Crypto Exchange Licensing

What a Crypto Exchange Licence Actually Is

A crypto exchange licence is not one licence. It is the family of VASP and CASP-class authorisations that cover the two regulated activities every centralised exchange performs: exchanging crypto-assets against fiat or other crypto-assets, and operating the trading platform on which client orders meet. Each regime names the permission differently: the EU grants a CASP authorisation under MiCA, Dubai a VASP licence, Hong Kong a VATP licence, Singapore a DPT service licence, and the offshore centres a VASP registration or licence. The activity bundle underneath is the same, and we obtain all of them.

Under Regulation (EU) 2023/1114 (MiCA), the relevant services are operating a trading platform and exchanging crypto-assets for funds or other crypto-assets, with custody and order execution almost always bundled into the same application. The trading-platform service sits in Annex IV Class 3, the highest tier, so the full exchange bundle falls under its single €150,000 own-funds floor. Other regimes draw the same perimeter in different vocabulary: VARA’s Exchange Services category, the SFC’s automated trading service definition, the BVI VASP Act’s exchange categories.

Unlike an EMI or Payment Institution licence, a crypto exchange authorisation covers the crypto-asset activity only. Fiat deposits, withdrawals and stored client balances ride on a separately licensed payment layer, either the exchange’s own EMI authorisation or a licensed institution. If you are planning a euro on-ramp at scale, read this alongside our EMI & Payment Institution Licensing: we increasingly sequence the two applications together.

Regimes split into two models. A registration regime (the BVI VASP registration, the UK’s live MLR cryptoasset registration) assesses the operator’s AML systems and controls; an authorisation regime (MiCA, VARA, the SFC) assesses the whole business: capital, governance, custody, market integrity, complaint handling and operational resilience. Registrations are faster; authorisations carry more institutional weight. Neither confers global coverage. An exchange must hold the local authorisation, or a valid passport, in each market it actively solicits. The reverse-solicitation carve-outs that once let offshore platforms serve onshore clients have narrowed sharply: the ESMA Guidelines on reverse solicitation under MiCA (applicable from 27 April 2025) are read restrictively, and any EU-targeted marketing, EU-language content or geo-targeted advertising voids the exemption. We structure your market access around what the regulator will actually accept.

Where We Obtain Crypto Exchange Licences

Ten jurisdictions cover the practical decision set for a centralised exchange: two EU anchor states under MiCA, the United Kingdom, two Gulf regimes, two Asia-Pacific regimes, and a three-jurisdiction offshore tier. We deliver crypto exchange licensing directly in Lithuania, Cyprus, Gibraltar, Malta, Poland and Switzerland, and structure and file the offshore and wider routes below through specialists we control in each territory.

European Union: MiCA CASP authorisation

MiCA replaced the EU’s fragmented national VASP regimes with a single CASP authorisation, fully applicable since 30 December 2024. Minimum own funds are tiered by service class: €50,000 (Class 1), €125,000 (Class 2), and €150,000 for Class 3, which includes operating a trading platform; ongoing own funds are the higher of the floor or 25% of the prior year’s fixed overheads. One authorisation passports to 30 EEA states by Article 65 notification: the home regulator forwards it within 10 working days, and services may start no later than the 15th calendar day after submission. The statutory clock under Article 63 is a 25-working-day completeness check plus a 40-working-day assessment, extendable by 20 for information requests.

Realistic end-to-end timelines differ by home state: Lithuania (Bank of Lithuania) runs 4–8 months and requires a Lithuanian-resident MLRO on an employment contract; Malta (MFSA) runs 9–18 months, offers a 5% effective tax rate via the shareholder-refund system, and requires at least 2 directors with 1 Malta-resident executive. We hold both routes and place the resident officers your application needs. The transitional window matters now: grandfathering of pre-MiCA national-regime firms under Article 143(3) closes no later than 1 July 2026, and grandfathered firms cannot passport, so operators still on national registrations have run out of road. See our MiCA / CASP licensing page for the deadline mechanics and the crypto licensing hub for jurisdiction detail. If you are caught by the deadline, talk to us now.

