US crypto licensing 2026 — federal and state routes

Why US crypto licensing needs a specialist law firm

The United States runs a fragmented framework for crypto licensing. Operators serving US customers deal with federal AML registration under FinCEN, state-by-state money-transmitter or digital-asset licensing, the NYDFS BitLicense for New York, California's Digital Financial Assets Law, and SEC and CFTC rules covering any activity that touches securities or commodity derivatives.

There is no single licence for exchanges or custodians and no EU-style passport between states. Federal law has a dedicated licensing regime only for payment stablecoins: the GENIUS Act, signed on 18 July 2025. Token classification moved in 2026 from enforcement cases to formal SEC guidance, with the 17 March 2026 interpretation and the 18 August 2026 Regulation Crypto Assets proposal.

Counsel choice matters because the stack is large. Practitioners put a full-stack engagement at 18-36 months and $1.5m-$5m+ in legal and licensing budget, and a mid-scope engagement (5-15 states plus federal plus enforcement-defence capability) at $250k-$1m (practitioner estimates). State enforcement, FinCEN civil penalties and criminal exposure for unlicensed money transmission cost more than the engagement.

Federal AML registration — FinCEN MSB

The Financial Crimes Enforcement Network (FinCEN), an agency within the US Treasury Department, runs the federal AML registration framework. Money services businesses (MSBs) — which includes crypto exchanges, custodians and most operators handling client crypto-assets — must register with FinCEN under the Bank Secrecy Act.

FinCEN MSB registration is free. The form is filed within 180 days of the business being established and renewed every two calendar years, and a foreign-located MSB must designate a US-resident agent for service of process (31 CFR 1022.380). Registration brings federal AML obligations: a written BSA/AML programme, a designated BSA officer, customer identification, suspicious activity reports, currency transaction reports for cash transactions over $10,000, and record retention. It does not authorise the underlying business; that depends on state licensing.

FinCEN enforcement against crypto MSBs with inadequate BSA/AML programmes includes Bittrex ($29.3 million, October 2022), BitMEX ($100 million, August 2021, coordinated with the CFTC) and Binance ($4.3 billion in coordinated US action, November 2023). FinCEN BSA programmes need real substance, not paper-only frameworks.

State money-transmitter and digital-asset licensing

The state layer is where the US framework diverges most sharply from the EU. Each state runs its own licensing regime, usually through its banking department. State-by-state surveys list Montana as the only state with no money-transmitter regime; how each state treats crypto activity varies, and some states license it under a dedicated digital-asset law instead.

California is the main example. Its Digital Financial Assets Law (DFAL), administered by the Department of Financial Protection and Innovation (DFPI), required firms doing digital financial asset business with California residents to hold a licence, or to have filed a complete application, from 1 July 2026. The DFPI began accepting applications through NMLS on 9 March 2026; the fee is $7,500 plus the DFPI's review costs.

State licences vary in capital and bonding, fees, processing times and substantive requirements (BSA/AML programme, fitness and propriety, cybersecurity standards, audited financials). Practitioner estimates put surety bonds at $25k-$500k plus net-worth requirements of $50k-$1m, and processing at 3-12 months per state. Some states coordinate examinations through Conference of State Bank Supervisors (CSBS) programmes; others require a full state-specific application even where the operator holds licences elsewhere.

Firms usually scope the state engagement to commercial priorities. Full national state coverage is rare given the cost and time (practitioner estimate: $1.5m+ and 18-24 months for the state layer alone). Mid-tier engagements cover 10-25 states based on customer concentration; phase-1 engagements often cover 5-10 high-revenue states with expansion over 12-24 months (practitioner estimates).

NYDFS BitLicense

The New York State Department of Financial Services BitLicense, in effect since 24 June 2015 under 23 NYCRR Part 200, authorises virtual currency business activity within New York State.

The superintendent sets each licensee's capital based on an assessment of its specific risks (23 NYCRR 200.8); practitioners see $250k-$10m+ depending on business profile (practitioner estimate). The application fee is $5,000 (200.5). Applicants need a BSA/AML programme with a qualified compliance designee (200.15), real-time AML and OFAC screening, a cybersecurity programme (23 NYCRR Part 500 also applies), a business continuity plan, audited financial statements and fitness-and-propriety review of senior management.

