Crypto License Guide 2026 — CASP, VASP, MSB, BitLicense, EMI

What a crypto licence is

A crypto licence is a regulatory authorisation — or, in lighter regimes, a registration — that permits a firm to provide crypto-asset services lawfully in a given jurisdiction. "Crypto-asset services" covers the regulated activities: operating an exchange or trading platform, custody of client assets, executing or transmitting orders, transferring crypto-assets for clients, advising, and portfolio management.

The term "crypto licence" is generic. What it actually means in practice depends entirely on the jurisdiction. In the European Union it is the MiCA CASP authorisation. In jurisdictions that have not adopted a bespoke regime it may be a money-services-business registration. In the United Arab Emirates, Dubai operates its own VARA framework. The first task in any licensing project is therefore not "get a crypto licence" — it is to identify which specific authorisation the business model and target market actually require.

A second, earlier question sits upstream of all of this: is the token a financial instrument? If a crypto-asset qualifies as a financial instrument under MiFID II, the crypto-specific regimes do not apply at all — the financial-instruments framework does. We cover this boundary in MiCA or MiFID II?.

The crypto licence types compared

The crypto licence landscape in 2026 has 15+ distinct authorisation categories across major jurisdictions. They are not interchangeable — each has a different legal basis, regulatory scope, and customer-access reach. The table maps the principal credentials.

For most operators servicing the EU customer base, the CASP is the central authorisation. For US-targeted operators, the FinCEN MSB plus state money transmitter licences plus NYDFS BitLicense stack covers federal AML plus state-level money transmission plus New York market access. The VASP belongs to the regime MiCA replaced — see VASP licence explained: pre-MiCA to MiCA. The EMI and PI are not crypto licences as such but sit alongside CASP — an EMI authorisation is the gateway to issuing an e-money-token stablecoin (USDC and similar Title IV designs), and PI / EMI arrangements underpin the fiat rails — see banking access for licensed CASPs.

Money transmitter licence (US)

A money transmitter licence (MTL) is a US state-level authorisation for businesses that transmit money or its equivalent. Forty-nine of the fifty US states require some form of MTL for crypto-asset operators servicing customers in that state. Montana is the principal exception. Operating without state MTLs where required has produced state-attorney-general enforcement and criminal referrals in multiple US states.

State MTLs vary in capital requirements (typically a $25,000-$500,000 surety bond plus minimum net worth of $50,000-$1,000,000), application fees ($500-$5,000 per state), processing times (3-12 months per state), and substantive requirements (BSA/AML programme, fitness-and-properness review, cybersecurity standards, audited financials). Some states accept multistate licensing through Money Services Businesses (MSB) Networked Supervision under the Conference of State Bank Supervisors; others require state-specific application even where the operator holds licences elsewhere.

Florida money transmitter licence applications face one of the more demanding state review processes alongside California, New York, Texas, and Illinois. A mid-scope US crypto operator typically scopes the engagement to 10-25 commercial-priority states reflecting customer-concentration analysis. Full national 49-state coverage costs $1.5-5.0 million in legal and licensing budget over 18-24 months. See the deeper analysis at US crypto licensing — state MTL, FinCEN MSB, BitLicense stack.

MSB licence (US FinCEN)

MSB stands for Money Services Business. In the United States, MSB registration with FinCEN is the federal AML registration required for crypto-asset operators handling client crypto-assets. The Financial Crimes Enforcement Network, an agency within the US Treasury Department, runs the MSB registration framework under the Bank Secrecy Act.

FinCEN MSB registration is free, takes effect immediately on filing, and renews every two years. The registration produces federal AML obligations: a written BSA/AML programme, a designated BSA officer, customer identification programme, suspicious activity reporting via SAR filings, currency transaction reports for $10,000+ transactions, and record retention. MSB registration does not authorise state-level money transmission — separate state MTLs are required for any state where the operator services customers.

FinCEN enforcement against unregistered or non-compliant MSBs has produced multi-million-dollar civil penalties since 2017 including Bittrex ($29m), BitMEX ($100m settlement), and the coordinated Binance action ($4.3bn in US enforcement). The MSB framework requires real BSA/AML substance, not paper-only compliance.

In Canada, MSB registration with FINTRAC under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act covers comparable AML obligations for Canadian crypto operators. See Canada MSB vs EU CASP for the cross-border comparison.

NYDFS BitLicense (New York)

The NYDFS BitLicense, established in 2015 under 23 NYCRR Part 200, is the most rigorous US state-level crypto licence and one of the most-respected crypto credentials globally. The licence authorises virtual currency business activity within New York State and is treated as a quasi-federal signal by the broader US compliance community.

BitLicense applicants face substantive capital requirements (set on a case-by-case basis but typically $250,000 to $10 million+ depending on business profile), full fitness-and-properness review of senior management, mandatory BSA officer and cybersecurity officer designations with NYDFS-approved credentials, real-time AML and OFAC screening framework, comprehensive cybersecurity programme under 23 NYCRR Part 500, capital management plan, business continuity plan, and audited financial statements.