United Kingdom: FCA registration now, FSMA authorisation from 2027

The UK runs two regimes in sequence. Live today is the FCA cryptoasset registration under the Money Laundering Regulations 2017: AML-only, no minimum capital, no prudential rulebook, observed processing times of 9–18 months, and a fee that scales with UK cryptoasset income. Full authorisation arrives next: the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, made 4 February 2026, bring regulated cryptoasset activities into FSMA from 25 October 2027, with the authorisation gateway open 30 September 2026 to 28 February 2027. The FCA’s proposed floors set a £150,000 permanent minimum for trading platform, custody and staking activity, with own funds the highest of the floor, a fixed-overhead requirement and a K-factor requirement. A UK registration confers no EU passporting rights, and MiCA has no third-country equivalence regime.

Middle East: Dubai VARA and ADGM

Dubai (VARA) licenses Exchange Services under Dubai Law No. 4 of 2022 and the VARA Rulebooks, within the federal framework of Cabinet Decision 111/2022. Paid-up capital for an exchange is AED 1.5 million (without a third-party custodian), held in a UAE-bank trust account with the regulator as beneficiary before grant, plus an ongoing net-liquid-assets test of at least 1.2× monthly operating expenses. The VARA track runs 4–12 months, permits retail clients, and requires UAE-resident senior officers (SEO, MLRO, Compliance Officer).

Abu Dhabi (ADGM) takes the institutional lane: an FSRA Financial Services Permission under the Financial Services and Markets Regulations, granted via In-Principle Approval and an operational-readiness review over 6–18 months. Base capital is layered with an Expenditure-Based Capital Minimum of 13/52 of annual audited expenditure. ADGM serves professional and institutional clients only, with no retail offering, and prohibits privacy tokens and algorithmic stablecoins.

Asia-Pacific: Singapore and Hong Kong

Singapore (MAS) licenses DPT services under the Payment Services Act 2019, with the Major Payment Institution tier the realistic class for an exchange: base capital plus a security deposit lodged with MAS, over 9–12 months. Retail access is permitted but constrained: no incentives, no credit-card top-ups, no retail credit or leverage. The FSM Act 2022 Part 9 DTSP regime, in operation since 30 June 2025, separately captures Singapore-based providers serving only overseas customers.

Hong Kong (SFC) licenses VATPs under the Securities and Futures Ordinance (Types 1 and 7) plus AMLO Part 5B. Minimum capital is HKD 8 million (5 million paid-up plus 3 million liquid), with liquid capital maintained at or above 120% of the requirement. The 12–18 month track includes a gate no other regime imposes: an external assessment under HKSAE 3000/ISAE 3000 plus an independent penetration test before grant. Retail trading is permitted for eligible large-cap assets, a broader perimeter than Singapore’s.

Offshore tier: BVI, Cayman Islands, Seychelles

BVI offers the lowest entry cost of any credible exchange regime: a VASP registration under the Virtual Assets Service Providers Act, 2022 with no fixed capital floor (the FSC expects 6–12 months of operating-expense evidence), a 4–6 month track with initial feedback in roughly 6 weeks, and 2 individual directors. The reputational caveat is real: the BVI sits on the FATF grey list and was added to the EU AML high-risk list in early 2026, which drives enhanced counterparty due diligence. We will tell you whether that friction is survivable for your model before you file.

Cayman Islands runs a dual track under the Virtual Asset (Service Providers) Act (2024 Revision): a Registration for exchange and transfer activity, and a full Licence, mandatory for trading platforms and custody since 1 April 2025. There is no statutory capital floor; CIMA assesses adequacy case by case over 3–12 months. Licensed platforms need at least 3 directors including 1 independent. Cayman is FATF-clear, which keeps its institutional credibility high.

