Operating a crypto exchange, custodian, or token issuance platform without the correct regulatory authorisation exposes the business to enforcement action, frozen payment rails and the loss of institutional banking relationships. Two regimes attract sustained attention from operators weighing their first or second licence: the European Union's MiCA regulation (supervised by ESMA and national competent authorities) and the Astana International Financial Centre's AFSA regime in Kazakhstan. This comparison maps both across the decision axes that matter – market access, substance requirements, AML posture, banking interaction and operational cost – so founders and general counsel can match the right regime to their specific business profile.
The Fundamental Regulatory Choice
MiCA and the AIFC regime represent structurally different bets. MiCA is a passport to roughly 450 million consumers across the EU and EEA; a CASP authorisation (Crypto-Asset Service Provider) granted by any one national competent authority travels across all member states without a fresh application. The AIFC is a common-law enclave inside Kazakhstan, operating under English-law principles and governed by the Astana Financial Services Authority. It offers lower friction and a faster path to operational status, but its geographic market access is materially narrower – Central Asia, the CIS corridor and counterparties who recognise the AIFC standard.
Neither regime is universally superior. The question is always: where are your users, where does your capital sit, and what level of institutional recognition do your counterparties require? In our cross-border practice, we advise operators to answer those three questions before they open a licensing conversation with any regulator.
Regulator Posture and Institutional Credibility
ESMA and the national competent authorities operating under MiCA carry the full institutional weight of EU financial regulation. Major banks, payment processors and institutional investors treat a MiCA CASP authorisation as the benchmark for counterparty due diligence. The regime's public consultation history, its formal passporting mechanism and its alignment with broader EU financial services law mean that compliance with MiCA translates directly into the kind of regulatory credibility that opens correspondent banking relationships in Western Europe and North America.
The AFSA, by contrast, is a younger authority, but it has built a reputation for regulatory engagement and relatively transparent dialogue with applicants. Operators we advise who have pursued both processes describe the AFSA as more accessible at the pre-application stage – a meaningful advantage when the substance of a business model is still evolving. The AIFC Courts operate under English common-law principles, which matters for dispute resolution and enforcement of contractual rights within the zone.
The credibility differential is real and should not be minimised. For an exchange or custodian whose primary counterparties are European institutional investors or regulated payment institutions, a MiCA authorisation is, in practice, the only commercially viable starting point. For a business targeting the emerging-market corridor – clients in the CIS, the Gulf, or South-East Asia who are not themselves subject to MiCA compliance requirements – the AIFC licence may provide sufficient recognition at meaningfully lower cost and time-to-market.
To map which licence tier your counterparty base actually requires, contact OBOLUS at info@oboluslaw.com. The answer is almost never obvious from the business plan alone; it turns on the regulatory status of your banking and payment partners.
Licence Categories: What Activities Are Covered?
MiCA's CASP regime covers a defined list of crypto-asset services: reception and transmission of orders, execution of orders, dealing on own account, portfolio management, advice, transfer services, placing and operating a trading platform. Each service is separately specified, and an operator providing more than one must be authorised for each. Token issuers face a parallel track: asset-referenced tokens (ARTs) and e-money tokens (EMTs) require distinct issuer authorisations with whitepaper obligations; "other" crypto-assets are subject to lighter whitepaper disclosure rules.
The AIFC regime, supervised by the AFSA, covers broadly analogous activities under its digital-asset framework – exchange operation, custody, dealing and advisory services – but the category boundaries and the conditions attached differ. Importantly, the AIFC framework was designed with the FATF Recommendations in mind and has been updated to align with the FATF virtual-asset standards, which matters for AML recognition by international counterparts.
A business that issues tokens and operates a trading platform would, under MiCA, need both an issuer authorisation (or an applicable exemption) and a CASP authorisation for the exchange activity. Under the AIFC regime, the same business would need to check activity-by-activity whether each function requires its own permission or whether a combined authorisation covers the full scope. In our practice, we see operators routinely underestimate the number of separate licences their activity map generates, in both regimes.
What Substance Is Required – and How Long Does It Take?
MiCA sets explicit substance expectations: a CASP must have a registered office (and at least its management) in the authorising member state, sufficient own funds by service class, a qualifying management body, and operational controls covering conduct-of-business, safeguarding and AML. The initial authorisation process, once an application is accepted as complete by the national competent authority, runs to a timeline specified in the regulation; in practice, total elapsed time from engagement to licence grant – including the pre-application engagement and any supplemental information rounds – has, in the early post-MiCA environment, typically taken a matter of months rather than weeks. The exact duration varies considerably by member state and by the complexity of the business model.