BitLicense application timeline runs 18-36 months for first-time applicants. NYDFS conducts substantive document review, multiple rounds of information requests, in-person interviews with senior management, and on-site inspection of New York operations. The process is functionally comparable to a fintech-grade banking supervisor review and produces the strongest US state-level reputational signal.

Holding a NYDFS BitLicense produces credibility signal across the US compliance community. Banks, payment processors, and institutional counterparties treat BitLicense holders as the most-rigorously-vetted US crypto operator tier. For New-York-customer-focused operators, the BitLicense is non-optional. See United States crypto licensing law firm guide for the broader US engagement framework.

VASP licence and pre-MiCA migration

VASP — Virtual Asset Service Provider — is the FATF-derived term used in pre-MiCA EU regulatory frameworks for entities providing crypto-asset services. The major pre-MiCA VASP registers operated under 5AMLD national implementations: Estonia MTR (since 2017), Lithuania VASP register (since 2020), Czech Republic CNB list (since 2017), Latvia FCMC register, Finland Fin-FSA register, Netherlands DNB register.

The pre-MiCA frameworks shared common characteristics: AML-focused registration only (no prudential or conduct regulation), national scope only (no EU passport), and variable supervisor intensity. The Estonian MTR register at peak had approximately 1,600 registered VASPs; the total EU pre-MiCA VASP population reached 2,500-3,000.

VASP licence cost varied by member state. Estonia and Lithuania pre-MiCA registration ran roughly EUR 5,000-15,000 in regulator fees plus EUR 50,000-150,000 in legal and substance costs. Finland and Netherlands applied more selective registration with substantive substance expectations and correspondingly higher costs.

MiCA replaces VASP registration with full CASP authorisation across all 27 EU member states. The Article 143 transitional regime allows existing VASP-registered operators to continue under transitional arrangements until 1 July 2026 maximum. New applications must go through CASP authorisation directly. See VASP licence explained: pre-MiCA to MiCA migration for the full transition framework.

EMI licence and the stablecoin pathway

EMI — Electronic Money Institution — is the authorisation under EU E-Money Directive 2 (Directive 2009/110/EC) and equivalent UK and national frameworks to issue electronic money. EMI authorisation is not a crypto licence in itself but is operationally central to two crypto use cases.

EMI as the EMT issuer pathway. Under MiCA Title IV, e-money-token (EMT) issuance — single-currency-backed stablecoins like USDC and EUR-pegged equivalents — is limited to credit institutions and EMIs. EMI authorisation plus MiCA Title IV overlay is the operational pathway for non-bank stablecoin issuers. Circle operates USDC issuance in the EU through Circle Internet Financial Europe SAS, an ACPR-authorised French EMI. See stablecoin issuer licence — EMI vs MiCA ART issuer.

EMI as the fiat-rails infrastructure. CASPs need fiat on/off-ramp infrastructure for customer deposits and withdrawals. EMI authorisations and Payment Institution authorisations underpin this infrastructure either through CASP ownership of an EMI subsidiary or through EMI-partner relationships. See banking access for licensed CASPs for the operational reality.

EMI licence cost in the EU runs EUR 100,000-500,000+ for application work plus EUR 350,000 minimum initial capital under EMD2. UK EMI cost is broadly comparable through the FCA framework. EMI authorisation timeline runs 6-12 months for clean files.

MiCA CASP authorisation (EU)

The Markets in Crypto-Assets Regulation (MiCA), Regulation (EU) 2023/1114, is the EU's purpose-built crypto regime. It applied to crypto-asset service providers from 30 December 2024. MiCA is organised into titles, and a founder needs to know which title applies to the business:

• Title II — offering "other" crypto-assets (utility-style tokens). Triggers a white paper notification.
• Title III — asset-referenced tokens (ARTs). Issuer authorisation, reserves, prudential rules. See stablecoin reserves under MiCA.
• Title IV — e-money tokens (EMTs). The issuer must be an EMI or credit institution.
• Title V — the CASP regime: authorisation, governance, capital, and the crypto-asset services themselves, including custody.
• Title VI — market abuse: insider dealing, unlawful disclosure, and market manipulation for crypto-assets.

A MiCA CASP authorisation passports — a single authorisation, granted by one home-state regulator, carries the right to operate across all 27 EU member states. This is the central economic logic of MiCA and the reason it is the priority for any EU-facing crypto business.

Non-EU regimes (UK FCA, MAS Singapore, Dubai VARA, Gibraltar)

Outside the EU, several major regimes operate distinct authorisation frameworks for crypto-asset operators. The choice depends on the operator's customer base, market positioning, and reputational requirements.

UK FCA cryptoasset registration. Currently operates under the Money Laundering Regulations 2017 with the emerging UK Cryptoasset Regulatory Framework phasing in through 2026-2027 under FSMA 2000. The FCA applies banking-grade rigour with a high authorisation bar — only ~15-20% of MLR registration applications have been approved since 2020. UK-resident senior management (SMF-16 head of compliance, SMF-17 MLRO) is non-negotiable. See UK crypto licensing law firm guide.