Seychelles moved from unregulated to licensed with the Virtual Asset Service Providers Act, 2024, in force 1 September 2024. The Virtual Asset Exchange category carries USD 100,000 paid-up capital, the highest of the four categories, and from year three capital must equal at least 2.5% of annual turnover where that exceeds the floor, over a 3–6 month track. Substance is real: resident director, physical office and a full-time compliance officer are expected, and we put them in place.

Regime comparison

Capital figures below are statutory minimums for the exchange or trading-platform class; several regimes add ongoing overlays covered under requirements.

The United States: No Single Federal Licence

The United States has no single federal crypto exchange licence. The federal layer is FinCEN registration as a money services business under 31 CFR 1010.100(ff): a registration, not a licence, that attaches Bank Secrecy Act AML obligations but authorises nothing by itself. The operative permission layer is state law: a patchwork of roughly 50 state money-transmitter licences, each with its own capital, bonding and reporting requirements, with New York adding the most demanding single regime, the NYDFS BitLicense under 23 NYCRR Part 200.

Federal legislation is moving but incomplete. The GENIUS Act, enacted 18 July 2025, created the first federal framework for payment stablecoin issuers, though implementing rules remained at proposed stage through H1 2026. The CLARITY Act market-structure bill, which would allocate spot-market jurisdiction between the SEC and CFTC, passed the House on 17 July 2025 and cleared the Senate Banking Committee in May 2026 but is not enacted as of June 2026. Exchange licensing remains a state-by-state exercise layered over federal registration. Tomberg & Partners does not provide services to US persons; this section is informational only.

What the Application Demands, and How We Handle It

The file a crypto exchange submits looks structurally similar everywhere: capital, governance, custody architecture, AML and CFT, technology resilience, and a credible business plan. What differs is the evidence standard, the statutory clock, and how much the regulator probes before grant. We assemble the file, draft the policies, place the people and answer the regulator’s questions on your behalf.

Capital and own funds

Statutory floors are only the entry point; most regimes add a formula that scales with the business. In the EU, ongoing own funds are the higher of the floor or 25% of the prior year’s fixed overheads. Hong Kong requires liquid capital at or above 120% of the requirement; ADGM applies an Expenditure-Based Capital Minimum of 13/52 of annual audited expenditure; Seychelles adds 2.5% of annual turnover from year three where that exceeds the floor. Even no-floor regimes are not capital-free: the BVI FSC expects 6–12 months of operating expenses against three-year projections. We model your ongoing capital requirement before you commit to a jurisdiction.

Substance and key persons

Resident-officer rules decide where the team actually sits. Lithuania requires a Lithuanian-resident MLRO on an employment contract; Malta expects at least 2 directors with 1 Malta-resident executive; the UAE regimes require UAE-resident senior officers (SEO, MLRO, Compliance Officer); Hong Kong requires at least 2 Responsible Officers, at least 1 Hong Kong-resident and 1 an executive director; the BVI requires 2 individual directors; Cayman-licensed platforms need 3 directors including 1 independent. We place the MLRO and compliance lead in the licensing jurisdiction before filing, from our controlled network of in-country specialists, because doing it after grant is the most common reason an application stalls.

Custody and client assets

Every authorisation regime now treats client-asset segregation as a core gate. MiCA requires client funds safeguarded at a credit institution and client crypto-assets segregated from the firm’s own book. Hong Kong requires custody through a wholly-owned associated entity, with a compensation arrangement covering 50% of cold-storage and 100% of hot-storage assets. Cayman made custody and trading-platform activity licensable rather than registrable from 1 April 2025 precisely to bring custody architecture under direct supervision. We draft the custody policy, wallet-management procedure and key-ceremony documentation to the standard each regulator reads closely.

AML and the Travel Rule

FATF Recommendation 15 made exchanges full AML-obliged entities everywhere, and the Travel Rule is operational in every jurisdiction on this page. In the EU, Regulation (EU) 2023/1113 applies it with no de minimis threshold for CASP-to-CASP transfers and a €1,000 threshold for self-hosted wallet verification; the BVI and Cayman apply USD 1,000; Hong Kong applies HKD 8,000. We build the file to show working Travel Rule tooling, sanctions screening with regulator-grade evidence trails, and a risk assessment at customer-segment level, not firm level.

