For a digital-asset business choosing between a common-law hub with deep institutional credibility and a newer but fast-moving Central Asian financial centre, the decision turns on more than a licence fee. The AIFC (Astana International Financial Centre) in Kazakhstan and the United Kingdom each represent a distinct regulatory philosophy, a distinct relationship with international banking, and a distinct set of commercial trade-offs. Operating without the right authorisation in either regime risks enforcement action, severed banking rails and the kind of reputational damage that is difficult to reverse. This page maps the two regimes head to head so your board can make the decision on facts.
Two Regimes, Two Risk Profiles
The AIFC, supervised by the Astana Financial Services Authority (AFSA), operates as a common-law enclave inside Kazakhstan with its own courts, its own English-language legislation and an explicit mandate to attract international digital-asset business. The United Kingdom, supervised by the Financial Conduct Authority (FCA), offers one of the world's most-recognised regulatory brands but imposes a demanding registration and compliance posture that has seen a significant proportion of applicants withdraw or be refused. Both are credible. Neither is simple.
In our practice, operators frequently underestimate the practical distance between a licence being issued and a business being fully operational. Banking access, substance requirements and AML infrastructure all have to be in place before the licence delivers commercial value. The two jurisdictions diverge sharply on each of those points.
What Does the AIFC Regime Require?
The AIFC digital-asset framework covers trading facility authorisation, custody, brokerage and related activities under AFSA supervision, with licensing categories that map broadly to operator function. The AIFC is a defined geographic zone in Nur-Sultan (Astana), and regulated firms must maintain a genuine operational presence within that perimeter – a factual substance requirement, not merely a registered address.
AFSA has structured the regime to be accessible to international applicants. The application process is conducted in English, documentation standards are consistent with those operators recognise from common-law offshore centres, and the timeline from a complete application to a decision is generally measured in months rather than years. Exact timelines vary by licence category and the readiness of the applicant's compliance infrastructure, so we always advise clients to treat published indicative periods as a floor rather than a guarantee.
The AML/CFT regime at the AIFC aligns to FATF Recommendation 15 on virtual assets, including Travel Rule obligations for the transfer of originator and beneficiary data. Operators need a policy suite, a nominated MLRO, and transaction monitoring proportionate to their activity profile. Regulators at the AIFC increasingly expect that infrastructure to be demonstrably operational at the point of licence grant, not assembled afterwards.
Banking for AIFC-licensed firms is improving but remains a practical consideration. A number of Kazakhstani and regional banks accept digital-asset business under the AIFC umbrella, and some operators hold a secondary account in a jurisdiction with deeper correspondent banking access. The cross-border banking question should be assessed before the licence application is filed, not after.
To map the licence, banking and compliance stack before you commit to the AIFC, write to us at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the user base, the banking relationships – change the analysis in ways that matter.
What Does the UK FCA Regime Require?
In the United Kingdom, a business carrying on cryptoasset activities that constitute money laundering-relevant conduct must register with the FCA under the Money Laundering Regulations (MLR). The FCA is also the competent authority for financial-promotion rules, which apply to crypto marketing directed at UK persons regardless of where the firm is incorporated. A non-UK firm marketing to UK clients without the correct approvals faces enforcement risk even without a UK entity.
The FCA's MLR registration process is demanding by design. The regulator scrutinises controller fitness, the adequacy of AML systems, the competence of key personnel and the credibility of the business model. The FCA has been explicit in guidance that it does not regard the MLR registration as a rubber stamp, and the refusal and withdrawal-during-review rates in successive cohorts of applicants have been material. Timelines are difficult to predict with precision; the FCA has at various points taken considerably longer than its stated service-level targets.
UK financial-promotion rules add a second compliance layer that operates independently of MLR registration. A firm communicating or approving a financial promotion relating to a qualifying cryptoasset must either be FCA-authorised or have the communication approved by an authorised person. This regime catches issuers and exchanges alike, and enforcement has been active.
