Choosing the wrong jurisdiction for a crypto licence is not merely an administrative inconvenience. Operating without the right authorisation risks enforcement action, the freezing of payment rails and the abrupt closure of banking relationships that took months to build. For a digital-asset business weighing Malta against Switzerland, the decision turns on regulator posture, entity substance requirements, the applicable licence category and the way each jurisdiction sits within the broader cross-border compliance picture.
Malta and Switzerland represent two structurally different approaches to digital-asset regulation. Malta operates inside the European Union and is now transitioning its domestic VFA (Virtual Financial Assets) framework to full MiCA (Markets in Crypto-Assets Regulation) authorisation under ESMA and the MFSA (Malta Financial Services Authority). Switzerland sits outside the EU and is governed by FINMA (the Swiss Financial Market Supervisory Authority), which applies a principles-based token taxonomy and routes businesses through existing financial-market licence categories. The practical consequence is that the two paths serve different operator profiles, carry different timelines and interact differently with banking, tax and passporting. This page maps both in detail and offers a profile-based decision matrix.
The Regulatory Architecture: MFSA and FINMA Compared
Malta's MFSA is an EU-integrated supervisor bound first by MiCA and second by its own VFA transition rules, meaning that a business authorised in Malta as a CASP (Crypto-Asset Service Provider) under MiCA can passport across every EU and EEA member state without re-authorisation. Switzerland's FINMA operates under a standalone Swiss framework with no equivalent passporting mechanism into the EU; market access to European users requires separate EU analysis each time.
The philosophical difference matters in practice. FINMA applies a substance-over-label token taxonomy — distinguishing payment tokens, utility tokens and asset tokens based on the economic rights conferred rather than the marketing description. That classification drives the applicable licence route. Under MiCA, the MFSA applies a parallel three-tier structure: asset-referenced tokens (ARTs), e-money tokens (EMTs) and a residual "other crypto-assets" category, each carrying distinct whitepaper and own-funds obligations.
Both regimes sit above a common FATF baseline. The Travel Rule (the obligation to pass originator and beneficiary data with a virtual-asset transfer) applies in both jurisdictions, though the precise data threshold and de-minimis treatment vary and should be confirmed against current national implementing measures.
What Licence Categories Are Available in Each Jurisdiction?
Malta under MiCA offers a single CASP authorisation covering the full suite of crypto-asset services — exchange, custody, portfolio management, advice, transfer and the placing of crypto-assets. The prior VFA framework distinguished between VFA agents, exchanges and portfolio managers; businesses that held a VFA authorisation are working through a structured transition to CASP status. The MFSA has confirmed the MiCA CASP as the destination regime, and new applicants should apply directly under MiCA rather than seek a legacy VFA authorisation.
Switzerland presents a wider menu because FINMA routes digital-asset businesses through established Swiss financial-market categories. A crypto business may require a fintech licence (for deposit-taking below a defined threshold), a full banking licence (for full deposit-taking or significant custody operations), a securities firm authorisation, or — at a minimum — affiliation with a recognised self-regulatory organisation (SRO) to satisfy anti-money-laundering requirements. A stablecoin issuer or a business accepting public deposits will face banking-licence analysis. An exchange dealing in tokens that qualify as securities under FINMA's taxonomy will face the securities-firm track.
The practical difference: Malta offers one CASP destination that covers most service combinations; Switzerland requires a careful pre-classification of the token and the activity before the licence route is even determined.
Does Malta's EU Passport Change the Analysis?
For any business intending to serve clients in Germany, France, the Netherlands or the other major EU markets, Malta's CASP authorisation offers a material structural advantage: a single authorisation, passported under MiCA, provides the regulatory gateway to the entire EU and EEA. The operator notifies the MFSA of the target member states; the notification travels via ESMA's coordination mechanism; and the business can begin operating in the notified state without a second application. Switzerland provides no equivalent mechanism — a Swiss-licensed business serving EU customers must independently assess whether each activity and each member state requires local authorisation or registration.
That said, passporting is not a free pass. MiCA requires meaningful substance in the home member state: governance, compliance and risk functions must be genuinely present in Malta, not merely post-addressed. Regulators across the EU have been increasingly alert to shell structures that use a low-substance EU entity to passport across the bloc. We advise clients at the outset that the substance investment required to maintain a credible CASP in Malta is real and ongoing.
For a business with no EU distribution ambition — focused on, say, professional counterparties in the Gulf, Asia-Pacific and North America — the passport premium of Malta may not justify the MiCA compliance cost. That is where the Swiss route becomes more competitive.
