Operating a crypto business across US state lines without the right authorisation exposes the company to enforcement action, account termination and personal liability for principals. The United States does not operate a single federal EMI licence (electronic money institution authorisation) of the kind found in Europe under MiCA. Instead, the US imposes a layered regime: federal obligations administered by FinCEN, the SEC and the CFTC sit alongside a patchwork of state-level money transmission licences (MTLs) – one per state where the business touches customers or moves value. For a crypto firm planning US market access, understanding that patchwork before the first transaction is not optional; it is the condition of sustainable operations.
This page maps the federal and state licensing obligations that apply to crypto businesses, the sequencing of a multi-state licensing programme, how that programme interacts with tax and banking, and the structural decision a cross-border operator must make before committing resources to a US build.
The US regulatory regime for crypto firms: no single licence
No single federal crypto licence exists for most digital-asset businesses in the United States. FinCEN (the Financial Crimes Enforcement Network) requires money services businesses (MSBs) – including crypto exchangers and administrators – to register at the federal level under the Bank Secrecy Act. That registration is a compliance obligation, not a licence to operate; it runs in parallel with, not in place of, state authorisation. The SEC and CFTC assert authority over tokens that qualify as securities or commodity derivatives respectively, adding a further federal layer for exchanges and intermediaries that handle those instruments.
The practical result is that a crypto firm touching US customers typically needs: an MSB registration with FinCEN; an MTL in each relevant state (subject to available exemptions); and, depending on the product, either broker-dealer or futures commission merchant registration at the federal level. The NYDFS BitLicense applies specifically to virtual-currency businesses operating in New York and is widely regarded as the most demanding single-state authorisation in the country. These obligations stack, they do not substitute for each other.
For an inbound operator, the first structural question is not which licence to apply for. It is which states trigger an MTL obligation and whether the product touches a securities or commodities boundary that activates federal registration. That analysis precedes every application.
To map the precise licence stack for your US build, contact OBOLUS at info@oboluslaw.com. The facts – your entity structure, user geography and product features – determine whether one filing or twenty is the right starting point. Map your options
What federal obligations apply to a crypto business?
Federal-level obligations for a US crypto business fall into three overlapping categories: AML/CFT registration, securities regulation and commodities regulation. Each is administered by a separate agency with independent enforcement authority.
FinCEN registration as an MSB is mandatory for any business that exchanges virtual currencies for fiat or other virtual currencies as a regular business activity, or that administers a virtual currency programme. Registration is completed through the BSA E-Filing system and triggers ongoing AML programme, recordkeeping and suspicious-activity reporting obligations. The Travel Rule – the obligation to pass originator and beneficiary data with a transfer – applies to covered MSBs above the applicable threshold under FinCEN guidance.
The SEC's position, developed through enforcement and guidance rather than a dedicated crypto statute, is that many tokens constitute investment contracts under established federal securities doctrine. A business that operates a trading platform, issues tokens or provides investment advice in relation to tokens that may qualify as securities must consider registration as a broker-dealer, alternative trading system or investment adviser, as applicable. Failure to register is itself a federal violation, independent of any state-level issue.
The CFTC has asserted jurisdiction over Bitcoin and Ether as commodities. Platforms offering derivatives, margin trading or futures on those assets face a separate registration track through the CFTC. The boundaries between SEC and CFTC jurisdiction over specific tokens remain an active area of regulatory and judicial development; any firm whose product could fall on either side of that line needs a considered position before launch.
Operators we advise routinely underestimate the SEC/CFTC question. Token classification is a substance-over-label exercise: the rights conferred, the reasonable expectations of purchasers and the degree of managerial effort involved determine the outcome, not the whitepaper description.
How does the state money transmission licence (MTL) system work?
State money transmission laws require any business that transmits money – including virtual currency – on behalf of consumers to hold an MTL in each state where it operates, subject to available exemptions. The definition of "money transmission" and its application to crypto activity varies materially by state. Most states have now explicitly extended their MTL statutes to cover virtual currency transmission, but the precise scope differs: some states exempt certain business-to-business activity; others have narrower token-type carve-outs; a small number have enacted distinct virtual-currency frameworks alongside or in place of the general MTL regime.
New York's BitLicense, administered by the NYDFS, is the most demanding single-state authorisation. It requires a dedicated application covering capital adequacy, cybersecurity, AML/BSA programme, consumer protection and business continuity – with ongoing supervision requirements that mirror bank-grade oversight. Many operators choose to obtain the BitLicense first, given New York's market importance, and treat it as the high-water mark against which other state applications are calibrated.
Most other states process applications through the Nationwide Multistate Licensing System (NMLS), a centralised platform that allows a single application to be submitted to multiple states simultaneously. A coordinated multi-state filing programme – sequencing states by commercial priority and managing surety bond and capital requirements across the portfolio – is materially more efficient than sequential individual filings. In our practice, the sequencing decision is as consequential as the individual application itself: a poorly ordered programme can leave a firm unlicensed in its largest revenue state while licences accumulate in markets it has yet to serve.