Practitioners report 18-36 months for first-time applicants, with document review, several rounds of information requests and interviews with senior management (practitioner estimate).

Banks, payment processors and institutional counterparties often treat a BitLicense as a strong due-diligence signal, which can justify the cost for operators with an institutional or New York-focused strategy.

SEC securities-law overlay

Where activity touches token offerings, secondary trading or investment advice, federal securities law applies. The test for an investment contract remains Howey: an investment of money in a common enterprise with an expectation of profits from the efforts of others. Security tokens need Securities Act 1933 registration or an exemption (such as Regulation D, Regulation S or Regulation A+), broker-dealer registration under the Exchange Act 1934 for distribution, and exchange or ATS registration for secondary trading.

The SEC's approach changed in 2025 and 2026. It dismissed its civil enforcement action against Coinbase on 27 February 2025, its case against Kraken was dismissed in March 2025 and its case against Binance in May 2025, and in SEC v Ripple both sides dropped their appeals in August 2025. On 17 March 2026 the SEC issued an interpretation, joined by the CFTC, that sorts crypto assets into digital commodities, digital collectibles, digital tools, stablecoins and digital securities. The first three are not securities in themselves, though a sale can still be part of an investment contract.

On 18 August 2026 the SEC proposed Regulation Crypto Assets, a framework for certain investment contracts involving crypto assets, including a one-time offering exemption of up to $5 million over four years and an exemption for offerings of up to $75 million in each 12-month period. Classification analysis is still central to US crypto compliance design, but it now starts from the March 2026 taxonomy rather than from enforcement cases.

CFTC commodity-derivatives overlay

The Commodity Futures Trading Commission supervises commodity derivatives in the US. Bitcoin and Ether are treated as commodities for CFTC purposes; derivatives (futures, swaps, options) referencing crypto-asset commodities are CFTC-regulated. Operators offering crypto futures, perpetual swaps to US persons or other crypto derivatives need FCM (Futures Commission Merchant) registration, DCM (Designated Contract Market) designation for venue operations, or SEF (Swap Execution Facility) registration. The CFTC joined the SEC's 17 March 2026 interpretation on crypto asset classification.

CFTC enforcement against unregistered derivatives venues serving US customers includes BitMEX, ordered in August 2021 to pay a $100 million civil monetary penalty, of which up to $50 million could be offset by payments under FinCEN's parallel assessment, and Binance.

How US engagement timing actually works

A representative US engagement timeline, based on practitioner estimates. Phase 1 (months 0-3): scoping, strategy, FinCEN MSB registration, BSA/AML programme design, OFAC screening framework. Phase 2 (months 3-9): state licence applications in 5-10 commercial-priority states, including California's DFAL where California residents are in scope. Phase 3 (months 6-18): further state licences filed in waves as the business expands. Phase 4 (months 12-36): NYDFS BitLicense application if New York customers are in scope. Phase 5 (ongoing): securities-law analysis for any token activity, CFTC engagement if derivatives are in scope, a GENIUS Act application if the business issues a payment stablecoin, and enforcement-defence capability as needed.

Most US crypto operators run the engagement in waves rather than all at once. The fragmented framework allows commercially prioritised licensing — start in the states where licences are in hand, build state coverage as customer demand justifies, and add the NYDFS BitLicense where New York market access matters.

Cost of US crypto licensing engagement

Engagement cost scales with scope (all practitioner estimates). Phase 1 federal scope (FinCEN MSB + BSA/AML programme): $50k-$150k. Phase 2 mid-state scope (5-10 licences + ongoing compliance): $250k-$750k. Phase 3 broader-state scope (15-25 licences): $750k-$1.5m. Phase 4 NYDFS BitLicense application: $250k-$750k incremental. Phase 5 SEC/CFTC overlay (token analysis, broker-dealer registration where applicable): $100k-$500k depending on scope.

Ongoing compliance is the larger long-tail cost. Practitioners put the annual legal and licensing budget for a full-stack US operator at $500k-$2m per year (practitioner estimate) — renewal fees, exam preparation, regulator dialogue, BSA officer functions, BitLicense reporting and state-by-state licence maintenance. Over a five-year horizon the ongoing cost often exceeds the initial application cost.