Crypto Exchange License: Costs, Jurisdictions & Requirements

What Is a Crypto Exchange License?

A crypto exchange license is not one licence. It is the family of VASP and CASP-class authorisations that cover the two regulated activities every centralised exchange performs: exchanging crypto-assets against fiat money or other crypto-assets, and operating the trading platform on which client orders meet. Each regime names the permission differently: the EU grants a CASP authorisation under MiCA, Dubai a VASP licence, Hong Kong a VATP licence, Singapore a DPT service licence, and the offshore centres a VASP registration or licence. The activity bundle underneath is essentially the same.

Under Regulation (EU) 2023/1114 (MiCA), the relevant crypto-asset services are the operation of a trading platform, the exchange of crypto-assets for funds, and the exchange of crypto-assets for other crypto-assets, with custody and execution of orders almost always bundled into the same application.^[1] The trading-platform service sits in Annex IV Class 3, which carries the €150,000 minimum own-funds floor; because Class 3 is the highest tier, the full exchange bundle falls under that single floor. Most other regimes draw the same perimeter with different vocabulary: VARA's Exchange Services category, the SFC's automated trading service definition, the BVI VASP Act's exchange categories.

Unlike an EMI or Payment Institution licence, a crypto exchange authorisation covers the crypto-asset activity only. Fiat deposits, withdrawals and stored client balances usually ride on a separately licensed payment layer, either the exchange's own EMI authorisation or a partner institution. Operators planning a euro on-ramp at scale should read this page alongside EMI & Payment Institution Licensing, because the two applications are increasingly sequenced together.

Regimes split into two structural models. The key difference is: a registration regime (the BVI VASP registration, the UK's live MLR cryptoasset registration) assesses the operator's AML systems and controls, while an authorisation or licence regime (MiCA, VARA, the SFC) assesses the whole business: capital, governance, custody architecture, market integrity, complaint handling and operational resilience. Registration regimes are faster and cheaper; authorisation regimes carry more institutional weight with banks and counterparties. Neither model confers global coverage.

No licence is global. An exchange must hold the local authorisation, or a valid passport, in each market it actively solicits. The reverse solicitation carve-outs that once let offshore platforms serve onshore clients have narrowed sharply: in the EU, the ESMA Guidelines on reverse solicitation under MiCA (published 26 February 2025, applicable from 27 April 2025) are interpreted restrictively, and any EU-targeted marketing, EU-language content or geo-targeted advertising voids the exemption.^[2]

Crypto Exchange Licence Regimes by Region

Ten jurisdictions cover the practical decision set for a centralised exchange in 2026: two EU anchor states under MiCA, the United Kingdom, two Gulf regimes, two Asia-Pacific regimes, and a three-jurisdiction offshore tier. Every figure in this section and the tables below is drawn from the same jurisdiction records that power our comparison tool across 50 jurisdictions.

European Union: MiCA CASP authorisation

MiCA replaced the EU's fragmented national VASP regimes with a single CASP authorisation, fully applicable since 30 December 2024. Minimum own funds are tiered by service class: €50,000 (Class 1), €125,000 (Class 2), and €150,000 for Class 3, which includes the operation of a trading platform.^[1] Ongoing own funds are the higher of the class floor or 25% of the preceding year's fixed overheads. One authorisation passports to 30 EEA states by Article 65 notification: the home regulator forwards the notification within 10 working days, and services may start no later than the 15th calendar day after submission.

The statutory clock under Article 63 is a 25-working-day completeness check plus a 40-working-day substantive assessment, extendable by 20 working days for information requests. Realistic end-to-end timelines differ by home state: Lithuania (Bank of Lithuania) runs 4–8 months with Year-1 all-in costs of €124,000–€420,500; Malta (MFSA) runs 9–18 months at €350,000–€900,000, with application fees of €17,000–€25,000 for Class 2/3 and a 5% effective tax rate via the shareholder-refund system. Malta requires a minimum of 2 directors with at least 1 Malta-resident executive; Lithuania requires a Lithuanian-resident MLRO on an employment contract.

The transitional window matters in 2026: grandfathering of pre-MiCA national-regime firms under Article 143(3) closes no later than 1 July 2026, and grandfathered firms cannot passport. Operators still on national registrations have effectively run out of road. See the MiCA / CASP licensing guide for the deadline mechanics and the crypto licensing hub for jurisdiction-by-jurisdiction detail.

United Kingdom: FCA registration now, FSMA authorisation from 2027

The UK runs two regimes in sequence. Live today is the FCA cryptoasset registration under the Money Laundering Regulations 2017: an AML-only registration with no minimum capital, no prudential rulebook, and observed processing times of 9–18 months.^[5] The application fee is £2,000 (UK cryptoasset income up to £250,000) or £10,000 above that. Year-1 advisory and compliance costs run £150,000–£500,000 excluding own funds.

The full authorisation regime arrives next: the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, made 4 February 2026, bring regulated cryptoasset activities into FSMA from 25 October 2027, with the authorisation gateway opening 30 September 2026 to 28 February 2027. The FCA's proposed prudential floors (CP25/14 and CP25/42, still proposals as of June 2026) set a £150,000 permanent minimum requirement for trading platform, custody and staking activity, with own funds as the highest of the floor, a fixed overhead requirement and a K-factor requirement.^[6] A UK registration confers no EU passporting rights, and MiCA has no third-country equivalence regime.

