Operating a digital-asset business in the United States without the right federal and state authorisations exposes the company to enforcement actions, payment-rail shutdowns, and a banking environment that will close accounts first and ask questions later. The U.S. regulatory regime for virtual asset service providers (VASPs) is not a single licence — it is a layered stack of federal registration, state money-transmission licensing, and, in some cases, specialised state authorisations such as the NYDFS BitLicense. Understanding which layers apply, in which sequence, and how they interact with the cross-border structure of a digital-asset business is the threshold question every inbound operator must answer before the first customer transaction clears.
This page maps the federal and state-level authorisation requirements for VASPs entering or operating in the U.S. market, the process an inbound business should follow, and the cross-border tax and banking considerations that shape the decision.
The Federal Baseline: FinCEN, the SEC, and the CFTC
At the federal level, a VASP operating in the U.S. market must register with FinCEN (the Financial Crimes Enforcement Network) as a money services business (MSB) if it engages in money transmission involving virtual currencies. FinCEN registration is not a licence in the traditional sense — it is a threshold AML/CFT compliance obligation that activates the full suite of Bank Secrecy Act requirements, including customer identification, suspicious activity reporting, and, critically for cross-border operators, compliance with the Travel Rule (the obligation to pass originator and beneficiary identification data with qualifying transfers). Failure to register before conducting regulated activity is a federal criminal exposure, not merely an administrative deficiency.
Beyond FinCEN, the nature of the tokens and services determines whether the SEC or CFTC also asserts jurisdiction. Tokens that qualify as securities under applicable federal law bring the business within the SEC's registration and broker-dealer framework. Tokens classified as commodities — a category that has historically included Bitcoin and Ether in regulatory guidance — may engage the CFTC's oversight, particularly for derivatives and leveraged products. In our cross-border practice, we routinely advise clients that the federal-layer analysis is a threshold exercise that must precede any state-level licensing work. Getting the token classification wrong at the outset generates structural errors that cascade through the entire licence stack.
For a scoped federal-layer assessment of your token and service model, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts — the entity, the user base, the token types — change the analysis at every layer.
State Money-Transmission Licensing: The Fifty-State Problem
State money-transmission licensing (MTL) is the most operationally demanding element of U.S. VASP authorisation, because there is no single federal money-transmission licence — each state administers its own regime, with its own capital requirements, surety-bond thresholds, application fees, examination standards and permitted-activity definitions. A business that transmits value involving virtual currency on behalf of customers in a given state generally requires that state's MTL before serving residents of that state.
The practical consequence is significant. A full national rollout means managing applications across dozens of jurisdictions simultaneously, with each state operating on its own timeline. Some states process applications in a matter of weeks; others take many months. Capital and surety-bond requirements vary materially by state — a figure that, because it is subject to frequent adjustment and varies by licence tier, must be verified directly with each state regulator or through a current regulatory database rather than stated as a fixed number here. The Nationwide Multistate Licensing System (NMLS) is the common submission portal for most states, but uniformity of the portal does not mean uniformity of the underlying requirements.
Operators we advise routinely underestimate the ongoing compliance burden of state MTL portfolios. Each licence carries annual renewal obligations, examination exposure, change-of-control notification requirements and, in some states, restrictions on permissible investments of customer funds. Managing a multi-state portfolio is a full-time compliance function, not a one-time application exercise.
The NYDFS BitLicense: A Regime Within a Regime
New York's BitLicense, administered by the New York State Department of Financial Services (NYDFS), is the most demanding state-level virtual-currency authorisation in the U.S. and, in terms of substantive requirements, among the most demanding in any jurisdiction globally. It applies to entities engaged in virtual-currency business activity involving New York or New York residents — a jurisdictional hook that catches many foreign businesses that did not initially consider themselves subject to it.
The BitLicense regime requires, among other things, a detailed application covering capital adequacy, cybersecurity standards, AML/KYC programme documentation, background checks on principals, and a detailed description of the business model and technical architecture. NYDFS has published a comprehensive cybersecurity regulation that applies to licensees, and the regulator has demonstrated consistent willingness to examine and enforce against licensees and, in some cases, against unlicensed entities operating in the state. The NYDFS also operates a conditional BitLicense pathway and a "greenlist" of pre-approved coins — structural features that affect which products a licensee may offer without additional approval.
Alternatively, a business may apply to NYDFS for a New York limited-purpose trust company charter, which carries its own capital and governance requirements but provides a different set of permitted activities — particularly relevant for custodians and fiduciaries. In our practice, we have seen clients default to the BitLicense without first modelling whether the trust-company route better fits their custody-heavy service model. That analysis is worth running before the application is filed.