The AFSA process is generally faster. Pre-application engagement with the AFSA is formalised and relatively predictable, and operators with straightforward business models and clean corporate structures have reached operational authorisation in a shorter window than equivalent EU timelines. That said, the AIFC imposes its own substance requirements: a presence within the AIFC zone, fit-and-proper management, financial resources commensurate with the risk of the activity, and AML/CFT compliance infrastructure. Physical substance inside the AIFC is not negotiable, even if the operational footprint is modest at first.
The speed advantage of the AIFC is meaningful for a business under commercial pressure to reach regulated status quickly. It is not unlimited. An operator that arrives at the AFSA with an incomplete compliance framework, a management team with unresolved fitness questions, or a business model that does not map cleanly to the defined activity categories will face delays in Astana just as it would in Frankfurt or Valletta.
AML, the Travel Rule and Compliance Posture
Both regimes operate against the baseline of the FATF Recommendations, including Recommendation 15 on virtual assets and the Travel Rule (the obligation to pass originator and beneficiary data with a virtual-asset transfer above the applicable threshold). MiCA's AML requirements are layered on top of the EU's broader anti-money-laundering directive framework; the EU's dedicated AML Authority (AMLA) is in formation and will take on direct supervision of the highest-risk CASPs in due course. The practical compliance burden for a MiCA CASP is substantial: transaction monitoring, Travel Rule data exchange with counterpart VASPs, sanctions screening and periodic regulatory reporting are all mandatory from day one.
The AIFC's AML regime aligns with FATF standards and the AFSA issues its own AML rulebook. For an operator whose users are primarily in jurisdictions with equivalent AML regimes, AIFC compliance is achievable without building a compliance function of the scale that a major EU exchange would require. For an operator whose user base spans higher-risk corridors, the AFSA will scrutinise the risk appetite carefully. Neither regime accepts a nominal compliance programme; both conduct supervisory reviews and expect evidence of a functioning AML infrastructure, not a policy document.
In recent months, we have seen regulators across both the EU and the AIFC increase their focus on Travel Rule implementation. Operators who cannot demonstrate a live Travel Rule solution at the point of licence grant – not just a plan – are finding applications delayed or conditioned.
Banking and Payment Rails: The Deciding Factor
The licence is only as useful as the banking relationship behind it. This is the axis that most often determines the outcome for a specific operator, and it is the one most frequently underweighted at the planning stage.
A MiCA CASP authorisation, particularly one granted by a well-regarded member state – Lithuania under the Bank of Lithuania's transition regime, Malta under the MFSA, or the Netherlands under AFM/DNB oversight – gives an operator the strongest available argument for EUR correspondent banking access. European banks, even those with restrictive crypto policies, are more likely to open business accounts for a fully authorised CASP than for any offshore equivalent. The passporting mechanism also means that banking in one EU member state can, in principle, support operations across all others.
Banking for an AIFC-licensed operator is more complex. Kazakh banks vary in their appetite for crypto-business clients, and international correspondent banking for an AIFC-licensed exchange is less standardised. Some operators use the AIFC licence as a bridge to CIS market access while maintaining a separate EU-licensed entity for fiat on/off ramp relationships. This two-entity approach is structurally sound but adds compliance cost and governance overhead.
If your banking stack is unsolved, the licence choice cannot be finalised. Write to OBOLUS at info@oboluslaw.com to map the banking interaction before committing to a jurisdiction.
Tax and Structuring Interaction
MiCA authorisation does not determine tax treatment, but the jurisdiction of authorisation is frequently the jurisdiction of operation – and EU member states vary widely in their treatment of crypto-asset income, token issuance proceeds, VAT on services and the tax characterisation of staking rewards. Lithuania has historically offered a competitive corporate tax environment alongside a workable VASP regime; Malta has similarly attracted businesses partly on tax grounds. Neither creates a tax-free environment; both require careful analysis of the interaction between the local corporate tax rules and the specific revenue model of the business.
Kazakhstan's tax environment, within the AIFC, is a meaningful differentiator for some operators. The AIFC regime operates under a specific tax framework that, as a general matter, is designed to be competitive for financial services businesses operating within the zone. Specific rates and exemptions are subject to the legislation as in force and should be verified with local tax counsel before a structuring decision is made.
Cross-border structuring – a MiCA entity holding an IP licence from an offshore parent, or an AIFC entity routing revenues through a holding structure in a third jurisdiction – introduces transfer pricing, controlled foreign company and beneficial ownership disclosure considerations that go well beyond the licence itself. We regularly advise on the tax layer as an integrated part of the licensing engagement, because a licence that creates an unexpected tax cost can undermine the commercial case for the jurisdiction.
