Operating a crypto exchange in the United States without the right federal and state authorisations is not a calculated risk – it is an enforcement invitation. The federal money-services business (MSB) registration with FinCEN is the baseline floor; above it sits a patchwork of state money-transmitter licences (MTLs) that each carry their own capital, bonding, examination and reporting requirements. No single filing resolves the exposure. An inbound business that treats US users as an afterthought – relying on geo-blocks that do not hold or on an offshore VASP registration that carries no weight with a federal examiner – faces account closures, civil money penalties and, in aggravated cases, criminal referral.
This page maps the US regulatory regime for crypto exchange setup from the ground up: the federal layer, the state-by-state MTL reality, the New York BitLicense as a market-specific decision point, the AML and Travel Rule obligations that run alongside licensure, and the cross-border structuring questions that determine whether a US entity is the right vehicle at all. One experience marker runs through each section: we have guided businesses through this stack from initial scoping to first examiner response, and the consistent finding is that the architecture decisions made before the first filing determine the compliance cost for years afterward.
The Federal Floor: FinCEN MSB Registration and What It Does Not Cover
Any business operating as a money-services business under federal law must register with FinCEN (the Financial Crimes Enforcement Network), maintain an AML program, file Suspicious Activity Reports and comply with the Bank Secrecy Act. For a crypto exchange, that means MSB registration is mandatory before the first US-user transaction. Registration itself is not a licence in the traditional sense – FinCEN does not examine financial soundness or impose capital requirements at the federal level. What it does is create the federal AML/CFT accountability layer and establish the business as a regulated entity for federal law-enforcement purposes.
The SEC and CFTC operate in parallel. If any digital asset traded on the platform qualifies as a security under the applicable federal securities law framework, SEC jurisdiction attaches. If it qualifies as a commodity, CFTC oversight is relevant for derivatives. The line between the two has been contested across multiple enforcement actions, and the safest posture – in our practice – is to conduct a thorough token-classification analysis before the platform goes live, not after the first regulator inquiry arrives. Skipping that step is the single most common structural mistake we see in inbound US market-entry files.
The practical consequence: FinCEN registration is the threshold, but it resolves almost none of the state-level exposure and none of the securities-law question. Operators who treat MSB registration as "the US licence" typically discover the gap at the worst possible moment.
To discuss whether your current structure clears the federal threshold – or leaves exposure you have not mapped – contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity domicile, the asset types, the user base – change the analysis.
What Are the State Money-Transmitter Licence Requirements for Crypto Exchanges?
State MTLs are the operational licences that most directly govern whether a crypto exchange can legally serve residents of a given state, and the requirements vary materially from state to state. Each MTL jurisdiction sets its own minimum net worth or surety bond, application fee, examination schedule and permissible-investment requirements for customer funds. An exchange serving US users nationwide faces the prospect of licensing in the majority of states where it has resident customers – a process that, in aggregate, involves substantial capital commitment, multi-year examination cycles and ongoing reporting obligations.
There is no federal equivalency for state MTLs. A FinCEN registration does not substitute for an MTL, and an MTL in one state does not passport to any other. This is the structural reality that distinguishes the United States from the EU's MiCA passporting model or Singapore's single MAS licence. The NMLS (Nationwide Multistate Licensing System) provides a common application infrastructure for many states, which reduces administrative duplication, but it does not harmonise the substantive requirements.
Several states impose requirements that go beyond the standard MTL template:
- New York's BitLicense (issued by NYDFS, the New York State Department of Financial Services) is the most demanding state-level crypto-specific regime in the country. It requires a dedicated application, a cybersecurity programme, a consumer-protection programme, a business-continuity plan and ongoing supervisory engagement. Many operators elect a NYDFS-chartered trust company structure as an alternative path.
- California has moved toward a dedicated Digital Financial Assets Law, which would create a crypto-specific licence separate from the general MTL. The transition timeline and scope are subject to ongoing legislative development.
- Texas and Wyoming have been relatively active in accommodating crypto business models within their MTL or bank-charter frameworks, though neither offers a shortcut around the core licensing obligations.
In our practice, the state-licensing question is never purely a compliance exercise. It is a market-access decision. The cost and timeline of full nationwide MTL coverage often drives operators toward a phased approach – launching in states where the regulatory pathway is clearer and capital requirements are proportionate, then expanding as the licence stack builds.
Is a New York BitLicense Worth the Cost and Time?
The NYDFS BitLicense is the most scrutinised crypto-specific state licence in the United States, and the decision to pursue it is rarely straightforward for an inbound operator. New York is one of the largest retail and institutional financial markets in the country, and many institutional counterparties – custodians, prime brokers, banking partners – treat NYDFS oversight as a baseline trust signal. Not having a BitLicense or NYDFS trust charter effectively closes the New York market to a retail exchange.