MAS Singapore Payment Services Act licence. The Monetary Authority of Singapore is the premier Asia-Pacific crypto regulator. Major Payment Institution (MPI) licence covers full-scope Digital Payment Token service. Standard Payment Institution (SPI) covers limited-scope activity. Capital Markets Services (CMS) licence covers security-token activity. MAS applies banking-grade rigour with tightly controlled licensee population. See Singapore crypto licensing law firm guide.

Dubai VARA licence. Virtual Assets Regulatory Authority licence is the bespoke MENA crypto framework. VARA covers exchange services, custody, lending, transfer, and broker-dealer activity with separate licence categories. The framework operates alongside Dubai's broader financial-services ecosystem. See MiCA vs Dubai VARA for the comparison.

Gibraltar DLT licence. The world's first dedicated DLT regulatory framework, launched in January 2018 — four years before MiCA. The Gibraltar Financial Services Commission applies principles-based supervision with thorough engagement. Tightly controlled licensee population (~20-30 operators). No EU passport post-Brexit. See Gibraltar crypto license guide.

Switzerland FINMA. Crypto bank licensing under Swiss banking law is the most demanding crypto-related authorisation globally — SEBA Bank and Sygnum Bank are the pioneer institutions. Lighter DLT licence frameworks operate alongside. See Switzerland FINMA vs EU MiCA.

Liechtenstein TVTG. Token and TT Service Provider Act framework — one of the most developed European non-EU crypto frameworks. EEA member but with limited EU-passport scope. See Liechtenstein TVTG vs MiCA.

Choosing a jurisdiction

Because a MiCA authorisation passports, the home jurisdiction does not limit the market — but it does determine the timeline, the cost, the regulator’s practice, and the supervisory reputation that travels with the licence. Choosing well matters.

This publication maintains two tools for the jurisdiction decision:

• The Crypto Jurisdiction Index — twelve EU and non-EU jurisdictions scored on five pillars: licensing speed, regulatory maturity, banking access, cost efficiency, and reputation and reach.
• The Best Jurisdiction Finder — a four-question tool that produces a ranked shortlist for a specific business model and priorities.

For deeper jurisdiction-by-jurisdiction analysis, see the EU jurisdiction comparison, and the head-to-head guides: Lithuania vs Poland, MiCA vs Dubai VARA, Canada MSB vs EU CASP, and Switzerland vs EU MiCA.

Cost

Crypto-licensing cost is consistently under-budgeted, because founders anchor on the headline capital figure. Under MiCA, the prudential capital floors are set by Annex IV:

The headline floor is the smallest line in the real cost. The total cost of being licensed and operating includes the ongoing own-funds requirement (the higher of the floor or one-quarter of fixed overheads), insurance for custody firms, substance — the local headcount and office the regulator expects — and counsel. See choosing your CASP class for how the class decision drives all of this.

Timeline

Under MiCA, Article 63 sets the statutory clock: a 25-working-day completeness check, then a 40-working-day substantive assessment of a complete application — roughly three months of formal clock. The real-world timeline is longer, commonly 4-8 months from decision to licence, because the assessment clock only starts once the regulator declares the file complete. The full mechanics are in how long a MiCA CASP licence takes.

For existing crypto firms, a separate clock matters: the VASP-to-CASP transition deadline of 1 July 2026 — the date by which an existing VASP must have filed, and ideally been granted, a CASP authorisation.

AML and compliance obligations

A crypto licence is not only a prudential authorisation — it carries an anti-money-laundering and financial-crime compliance load that runs for the life of the licence. The core workstreams:

• The MLRO function — the Money Laundering Reporting Officer, with substance expectations that vary sharply by jurisdiction. See MLRO substance requirements.
• The Travel Rule — originator and beneficiary information on crypto-asset transfers, under the EU Transfer of Funds Regulation. See the EU Travel Rule explained.
• Sanctions compliance — a strict-liability regime separate from AML. See sanctions compliance for CASPs.
• ICT resilience — under DORA, the Digital Operational Resilience Act. See DORA ICT resilience for CASPs.

The licensing process, step by step

1. Classify. Establish whether the token is a financial instrument, and which licence the business model requires.
2. Choose the jurisdiction. Decide the home jurisdiction against timeline, cost, banking, and reputation — the Jurisdiction Index and Finder are built for this step.
3. Decide the licence class. The class — driven by whether the firm holds client assets or runs a trading venue — sets capital, governance depth, and cost.
4. Build the file. Prudential capital evidence, governance and management-body suitability, AML/CFT framework, ICT-resilience plan, custody policy where relevant, complaints procedure.
5. Pre-engage where possible. Several regulators offer pre-application dialogue that surfaces gating issues before the formal review.
6. File and clear completeness. The application has to reach "complete" before the substantive assessment clock starts.
7. Respond to information requests. Response speed materially affects total timeline.
8. Authorisation and passport. On a grant, notify host competent authorities to passport the services across the EU.

Frequently asked questions