be costed and planned at the structuring stage.
Cross-border note: The Travel Rule de-minimis threshold varies by jurisdiction. Operators serving multiple markets must apply the most restrictive applicable threshold on each transaction leg, which can mean different compliance obligations on the send and receive sides of the same transfer.
Step 5: Match the Jurisdiction to Your Operator Profile – A Decision Matrix
Different operator profiles require different licensing approaches. The following matrix maps the four most common profiles to the appropriate strategy.
Profile A – EU-focused retail exchange seeking a single authorisation with passporting rights. The primary path is a CASP authorisation under MiCA, obtained through a national competent authority in a member state with an accessible supervisory process. The key risk is that MiCA's capital and whitepaper obligations are more demanding than the legacy EU VASP registrations they replace; planning on a legacy-speed application will produce a missed deadline. Timeline: qualitatively a matter of several months for a complete application in a cooperative jurisdiction; the exact period varies with the NCA and the application's complexity.
Profile B – Exchange or custody business targeting the GCC and broader Middle East, with a UAE operational presence. The primary path is a VARA licence in Dubai, potentially alongside an ADGM-FSRA authorisation in Abu Dhabi if the Abu Dhabi market is material. VARA requires demonstrable operational substance in the emirate; a shell structure will not pass the licensing requirements. Timeline: qualitative; VARA processing timelines have tightened as the regime matures.
Profile C – Institutional trading desk seeking a well-regulated common-law hub with strong banking access. Singapore's MAS Payment Services Act (major payment institution tier) and Hong Kong's SFC VATP regime are the primary candidates. Both impose demanding capital and governance requirements. The selection turns on the depth of the institutional client base in each geography and the operator's ability to meet the SFC's vetting standards, which are rigorous by regional standards. For a trading desk with significant Swiss private-banking clients, the FINMA fintech or banking licence route in Switzerland merits assessment alongside the Asia options.
Profile D – Token issuer requiring a whitepaper regime and limited ongoing VASP footprint. Under MiCA, the whitepaper obligation for certain token types is distinct from, though related to, the CASP authorisation requirement. The ADGM-FSRA framework and the AIFC-AFSA regime in Kazakhstan each offer structured token-offering frameworks. The selection depends on where the primary investor base sits and which regime's token-classification analysis best fits the instrument being issued.
The common mistake across all profiles is treating the jurisdiction decision as permanent. It is not. Structures can be re-domiciled, subsidiaries added and licences expanded. But doing so after deployment is significantly more expensive than building the right stack from the outset.
Step 6: Assess the Banking and Tax Stack in Parallel, Not Afterward
Licensing, banking access and tax treatment are three interdependent variables. Optimizing for one without modeling the others produces a structure that is legally compliant but commercially unworkable. This step is where operators most frequently arrive at OBOLUS having already made a jurisdictional commitment that the tax or banking layer cannot support.
In our practice, we consistently see the same pattern: a founder selects a jurisdiction for its licensing speed or reputational profile, obtains the VASP registration, and then discovers that the corporate tax treatment of trading income or token issuance proceeds in that jurisdiction generates an unexpected effective rate. Or the licensed entity cannot open a settlement account in the same jurisdiction because local banks have informal sector restrictions on crypto businesses. In both cases, the licensing cost is sunk but the commercial objective is unmet.
The banking question turns on three elements: which banks in or adjacent to the candidate jurisdiction are willing to onboard licensed crypto entities; what AML/KYC documentation those banks require and how long onboarding takes; and whether the entity's operating currency and settlement pairs are natively supported. The tax question turns on how the jurisdiction classifies digital-asset income, whether it imposes withholding tax on distributions to a parent holding entity, and whether a tax treaty network provides relief on the flows that matter commercially.
The common mistake is accepting the assurance of a formation agent that "banking is not a problem" in a given jurisdiction. Formation agents are not banking counsel. The only reliable test is a documented pre-application conversation with target banks, conducted as part of the structuring process.
Cross-border note: A layered structure – operating subsidiary in the licensed jurisdiction, holding entity in a treaty-efficient location, intellectual property held separately – is common in well-structured crypto businesses. But it creates its own licensing questions: custody arrangements between group entities, intra-group service agreements and transfer-pricing documentation all require legal and tax attention before go-live.
