Where to license a crypto exchange, and which licences banks accept.

Founders usually approach licensing as a shopping decision: which jurisdiction is cheapest and fastest. That framing produces the licences that end up being surrendered eighteen months later. What is actually being chosen is a package of five things, and cost is the least consequential of them.

The first is market access. A licence permits defined activities to defined customers in a defined territory, and sometimes beyond it through passporting or equivalence. A licence that cannot lawfully serve the customers you have is decorative.

The second is banking acceptance. Institutions maintain informal views on regulators. A licence from a regime that correspondent banks respect makes account opening a normal underwriting exercise; a licence from a regime they do not respect makes it harder than having no licence at all, because it signals a business doing regulated activity without supervision the bank trusts.

The third is the ongoing obligation set: capital adequacy, safeguarding or segregation of client assets, a local compliance officer and MLRO, audited accounts, regulatory reporting, incident notification, and in many regimes a resident director and physical office. These are annual operating costs and hiring problems, not one-off fees.

The fourth is substance, which is what makes the structure survive both a regulatory inspection and a tax challenge in the countries where the founders actually live. The fifth is exit and change-of-control: how hard it is to add a shareholder, take investment or be acquired without a fresh approval process.

This guide walks the main regime families, what each realistically demands, how they compare on banking acceptance and timeline, the mistakes that cost founders a year, and how to sequence entity, licence, banking and tax so they agree with each other rather than fight.

Licensing regimes are activity-based, and the activities look similar from outside and are treated very differently inside. Custody of client assets is the highest-obligation activity almost everywhere, because it attracts safeguarding rules, capital requirements and insolvency-protection expectations. Exchange between crypto and fiat brings the full AML perimeter and banking dependency. Crypto-to-crypto exchange is sometimes lighter. Brokerage and order routing may fall under investment-services rules rather than crypto-specific ones.

Derivatives are a separate world: offering leveraged or futures products usually engages investment-firm or market-operator licensing, retail restrictions, and in many jurisdictions is prohibited to local retail users entirely. Stablecoin issuance is now its own regime family in several major markets, with reserve, redemption and audit requirements closer to payments regulation than crypto regulation.

Then the adjacent activities: staking-as-a-service, lending and yield products, payment processing in crypto, OTC dealing, market making, wallet provision, and token issuance itself. Several of these are unregulated in some regimes and licensable in others, and the difference frequently decides which jurisdiction is even viable.

The practical exercise is to write down, precisely, what the business does today, what it intends to do within eighteen months, whose assets it touches, whether it ever holds fiat, and which countries its users are in. That document determines the licence. Doing it in the other order — choosing a jurisdiction, then discovering the roadmap needs a permission that regime does not grant — is the most common expensive mistake in the sector.

It also determines whether a licence is needed at all. Non-custodial software, pure infrastructure, and some B2B tooling can operate without one, and paying for a licence you do not need imports obligations for no market benefit.

The EU's harmonised regime for crypto-asset service providers is now the reference point for the sector. Authorisation is granted by a national regulator and then permits service across the bloc, which is the single largest access benefit available anywhere.

What it demands is proportionate to that: minimum own funds by service category, fit-and-proper assessment of management and qualifying shareholders, a full governance and risk framework, ICT and operational resilience documentation, safeguarding arrangements for client crypto and funds, complaints and conflicts policies, disclosure obligations, market-abuse controls, and audited reporting. Applications run to hundreds of pages and regulators send substantive questions.

Timelines are measured in quarters, not weeks — realistically nine to eighteen months from a standing start including pre-application engagement, with the variance driven mostly by how complete the first submission is. Costs are correspondingly real: regulatory fees, legal and compliance consultancy, local hires, audit, capital, and the office and governance footprint the regulator expects.

Regulators inside the bloc differ in practice — appetite, engagement style, queue length, language and how they treat specific activities — so the choice of member state is a genuine strategic decision rather than a formality. So is the fact that a shell presence does not pass: substance requirements are enforced, and a locally resident senior management function is expected.

Who this suits: businesses serving European retail or institutional users at scale, anyone needing banking from institutions that will not touch unsupervised crypto activity, and anyone contemplating institutional investment or acquisition. Who it does not: early-stage projects with no European user base and no capital to sustain the obligation set.