Decision Matrix by Operator Profile
Profile A – EU-facing centralised exchange with institutional counterparties. This operator needs the MiCA CASP authorisation. Institutional clients, payment partners and correspondent banks will require it. The timeline and substance cost are real, but the commercial alternative – operating without it or relying on an AIFC licence for EU market access – creates an unacceptable enforcement risk under MiCA's third-country provisions. The recommended entry point is a member state with a mature supervisory dialogue and established banking relationships for crypto businesses.
Profile B – Emerging-market or CIS-focused exchange seeking regulated status quickly. The AIFC is the more efficient path. The AFSA's pre-application engagement is accessible; the timeline to operational status is shorter; and the market being served does not require MiCA recognition from counterparties. The operator should build the AIFC licence now and plan for a MiCA authorisation if and when European market access becomes a strategic priority.
Profile C – Token issuer seeking to issue an ART or EMT into the EU. MiCA is mandatory for EU distribution; there is no AIFC equivalent that provides market access to EU retail or institutional buyers for a token marketed in the EU. The issuer must pursue MiCA authorisation or structure its issuance to fall outside the MiCA perimeter – a question of legal substance, not marketing description.
Profile D – Custodian serving institutional clients across multiple regions. A two-jurisdiction approach is frequently the right answer: MiCA CASP authorisation for the EU custody book, and an AIFC licence (or an alternative such as ADGM's FSRA regime) for the non-EU institutional book. The governance overhead of two regulated entities is real, but the alternative – a single offshore structure – fails the due diligence requirements of most institutional clients in both regions.
Profile E – Fund investing in digital assets. A MiCA CASP authorisation is not, by itself, a fund management licence; EU fund structures require authorisation under the applicable AIFMD or UCITS framework. The AIFC has its own fund regime, and AFSA-authorised fund structures have found acceptance among institutional investors in the Gulf and CIS. The applicable regime depends on the investor base and the fund's distribution strategy, not on the asset class alone.
A common assumption we encounter is that a single offshore or lightly regulated licence is sufficient to serve clients globally. It is not. Most institutional counterparties, payment processors and custodian banks now conduct regulatory status due diligence as a condition of onboarding. A licence from a jurisdiction whose standard is not recognised by the counterparty's compliance team provides no practical benefit. We map the counterparty requirement before recommending a jurisdiction, not after.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – our full practice overview covering 70+ licensing jurisdictions
- VARA Licence Application in El Salvador – an alternative emerging-market licensing route with a distinct regulatory model
- Electronic Money Institution (EMI): A Legal Guide for Digital-Asset Businesses – how the EMI structure interacts with CASP authorisation and stablecoin issuance
FAQ
How long does a crypto licence take to obtain?
Timeline varies significantly by jurisdiction, regulator and the complexity of the applicant's business model. Under MiCA, the authorisation process for a CASP, once an application is accepted as complete, runs to a defined statutory period – but total elapsed time from initial engagement to licence grant typically spans several months when pre-application work and supplemental information rounds are counted. AIFC/AFSA authorisations have generally moved faster, but the timeline depends on the applicant's preparedness. In both cases, an incomplete application resets the clock.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer, and any adviser who offers one without analysing your specific facts is providing incomplete guidance. The right jurisdiction depends on where your users are, what authorisation your banking and payment partners require, the activities you intend to conduct, your timeline to market and your structuring and tax position. A MiCA CASP authorisation is effectively mandatory for EU market access; the AIFC is a strong option for CIS and emerging-market-focused businesses. Most scaling operators end up with licences in more than one jurisdiction.
Do I need a separate custody licence?
Under MiCA, custody and administration of crypto-assets on behalf of clients is a separately defined CASP service requiring explicit authorisation; it cannot be bundled into a trading or exchange licence without that activity being named in the authorisation. The AIFC regime similarly treats custody as a distinct regulated activity. An operator that holds client assets – whether as a primary service or as an operational element of an exchange – should assume that a custody authorisation or permission is required and verify this with counsel before commencing the activity.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than 70 jurisdictions, on disputes and on-chain asset recovery across more than 25 forums, and on the tax, banking and compliance structures that sit around them. We map the licence, custody and payment stack before you commit – not after a regulator has raised the issue. Digital assets are the whole of our practice. Operators across the EU, the Gulf, the CIS and beyond rely on us for the cross-border legal analysis that determines where and how they operate. To discuss your licensing situation, contact info@oboluslaw.com or reach us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialist in comparative CASP and VASP authorisation across EU, Gulf and emerging-market regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.