Once registered, a UK-based digital-asset firm operates in one of the most commercially credible regulatory environments in the world. UK banks, prime brokers and institutional counterparties are familiar with the regime; correspondent banking is generally more straightforward than at many newer hubs. The trade-off is the cost and duration of achieving and maintaining that status.
In a recent matter, an exchange operator that had been operating informally in the UK market approached us after the FCA issued a supervisory notice. The compliance programme had not been reviewed since initial registration. We worked with the client to reconstruct the AML policy suite, update the controller disclosures and engage proactively with the regulator's concerns. The outcome was a return to good standing, but the process took considerably longer and cost considerably more than addressing the gaps at registration would have.
Five Decision Axes That Separate the Two Jurisdictions
The following five axes represent the practical comparison points that operators in our practice use when deciding between these two regimes. No single axis is determinative; the right answer depends on the intersection of all five with the operator's specific profile.
Regulatory credibility and institutional recognition. The FCA carries stronger institutional recognition with European and North American counterparties. The AFSA brand is well understood within the CIS region and among international digital-asset operators, but a UK-registered firm may face fewer questions from prime brokers and payment processors operating in Western markets. For an exchange targeting institutional clients primarily in the UK or EU, this matters. For an operator whose primary markets are Central Asia, the Middle East or South-East Asia, the AIFC's credibility in those corridors is sufficient.
Application difficulty and timeline. The AIFC process is, in our experience, more predictable. A well-prepared application with complete documentation and a functioning compliance programme moves through the process on a timetable that allows for reasonable business planning. The FCA process is less predictable, particularly for applicants who do not have significant UK AML and financial-crime infrastructure already in place. Operators who have previously been through an offshore registration or a MAS or SFC licensing process will find the AFSA process more familiar in structure.
Substance and physical presence. Both jurisdictions require genuine substance, not a letterbox. The AIFC requires presence within the Astana financial zone. The FCA's expectations around controllers and senior management being present and accessible are embedded in the MLR registration criteria. Neither jurisdiction should be approached as an easy-address solution.
AML posture and Travel Rule compliance. Both regimes impose FATF-aligned AML obligations and expect Travel Rule compliance on qualifying transfers. The FCA's supervisory posture on AML is active and consequential; the AIFC's is developing rapidly in the same direction. Operators who underinvest in AML infrastructure face risk in both jurisdictions, but the FCA's enforcement history makes the UK the higher-risk environment for an operator with gaps.
Banking access and payment rails. This is the axis where the UK has a clear structural advantage for operators targeting Western institutional or retail clients. UK banking, while not straightforward for crypto firms, is materially more accessible than it was several years ago, and an FCA registration is a recognised signal for UK banks. AIFC-licensed firms have access to Kazakhstani and regional banking, with some operators supplementing that with accounts in other jurisdictions.
Decision Matrix by Operator Profile
Different operator profiles point toward different conclusions. The following analysis addresses the four most common profiles we encounter.
A spot exchange targeting CIS and Central Asian retail users is the clearest AIFC fit. The AFSA licensing regime covers exchange activity directly, the substance requirements are manageable, and the banking access for the relevant user base is strong. The FCA route adds cost and complexity that is not commercially justified if the primary market is not the UK.
A custodian servicing institutional clients in Europe or the UK faces a different calculus. UK FCA registration, potentially alongside a MiCA-compliant CASP authorisation in an EU member state, positions the custodian for the institutional counterparties it needs. An AIFC licence alone will satisfy some institutional clients but may face friction with others. The risk is not regulatory; it is commercial.
A token issuer planning a primary offering and secondary market should assess the classification question first. Under UK rules, if the token is a specified investment, FCA authorisation is required for most activities. Under the AIFC, the AFSA's token taxonomy and its treatment of security tokens versus utility instruments will drive the applicable licence category. In our cross-border practice, issuers frequently need a layered structure – an AIFC entity for the primary issuance mechanics and a UK-compliant structure or approved-person arrangement for any UK marketing.
