Crypto exchange licensing: Legal Counsel for Digital-Asset Firms

Operating a crypto exchange without the correct regulatory authorisation exposes a business to enforcement action, the sudden loss of banking relationships and, in the worst cases, criminal referral. With VASP registration regimes tightening across every major hub — from MiCA in the European Union to the VARA rulebooks in Dubai and the Payment Services Act licensing regime administered by MAS in Singapore — the compliance bar is rising faster than most in-house teams can track. This page sets out what crypto exchange licensing legal counsel covers, how the process works across the key jurisdictions, and where firms most commonly go wrong. The analysis is written for founders, general counsel and operators who already understand the product and need the legal answer.

What Activities Require a Crypto Exchange Licence?

Any business that operates a platform matching buy and sell orders for virtual assets — or that routes such orders on behalf of clients — falls within the regulated perimeter in every major jurisdiction that has enacted a dedicated digital-asset regime. The activity, not the label, determines the licence category. A firm calling its product a "trading terminal" or a "conversion tool" does not escape the licensing obligation if the economic substance is exchange activity. Under MiCA, operating a crypto-asset trading platform without CASP authorisation is prohibited. Under the VARA regime in Dubai, exchange services require a specific activity licence from the Virtual Assets Regulatory Authority. MAS requires licensing under the Payment Services Act for any firm providing a digital payment token exchange service to customers in Singapore.

The perimeter extends further than many operators expect. Firms that aggregate liquidity from multiple venues and present a unified order book to clients are typically caught. So are platforms that hold client assets even briefly to settle trades — because custody is, in most regimes, a separately regulated activity that runs alongside the exchange function. The interaction between exchange, custody and payment-processing activities is where the majority of licensing errors originate in our practice.

Beyond the core exchange function, ancillary activities commonly trigger additional authorisation requirements. Providing investment advice on digital assets, offering portfolio management, or lending against crypto collateral each carry distinct regulatory consequences under MiCA, under the SFC's VASP regime in Hong Kong and under FINMA's guidance in Switzerland. A business that starts as a pure-play exchange and gradually adds features can find itself requiring a materially broader licence stack than the founding team anticipated.

The applicable regime follows the user, not only the entity. A platform incorporated offshore but accessible to EU retail users is within MiCA's reach for reverse-solicitation purposes. A firm with no local presence in Hong Kong may still be subject to SFC oversight if it actively markets to Hong Kong users. Mapping the regulatory perimeter therefore requires a simultaneous read of where the entity sits, where the users are, and where the banking and settlement rails run.

Which Licences Does a Crypto Exchange Actually Need?

Most operating exchanges require a layered licence stack rather than a single authorisation, and the composition of that stack varies significantly depending on the jurisdictions in which the business operates and the services it offers. The starting point is always the primary trading or exchange licence — the authorisation that permits the platform to match orders and execute trades. Around that core, a business typically needs to consider custody authorisation, payment or money-transmission permissions and, where the product touches securities-like tokens, a broker-dealer or investment-services licence.

Under MiCA, a CASP (crypto-asset service provider) authorisation granted by one EU member state's national competent authority can be passported across the entire EU and EEA. This makes the choice of EU home member state a significant strategic decision. Lithuania, administered by the Bank of Lithuania, has historically offered a pragmatic entry point for EU VASP registration. Malta's MFSA oversees a VFA framework that is transitioning to the MiCA CASP regime. The passporting right is a material commercial advantage — it is the primary reason exchange operators targeting European users structure into the EU rather than relying on offshore equivalents.

In the Gulf, the architecture is different. VARA in Dubai issues activity-specific licences — exchange services, custody, lending, advisory — and operators must hold each applicable licence separately. The FSRA within the ADGM in Abu Dhabi takes a comparable activity-based approach under its own virtual-asset framework. Neither VARA nor ADGM licences passport to the other; a firm operating across both Dubai and Abu Dhabi needs engagement with both regulators.

In Asia, MAS licensing under the Payment Services Act is the gateway to Singapore. The SFC's VASP licensing regime covers trading platforms in Hong Kong. Japan's FSA requires registration and ongoing compliance with the JVCEA's self-regulatory standards. For a firm with a pan-Asian user base, each of those jurisdictions requires independent analysis.

The BVI FSC's VASP Act 2022 and CIMA's virtual-asset regime in the Cayman Islands offer structuring options for offshore holding or operating entities, particularly for funds and ventures that are not directly serving retail clients. These jurisdictions are frequently used in combination with an onshore licence to separate the operating function from the fund or treasury layer.

