Operating a crypto exchange without the correct regulatory authorisation is not a calculated risk – it is a structural vulnerability. Enforcement actions, account closures and banking withdrawal happen without notice. For an established operator – one already processing volume, already serving institutional and retail clients – the cost of a licensing gap is measured not in application fees but in interrupted revenue and compromised counterparty trust. The question is rarely whether to obtain the right crypto exchange licence (a formal regulatory authorisation to operate a virtual-asset trading platform) but which licences, in which jurisdictions, and in what sequence.
This page sets out the regulated basis for exchange operations across the leading hubs, the practical licensing process, the cross-border complications that trip up even well-resourced operators, and the decision axes that determine the right jurisdiction mix for a given business profile. Where timing or thresholds vary by licence category or regime, we say so – and we write qualitatively rather than invent a figure that belongs in a current filing, not a public analysis.
Why Licensing Gaps Persist in Established Operations
Most established operators do not have a blank-slate licensing problem. They have an inherited-structure problem. A business that launched under a permissive regime, or under an earlier interpretation of an existing regime, now finds that supervisory expectations have hardened – and its current authorisation profile no longer covers the full scope of what it does. The EU's MiCA regulation (Markets in Crypto-Assets Regulation), administered by national competent authorities under ESMA oversight, is the clearest example: a platform that registered as a VASP (virtual asset service provider) under a national AML regime may not be automatically authorised to operate as a CASP (Crypto-Asset Service Provider) once MiCA's authorisation track is fully in force.
The same pressure applies in Dubai, where VARA (the Virtual Assets Regulatory Authority) has introduced activity-based licensing across advisory, custody, exchange, lending and transfer functions. An operator active on the Dubai mainland under an earlier commercial licence without a VARA authorisation faces a clear compliance cliff. The ADGM's FSRA in Abu Dhabi runs a parallel but distinct regime; the two are not interchangeable.
In our practice, we see operators most exposed when three conditions coincide: the core exchange function is licensed, but custody and payment transfer are not separated out; the entity structure was built for a prior regime rather than the current supervisory model; and the banking relationship depends on a correspondent that is itself tightening its crypto-business acceptance criteria. All three create exposure simultaneously.
For a scoped assessment of your current authorisation profile, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the user base, the banking stack – change the analysis. Map your options.
The Regulated Perimeter: What Exchange Activity Requires a Licence?
The regulated perimeter for a crypto exchange turns on what the platform actually does, not on what it calls itself. Across the major hubs, the following activities consistently attract licensing or registration obligations: operating a trading venue where buyers and sellers of virtual assets are matched; holding client assets in the course of providing that service; executing client orders against a proprietary book; and providing transfer or settlement functionality between wallets or accounts.
Under MiCA, these activities map to specific CASP service categories. An operator providing the full stack – matching, custody, transfer – will need authorisation across several of those categories, not a single blanket licence. The VARA regime in Dubai operates on the same logic: licences are activity-based, and operating an unlicensed activity alongside a licensed one does not receive safe harbour treatment.
Singapore's Payment Services Act, supervised by MAS (the Monetary Authority of Singapore), focuses on the payment-token dimension of exchange activity. A platform handling digital payment token services needs a licence under that regime, and the threshold between a standard payment institution and a major payment institution licence turns on transaction volumes – figures that are set in current legislation rather than reproduced here, because they move.
In Hong Kong, the SFC (Securities and Futures Commission) requires a VASP licence for operators of virtual-asset trading platforms. In the UK, the FCA (Financial Conduct Authority) requires cryptoasset registration under the Money Laundering Regulations, with additional financial-promotion obligations layered on top. The point is not that every regime is the same – they are not – but that the regulated perimeter in each hub is now drawn broadly enough that a full-service exchange cannot easily argue it falls outside it.
How Does the Licensing Process Work for an Established Operator?
For an established operator, the licensing process differs materially from a greenfield application. The regulator will have access to transaction data, complaint records and any prior supervisory correspondence. What reads as a strength on a first application – volume, a live user base, institutional counterparties – reads simultaneously as a compliance obligation already in motion. Regulators in the leading hubs increasingly expect the application to address not only the prospective business plan but the current operational reality.
The practical sequence runs as follows. First, a gap analysis: mapping current activities against the regulated perimeter in each target jurisdiction, identifying where existing authorisations leave gaps, and flagging where the entity structure needs adjustment before an application is viable. Second, pre-application engagement: in most flagship regimes, the ability to have a pre-filing meeting with the regulator is underused by operators who are trying to minimise exposure time. Used well, it surfaces objections before they become refusal grounds. Third, the formal application: fitness-and-propriety assessments of key individuals, an AML/CFT programme aligned to FATF Recommendation 15 (the FATF standard for virtual-asset service providers), a technology risk assessment, and a financial-resources demonstration.