ICT and operational resilience

In the EU, DORA (Regulation (EU) 2022/2554) has applied to CASPs since 17 January 2025: an ICT risk-management framework, major-incident reporting, a register of ICT third-party providers, and periodic resilience testing. VARA imposes its Technology & Information Rulebook with annual penetration testing; the SFC requires the pre-grant external assessment plus an annual penetration test thereafter. Exchanges carry the heaviest technology files of any licence class because the matching engine, wallet infrastructure and market-surveillance stack are all in scope, and we prepare them all.

The application arc

The process arc is consistent across regimes, and the statutory clocks are knowable in advance:

• Pre-application engagement: VARA’s Initial Disclosure Questionnaire, ADGM’s pre-application meetings toward In-Principle Approval, the Bank of Lithuania’s Newcomer Programme, CIMA’s Innovation Unit meeting.
• Completeness check: MiCA fixes it at 25 working days; the Seychelles FSA treats an application as received only once complete.
• Substantive review: MiCA allows 40 working days plus a 20-day extension for information requests; the SFC’s standard is 15 weeks once complete; the BVI FSC gives initial feedback in roughly 6 weeks and decides within 6 months.
• Interviews and inspection: officer interviews are standard in the Gulf; operational-readiness reviews precede grant at ADGM and VARA; Hong Kong adds the external assessment gate.
• Grant and post-grant: conditions, reporting calendars, and in the EU the Article 65 passport notifications that open the other 29 EEA markets.

The honest planning number is the end-to-end range, not the statutory clock: completeness disputes, information-request cycles and banking evidence dominate real timelines.

What Drives the Cost of an Exchange Licence

The total cost of standing up a licensed exchange spans two orders of magnitude by jurisdiction, with the same line items everywhere: government and supervision fees, regulatory capital, drafting and legal work, resident substance, technology and compliance tooling, and audit. The biggest swing is the regulator you choose: a BVI registration sits at the bottom of the range, a Hong Kong VATP licence at HKD 8 million minimum capital at the top. Cheap and credible pull in opposite directions: the BVI’s low entry point comes with FATF grey-list counterparty friction, while Hong Kong’s capital floor buys the deepest institutional acceptance in Asia. The right way to scope cost is to fix the target market first, then let the regime list collapse: an EU retail exchange has two realistic options, a Gulf institutional venue two different ones, a non-EU global startup the offshore tier.

Banking for Licensed Crypto Exchanges

A licence without banking is a certificate on the wall. An exchange needs three account layers, each with a different acceptability profile: client fiat accounts for deposits and withdrawals, an operating account for the firm’s own funds, and where the regime requires it, a safeguarding account. Under MiCA the safeguarding layer must sit at a credit institution, and that is the binding constraint in practice: in the Baltic CASP market a full safeguarding account can take several months to land. Offshore the constraint is sharper still: BVI-registered exchanges bank almost entirely outside the territory, on EU and UK fintech rails.

This is why we address banking feasibility at the start of the engagement, not the end. We work with established banking and EMI partners in the jurisdictions we service and confirm a realistic account-opening route before the application is filed, so you do not win a licence you cannot operate. As a matter of policy we never name a bank or payment provider in public, and never offload your introduction to a stranger. This settlement and account architecture sits alongside our wider banking and payments work, which supports the licence rather than leads it.

Frequently Asked Questions

Basics

What is a crypto exchange license?

The authorisation that lets a business exchange crypto-assets against fiat or other crypto-assets and operate a trading platform where client orders meet. It is not one licence: each regime names it differently. The EU grants a MiCA CASP authorisation, Dubai a VARA VASP licence, Hong Kong an SFC VATP licence, Singapore an MAS DPT service licence, and the BVI, Cayman and Seychelles grant VASP registrations or licences. No version is global: an exchange needs the local authorisation, or a valid passport, in every market it actively solicits.

What is the difference between a VASP registration and a CASP authorisation?