How Does Federal Registration Interact With State MTL?
Federal FinCEN registration and state MTL authorisations are independent, parallel obligations — neither satisfies the other. A business that has registered with FinCEN as an MSB is still unlicensed in every state in which it operates without a state MTL. Conversely, holding state MTLs does not substitute for FinCEN registration or for SEC/CFTC registration requirements where those apply.
The interaction point that surprises most inbound operators is the AML/CFT programme obligation. FinCEN requires a written, risk-based AML programme at the federal level. Each state MTL may impose its own AML programme requirements. NYDFS overlays a further, more detailed compliance-programme standard. A well-structured compliance programme should be designed to satisfy all three layers simultaneously — rather than creating three separate documents that generate internal inconsistencies and examination risk.
The Travel Rule obligation — requiring transmission of originator and beneficiary data on qualifying transfers — applies at the federal level under FinCEN rules and is increasingly enforced across the state MTL environment as well. For cross-border transfers, the Travel Rule interacts with the FATF Recommendation 15 framework that other jurisdictions apply, creating a data-sharing compliance question that touches the technical architecture of the transfer system itself.
What Is the Right Process for an Inbound Operator?
An inbound operator entering the U.S. market should follow a structured sequencing rather than beginning state MTL applications before the federal and token-classification questions are resolved. The logical order runs as follows.
The first step is a token and activity classification analysis — determining which federal regulators have jurisdiction over the specific tokens and services offered. This analysis drives the entirety of the downstream licensing strategy. A misstep at this stage is expensive to correct after state applications have been filed.
The second step is a state-footprint analysis — identifying which states the business will actively serve, by which channel, and what triggering activity (solicitation, transmission, custodial holding) the applicable state statutes define as requiring a licence. Not every business must be licensed in all fifty states on day one; a phased approach that matches licensing pace to market-entry pace is commercially rational and regulatorily defensible if structured correctly.
The third step is FinCEN MSB registration, which must be completed before the business begins operating as a money transmitter. FinCEN registration is a prerequisite, not a concurrent filing.
The fourth step is the state MTL application programme — filed through NMLS where available, supplemented by direct state-agency submissions. Priority states (New York, California, Texas, Florida, Illinois) represent both the largest user bases and the most complex compliance environments; in our practice, we recommend building the programme around the most demanding state requirements first, then adapting downward rather than trying to retrofit a minimal-compliance model upward.
NYDFS BitLicense applications require additional preparation time, given the documentation depth required. Businesses planning to serve New York customers should factor a materially longer runway for that component.
Cross-Border Tax and Banking: The Structural Decisions That Precede Licensing
For an inbound foreign operator, the U.S. licensing question cannot be separated from the entity and tax structure. A foreign entity operating in the U.S. may generate a taxable presence — an effectively connected income or permanent establishment — depending on the level and nature of U.S. activity. The licensing structure and the tax structure must be designed together. In several mandates, we have seen businesses file MTL applications in the name of a foreign parent entity that creates unintended U.S. tax exposure; restructuring after the fact is materially more disruptive than planning before.
Banking access is the other critical constraint. U.S. banks remain cautious about crypto business customers, particularly for FinCEN-registered MSBs operating across multiple states. MTL-licensed operators have meaningfully better access to banking relationships than unlicensed operators, but the licence alone does not guarantee a banking partner. We regularly advise clients on structuring the banking engagement in parallel with the licensing programme — identifying partners whose risk appetite matches the business model before the account is needed operationally.
For businesses holding assets on behalf of U.S. customers, the custody question also intersects with licensing. Some state MTLs permit ancillary custody of digital assets within the transmission licence framework; others require a separate authorisation. NYDFS, for example, distinguishes between BitLicense-permitted activities and trust-company-permitted activities in ways that matter materially for custody-centric business models.
To map the licence, banking, and tax stack for your U.S. build, write to OBOLUS at info@oboluslaw.com. If a prior application stalled or a banking relationship closed, a second review can identify the structural reason and the route forward.
A Common Assumption: Does an Offshore Licence Cover U.S. Operations?
A persistent assumption among inbound operators is that a well-regarded offshore VASP licence — whether from the BVI FSC under the VASP Act 2022, CIMA under the Cayman VASP regime, or even a MiCA CASP authorisation in the EU — is sufficient to serve U.S. customers without U.S.-layer authorisation. It is not. U.S. federal and state money-transmission law applies based on where customers are located and where transactions touch the U.S. financial system, not where the operator is licensed. An entity holding a BVI or Cayman registration and transmitting value on behalf of U.S. residents is a U.S. money transmitter for FinCEN purposes and requires state MTLs in the states where it serves customers.
