Crypto Custody Licence: Jurisdictions Compared (2026)

Custody is the heaviest licence to carry

If running an exchange is administratively demanding, running custody is harder in every jurisdiction that takes the activity seriously. The reasons are the same everywhere — holding someone else’s assets is a different category of trust than facilitating their trades — and the operational implications are the heaviest part of any crypto firm’s licensed build.

There is no single global custody licence. There are six or seven regimes, each with its own rulebook. This is the 2026 comparison.

EU — MiCA CASP Class 2 custody rules

Under MiCA, custody of crypto-assets on behalf of clients is a listed crypto-asset service — Annex I — and a CASP authorised for that service sits in Class 2 for capital purposes (€125,000 Annex IV own-funds floor) or Class 3 if also operating a trading platform.

The operational rules sit in The custody-service rulebook: a written custody policy, a register of positions per client per crypto-asset, a procedure for handling client communications, and explicit liability for losses caused by ICT or other incidents (with limited carve-outs). The custody-service rulebook is the custody service rulebook.

Separately, The client-asset safeguarding rule sets a cross-cutting safeguarding duty that applies to any CASP holding clients’ crypto-assets or funds — not only custody providers. For that distinction in detail, see our the client-asset safeguarding rule safeguarding piece.

United States — state trust charters and the Wyoming SPDI

The US does not have a federal custody licence. Custody-focused crypto firms typically operate under one of:

• A state trust charter — most notably the NYDFS Limited Purpose Trust, which authorises custody and limited fiduciary activity for crypto under New York’s banking law.
• The Wyoming Special Purpose Depository Institution (SPDI) charter — a state-bank charter created specifically for crypto, allowing custody of fiat and crypto without lending against it.

These charters layer on top of the federal FinCEN MSB registration; New York adds the BitLicense for non-trust-chartered firms doing business with NY residents. The full US stack for non-custody operations is covered in US Crypto Licensing — state MTLs, FinCEN MSB, BitLicense.

Singapore — DPT custody under the PSA

Singapore’s Payment Services Act 2019 treats custody of Digital Payment Tokens as a regulated service. A firm offering DPT custody to Singapore clients needs a DPT services licence from MAS, in either the Standard Payment Institution (SPI) or Major Payment Institution (MPI) class. MAS expectations on segregation, custody policy, and ICT risk are demanding — see our Singapore MAS practitioner guide for the full regime.

Hong Kong — custody under the VATP licence

In Hong Kong, custody is integral to the Virtual Asset Trading Platform (VATP) licence issued by the SFC under Cap. 615 since 1 June 2023. The investor-protection bar is heavy: the licence carries custody, segregation, listing-policy, and conduct standards designed to make retail virtual-asset trading safe.

For securities-classified assets, the SFC’s Type 1 and Type 7 licences under the SFO apply in parallel. The Hong Kong SFC practitioner guide covers the wider picture.

Switzerland — FINMA, depending on the model

Switzerland does not run a single “crypto custody licence.” Custody-focused models sit under FINMA-supervised activity: a full banking licence, the lighter fintech licence under the Swiss Banking Act (for deposits up to a threshold and without maturity transformation), or a DLT trading venue licence where the model is infrastructural.

For how FINMA’s wider crypto framework fits next to MiCA, see Switzerland vs EU MiCA; for the token-side, our FINMA token classification piece.

UAE — Dubai VARA custody-services licence

Dubai’s Virtual Assets Regulatory Authority (VARA) issues activity-specific licences, including a custody-services licence for firms holding virtual assets on behalf of clients within the Dubai framework. For the wider VARA picture and the corporate side, see our UAE crypto company formation guide and MiCA vs Dubai VARA comparison.

United Kingdom — narrow today, expanding

The UK route is the narrowest on the list today. FCA cryptoasset registration under MLR 2017 covers custodian wallet providers — but only on AML-only scope. It is not a full prudential or conduct licence. A broader UK regime for cryptoasset custody is being phased in under FSMA 2023. For the current state, see UK FCA cryptoasset registration vs EU MiCA.

The comparison, side by side

Jurisdiction	Regulator	Custody licence	EU passport
EU	National competent authority	MiCA CASP Class 2 — the custody-service rulebook rules	Yes — across 27 member states
United States	State regulator + NYDFS / Wyoming	State trust charter (e.g. NY Limited Purpose Trust) or Wyoming SPDI, plus FinCEN MSB	No
Singapore	MAS	PSA — DPT custody service, SPI / MPI class	No
Hong Kong	SFC	VATP licence under Cap. 615 (and SFO Type 1/7 if securities)	No
Switzerland	FINMA	Banking / fintech / DLT trading venue, depending on model	No
UAE — Dubai	VARA	Custody-services licence under Dubai’s virtual-assets framework	No
United Kingdom	FCA	Cryptoasset registration (AML-only)	No

Where the real money goes

For any of these regimes, the licence is the smaller part of the project. The bulk of the cost sits in the operational build behind it:

• Cybersecurity and key management — multi-sig, hardware security modules, separation of duties, incident response.
• Insurance — coverage of custody risk where the market and the regulator both expect it.
• Operational resilience — under DORA in the EU, under NYDFS Part 500 in New York, under MAS ICT guidelines in Singapore.
• Segregation in fact, not in name — wallets, accounts, books — built so that the answer to “which of these are the clients’?” is immediate and clean.

For the EU operational-resilience layer specifically, see DORA ICT resilience for CASPs.

Working with counsel on a custody build

The diagnostic for counsel: ask them to scope the operational build alongside the licence — custody policy, cybersecurity controls, insurance, insolvency mechanics — and to tie every cost line to the specific jurisdiction’s rulebook, not to a generic custody plan. Counsel that treats custody licensing as a paperwork exercise has under-scoped the project that comes after the licence. The firms in our index with crypto-custody experience are listed below.