If a prior application stalled, a banking account was declined, or a structure you committed to is not performing as planned, a second-look engagement can surface the structural reason and the route forward. Write to OBOLUS at info@oboluslaw.com.
Step 7: Engage Specialist Counsel Before You File – Not When You Hit a Wall
The licensing application itself is not the hardest part of obtaining a crypto licence. The hardest part is the pre-application structuring: resolving activity classification questions, aligning the governance framework to the regulator's expectations, documenting the AML/CFT program to the required standard and sequencing the licensing and banking steps in the right order.
Regulators across the leading hubs – VARA, MAS, the SFC, the MFSA and the national competent authorities under MiCA – publish detailed application guidance, and their processing standards have risen materially as the licensing frameworks have matured. An application submitted without pre-filing engagement with the regulator, without a fully evidenced AML/CFT manual, or without a governance structure that meets the regulator's controller-assessment expectations will typically receive a deficiency notice. Remedying a deficiency notice after submission is slower and more expensive than getting the application right before it is filed.
In a recent licensing matter, a digital-asset exchange had prepared its own application for a regulated hub in Asia, proceeding on the basis that the activity mapping was straightforward. On review, we identified that one of the platform's staking products constituted a separately regulated activity not covered by the applied-for licence category. The operator restructured the product terms before filing, which avoided a regulatory inquiry post-submission that could have extended the timeline by several months.
We regularly advise operators on the pre-filing stage: activity classification, governance alignment, the AML/CFT program design, and the sequencing of regulatory engagement. We also coordinate with allied counsel in the relevant jurisdiction where local regulatory representation is required.
The common mistake at this final step is the most expensive: treating the filing as the beginning of the process, rather than the midpoint. The regulatory work happens before the application is submitted, not during the regulator's review period.
Cross-border note: Where an application requires local counsel in the target jurisdiction – as VARA applications require on-the-ground representation in Dubai, and MAS applications benefit from Singapore-admitted counsel – we coordinate that engagement from the outset, providing a single point of accountability for the cross-border structure.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – an overview of the licence types, key regimes and our process across 70+ jurisdictions.
- Digital-Asset Custody Authorisation in Switzerland – FINMA's custody regime for digital assets, the applicable routes and the banking dimension.
- Crypto Fraud and Asset Recovery in the Cayman Islands – CIMA's VASP regime and the Cayman courts' approach to digital-asset recovery.
FAQ
How long does a crypto licence take to obtain?
Timelines vary significantly by jurisdiction, licence category and application quality. In the leading hubs – VARA in Dubai, MAS in Singapore, the SFC in Hong Kong, ESMA-aligned national competent authorities under MiCA – well-prepared applications typically progress over a period of several months, with more complex applications taking longer. Pre-filing preparation, including governance documentation and AML/CFT program completion, is the primary variable within the operator's control. Underprepared applications attract deficiency notices that extend timelines materially.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction. The right choice depends on your activity mix, customer geographies, capital position, banking requirements and tax structure. A retail exchange targeting EU customers has a different optimal path than an institutional custodian targeting GCC family offices. The correct answer requires mapping the regulatory authorisation requirements, the banking environment and the tax treatment simultaneously for each candidate hub before committing to a structure.
Do I need a separate custody licence?
In most leading jurisdictions, custody of digital assets is a regulated activity requiring specific authorisation – it is not automatically covered by an exchange or payment licence. Under MiCA, custody and administration of crypto-assets on behalf of clients is a separately enumerated CASP service. VARA in Dubai, MAS in Singapore and the SFC in Hong Kong each treat custody as a distinct regulated function. Whether your platform's key-management and safeguarding arrangements constitute regulated custody depends on the technical structure and the relevant jurisdiction's definition. Legal analysis of the specific arrangement is required before relying on any exclusion.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence, banking and tax stack across operating, custody and payment layers before you commit – so the structure works commercially, not just on paper. Our disputes team also coordinates freezing relief and on-chain tracing across leading common-law forums when recovery matters arise. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com or reach us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in multi-hub VASP authorisation strategy, activity mapping and the banking and tax dimensions of crypto licensing across the EU, GCC and Asia-Pacific.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.