Digital-asset custody licensing in United States (federal + state MTL)

Operating a digital-asset custody business in the United States without the correct federal and state authorizations exposes a company to enforcement action, banking termination and, in the most serious cases, criminal prosecution under federal money-transmission statutes. The US regime is not a single licence: it is a layered stack of federal obligations under the Bank Secrecy Act (BSA) administered by FinCEN, potential registration requirements with the SEC and the CFTC depending on the nature of assets held, and state-by-state money-transmitter licensing (MTL) that varies materially in its application to digital assets. This page maps that stack, explains the inbound-business process and identifies where cross-border structures create the most acute regulatory friction.

For a custody operator expanding into the US market, the core legal question is whether the business constitutes a money services business (MSB) at the federal level, whether state MTL obligations are triggered, and whether any assets held could be characterized as securities requiring a qualified-custodian framework under federal securities law. The answers drive every downstream decision on entity structure, banking and operational scope.

The federal regulatory perimeter for digital-asset custody

At the federal level, FinCEN is the primary gatekeeper for custody businesses that handle value transfers: a business that accepts and transmits convertible virtual currency (CVC) on behalf of others is a money services business under the BSA regime, and MSB registration is mandatory regardless of state licensing status. That obligation sits independently of whether the business holds assets in a custodial wallet, operates a trading desk or facilitates stablecoin settlement. The registration itself is administrative, but the obligations that attach – AML/CFT program maintenance, suspicious-activity reporting and, under the Travel Rule (the obligation to pass originator and beneficiary data with a transfer), transaction-monitoring obligations – are substantive and carry significant penalty exposure.

The SEC and the CFTC add a second federal layer. Where assets held in custody are characterized as securities, the custodian may need to operate as a qualified custodian or broker-dealer under the federal securities regime. Where the assets are commodities or commodity derivatives, CFTC registration may be independently triggered. These are not hypothetical risks: regulators have been willing to re-characterize assets that operators assumed were outside the securities perimeter, with retroactive consequences for any custody arrangements already in place.

The NYDFS BitLicense sits apart from both layers. New York requires a BitLicense for any entity engaged in virtual-currency business activity involving New York residents, and the BitLicense requirements for custody are materially more detailed than most state MTL regimes. Capital requirements, cybersecurity standards and independent examinations are all prescribed. Operators who structure around New York – excluding its residents – take on significant ongoing compliance obligations to make that exclusion demonstrable.

The process above describes the standard federal path. Your facts – the entity type, the asset classes held, the user base and the banking relationships – change the analysis. For a scoped federal-layer assessment, contact OBOLUS at info@oboluslaw.com.

Who needs a licence: custody, exchange and stablecoin operators

The custodial relationship is the trigger: any business that holds private keys on behalf of third parties and can initiate transfers of those assets will almost certainly be an MSB under the BSA, and will trigger MTL filing obligations in the states where its customers are located. The label the operator applies to itself – "vault", "wallet provider", "prime broker" – is irrelevant to regulators. Substance governs.

Exchange operators that also hold assets between trades are simultaneously operating a custody function. That layering means the exchange licence analysis and the custody licence analysis must be run together. A business that licenses its exchange activity while ignoring the custody dimension has addressed half the stack. We have seen this gap surface during banking due-diligence reviews, when correspondent banks identify unlicensed custody exposure and suspend account access as a precautionary measure.

Stablecoin issuers that hold reserves in custodial structures face a separate question: whether the reserve-management function is itself a regulated trust or custody activity. Several states have issued guidance treating reserve custodians as money transmitters or special-purpose depositories. The NYDFS has been particularly active in defining expectations for USD-backed stablecoin reserves held under New York law.

How does state MTL work for custody businesses?

State money-transmitter licensing applies on a state-by-state basis, and custody operators serving US retail or institutional clients must map each state individually rather than assume a uniform national standard. Most states require a licence before a business commences operations with residents of that state. Some states extend MTL to digital-asset custody; others maintain narrower statutes that may or may not capture a pure-custody model depending on whether the business "transmits" value in the technical statutory sense.

A multi-state build typically proceeds through a prioritized filing sequence rather than simultaneous applications in all required states. The highest-risk states – those with the most prescriptive regimes or the largest user bases – are usually addressed first, with a phased rollout to lower-risk or smaller-volume states following. The timeline for each state filing varies by backlog, staffing at the relevant division of financial institutions and the completeness of the initial application. End-to-end, building a nationwide MTL stack is measured in many months, not weeks.

The Nationwide Multistate Licensing System (NMLS) provides a centralized filing infrastructure for most state MTL applications, which reduces administrative duplication. However, each state conducts its own substantive review. There is no federal passporting mechanism equivalent to the EU's MiCA CASP passporting regime: a licence in Delaware does not authorize operations in California. Operators who assume otherwise have encountered enforcement action.