Timeline varies by state and application quality. Some states process within a matter of weeks; New York and several other major states typically require a considerably longer review period, measured in months. Application quality – completeness, document organisation, AML programme robustness – is the primary driver of pace. Deficiency letters reset timelines.
What does the NYDFS BitLicense actually require?
The NYDFS BitLicense is a standalone virtual-currency business activity licence, distinct from New York's general MTL. A business needs a BitLicense if it conducts "virtual currency business activity" in New York – a defined term covering exchange, transmission, custody and administration of virtual currencies for New York residents, regardless of where the business is incorporated or physically located. Nexus to New York is user-based, not entity-based.
The application is substantive. NYDFS requires detailed submissions on: corporate history and organisational structure; biographical information on principals and significant shareholders; a compliance programme covering AML, BSA, sanctions screening and consumer protection; cybersecurity policies meeting the NYDFS cybersecurity regulation standard; financial projections; and a description of the business model, including the technical operation of any exchange or custody service. NYDFS has authority to impose conditions, require capital adjustments and supervise licensees on an ongoing basis.
A common mistake in our practice is firms treating the BitLicense as a compliance filing rather than a regulatory authorisation. NYDFS reviews the application as a regulator, not as a registry. Examiners ask substantive questions about the technology, the key personnel and the financial controls. A firm that has not fully built out its compliance infrastructure before applying will receive a deficiency letter – and that letter resets the clock.
The NYDFS also administers a conditional BitLicense framework, allowing qualifying firms to operate under a limited authorisation while a full application is pending. Eligibility criteria apply; not every applicant qualifies.
How does the US licence stack interact with cross-border operations?
For a crypto firm operating across jurisdictions – a common scenario for any business with US users alongside an EU, UAE or Asian base – the US licensing programme does not exist in isolation. It sits alongside the entity's obligations in its home jurisdiction and the jurisdictions where it holds or moves assets.
Banking is the first friction point. A US MTL – and in particular a BitLicense – signals to banking partners that the firm has met a US regulator's standard. That signal has value outside the US: some international banks that would otherwise decline a crypto firm will engage once a NYDFS or major-state MTL is in place. Conversely, a firm that holds a non-US licence and serves US users without an MTL risks losing its banking rails when a US correspondent bank flags the activity.
Tax interaction is the second. A foreign entity that obtains a US money transmitter licence and serves US customers may create a taxable presence – a "permanent establishment" or "effectively connected income" nexus – depending on the structure. The entity-level decision (whether to operate through a US subsidiary, a branch or a contractual arrangement) should be taken before the licence application, not after. We regularly advise clients who have approached the licensing programme without resolving the tax structure, and the sequencing correction adds time and cost that is avoidable.
Third, for businesses that hold custody of US-person assets, OFAC sanctions screening obligations apply regardless of the entity's home jurisdiction. The FinCEN and OFAC frameworks interact: a firm that registers as an MSB must also maintain a sanctions screening programme adequate for its transaction profile. These are not separable compliance projects.
In a recent licensing matter, a payments business domiciled in the EU sought to extend its product to US users. The business held an EU licence and assumed its existing AML programme would satisfy US requirements with modest adaptation. On review, the FinCEN and NYDFS expectations for transaction monitoring, suspicious-activity reporting and customer due diligence required material enhancements. We restructured the compliance programme before the application and the BitLicense was granted without a deficiency letter – a significantly faster outcome than the firm's original timeline projected.
If a prior US application stalled or a banking relationship was closed, a structural review can identify the gap and map the route to authorisation. Contact OBOLUS at info@oboluslaw.com for a scoped assessment. Map your options
Which crypto businesses need a US licence and which are exempt?
The threshold question – does a given business need an MTL or a BitLicense – turns on whether it engages in "money transmission" or "virtual currency business activity" with or for US persons. The analysis is fact-specific, but several patterns recur.
A crypto exchange that matches buy and sell orders for US-resident customers and settles in fiat or virtual currency is almost certainly conducting money transmission in every state where those customers reside. An exchange that restricts its platform to non-US persons through robust geoblocking and KYC procedures, and can demonstrate that restriction to a regulator, may avoid the obligation – but the bar for that demonstration is high. "No US IP addresses" is not sufficient; regulators examine actual customer nationality and residency data.
A pure self-custody wallet provider, with no control over user funds and no exchange or transmission function, occupies a different position. FinCEN has issued guidance distinguishing administrators and exchangers – who are covered MSBs – from users and certain software providers who are not. The boundary is technology-specific: a wallet that also offers exchange functionality, or that operates a non-custodial mixer with certain characteristics, may be a covered MSB despite the non-custodial framing.
A stablecoin issuer that accepts fiat and issues stablecoins against it is conducting an activity that several states treat as money transmission. The federal-level treatment of stablecoin issuance under emerging legislative proposals adds further uncertainty. Firms in this category should obtain a current analysis rather than relying on the status quo.
Custody-only businesses – firms that hold virtual assets for clients but do not transmit or exchange – fall under a separate analytical track. Some states have specific custody licensing requirements; others treat custody as incidental to a broader money transmission analysis. The federal custody question is distinct again: whether custody of tokens that qualify as securities triggers SEC investment adviser or custodian requirements is a live issue.