The process above describes the standard path. Your facts — the entity, the user base, the banking — change the analysis materially. For a scoped mapping of the licence stack your business requires, contact OBOLUS at info@oboluslaw.com.

How Does the Crypto Licensing Application Process Work?

A crypto exchange licensing application is a structured multi-stage process that typically spans several months from initial pre-application engagement to formal authorisation, with the precise timeline depending on the regulator, the complexity of the business model and the completeness of the application pack submitted. Operators who underestimate the preparation phase consistently face the longest delays.

The process across the leading hubs shares a common architecture, even if the terminology and sequencing vary.

• Scoping and structure review. Before any application is filed, the business model, the token taxonomy, the ownership and control structure and the proposed jurisdiction must be validated. Regulators in every major hub scrutinise the ultimate beneficial owner chain and the source of capital early in the process. A structure that has not been reviewed for regulatory compatibility will produce adverse questions at the assessment stage.
• Policy and procedure documentation. Regulators require comprehensive AML/CFT policies, a Travel Rule (the obligation to pass originator and beneficiary data with each qualifying transfer) compliance framework, risk-based customer due diligence procedures, a business continuity plan and, in most regimes, a written technology risk or cyber-security policy. Under MiCA, a crypto-asset white paper may also be required for the tokens the platform lists.
• Key-person fitness and propriety. Directors, senior managers and compliance officers are subject to fit-and-proper assessment. Most regulators require a qualified compliance officer resident in the jurisdiction. We assist clients in assessing whether their proposed key persons satisfy the applicable criteria before submission.
• Capital adequacy. Each licence category carries a minimum own-funds or capital requirement that varies by regime. We advise on the applicable threshold qualitatively at the scoping stage and direct clients to current regulatory guidance for the operative figure.
• Pre-application meeting. Most leading regulators — including VARA, FSRA and MAS — offer or require a pre-application or gateway meeting. This meeting is strategic. It is an opportunity to clarify the regulator's expectations and to surface any structural concerns before the formal file is submitted.
• Formal submission and assessment. Once the application is filed, the regulator's assessment clock begins. Regulators commonly issue requests for information (RFIs), and each RFI round extends the timeline. Application packs that are complete and well-structured at submission generate fewer RFIs.
• Authorisation and ongoing obligations. On grant, the operator must maintain the conditions of authorisation — capital, systems, AML compliance, annual reporting and, under most regimes, notification of material changes to the business model or ownership.

In our cross-border practice, the most common delay driver is an incomplete AML/Travel Rule framework at the point of submission. Regulators expect to see a functioning compliance infrastructure, not a theoretical one. Firms that submit a policy document without underlying technology integration — transaction monitoring, wallet screening, Travel Rule messaging — are routinely asked to re-submit.

What Are the Most Costly Licensing Mistakes?

The most damaging mistake in crypto exchange licensing is beginning commercial operations before the authorisation is in place. Enforcement consequences across the leading regimes range from public censure and financial penalties to directed wind-down and referral to criminal prosecutors. Banking relationships — difficult enough to establish for any digital-asset business — are almost immediately at risk once an enforcement finding is made public.

The second most common error is assuming that a VASP registration obtained before MiCA's transition deadline is automatically equivalent to a MiCA CASP authorisation. It is not. Businesses that registered under the prior national regimes must comply with MiCA's transition requirements and, in most cases, submit a formal MiCA authorisation application within the applicable window. Firms that miss that transition are operating without authorisation for the purpose of EU law, regardless of the legacy registration they hold.

A persistent structural mistake is choosing a jurisdiction based on reputational ease or low stated fees rather than on operational compatibility. The right licensing jurisdiction for a crypto exchange is the one whose regime aligns with the business model, whose banking ecosystem can support the payment rails the platform needs and whose regulator has demonstrated a consistent and predictable approach to digital-asset supervision. We have seen firms license in a jurisdiction that could not support the underlying banking, leaving a technically licensed business unable to operate.

Offshore licence reliance for global operations is another structural risk. A single offshore registration — in the BVI, Cayman Islands or similar — does not authorise an exchange to serve retail clients in the EU, the UK, Singapore or Hong Kong. Each of those jurisdictions applies its own regulatory perimeter test. Operating into a regulated jurisdiction on the strength of an offshore registration, without the required local licence, is unlicensed activity in that jurisdiction.

How Does Cross-Border Licensing Work for an Exchange With Global Users?

For an exchange with a multi-jurisdictional user base, the correct analysis maps each service — trading, custody, payment processing — against each jurisdiction where users are located and determines which of those combinations triggers a licensing obligation. This is not a theoretical exercise. Regulators in the EU, Singapore and Hong Kong actively monitor for platforms that serve their markets without local authorisation.