For a scoped assessment of how passporting interacts with your distribution model, contact OBOLUS at info@oboluslaw.com. The EU/non-EU tension appears in nearly every cross-border structure we review, and the right answer turns on where your users, banking and revenue sit — not on which jurisdiction headline sounds better. Map your options
What Substance Does Each Jurisdiction Require?
Substance requirements in Malta and Switzerland are both real, though they arise from different sources. Under MiCA, the MFSA expects a CASP applicant to demonstrate a registered office in Malta, senior management genuinely located and exercising authority from Malta, and operational infrastructure — compliance, AML, risk — proportionate to the services offered. The MFSA has applied these requirements with increasing rigour as the post-Brexit and post-MiCA period has attracted a volume of applicants from businesses that prefer a lighter commitment.
FINMA's substance expectations derive from Swiss financial-market law more broadly. A fintech-licence holder or a banking-licence applicant must demonstrate credible Swiss governance. For an SRO-affiliated operation at the lighter end of the spectrum, the substance bar is lower but the permitted activities are correspondingly narrower. Businesses that have attempted to run a Swiss structure from offshore without genuine local presence have encountered supervisory pushback and, in some cases, informal enforcement action.
In our cross-border practice, we have seen clients underestimate the substance cost in both jurisdictions. The licence fee is rarely the significant line item — the ongoing compliance infrastructure, the local directorship, and the audit and reporting obligations almost always dominate the budget.
AML/CFT Posture and the Travel Rule
Both Malta and Switzerland implement the FATF framework for virtual assets, including the Travel Rule under FATF Recommendation 15. In practice, this means that any business transferring virtual assets above the applicable threshold must collect, verify and transmit originator and beneficiary information with every qualifying transfer. The specific threshold and the technical implementation requirements are set by national law in each jurisdiction and are subject to periodic revision; operators should confirm the current thresholds with counsel at the application stage.
Malta's AML regime operates within the EU's AMLD (Anti-Money Laundering Directive) architecture and is supervised by the MFSA and the FIAU (Financial Intelligence Analysis Unit). Switzerland's AML supervision for VASPs runs through FINMA and, for SRO-affiliated entities, through the relevant SRO. The Swiss system is often described as more principles-based; the EU system, particularly post-AMLD, is increasingly prescriptive and supported by the EU's new central AML authority.
For a business handling high volumes of peer-to-peer transfers or running an unhosted-wallet product, the AML analysis in both jurisdictions is demanding. We map the AML obligations alongside the licence structure in every engagement — they are not separable.
Banking Access and Tax Interaction
Banking access is, in practice, the most operationally sensitive variable for any digital-asset business. Switzerland's crypto-friendly banking history — several Swiss banks have historically been willing to onboard crypto businesses — remains a relative advantage for a Swiss-licensed entity. That said, Swiss banks apply their own correspondent-banking risk appetites, and access is not guaranteed by the licence alone. A FINMA-licensed business still needs to demonstrate clean AML procedures, credible governance and a customer base that the bank can risk-assess.
Malta has faced periods of difficulty in this regard. EU-member-state banking for crypto businesses has historically been more constrained than Swiss banking, though the picture continues to evolve as MiCA brings greater regulatory certainty. EMI (electronic money institution) rail access and the use of non-EU banking partners are common workarounds, each carrying their own compliance considerations.
On tax: Switzerland offers clarity through FINMA's token taxonomy and a generally favourable treatment of crypto businesses, though the specifics — corporate tax rates, VAT treatment, withholding tax on token issuances — vary by canton and by the nature of the token or activity and should not be assumed. Malta operates a full-imputation corporate tax system that can, in the right structure, result in an effective rate significantly below the headline rate; but the structure must be correctly implemented and the substance requirements genuinely met. Both jurisdictions' tax positions are fact-specific. We work alongside specialist tax counsel in each location to build the structure correctly from the start.
If a prior application stalled or a banking relationship was lost, a second read of the structure can surface the underlying issue. Write to info@oboluslaw.com with the facts. Map your options
Decision Matrix: Which Operator Profile Should Choose Which Jurisdiction?
The right jurisdiction is not a universal answer — it is a function of the operator's activity, target market, entity history and long-term build. The matrix below describes the principal profiles we encounter in practice.
Retail crypto exchange targeting EU customers. This profile needs EU market access. Malta's CASP authorisation under MiCA is the natural starting point: a single authorisation, passported across the EU, with the MFSA as the home supervisor. The key risk is underestimating the substance and compliance build. Timeline for a well-prepared application varies and should be confirmed with the MFSA at the pre-application stage.