The UK operates registration for cryptoasset businesses under its money-laundering regime, with financial-promotions rules that materially constrain how services can be marketed to UK consumers, and a broader regulatory build-out in progress. Registration is not a light exercise: the regulator has refused or seen withdrawn a large share of applications, mostly on the quality of the AML framework and the fitness of the people running it. Banking acceptance for a properly registered UK entity is comparatively good.

The Gulf has become a serious option rather than a novelty. The UAE offers multiple routes — a federal regulator, an emirate-level virtual-asset authority, and separate financial free-zone regulators each with their own rulebook — and the choice among them changes the permitted activities, the capital requirement, the substance expectation and which banks will engage. Timelines are typically six to twelve months, costs are meaningful, and the regimes expect genuine local presence: office, resident senior management, local compliance function.

Other mid-cost regimes appear and disappear from the shortlist as rules tighten. The stable test is not the marketing but three questions: does the regulator supervise in practice, do correspondent banks respect it, and does the permission set cover your roadmap.

Across all of these, the common pattern is that credible regimes cost more up front and less over the life of the business, because banking works, institutional counterparties engage, and the entity survives diligence when investment or acquisition arrives.

The corollary is worth stating: for a business that intends to be operating in five years, licensing cost is a capital-efficiency question, not an expense-minimisation question.

Caribbean and other international financial centres offer virtual-asset regimes with lower capital requirements, faster processes and smaller footprints. Several of them are properly supervised and produce entities that bank and that institutional counterparties will trade with. Others are effectively registration exercises, and the difference is not obvious from the legislation.

The honest use cases for these regimes are real: a token issuer or foundation-type vehicle that does not touch client assets; a B2B service with institutional counterparties who do their own diligence; a group entity for non-EU, non-US markets; a first licence for a business whose economics do not yet support a European authorisation. Used that way, they are the correct answer.

Where they fail is as a substitute for market access. A lightly-supervised licence does not let you serve European or UK retail customers, and it will not persuade a US or European bank to take on the underwriting risk. Founders who buy one expecting it to unlock global operations discover the constraint at the banking stage.

Two further points that decide outcomes in this family. First, substance: a company with a registered agent, no staff, no local decision-making and directors resident elsewhere is exposed both to substance regimes locally and to place-of-effective-management challenges in the countries where the founders actually sit. Second, sequencing: applying in one of these jurisdictions after being refused elsewhere is visible and it damages the application.

Assessed honestly, this family is a tool with a defined purpose, not a shortcut around regulation. The projects it works well for are the ones that chose it deliberately.

The US is not a jurisdiction on a comparison table; it is a parallel programme. Federal registration as a money services business with the financial-crimes regulator is the entry obligation for money transmission and exchange activity, and it sits alongside state-by-state money-transmitter licensing with its own capital, bonding and reporting requirements in each state where customers sit.

Layered on top are the securities and commodities perimeters, which are activity-dependent and enforcement-driven, and a New York-specific regime for virtual-currency business activity that is treated as its own approval process with its own reputation.

The consequence is that serving US retail users is a multi-year, multi-million-dollar compliance build, not a licence purchase, and the honest advice for most non-US founders is to geofence the US properly rather than serve it partially. Partial service — accepting US users without the corresponding permissions — is the single most common cause of catastrophic outcomes in this sector, including banking termination, asset freezes and personal exposure.

Geofencing has its own standard: IP blocking alone is not considered adequate where a business knows or should know that users are circumventing it. KYC-level residency screening, sanctions screening, terms that match actual practice, and evidence of enforcement are what regulators and banks expect to see.

For B2B businesses with US institutional counterparties, the analysis is different and often workable. It should be run with US counsel specifically, before the first US counterparty is onboarded.

A licensed crypto business needs several distinct banking relationships: an operating account for payroll and expenses, a client-money or safeguarding account where the regime requires segregation, fiat on-ramp and off-ramp capability in the currencies customers actually use, and often a separate institution for treasury.

Institutions underwrite this on the licence, the regulator, the flow profile, the counterparties, the on-chain monitoring stack, and the beneficial owners' residency. The regulator's reputation is a first-order input, which is why the licence decision and the banking decision cannot be sequenced independently.

The pattern that works is to establish, before applying, which institutions would underwrite the finished entity under each candidate regime, and to weight the jurisdiction choice accordingly. The pattern that fails is to obtain a licence and then discover that the accessible institutions cannot support the currencies or corridors the business runs on.