In a recent matter, a payments company that had secured MTL licences in its three primary operating states expanded its user base nationally without completing the remaining state filings. When a banking partner's compliance team flagged the gap during a periodic review, the company faced a compressed remediation timeline under an informal commitment to the bank. We mapped the outstanding state obligations, sequenced the remaining applications by regulatory risk and supported the company through the filing process – achieving a compliant position without the business having to contract its active user base.

Cross-border custody: where the entity sits versus where the users are

For an internationally organized custody business, the legal question is almost never limited to the US alone. A business whose parent entity is incorporated in the Cayman Islands or BVI, whose technology infrastructure runs through a Singapore subsidiary, and whose US clients are served through a dedicated US entity faces a matrix of concurrent regulatory obligations. The US obligations do not disappear because the parent sits offshore; in many cases they are amplified, because federal regulators apply their reach to any business touching US persons regardless of where the legal entity is domiciled.

The Travel Rule creates particular friction in cross-border custody structures. US obligations under the BSA Travel Rule apply to transfers above the applicable threshold, and those obligations must be reconciled with Travel Rule requirements in other jurisdictions – which differ on threshold amounts, data fields required and the technical standards used for inter-VASP messaging. A custody business that manages assets for clients across the US, EU (where MiCA and the Transfer of Funds Regulation apply) and Singapore (where the MAS Payment Services Act imposes its own Travel Rule framework) cannot maintain three separate compliance postures: it needs an integrated data architecture that satisfies all three regimes simultaneously.

Banking is the third axis. US correspondent banking relationships require the domestic entity to demonstrate a clean regulatory posture – active MSB registration, completed MTL filings for states where clients are located, a functioning AML program. Foreign-parent structures can face additional scrutiny if the ultimate beneficial owners or the parent's jurisdiction are on enhanced-due-diligence watch lists. We regularly advise clients on structuring the US entity's documentation package so that the banking conversation begins from a position of demonstrable compliance rather than reactively during account opening.

What does the NYDFS BitLicense process involve?

The NYDFS BitLicense is widely regarded as the most demanding US state-level digital-asset authorization. The application requires detailed disclosure of the business model, technology architecture, cybersecurity program, AML/BSA program, consumer-protection policies, financial statements and background checks on all key personnel and controlling persons. The capital-adequacy requirement is prescribed by NYDFS and is set by reference to the nature and volume of the applicant's business, meaning a startup applicant will face a different calculation than an established operator scaling into New York.

Post-authorization, BitLicensed entities are subject to ongoing examination, mandatory cybersecurity audits, change-of-control approvals and prior NYDFS approval for new virtual-currency product lines. The regulatory relationship is closer and more active than in most other US states. That intensity is also, for certain institutional clients, a trust signal: a BitLicense demonstrates a level of regulatory scrutiny that a simple offshore registration does not.

For operators who want New York market access without maintaining a full BitLicense, the NYDFS has historically offered a charter path for limited-purpose trust companies. This requires more capital and a different governance structure, but it permits a broader range of activities and provides a custody-specific legal framework. The trade-off between the BitLicense and the limited-purpose trust charter is a genuine strategic decision, not merely an administrative preference.

If a prior application stalled or a banking relationship was terminated following a regulatory gap, a structured second review can identify the root cause. Write to OBOLUS at info@oboluslaw.com or message us at t.me/oboluslaw.

Do securities and commodity regulations apply to a crypto custodian?

Federal securities law imposes a qualified custodian requirement on investment advisers that hold client assets, and the question of whether a crypto custodian meets that standard has been actively contested between the industry and the SEC. The SEC's position, articulated through guidance and enforcement posture rather than a formal rule, has been that most crypto custodians do not qualify as qualified custodians for purposes of client-asset safeguarding under the federal investment-adviser regime. That position has significant downstream consequences for funds and managed accounts that hold digital assets.

For a custody operator whose institutional clients include registered investment advisers, the ability to credibly represent qualified-custodian status is a commercial prerequisite. That typically requires either a chartered trust company status at the state level, or a broker-dealer registration under the federal securities regime. Neither is a rapid or inexpensive path. The CFTC has its own set of customer-fund segregation requirements for futures commission merchants and other registered entities, and a custody business that holds assets underlying commodity derivatives must map those requirements independently.

The intersection of state trust-company law, the SEC qualified-custodian analysis and the CFTC segregation rules is where most sophisticated custody builds become complex. Operators who enter the US market planning to serve institutional clients cannot defer this analysis: the institutional client's own compliance team will ask the question before signing a custody agreement, and an uncertain answer ends the conversation.

What are the most common mistakes in US digital-asset custody licensing?