A VASP registration (the BVI model, or the UK’s live MLR registration) is an AML-perimeter approval: the regulator assesses the operator’s anti-money-laundering systems and fit-and-proper officers, but imposes no prudential rulebook and usually no capital floor. A CASP authorisation under MiCA, like the licence regimes in Dubai, Singapore and Hong Kong, assesses the whole business: capital, governance, custody, market integrity, complaint handling and operational resilience. Registrations are faster and cheaper; authorisations carry more weight with banks and counterparties, and in the EU they carry passporting rights that no registration regime offers.

Costs and timelines

How long does it take to get a crypto exchange licence?

Realistic end-to-end timelines, including preparation: Seychelles 3–6 months, BVI 4–6, Cayman 3–12 by track, Lithuania 4–8, Dubai (VARA) 4–12, ADGM 6–18, Singapore 9–12, Malta and the UK 9–18, Hong Kong 12–18. Statutory clocks are shorter (MiCA allows 25 working days for completeness plus 40 for assessment; the SFC’s standard is 15 weeks once complete), but information-request cycles, officer interviews and custody reviews dominate real timelines. We run banking and substance in parallel with drafting rather than after filing, the main controllable accelerator. Book a free consultation and we will give you a realistic timeline for your model.

Which is the cheapest crypto exchange licence?

The BVI VASP registration is the lowest-cost credible route: no fixed capital floor and a 4–6 month track. Seychelles is the cheapest licence regime with a real capital requirement. The trade-offs are concrete: the BVI sits on the FATF grey list and the EU AML high-risk list as of early 2026, which lengthens every counterparty onboarding, and neither jurisdiction reaches EU or UK clients. Cheap entry suits a non-EU global startup but anti-sells to institutional counterparties. We will tell you honestly whether it fits your business before you commit.

How much capital does a crypto exchange licence require?

Statutory floors for the exchange or trading-platform class: €150,000 in the EU (MiCA Annex IV Class 3), AED 1.5 million in Dubai (VARA Exchange without a custodian), an expenditure-based minimum on a base in ADGM, a base plus security deposit in Singapore, HKD 8 million in Hong Kong, USD 100,000 in Seychelles. The BVI, Cayman and the UK’s live MLR registration set no fixed floor. Most regimes add ongoing overlays: the higher of the floor or 25% of fixed overheads in the EU, liquid capital at 120% of requirement in Hong Kong, 2.5% of turnover from year three in Seychelles.

Market access

Can one licence cover the whole EU?

Yes. A MiCA CASP authorisation from any EU member state passports to all 30 EEA states by Article 65 notification: the home regulator forwards it within 10 working days, and services may start no later than the 15th calendar day after submission. It is the only crypto exchange licence with multi-country coverage from a single authorisation. The caveat is transitional: firms on grandfathered national VASP registrations under Article 143(3) cannot passport, and the window closes no later than 1 July 2026. No non-EU licence, including the UK’s, benefits from equivalence, because MiCA contains no such mechanism.

Can an offshore-licensed exchange serve EU clients?

Not systematically. The only lawful route without a CASP authorisation is reverse solicitation under MiCA Article 61, and the ESMA Guidelines (applicable from 27 April 2025) read it restrictively: the client must initiate the relationship at their own exclusive initiative, and any EU-targeted marketing, EU-language content, geo-targeted advertising, app-store availability or EU-based influencer activity voids the exemption. It is a passive defence for incidental clients, not a market-access strategy. An operator that wants EU revenue at scale obtains a CASP authorisation in a member state and passports from there.

Related Services

• Crypto Exchanges: The full launch stack for exchange operators, licensing and formation together
• Crypto Licensing (VASP / CASP / MiCA): Jurisdiction-by-jurisdiction crypto licensing
• MiCA / CASP Licensing: EU authorisation and the 1 July 2026 transitional deadline
• Company Formation: The licensed entity, formed and substanced in the jurisdiction you operate from
• Banking & Payments: Account and settlement architecture supporting the licence