The EU's reverse-solicitation concept under MiCA provides a narrow exemption for situations where a client in the EU exclusively and at their own initiative seeks a service from a non-EU firm. Regulators and legal practitioners understand that this exemption does not cover active marketing to EU users. A non-EU exchange running digital advertising, social-media campaigns or localised content in EU languages directed at EU residents is not relying on reverse solicitation — it is soliciting, and it requires CASP authorisation or a passported licence from an EU home member state.

Banking is the practical constraint that most shapes jurisdiction selection for an exchange. Digital-asset businesses face elevated due-diligence requirements from correspondent banks in every major hub. A licence from a well-regarded regulator — VARA, MAS, the Bank of Lithuania under MiCA, the FSRA within ADGM — is a necessary but often not sufficient condition for maintaining a banking relationship. Operators we advise routinely find that their banking prospects improve materially once the licence is in place, but that the choice of jurisdiction significantly affects which banking options are realistically accessible.

Tax sits alongside the licence and banking decisions. The jurisdiction of the operating entity determines the tax treatment of trading revenues, the VAT or GST position on exchange fees and the withholding-tax implications of paying service providers across borders. Structuring the operating entity, the intellectual-property holding and the treasury function across the right combination of jurisdictions requires a coordinated view of the licensing, banking and tax position before any structure is committed. We advise on that combined stack as a matter of course, and work with allied counsel in the relevant jurisdiction where local tax or corporate law input is required.

In a recent cross-border licensing matter, an exchange operator had secured registration in one EU member state but was actively serving users across six EU countries with materially different product features in each market. We identified that two of the activity variants required separate regulatory notifications that had not been filed, and managed the remediation process with the relevant national competent authority, achieving a clean compliance position before the MiCA transition deadline. The operator avoided a formal enforcement inquiry.

If a prior application stalled, a banking relationship was withdrawn, or an enforcement inquiry has been opened, the structural reason is rarely obvious from the surface. A second read frequently surfaces it. Write to OBOLUS at info@oboluslaw.com or message us via t.me/oboluslaw.

Which Licensing Path Fits Your Exchange Profile?

The right licensing path is determined by four variables: the operator's primary user geography, the services offered beyond spot trading, the existing corporate structure and the available banking relationships. No single configuration fits all exchange operators.

Profile A — EU-focused retail exchange. The primary licensing instrument is a CASP authorisation under MiCA, obtained through an EU member state whose national competent authority has the capacity and the process to handle a full-scope authorisation. The timeline from a complete application submission to authorisation varies by member state and application complexity — plan for a process measured in months rather than weeks. The primary risk at this profile is underestimating the AML and Travel Rule infrastructure requirements at submission. A passported CASP authorisation resolves the EU perimeter across all member states.

Profile B — Gulf and MENA-focused exchange. The primary licensing instrument is a VARA activity licence for Dubai operations, or an FSRA authorisation within the ADGM for Abu Dhabi. Both regulators conduct active pre-application engagement. Timeline to authorisation is typically measured in months and is sensitive to the UBO structure and the source-of-funds narrative. The key cross-border risk at this profile is the absence of passporting — a VARA licence authorises activity in Dubai; a firm serving Abu Dhabi users separately needs to address the FSRA's perimeter.

Profile C — Asia-Pacific exchange. The primary licensing instrument is a MAS Digital Payment Token service licence under the Payment Services Act for Singapore. Firms targeting Hong Kong users require SFC VASP licensing. The timelines and capital requirements at each regulator vary and should be confirmed against current regulatory guidance. The key structural risk at this profile is the tendency to under-invest in compliance staffing: both MAS and the SFC conduct ongoing supervision at a level of intensity that requires a resident compliance function.

Profile D — Offshore-structured fund-adjacent exchange. For operators whose primary activity is serving institutional or fund counterparties rather than retail, a BVI FSC VASP registration or CIMA virtual-asset registration may be the starting point — combined with appropriate onshore licensing where retail users are reached. The primary risk at this profile is scope creep: a platform that begins as institutional and gradually opens to retail triggers materially higher licensing obligations without, in many cases, any deliberate decision to do so.

Is a Single Offshore Licence Enough to Operate Globally?

A common assumption in the early stages of an exchange build is that a single offshore licence — typically from the BVI, Cayman Islands or a similar jurisdiction — provides sufficient cover to serve clients in any market. It does not. This assumption has produced some of the most serious enforcement outcomes in the digital-asset sector over the past several years.