Institutional exchange or OTC desk with a global professional-client base. If EU retail distribution is not the priority and the client base is professional counterparties in Switzerland, the Gulf and Asia, a Swiss fintech licence or SRO affiliation may offer a lower-cost path with a more established banking environment. The absence of EU passporting is not a disadvantage if there is no EU retail distribution intent. Timeline varies by licence track and application quality.
Token issuer (non-security, utility or payment token). For an EU-targeted issuance, MiCA's whitepaper regime — administered via the MFSA in Malta — provides the clearest legal basis. Switzerland offers FINMA's well-established token-classification guidance, which may be preferable for a global issuance not focused on EU retail; FINMA's no-action letter process gives early certainty on token classification. Either way, the issuer's structure, the rights attached to the token and the distribution channel drive the analysis.
Custodian or digital-asset fund manager. Custody is a regulated activity under both regimes. Under MiCA, Malta's CASP authorisation covers custody as a standalone permitted service. In Switzerland, custody at meaningful scale typically requires a banking or securities-firm analysis. A fund manager may need additional authorisation in either jurisdiction depending on whether the managed assets qualify as collective investment schemes. The interaction between the custody layer and the fund layer is one of the most complex structuring questions in the digital-asset space; we build both layers from the outset.
Stablecoin issuer (ART or EMT equivalent). Malta under MiCA imposes significant authorisation and reserve requirements on ART and EMT issuers. Switzerland's equivalent analysis under FINMA can lead to a banking-licence requirement for issuers accepting public deposits. Neither jurisdiction offers a light-touch route for large-scale stablecoin issuance, and the compliance cost is proportionate to the systemic risk these instruments carry.
A common assumption we address regularly: that a single licence in one jurisdiction will suffice for global operations. It will not. Even a fully passported EU CASP does not cover the US, the UK, Singapore, Hong Kong or the UAE. A Swiss FINMA licence carries equivalent jurisdictional limits. Every business with a cross-border user base needs a jurisdiction-by-jurisdiction analysis of what activity is being conducted, where, and what local authorisation that triggers. We map that picture as the first step of every engagement.
A Cross-Border Structuring Illustration
Earlier this year, we advised a payments business structuring a stablecoin transfer product for European and Middle Eastern professional clients. The client's initial assumption was that a Malta CASP would cover both corridors. Our analysis identified that the Gulf-side activity, involving UAE-resident institutional clients, required separate analysis under VARA (the Virtual Assets Regulatory Authority) in Dubai and the ADGM/FSRA regime in Abu Dhabi. The resulting structure used Malta for the EU-passported layer and a separate UAE entity for Gulf-side operations, with a carefully drafted intragroup services agreement defining the flow of client data and transaction reporting. The AML and Travel Rule compliance programme was built to cover both regimes from a single policy framework, supported by allied counsel in the relevant jurisdictions. The client avoided the enforcement exposure that would have arisen from operating the Gulf activity under a CASP alone.
Related at OBOLUS
- Licensing & Registration for Digital-Asset Businesses – how we structure the full licence, banking and compliance stack across jurisdictions
- Legal Counsel for OTC Trading Desks – regulatory and structuring counsel for institutional OTC operations
- AIF for Digital Assets in the United Kingdom – UK alternative investment fund structuring for digital-asset strategies
FAQ
How long does a crypto licence take to obtain?
Timeline varies materially by jurisdiction and application quality. A Malta CASP authorisation under MiCA, submitted with complete documentation and genuine substance in place, typically takes a number of months; the MFSA's current review periods should be confirmed at the pre-application stage. A Swiss SRO affiliation for a lower-risk activity can move faster than a FINMA banking or fintech licence application, which involves a more intensive review. In both jurisdictions, incomplete applications or substance deficiencies extend the process significantly.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction turns on your activity (exchange, custody, issuance, fund management), your target market (EU users require a passportable authorisation; non-EU clients do not), your entity substance budget and your banking relationships. Malta offers EU passporting via MiCA CASP. Switzerland offers regulatory clarity, an established banking environment and a flexible token taxonomy, without EU market access. We assess both options against your specific profile before any recommendation is made.
Do I need a separate custody licence?
In Malta under MiCA, custody is a permitted service under the CASP authorisation — a separate standalone custody licence is not required if custody is bundled into an existing CASP application. In Switzerland, custody at meaningful scale typically requires analysis under FINMA's banking and securities-firm framework, which may result in a separate licence requirement. In either case, the custody layer interacts with the operational, segregation and safeguarding requirements of the applicable regime and should be assessed alongside the primary licence, not treated as an afterthought.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit — so structural problems surface before the application, not after. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst — specialising in regulatory authorisation strategy across EU and non-EU digital-asset regimes, with a focus on MFSA, FINMA, VARA and ADGM/FSRA licensing pathways.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.