Timeline varies materially by jurisdiction and by the complexity of the application. Regulators in well-resourced hubs can move in a matter of months on a clean, well-prepared file; others take considerably longer. What consistently extends timelines is not the formal review clock but the back-and-forth on incomplete documentation – a fixable problem if the file is prepared to the right standard before submission.
The cross-border angle matters here. An established operator typically cannot afford to stop serving clients in one jurisdiction while it waits for a licence in another. Structuring the sequencing – which jurisdiction to lead with, which to passport from under MiCA, which to run through a separate subsidiary – is a material part of the advice, not an afterthought.
Common Mistakes That Delay or Damage Established Operator Applications
Established operators make predictable mistakes, and most of them are structural rather than procedural. The most common is treating the licensing project as a compliance task rather than a strategic one. An application that simply describes the current business without a forward-looking compliance architecture – and without addressing known gaps honestly – will not survive regulatory scrutiny in any of the leading hubs.
A second mistake is underestimating the fit-and-proper assessment. Regulators assess beneficial owners, directors and senior managers against conduct standards that are applied rigorously. Undisclosed prior regulatory findings, even in a different jurisdiction, create refusal grounds that are hard to recover from after submission. The time to surface and address these is before the application, not during it.
A third mistake is misaligning the entity structure with the licence. Many established operators have holding structures, operating subsidiaries and technology-service entities that made sense at the time of formation. They may not map cleanly to the regulatory perimeter in the target jurisdiction. Trying to licence an entity that does not control the relevant activity – or that holds assets it should not hold under the applicable custody rules – produces avoidable objections.
We have seen applications delayed by months because the applicant's AML programme described a manual transaction-monitoring process that the live platform had already replaced with an automated system – and the regulator spotted the inconsistency. Accuracy of the operational picture submitted is not optional; it is the foundation of the file.
The Cross-Border Reality: One Licence Is Rarely Enough
A common assumption among established operators is that a single well-chosen offshore licence provides adequate cover for a global user base. In practice, this assumption is wrong on multiple dimensions. A licence issued by a jurisdiction's regulator authorises activity in that jurisdiction, or – where passporting exists – in a defined bloc. It does not extend to users in jurisdictions that require their own authorisation.
Under MiCA, a CASP authorised in one EU/EEA member state may passport to all other member states – this is one of the regime's material commercial advantages. But it does not extend to the UAE, Singapore, Hong Kong or the UK. An exchange that serves clients in Dubai without a VARA authorisation is unregulated in Dubai, regardless of what its EU licence says.
The AIFC in Kazakhstan operates an AFSA (Astana Financial Services Authority) regime under a common-law framework. Operators looking at Central Asian exposure, or at a secondary hub to complement a Dubai or EU structure, will find the AFSA regime relevant – but it does not substitute for authorisation in the jurisdiction where the client sits. Switzerland's FINMA requires its own engagement, and the token taxonomy under FINMA guidance – payment, utility and asset tokens – determines the applicable licence route.
The cross-border question for an established operator is therefore not "which licence" but "which licence stack." The operating entity, the custody layer, the payment-transfer function and the marketing entity may each attract separate regulatory requirements in each material jurisdiction. Operators we advise routinely find that the banking question and the licensing question converge: the correspondent banks that will serve a crypto exchange increasingly require the operator to demonstrate authorisation in each jurisdiction from which it is drawing client funds.
To map the licence, banking and tax stack for your build, write to info@oboluslaw.com. If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back. Map your options.
Decision Matrix: Which Profile Points to Which Jurisdiction?
The right jurisdiction mix for a crypto exchange depends on four axes: where the clients are, where the entity wants to bank, what the operator's compliance infrastructure can support, and what timeline the business can absorb.
Profile A – EU-centric operator, institutional and retail mix: MiCA authorisation through a national competent authority in a jurisdiction with a well-staffed regulator and a track record of processing CASP applications. This delivers EU-wide passporting and the credibility signal that institutional counterparties increasingly require. The preparation burden is material; the regulatory expectation on AML, technology risk and financial resources is high. Timeline is typically measured in months, not weeks, on a well-prepared file.
Profile B – MENA-focused operator, primarily institutional: A VARA licence for the Dubai mainland, or an FSRA authorisation within ADGM, depending on whether the operator intends to interact with DIFC entities. Both regimes require demonstrated capital adequacy, AML programme alignment to FATF standards, and technology risk controls. The two regimes are not alternatives to each other – an operator active in both zones needs to address both. Timeline varies by activity class and application quality.
Profile C – Asia-Pacific hub strategy: MAS authorisation in Singapore under the Payment Services Act, or SFC VASP licensing in Hong Kong, are the primary routes. Singapore's regime has tiered licensing that tracks transaction volume; Hong Kong's VATP licensing process is demanding on fit-and-proper and operational requirements. Both are viable for operators with the compliance infrastructure to support them; the choice turns on where the client base sits and where the banking relationship is strongest.