The offshore licence may still be valuable — as a structuring element, as a passport within its home jurisdiction's regime, or as the entity through which non-U.S. business is conducted. But it does not substitute for U.S.-layer compliance. Operators we advise who have relied on offshore licences for U.S.-customer servicing have, in several cases, discovered this exposure only when a banking partner or institutional counterparty requested confirmation of U.S. regulatory status. That discovery is considerably more expensive to manage than front-end compliance planning.
In Practice: A Licensing Sequencing Matter
In a recent licensing engagement, a payments company domiciled in a European jurisdiction sought to expand its U.S. customer base through a direct-to-consumer stablecoin transfer product. The company held a MiCA-adjacent VASP registration in its home market and assumed that U.S. operations could proceed through a subsidiary once state MTL applications were filed. On review, the token classification analysis identified that the product triggered FinCEN MSB registration obligations before any state-level filing, and that two states in the initial target footprint required BitLicense-equivalent authorisations that the existing corporate structure could not support. We restructured the entity stack, sequenced the federal registration ahead of the state MTL programme, and identified a banking partner whose existing MTL-client portfolio meant a materially faster account-opening process. The business entered its priority states in a sequence aligned with its licensing readiness rather than its marketing calendar.
Which Profile Needs Which Authorisation Path?
A foreign exchange operator entering the U.S. market with a spot-trading product for institutional counterparties faces a different authorisation path than a consumer-facing stablecoin remittance app. The institutional exchange operator's first question is token classification — whether the assets it lists trigger SEC broker-dealer or alternative trading system registration requirements. If the assets are commodities, the CFTC framework applies to derivatives. State MTL exposure depends on whether fiat currency moves through the platform on behalf of customers. The timeline for this profile is driven by the federal-layer analysis, which must precede state filings.
A consumer remittance product that transmits stablecoins to end users in the U.S. is almost certainly a money transmitter at both the federal and state levels from day one. For this profile, FinCEN registration is immediate, state MTL applications should be sequenced against the intended state rollout, and NYDFS BitLicense should be planned for if New York is in the footprint. Banking is a parallel workstream, not a follow-on task. The timeline is measured in months — and in some states, longer — from first application to first licensed operation.
A custody-centric business — holding digital assets for U.S. institutional clients — faces the additional question of whether the MTL framework in each target state extends to custody, or whether a trust company charter or a separate state-specific custodian licence is required. This profile should model the New York trust-company route seriously alongside the BitLicense, given the different permitted activities each provides.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – the OBOLUS approach to the full licence-stack mandate across jurisdictions
- Economic substance for licensed VASPs – meeting substance requirements after the licence is granted
- Creditor claims in crypto insolvency – protecting your position when a counterparty becomes insolvent
FAQ
How long does a crypto licence take to obtain?
In the U.S. context, timelines vary significantly by authorisation type and state. FinCEN MSB registration can be completed in a matter of days once the required information is assembled. State MTL applications range from several weeks in faster-processing states to many months in states with more demanding review processes. The NYDFS BitLicense is among the longer processes, reflecting the depth of documentation required. A realistic planning assumption for a multi-state programme is that full operational licensing across a priority footprint takes the better part of a year from first application submission.
Which jurisdiction is best for licensing my crypto business?
There is no universally optimal jurisdiction. A business with U.S. customers needs U.S.-layer authorisation regardless of where its holding entity sits. For the operating layer, the right jurisdiction depends on the service model, the customer base, the token types, and the banking requirements. For entities seeking a non-U.S. base for non-U.S. business alongside a U.S. compliance programme, the choice between EU MiCA, VARA in Dubai, MAS in Singapore, or other regimes depends on a multi-factor analysis. We map that choice as part of the initial structure mandate.
Do I need a separate custody licence?
Whether a separate custody authorisation is required depends on the state and the nature of the custodial activity. Some states treat custody of digital assets as falling within the scope of a money-transmission licence; others require a distinct authorisation. In New York, NYDFS distinguishes between BitLicense-permitted activities and trust-company-permitted activities in ways that are material for custody business models. Federal-level SEC custody rules may also apply depending on the customer type and asset classification. A custody-specific licensing analysis should be conducted before the service is launched.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, including the full federal and state-level stack in the U.S. market. We map the licence, banking and tax structure as one mandate rather than three disconnected workstreams — because the structural decisions interact, and errors in sequencing are expensive. To discuss your U.S. entry or compliance position, contact info@oboluslaw.com or reach us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst — specialises in multi-state U.S. VASP authorisation strategy and inbound operator licensing across federal and state regulatory layers.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.