Each major jurisdiction — the EU under MiCA, the UK under the FCA's registration and financial-promotion regimes, Singapore under the Payment Services Act, Hong Kong under the SFC's VASP licensing regime — applies its own regulatory perimeter test independently. The question is not whether the firm is licensed somewhere. The question is whether it is licensed in the jurisdiction where the regulated activity is occurring with respect to users in that jurisdiction.

An offshore registration is a legitimate and useful part of many sophisticated exchange structures. Its function is typically to house the offshore operating entity, to serve institutional counterparties who are themselves regulated and to provide a structuring layer between the fund and the operating platform. It is not a substitute for the onshore authorisations that retail-facing activity requires.

Operators we advise who have relied on an offshore-only structure are typically in one of two situations: they have not yet been caught, or they have been caught and are managing the consequences. The remediation path — filing for the required local licences, closing the gap in the interim, managing the banking risk during the transition — is manageable with early legal input. It is significantly harder once a regulator has already inquired.

Self-Assessment: Is Your Exchange Ready to Apply?

Before committing resources to a formal licensing application, an exchange operator should be able to answer affirmatively to each of the following questions. A "no" or "unsure" at any point signals a gap that will likely surface in the regulator's assessment.

• Is the corporate structure — including the ultimate beneficial owner chain — clean, documented and supportable with source-of-funds evidence?
• Have all relevant jurisdictions where users are located been identified, and has a licensing obligation analysis been completed for each?
• Is a qualified compliance officer in place or identified, and does that person satisfy the fit-and-proper criteria of the target regulator?
• Has a functioning AML/CFT policy been drafted, reviewed and tested against the business's actual transaction flows?
• Is a Travel Rule compliance solution integrated or under active procurement — not merely identified as a future task?
• Is transaction monitoring software in place, calibrated to the platform's token types and user risk profiles?
• Has the minimum capital requirement of the target regime been met and documented as available for the purpose of the application?
• Has a banking relationship been established or credibly confirmed as available on authorisation?

If two or more of these questions cannot be answered affirmatively, the application is not ready. Filing a materially incomplete application does not accelerate the timeline — it generates RFIs that extend it and, in some regimes, triggers a formal refusal that complicates any subsequent re-application.

We map the licence, banking and compliance stack for your exchange before you commit to a jurisdiction or file an application. To pressure-test your structure, message OBOLUS via t.me/oboluslaw.

Related at OBOLUS

• Licensing and Registration for Digital-Asset Businesses – The full scope of OBOLUS's licensing practice across 70+ jurisdictions.
• Digital-Asset Licensing in El Salvador – What exchange operators and token issuers need to know about El Salvador's regime.
• Transaction Monitoring Setup in Lithuania – Practical guidance on satisfying the Bank of Lithuania's AML compliance expectations.

FAQ

How long does a crypto licence take to obtain?

Timelines vary significantly by jurisdiction, licence category and the completeness of the application submitted. A well-prepared application to a regulator with a functioning digital-asset licensing process — such as VARA, MAS or the Bank of Lithuania under MiCA — typically takes several months from formal submission to authorisation. Incomplete applications generate requests for information that can double or triple the timeline. Pre-application engagement with the regulator is the most reliable way to calibrate expectations for a specific business model.

Which jurisdiction is best for licensing my crypto business?

There is no single best jurisdiction. The right choice depends on where your users are located, what services you offer, which banking relationships you need and whether passporting across a trading bloc is commercially important. An EU CASP authorisation under MiCA provides passporting across the EU and EEA. VARA and FSRA licences are strong choices for Gulf-facing operations. MAS licensing is the gateway to Singapore. The optimal answer usually involves a primary licence in one jurisdiction and a coordinated strategy for others — not a single global solution.

Do I need a separate custody licence?

In most leading regulatory regimes, custody of client virtual assets is a separately regulated activity. Under MiCA, providing custody and administration of crypto-assets on behalf of clients requires CASP authorisation that specifically covers that activity. VARA, MAS and the SFC each treat custody as a distinct regulated function. An exchange that holds client assets — even briefly, for settlement — must assess whether its exchange licence covers that holding or whether a separate custody authorisation is required. The analysis is fact-specific and should be confirmed against the applicable regime before operations begin.

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance structures that sit around them. Digital assets are the whole of our practice. We map the licence, banking and compliance stack before our clients commit — and we manage the regulatory process through to authorisation. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums when things go wrong. To discuss your exchange licensing situation, contact info@oboluslaw.com.

By Aisha Tan, Licensing and Jurisdictions Analyst — specialising in multi-jurisdictional VASP and CASP authorisation strategies for exchange operators and custodians entering regulated markets.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.