The application process is substantive. NYDFS examines the financial condition of the applicant, the backgrounds of principals and key personnel, the AML and cybersecurity programmes, the consumer-protection framework and the capitalisation of the business. Application review timelines have historically extended well beyond the initial statutory period, though NYDFS has taken steps to improve processing times. Operators should plan for a multi-year pathway to approval, with material management bandwidth consumed throughout.
The alternative for some businesses is geographic segmentation: build the exchange for non-New York users initially, capture the institutional or custodial side of the New York market through a separately licenced or NYDFS-approved partner, and pursue the BitLicense once the rest of the US stack is operational and revenue-generating. Whether that strategy fits depends on the business model, the investor base and the institutional relationships at stake. We map that decision matrix explicitly with clients before they commit to a filing sequence.
How Do AML and Travel Rule Obligations Apply to a US Crypto Exchange?
AML obligations for a US crypto exchange flow from the Bank Secrecy Act and FinCEN's implementing rules, which require a written AML programme, Customer Identification Program (CIP), transaction monitoring, Suspicious Activity Report filing and Currency Transaction Report filing above the applicable threshold. These are not optional elements of a compliance programme – they are conditions of MSB registration and are examined by FinCEN and, where applicable, by state regulators.
The Travel Rule (the obligation to pass originator and beneficiary data alongside a virtual asset transfer) applies to US money-services businesses under FinCEN's existing rules, making the United States one of the earliest jurisdictions to impose the obligation on crypto businesses. The threshold and the technical implementation requirements have been the subject of ongoing regulatory guidance. Practically, this means an exchange must have counterparty data-exchange protocols in place with other VASPs before processing transfers above the applicable threshold – a requirement that intersects directly with the choice of technology stack and the list of permitted counterparty exchanges.
OFAC sanctions screening is a parallel obligation that runs irrespective of MSB status. Any exchange with US nexus – including a foreign exchange processing transactions for US-person customers – must screen against OFAC's Specially Designated Nationals list and comply with all applicable sanctions programmes. In our cross-border practice, we regularly see operators underestimate the reach of OFAC: it applies to US persons wherever located, to any transaction involving US-dollar settlement and, in certain programmes, extraterritorially. The consequence of a sanctions violation can be existential for a banking relationship.
What Does the Cross-Border Structuring Reality Look Like for a US Crypto Exchange?
Few crypto exchanges set up exclusively in the United States. The more common pattern for an inbound operator is a structure in which a non-US holding company – often in a jurisdiction such as the BVI, Cayman Islands or a European hub – owns a US operating subsidiary that holds the MTL stack and the FinCEN registration. That parent-subsidiary model contains the US regulatory perimeter, preserves the ability to serve non-US markets through the offshore entity, and separates the capital and bonding requirements of the US licences from the rest of the group's liquidity.
The tax dimension of that structure is non-trivial. A foreign-owned US operating company is subject to US corporate income tax on its US-source income, and the FDAP and ECI rules can reach certain payments made to the foreign parent. Transfer-pricing obligations apply to intercompany arrangements. Where the parent holds intellectual property or a platform licence and charges a royalty to the US entity, the structure needs to be defensible under both US and OECD transfer-pricing standards. We advise on the licensing architecture alongside allied counsel in the tax jurisdictions concerned – the two conversations must happen together, not sequentially.
Banking is the operational chokepoint that no amount of regulatory authorisation resolves by itself. US-licenced crypto exchanges have faced persistent pressure from correspondent banks, and the de-risking trend that began before 2020 has not fully reversed. An MTL and a FinCEN registration are necessary but not sufficient for a stable banking relationship. The banking strategy – which institutions, which account structure, which jurisdictions for settlement rails – is built in parallel with the licensing timeline, not after the licences land.
In a recent cross-border structuring matter, a payments business with an existing EU regulatory authorisation sought to expand its exchange operations into the US market. We mapped the MTL priority sequence across the states where its projected user base was concentrated, identified the FinCEN registration requirements, coordinated the AML programme alignment between the EU and US entities, and connected the client with US banking relationships willing to onboard a newly licenced MSB. The client launched in a subset of target states within a commercially viable timeline, with a phased expansion plan to the remaining states already documented.
If a prior MTL application stalled or a US banking relationship closed, a second read can surface the structural reason and the route back. Contact OBOLUS at info@oboluslaw.com to discuss your specific situation.
Which Operator Profile Should Pursue Which US Licensing Path?
The right licensing path in the United States depends on the operator's business model, user geography, asset scope and institutional ambitions. There is no single sequence that fits every inbound business, and the cost of choosing the wrong starting point compounds over time as regulators compare applications against each other.
A retail exchange targeting broad US consumer access needs a full MTL stack across its target states, FinCEN registration, a functioning AML programme and – if New York is in scope – a BitLicense or NYDFS trust charter application running in parallel. The capital and timeline implications of that programme are substantial. Operators in this profile benefit most from a phased state strategy with clear decision gates before each new state is added.