Which profile should choose which US licensing path?
The right licensing programme depends on three variables: the product, the states served and the entity structure. The following outlines the principal profiles we see in practice.
Profile A – Full-service exchange serving US retail. This profile requires FinCEN MSB registration, MTLs in all states where customers reside (or a phased approach starting with highest-revenue states and expanding), and a BitLicense for New York. If the exchange lists tokens that could be securities, federal broker-dealer analysis is mandatory before launch. Timeline: phased, with the NYDFS process driving the longest single path. The surety bond and capital requirements across a 50-state portfolio are material; budget and balance sheet planning should precede the application programme.
Profile B – Payments business or stablecoin issuer. This profile sits squarely within FinCEN's MSB definition and the MTL regime of most states. The NYDFS BitLicense applies to New York-nexus activity. If the stablecoin issuance model involves accepting US-person fiat, a money transmitter analysis in the issuer's home state is the first filing. The cross-border structure – particularly whether the issuer entity is US-based or foreign – determines both the tax exposure and the scope of US licensing required.
Profile C – Custody-only business. The licensing path is less standardised than for exchangers. Some states explicitly licence cryptocurrency custodians; others require a broader money transmitter analysis. A federal securities custody analysis is required for any firm that holds tokens with potential securities characteristics. This profile benefits from a state-by-state mapping before committing to a US entity, as the licensing burden varies significantly by state.
Profile D – Institutional-only platform (no retail US clients). Where a firm can credibly demonstrate that it serves only sophisticated institutional counterparties and does not engage in retail money transmission, the MTL exposure is reduced. However, the FinCEN MSB analysis does not turn solely on client type; the nature of the activity matters. A firm that transmits value on behalf of institutional clients is still an MSB. The institutional designation affects the securities analysis more than the money transmission analysis.
What are the most common mistakes in US crypto licensing?
The mistakes we see most often are structural, not technical. The most consequential is proceeding with product development and customer acquisition before the licence programme is designed. US regulators – particularly NYDFS – will ask about the firm's US customer history during the application review. A business that has been serving New York users for two years without a BitLicense is not in the same position as one applying before launch. The retroactive compliance problem is harder and more expensive to resolve than the prospective one.
A second common mistake is treating the FinCEN registration as a substitute for state MTLs. It is not. FinCEN registration is a federal AML obligation; it does not authorise the business to transmit money in any state. A firm that has registered as an MSB and believes that satisfies its US obligations is exposed in every state where it operates without an MTL.
Third, and especially relevant for inbound operators: relying on the entity's home-jurisdiction licence to cover US activity. A MiCA-authorised CASP, a VARA-licensed exchange or an MAS-regulated DPT service provider has no standing in the US as a result of those licences. US obligations are assessed against US law, applied to US-nexus activity, regardless of what the entity holds elsewhere. Operators we advise from the EU and UAE regularly arrive with this assumption, and correcting it is typically the first step in the US market-entry analysis.
Related at OBOLUS
Related at OBOLUS
- Licensing and registration for digital-asset businesses – full-service licence stack design across 70+ jurisdictions
- ADGM vs AIFC licensing comparison – how two leading non-Western hubs compare for an inbound crypto operator
- Payment institution licensing for early-stage founders – the payment licence process for founders at the pre-Series A stage
FAQ
How long does a crypto licence take to obtain?
Timeline depends on the jurisdiction, the licence type and the completeness of the application. In the US, FinCEN MSB registration processes quickly once submitted. State MTLs range from a matter of weeks in streamlined states to several months or more for New York's BitLicense, which involves substantive regulatory review. Application quality – completeness, AML programme robustness, organised documentation – is the primary driver of pace. A deficiency letter from a state regulator resets the review clock. Building the compliance infrastructure before filing, not during review, consistently produces faster outcomes.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on your target market, product type, entity structure, banking access and tax position. For US market access, US licensing is required regardless of where the entity is domiciled. For a business building a global programme, the US licence stack sits alongside – not in place of – obligations in the EU under MiCA, in the UAE under VARA or FSRA, or in Singapore under the Payment Services Act. The decision matrix turns on where your users are, where your assets are held and where your banking relationships can be maintained.
Do I need a separate custody licence?
In the US, the answer depends on the state and the asset type. Several states have enacted specific custodian licensing requirements for virtual assets; others analyse custody as part of a broader money transmission assessment. Federally, custody of tokens that may qualify as securities triggers a separate analytical track under SEC rules. A business that holds client assets – whether as a standalone custodian or as an incident of exchange operations – should obtain a current state-by-state and federal analysis before assuming that an MTL or BitLicense covers its custody function. In most flagship licensing jurisdictions internationally, custody is a separately regulated activity.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice, and we act only for businesses – not for retail investors or individuals. We map the licence stack across operating, custody and payment layers before you commit, so that the structure is right before the first regulatory clock starts running. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in multi-state US licensing programmes and inbound market-entry structuring for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.