Safeguarding requirements deserve specific attention because they narrow the institution list sharply. A regime that requires client fiat to be held in a segregated account at a credit institution in a particular territory eliminates most payment institutions from the solution, and the remaining banks are few and selective.

Practically, budget for a banking workstream that runs in parallel with licensing, with a primary and at least one contingency institution, because a single account closure should never be able to stop the business.

A licence tells you where the business is regulated. It does not tell you where it is taxed. Corporate tax residency follows management and control or place of effective management in most systems, which means a company licensed in one jurisdiction and directed from a founder's living room in another can be treated as resident where the founder sits — with that country's corporate tax rate, filing obligations and, on a bad day, penalties for years of non-filing.

Controlled-foreign-company rules add a second exposure: even where the company is not treated as locally resident, a founder resident in a jurisdiction with CFC rules may have the company's profits attributed to them personally. Economic-substance regimes add a third, requiring demonstrable local activity, expenditure and decision-making in the jurisdiction of incorporation.

The three interact. Real substance in the licensing jurisdiction — local directors who genuinely decide, staff, office, board meetings held and minuted there, local expenditure — is what answers all three at once. Nominal substance answers none of them, and it is visible in the era of beneficial-ownership registers and automatic information exchange.

There is also the founder's own position: personal tax residency, the treatment of token holdings, and the exit exposure if the founder intends to relocate. Getting the corporate structure right and leaving the founder's personal position unaddressed is a half-finished job that surfaces at the first significant liquidity event.

The workable approach is to design licensing, corporate residency, substance and the founders' personal positions as one structure, with local counsel in each relevant country, before the licence application is filed. Retrofitting is possible and considerably more expensive.

Choosing the jurisdiction before defining the activity set, then finding the roadmap needs a permission that regime does not grant. Optimising for speed and cost, then failing to open a bank account that supports the business.

Assuming a licence in one jurisdiction permits service everywhere, and serving customers in territories where it does not. Serving US users without US permissions, on the theory that the terms of service exclude them while the onboarding does not.

Building the structure with nominal local presence and no real decision-making, then facing substance, corporate-residency and CFC challenges simultaneously. Appointing a resident director who is a name rather than a person who governs.

Submitting an incomplete application to save consultancy cost, which converts a nine-month process into an eighteen-month one, and in some regimes into a refusal that has to be disclosed on every subsequent application.

Underbudgeting the ongoing obligation set — MLRO, compliance officer, audit, capital, reporting — and discovering in year two that the licence costs more to keep than the business earns. Ignoring change-of-control rules until an investor's diligence surfaces them. And leaving the founders' personal tax positions out of the design entirely.

We begin with the activity and market map rather than a jurisdiction recommendation: exactly what the business does and intends to do, whose assets it touches, whether it ever holds fiat, which countries its users are in, and which of those must be geofenced. That document is what makes every later decision defensible.

We then produce a shortlist with the trade-offs written down — permitted activities against your roadmap, capital and ongoing obligations, substance and hiring requirements, realistic timeline, and critically the banking acceptance we expect for the finished entity in each case. Where the honest answer is that a business is not yet ready for the regime it wants, we say so and set out the interim structure.

Execution runs with qualified local counsel and licensed local agents in the chosen jurisdiction. We coordinate the application file — governance and risk framework, AML/CFT policies and MLRO arrangements, safeguarding and custody arrangements, ICT and resilience documentation, fitness-and-propriety packs for management and shareholders, capital arrangements — and we manage the regulator's question rounds rather than leaving them to founders.

Banking runs in parallel, not afterwards. Drawing on a network of more than 120 banking and payment institutions whose current appetite for licensed digital-asset businesses we track, we build the file to institutional standard and approach institutions that underwrite your specific profile — operating accounts, safeguarding or client-money accounts, fiat on-ramp and off-ramp, and treasury. Every institution decides independently, and we say that before an engagement starts.

Around the licence we build the rest of the structure: group and issuer entities, corporate residency and substance so the company is taxed where it is designed to be taxed, the founders' personal residency and holding positions coordinated with local counsel, and the OTC and treasury path for converting revenue. Where the business needs liquidity or exchange access, those run as connected mandates rather than separate projects.

Send us the activity list, the user geography and where the founders are resident, and we will tell you which regimes are genuinely viable, what each costs to obtain and to keep, what banking you can expect, and how long it takes. Compliance-first — and we decline mandates where the plan is to serve markets the licence does not cover.