A B2B or institutional exchange serving accredited investors or financial institutions can often stage the MTL build around the specific states where its counterparties are domiciled. The FinCEN baseline still applies, but the breadth of the consumer-facing MTL requirement is reduced. Where the assets traded include potential securities, a separate dialogue with SEC counsel is required before the platform onboards institutional clients.
A foreign exchange seeking US institutional access without a full retail launch may be able to structure the US presence as a limited-purpose entity – a broker introducing order flow to a separately licenced US entity, for example – rather than holding its own full MTL stack. That model has its own regulatory conditions and limits, but it can reduce the initial compliance investment while the business validates the US market opportunity.
An operator seeking to serve US persons from offshore who believes that geo-blocking or IP-filtering resolves the jurisdictional question is operating on a premise that US regulators and courts have repeatedly rejected. FinCEN and the SEC have pursued enforcement against foreign exchanges where US-person activity was demonstrably occurring regardless of terms-of-service disclaimers. The exposure in that scenario is not just regulatory – it is reputational and criminal.
What Are the Most Common Mistakes in US Crypto Exchange Setup?
The mistakes we encounter most frequently in US crypto exchange setup files fall into a predictable pattern – and they are almost always architectural, made before the first regulatory filing rather than during it.
The first is token-classification deferral. Operators launch with an asset list that includes tokens whose regulatory status under federal securities law has not been assessed, and the question surfaces only when an enforcement inquiry arrives. By that point, the exchange has months of transaction history with an unanalysed asset class, and the remediation is significantly more expensive than the initial analysis would have been.
The second is sequential rather than parallel planning. The licensing timeline, the banking strategy and the AML programme build are treated as separate workstreams to be resolved in order. In practice, the banking relationship depends on the licence status, the AML programme is reviewed by the licensing examiner, and the licence application asks about banking arrangements. All three tracks must run concurrently from day one.
The third – and most persistent – is the offshore-licence fallacy. A common assumption is that a well-regarded VASP registration in a European hub, in the BVI or in the Cayman Islands provides a compliance foundation for US operations. It does not. US regulators assess US nexus independently of any foreign authorisation. The offshore licence is relevant to the foreign market it covers; it carries no weight in an FinCEN examination or an NYDFS application review.
The fourth is underestimating the OFAC dimension. An exchange that has resolved all of its licensing questions but has not built a sanctions-screening programme that matches the sophistication of its transaction volume is operating with a live enforcement risk. OFAC penalties for crypto-related sanctions violations have been material, and the "we didn't know the customer was sanctioned" defence carries little weight without documented screening controls.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – the full spectrum of OBOLUS licensing practice across 70+ jurisdictions
- How to Set Up a Licensed Crypto Exchange – a step-by-step guide to the exchange licensing process from entity to first user
- Tax Regime for Digital Assets in Hong Kong – the Hong Kong tax treatment of digital assets for exchanges and investors
FAQ
How long does a crypto licence take to obtain?
In the United States, the timeline depends on the scope of the MTL programme and the states involved. FinCEN MSB registration is a filing that can be completed relatively quickly once the AML programme is in place. State MTL applications vary from a matter of weeks in simpler jurisdictions to many months in states with more demanding review processes. The NYDFS BitLicense is a multi-year commitment for most applicants. In other major licensing hubs – Singapore, the UAE, the EU under MiCA – timelines vary by category and regulator workload. We provide jurisdiction-specific timeline guidance as part of every licensing scoping engagement.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The optimal jurisdiction depends on your business model, user geography, asset types, banking requirements and tax structure. A US-focused exchange must engage the federal and state MTL regime regardless of where the holding company sits. A business seeking broad global access may combine a US entity for the American market with a MiCA-authorised EU entity and a Singapore or UAE licence for other regions. We map the licence stack across operating, custody and payment layers before you commit to a structure – because the wrong starting jurisdiction creates compounding remediation costs.
Do I need a separate custody licence?
In the United States, holding customer digital assets as a custodian is a regulated activity in most states that have addressed the question, and the NYDFS regime specifically addresses custodial services through its trust company charter pathway. At the federal level, the SEC has taken the position that qualified custodian requirements apply to investment advisers holding client crypto assets. Whether your exchange model triggers a separate custody licence depends on the structure of the asset-holding arrangement, the asset types and the states of operation. This is one of the threshold questions we resolve in the initial scoping phase of every US exchange mandate.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance structures that sit around them. Digital assets are the whole of our practice. We map the licence, banking and AML stack across the operating, custody and payment layers before you commit – because the architecture decisions made before the first filing determine the compliance cost for years afterward. To discuss your US market-entry structure, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in US federal and state digital-asset licensing strategy for inbound and domestic operators.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.