Profile D – Offshore holding with operating subsidiary model: BVI FSC registration under the VASP Act 2022 or Cayman CIMA registration provides a structural layer at the holding level, but does not substitute for operating licences in the jurisdictions where clients are actively served. Operators we advise in this configuration typically hold the IP and treasury at the offshore level and maintain operating licences in one or more of the hubs above.
A Practice Note on Custody, AML and Travel Rule Alignment
Custody and AML are not ancillary to an exchange licence application; in the major hubs, they are part of the licence perimeter itself. Under MiCA's CASP regime, custody of client assets is a regulated service category, separately authorised and subject to safeguarding and segregation expectations. An exchange that holds client assets – which is most exchanges – cannot treat custody as implicit in the trading authorisation.
The Travel Rule (the obligation, derived from FATF Recommendation 15, to pass originator and beneficiary data with a virtual-asset transfer) is now enforced or in active implementation across every major hub. An operator that cannot demonstrate a Travel Rule-compliant transfer mechanism will not satisfy AML programme requirements in the EU, UAE, Singapore, Hong Kong or the UK. The data threshold above which the Travel Rule applies varies by jurisdiction – consult current legislation for the applicable figure.
In a recent matter, a payments-adjacent exchange operator had filed its AML programme without addressing Travel Rule implementation, reasoning that its transfer volumes did not routinely cross the threshold. The regulator's pre-application query flagged the gap immediately; we restructured the AML programme documentation and the application proceeded. The lesson: regulators do not want evidence that the Travel Rule has not yet been triggered. They want evidence that the infrastructure exists to comply when it is triggered.
Stablecoin activity introduces an additional layer. Under MiCA, issuers of ART (asset-referenced tokens) and EMT (e-money tokens) require separate authorisation, and an exchange that facilitates trading in those instruments has its own disclosure and listing obligations. The reserve composition and redemption rules for ARTs and EMTs are set in the applicable MiCA provisions; numeric reserve thresholds vary by classification and should be read from the current text.
Self-Assessment Checklist Before You File
An established operator preparing a licensing application should work through the following questions before submission. These are not exhaustive, but they cover the issues that most frequently produce regulatory pushback.
- Is the entity that will hold the licence the entity that controls the regulated activity – including the order book, the custody wallet infrastructure and the client-facing interface?
- Does the AML/CFT programme reflect the platform's current technical architecture, not the architecture at the time the programme was last written?
- Have all beneficial owners, directors and senior managers been assessed for fitness and propriety, including review of prior regulatory findings across all jurisdictions?
- Is the Travel Rule implementation documented at the infrastructure level, not just referenced in policy?
- Has the financial-resources position been calculated against the specific capital expectations of the target regime – not a generic threshold?
- Has the technology risk assessment addressed custody segregation, key-management procedures and incident-response protocols?
- Is the cross-border user base mapped against licensing obligations in each material jurisdiction – not just the jurisdiction of the proposed licence?
A "no" or "not sure" on any of these items is a preparation task, not a submission task. We regularly advise operators to delay a filing by weeks in order to resolve a structural issue rather than submit a file that will generate a regulatory query that delays the outcome by months.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – the full regulatory regime map across 70+ jurisdictions for operators at every stage.
- Crypto Exchange Setup in Germany under BaFin – jurisdiction-specific analysis of Germany's regulatory requirements for exchange operators.
- Crypto Exchange Licensing for Early-Stage Founders – the licensing path for operators building from the ground up, before the structure is set.
FAQ
How long does a crypto licence take to obtain?
Timeline varies materially by jurisdiction, licence category and the quality of the application file. In well-resourced hubs, a clean, well-prepared CASP or VASP application can be processed in a matter of months. Incomplete documentation, fitness-and-propriety queries or structural misalignment between the applicant entity and the regulated activity are the most common causes of delay. For an established operator, pre-application engagement with the regulator is the most effective tool for compressing the review clock.
Which jurisdiction is best for licensing my crypto business?
There is no universally optimal jurisdiction. The right choice turns on where your clients are located, where your banking relationships sit, what compliance infrastructure you can deploy, and what timeline your business can absorb. EU MiCA authorisation delivers passporting across the bloc; VARA and FSRA serve the MENA market; MAS and SFC serve Asia-Pacific. Most established operators with a multi-region client base need more than one licence. We map the full stack – licence, banking and tax – before recommending a structure.
Do I need a separate custody licence?
In most leading regimes, yes. Under MiCA, custody of client crypto-assets is a separately authorised CASP service category. VARA, FSRA and the SFC regime in Hong Kong each treat custody as a distinct regulated activity. An exchange licence does not automatically cover custody of client assets held in the course of providing exchange services. Operators running a combined model – matching and holding – should assume that both activities require specific authorisation and verify the position under the applicable regime before operating.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – because the cost of a gap at scale is not a compliance fine but a business interruption. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing and Jurisdictions Analyst – specialising in multi-hub authorisation strategies for established crypto exchange and custodian operators across the EU, MENA and Asia-Pacific.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.