The most frequently recurring mistake is treating the US as a single jurisdiction and assuming that federal MSB registration covers state obligations. It does not. MSB registration with FinCEN and state MTL are independent requirements. A business can be fully registered at the federal level and simultaneously in violation of the law in every state where it has customers.

A second common mistake is the assumption that a single offshore licence is sufficient to serve US clients. It is not. US regulatory reach – under the BSA, under the federal securities laws and under state consumer-protection statutes – attaches to conduct directed at US persons, regardless of where the legal entity sits. A Cayman or BVI registration that was designed for non-US clients does not insulate a business from US obligations when it begins acquiring US customers. In our cross-border practice, we see this misunderstanding most often among European and Asian operators expanding into the US for the first time, whose home-jurisdiction licensing experience gave them confidence that did not transfer to the US context.

A third mistake is building the custody product before completing the licensing analysis. Technology build and regulatory build must run in parallel. Launching a product and then discovering that the product's architecture triggers qualified-custodian or trust-company requirements forces a reconstruction of both the legal structure and the technology stack – at far greater cost than addressing it in the design phase.

Decision guidance: which profile should take which path?

A newly formed custody operator seeking to serve a limited set of institutional clients in its home state should begin with MSB registration with FinCEN and a single-state MTL application in its principal state of operations, while simultaneously mapping the states where it anticipates onboarding institutional counterparties. The timeline for this foundational layer is measured in months, not weeks, and should be initiated before the first custody agreement is executed.

An operator that needs immediate New York market access – because its target institutional clients are headquartered there or its primary banking relationship is New York-based – should treat the NYDFS BitLicense or the limited-purpose trust charter as a day-one priority. The BitLicense path is long and resource-intensive; a business that begins it after other regulatory obligations have been partially addressed will face questions about the gap period. The decision to pursue the BitLicense should be made before operations begin, not after.

A foreign operator entering the US as part of a global expansion should build the US regulatory analysis into the overall group structure design. The US entity must be capitalized appropriately, managed by US-resident officers where the state licensing requires it, and operationally distinct enough from the foreign parent to satisfy the bank's enhanced-due-diligence inquiry. Where the foreign parent holds a licence under a recognized regime – MiCA, the MAS Payment Services Act, the VARA regime – that does not substitute for US authorization, but it does support the narrative of an operator with a demonstrated compliance culture. Regulators and banking partners notice the difference.

Related at OBOLUS

• Licensing and registration for digital-asset businesses – our practice overview across 70+ jurisdictions, from MSB to CASP to VASP
• Cayman Islands vs. Singapore: where to license a crypto business – comparing two leading offshore and Asian hubs for custody and exchange structures
• Worldwide freezing orders in Germany and BaFin enforcement – cross-border asset recovery and regulatory enforcement in a major EU jurisdiction

FAQ

How long does a crypto licence take to obtain?

In the United States, timelines vary substantially by state and by licence type. Federal MSB registration with FinCEN is administrative and can be completed relatively quickly once the required information is assembled. State MTL applications are reviewed individually by each state's financial regulator, and review periods range from several months to well over a year depending on the state, its current backlog and the completeness of the application. The NYDFS BitLicense process is typically among the longest. Building a multi-state MTL stack for national operations should be planned over a period of many months. Beginning the process before operations launch – rather than after – is essential.

Which jurisdiction is best for licensing my crypto business?

There is no universally correct answer. For a business focused on US institutional clients, the US licensing stack is unavoidable regardless of where the parent entity sits: US regulatory reach attaches to conduct directed at US persons. For an operator weighing a primary licensing jurisdiction for non-US activity, the choice turns on the business model, the target client base, the available banking and the operator's own governance capacity. Comparing a Cayman or Singapore structure against a MiCA CASP authorisation requires analysis of the custody, exchange and payment activities independently. A single answer applied to all profiles produces a poor result; the right jurisdiction follows the right legal analysis of the specific build.

Do I need a separate custody licence?

In the United States, custody is not a separately named licence in most states – but the activity of holding digital assets on behalf of others almost always triggers MSB status with FinCEN and state MTL obligations. In New York, the NYDFS BitLicense or a limited-purpose trust charter is required for custody of virtual currencies on behalf of others. Federally, holding assets that qualify as securities may require broker-dealer registration or qualified-custodian status. Whether a standalone "custody licence" is the right framing depends on the asset classes held and the client types served. The practical answer is that custody triggers multiple concurrent obligations, not a single designated licence.

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before a client commits – so that the banking conversation, the institutional client inquiry and the regulator examination all begin from a position of demonstrable compliance. Digital assets are the entirety of our practice. To discuss your situation, contact info@oboluslaw.com.

By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in multi-state US licensing strategy, inbound-operator structuring and the interaction between federal and state digital-asset authorisation regimes.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.