A fund or family office investing in digital assets may find the AIFC's fund management provisions attractive, particularly for a vehicle that does not need to market to UK retail investors. The AIFC is a recognised fund domicile in CIS markets. For a vehicle that needs UK regulatory permissions or that plans to engage UK professional investors, the FCA route becomes necessary either for the vehicle itself or for the manager.
Cross-Border Interaction: What Each Licence Covers – and What It Does Not
A common misread is that any offshore or specialist-hub licence provides a foundation for global operations. It does not. An AIFC licence authorises activity within the AIFC and, subject to specific arrangements, in Kazakhstan. It does not authorise a firm to solicit UK clients, distribute into the EU without MiCA compliance, or operate in Singapore without a MAS payment service licence. The UK MLR registration similarly covers UK-regulated activity; it is not a passport into the EU post-Brexit.
In our cross-border practice, we regularly see operators who assumed their single registration covered more activity than it did. The enforcement trigger is almost always banking or a regulatory inquiry that asks where the firm is authorised to serve the clients it is actually serving. At that point, remediation is far more expensive than a pre-launch licensing analysis would have been.
The correct planning approach is to map the jurisdictions in which the business will operate, the clients it will serve, and the activities it will carry out – and then to build the licence stack from that map outward. For most international operators, that means a combination of a primary licence (often the AIFC, a MiCA-compliant EU jurisdiction, or the UK) plus confirmatory registrations or local authorisations in material market jurisdictions.
A Common Assumption About Offshore Registration
A common assumption is that a BVI or Cayman registration, combined with an AIFC or UK entity, provides full coverage for a global digital-asset business. The BVI Virtual Asset Service Providers Act 2022 and the Cayman VASP regime under CIMA are registration regimes for entities incorporated in those jurisdictions; they do not authorise those entities to operate in other jurisdictions without the local permissions those jurisdictions require. An operator whose users are primarily in the EU will need MiCA CASP authorisation. An operator whose users are primarily in the UK will need FCA MLR registration. The offshore entity may be useful for holding-company or fund-structuring purposes, but it is not a substitute for the operating licences the business actually needs.
We map the full licence stack – operating, custody and payment layers – before a client commits capital to a structure. That analysis frequently changes the entity plan and saves material cost downstream.
If a prior application stalled or a banking relationship was closed, a second read of your structure can identify the root cause and the route back. Contact OBOLUS at info@oboluslaw.com to start that review.
Related at OBOLUS
- Licensing & Registration for Digital-Asset Businesses – how we scope and execute multi-jurisdiction licence applications end to end.
- EU MiCA vs United Kingdom: Where to License a Crypto Business – a parallel comparison for operators weighing the EU CASP regime against the FCA route.
- PSP and Acquiring Agreement in Poland – payment licensing considerations for operators building into Central and Eastern European markets.
FAQ
How long does a crypto licence take to obtain?
Timelines vary materially by jurisdiction and by the readiness of the applicant's compliance programme. The AIFC process, for a well-prepared application, is generally measured in months. The FCA MLR registration has historically taken longer, with the duration depending significantly on whether the regulator raises queries about the AML framework or controller fitness. No published timeline should be treated as a guarantee; build planning buffers into any launch schedule.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on where your users are, what activities you are carrying out, what banking access you need, and what institutional counterparties you need to satisfy. The AIFC suits operators with a CIS or regional focus who need a credible common-law authorisation. The UK suits operators who need FCA recognition for institutional or UK client relationships. Most international businesses need more than one authorisation across the jurisdictions they actually operate in.
Do I need a separate custody licence?
In most flagship regimes, custody of digital assets on behalf of clients is a separately regulated activity. Under the AIFC framework, custody services require their own AFSA authorisation. Under the FCA regime, the treatment of custody depends on whether the assets are specified investments and on the specific activities carried out. An exchange that also holds client assets should not assume its trading or money-service authorisation covers the custody function. This question should be resolved during the licence-planning stage, not after the service is live.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice, and we act only for businesses. We map the licence stack – operating, custody and payment layers – before a client commits capital to a structure. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialist in multi-hub digital-asset authorisation, AIFC, FCA and comparative VASP registration for international operators.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.