Crypto Licensing: The Complete 2026 Guide

What a crypto licence is

A crypto licence is a regulatory authorisation — or, in lighter regimes, a registration — that permits a firm to provide crypto-asset services lawfully in a given jurisdiction. "Crypto-asset services" covers the regulated activities: operating an exchange or trading platform, custody of client assets, executing or transmitting orders, transferring crypto-assets for clients, advising, and portfolio management.

The term "crypto licence" is generic. What it actually means in practice depends entirely on the jurisdiction. In the European Union it is the MiCA CASP authorisation. In jurisdictions that have not adopted a bespoke regime it may be a money-services-business registration. In the United Arab Emirates, Dubai operates its own VARA framework. The first task in any licensing project is therefore not "get a crypto licence" — it is to identify which specific authorisation the business model and target market actually require.

A second, earlier question sits upstream of all of this: is the token a financial instrument? If a crypto-asset qualifies as a financial instrument under MiFID II, the crypto-specific regimes do not apply at all — the financial-instruments framework does. We cover this boundary in MiCA or MiFID II?.

The licence types — CASP, VASP, MSB, EMI, PI

Five acronyms account for most of the crypto-licensing landscape. They are not interchangeable — each is a different category of authorisation, with a different legal basis and a different scope.

For most crypto businesses targeting the EU, the CASP is the central authorisation. The VASP belongs to the regime MiCA replaced — see CASP vs VASP: what changed under MiCA. The EMI and PI are not crypto licences as such, but they sit alongside the CASP regime: an EMI authorisation is the gateway to issuing an e-money-token stablecoin, and PI / EMI arrangements underpin the fiat rails a crypto business needs — see banking access for licensed CASPs.

MiCA — the EU framework

The Markets in Crypto-Assets Regulation (MiCA), Regulation (EU) 2023/1114, is the EU’s purpose-built crypto regime. It applied to crypto-asset service providers from 30 December 2024. MiCA is organised into titles, and a founder needs to know which title applies to the business:

• Title II — offering "other" crypto-assets (utility-style tokens). Triggers a white paper notification.
• Title III — asset-referenced tokens (ARTs). Issuer authorisation, reserves, prudential rules. See stablecoin reserves under MiCA.
• Title IV — e-money tokens (EMTs). The issuer must be an EMI or credit institution.
• Title V — the CASP regime: authorisation, governance, capital, and the crypto-asset services themselves, including custody.
• Title VI — market abuse: insider dealing, unlawful disclosure, and market manipulation for crypto-assets.

A MiCA CASP authorisation passports — a single authorisation, granted by one home-state regulator, carries the right to operate across all 27 EU member states. This is the central economic logic of MiCA and the reason it is the priority for any EU-facing crypto business.

Choosing a jurisdiction

Because a MiCA authorisation passports, the home jurisdiction does not limit the market — but it does determine the timeline, the cost, the regulator’s practice, and the supervisory reputation that travels with the licence. Choosing well matters.

This publication maintains two tools for the jurisdiction decision:

• The Crypto Jurisdiction Index — twelve EU and non-EU jurisdictions scored on five pillars: licensing speed, regulatory maturity, banking access, cost efficiency, and reputation and reach.
• The Best Jurisdiction Finder — a four-question tool that produces a ranked shortlist for a specific business model and priorities.

For deeper jurisdiction-by-jurisdiction analysis, see the EU jurisdiction comparison, and the head-to-head guides: Lithuania vs Poland, MiCA vs Dubai VARA, Canada MSB vs EU CASP, and Switzerland vs EU MiCA.

Cost

Crypto-licensing cost is consistently under-budgeted, because founders anchor on the headline capital figure. Under MiCA, the prudential capital floors are set by Annex IV:

The headline floor is the smallest line in the real cost. The total cost of being licensed and operating includes the ongoing own-funds requirement (the higher of the floor or one-quarter of fixed overheads), insurance for custody firms, substance — the local headcount and office the regulator expects — and counsel. See choosing your CASP class for how the class decision drives all of this.

Timeline

Under MiCA, Article 63 sets the statutory clock: a 25-working-day completeness check, then a 40-working-day substantive assessment of a complete application — roughly three months of formal clock. The real-world timeline is longer, commonly 4-8 months from decision to licence, because the assessment clock only starts once the regulator declares the file complete. The full mechanics are in how long a MiCA CASP licence takes.

For existing crypto firms, a separate clock matters: the VASP-to-CASP transition deadline of 1 July 2026 — the date by which an existing VASP must have filed, and ideally been granted, a CASP authorisation.

AML and compliance obligations

A crypto licence is not only a prudential authorisation — it carries an anti-money-laundering and financial-crime compliance load that runs for the life of the licence. The core workstreams:

• The MLRO function — the Money Laundering Reporting Officer, with substance expectations that vary sharply by jurisdiction. See MLRO substance requirements.
• The Travel Rule — originator and beneficiary information on crypto-asset transfers, under the EU Transfer of Funds Regulation. See the EU Travel Rule explained.
• Sanctions compliance — a strict-liability regime separate from AML. See sanctions compliance for CASPs.
• ICT resilience — under DORA, the Digital Operational Resilience Act. See DORA ICT resilience for CASPs.

The licensing process, step by step

1. Classify. Establish whether the token is a financial instrument, and which licence the business model requires.
2. Choose the jurisdiction. Decide the home jurisdiction against timeline, cost, banking, and reputation — the Jurisdiction Index and Finder are built for this step.
3. Decide the licence class. The class — driven by whether the firm holds client assets or runs a trading venue — sets capital, governance depth, and cost.
4. Build the file. Prudential capital evidence, governance and management-body suitability, AML/CFT framework, ICT-resilience plan, custody policy where relevant, complaints procedure.
5. Pre-engage where possible. Several regulators offer pre-application dialogue that surfaces gating issues before the formal review.
6. File and clear completeness. The application has to reach "complete" before the substantive assessment clock starts.
7. Respond to information requests. Response speed materially affects total timeline.
8. Authorisation and passport. On a grant, notify host competent authorities to passport the services across the EU.

Frequently asked questions