Middle East: Dubai VARA and ADGM

Dubai (VARA) licenses Exchange Services under Dubai Law No. 4 of 2022 and the VARA Rulebooks, within the federal framework of Cabinet Decision 111/2022.^[7] Paid-up capital for an exchange is AED 1.5 million (without a third-party custodian), held in a UAE-bank trust account with the regulator as beneficiary before grant, plus an ongoing net-liquid-assets test of at least 1.2× monthly operating expenses with daily reconciliation. Government fees are AED 40,000–100,000 at application plus AED 80,000–200,000 annual supervision; Year-1 all-in runs AED 1.5–10 million (USD 410,000–2.7 million). The VARA track runs 4–12 months and permits retail clients; UAE-resident senior officers (SEO, MLRO, Compliance Officer) are required.

Abu Dhabi (ADGM) takes the institutional lane: an FSRA Financial Services Permission under the Financial Services and Markets Regulations, granted via In-Principle Approval and an operational-readiness review, over 6–18 months.^[8] Base capital is USD 250,000–500,000 plus an Expenditure-Based Capital Minimum of 13/52 of annual audited expenditure; Year-1 all-in is USD 1.2–2.5 million. ADGM serves professional and institutional clients only, with no retail crypto offering, and prohibits privacy tokens and algorithmic stablecoins.

Asia-Pacific: Singapore and Hong Kong

Singapore (MAS) licenses DPT services under the Payment Services Act 2019, with the Major Payment Institution tier the realistic class for an exchange: SGD 250,000 base capital plus a security deposit of SGD 100,000–200,000 lodged with MAS.^[9] Year-1 all-in runs SGD 1.5–3 million or more including capital, over 9–12 months. Retail access is permitted but deliberately constrained: no incentives, no credit-card top-ups, no retail credit or leverage. The FSM Act 2022 Part 9 DTSP regime, in operation since 30 June 2025, separately captures Singapore-based providers serving only overseas customers.

Hong Kong (SFC) licenses VATPs under the Securities and Futures Ordinance (Types 1 and 7) plus AMLO Part 5B.^[10] Minimum capital is HKD 8 million (HKD 5 million paid-up plus HKD 3 million liquid), with liquid capital maintained at or above 120% of the requirement. The 12–18 month track includes a gate no other regime imposes: a single external assessment under HKSAE 3000/ISAE 3000 plus an independent penetration test before grant. Operating costs ex capital run HKD 7–15 million in Year 1. Retail trading is permitted for eligible large-cap assets, a broader retail perimeter than Singapore's.

Offshore tier: BVI, Cayman Islands, Seychelles

BVI offers the lowest entry cost of any credible exchange regime: a VASP registration under the Virtual Assets Service Providers Act, 2022 with no fixed capital floor (the FSC expects 6–12 months of operating-expense evidence), Year-1 costs of USD 40,000–156,000, and a 4–6 month track with initial feedback in roughly 6 weeks.^[11] The VASP Act requires at least 2 directors, both individuals. The reputational caveat is real: the BVI sits on the FATF grey list (confirmed in the 13 February 2026 statement) and was added to the EU AML high-risk list on 29 January 2026, which drives enhanced counterparty due diligence.^[18]

Cayman Islands runs a dual track under the Virtual Asset (Service Providers) Act (2024 Revision): a Registration for exchange and transfer activity, and a full Licence, mandatory for trading platforms and custody since 1 April 2025.^[12] There is no statutory capital floor; CIMA assesses adequacy case by case. Year-1 runs USD 150,000–500,000 for a Registration and USD 300,000–1,500,000+ for a Licence (the VATP grant fee alone is USD 121,951), over 3–12 months. Licensed platforms need at least 3 directors including 1 independent. Cayman is FATF-clear, removed from the grey list on 27 October 2023, which keeps its institutional credibility high.

Seychelles moved from unregulated to licensed with the Virtual Asset Service Providers Act, 2024, in force 1 September 2024.^[13] The Virtual Asset Exchange category carries USD 100,000 paid-up capital, the highest of the four categories, and from the third year of operation capital must equal at least 2.5% of annual turnover where that exceeds the floor. Year-1 costs run USD 55,000–158,000 excluding capital, over 3–6 months, with a licensed-VASP concessionary business tax rate of 1.5% on Seychelles-sourced income. Substance is real: resident director, physical office and a full-time compliance officer are expected.

Regime comparison

The table below compares the licence class, regulator, capital floor and retail perimeter across all ten jurisdictions. Capital figures are statutory minimums for the exchange or trading-platform class; several regimes add ongoing overlays covered under requirements.

The United States: No Single Federal Licence

Unlike every regime above, the United States has no single federal crypto exchange licence. The federal layer is FinCEN registration as a money services business under 31 CFR 1010.100(ff): a registration, not a licence, that attaches Bank Secrecy Act AML obligations but authorises nothing by itself.^[14] The operative permission layer is state law: a patchwork of roughly 50 state money-transmitter licences, obtained state by state, each with its own capital, bonding and reporting requirements. New York adds the most demanding single state regime, the NYDFS BitLicense under 23 NYCRR Part 200.^[15]

Federal legislation is moving but incomplete. The GENIUS Act, enacted 18 July 2025, created the first federal framework for payment stablecoin issuers; its implementing rules remained at proposed stage through H1 2026, so the regime is law but not yet operational practice.^[16] The CLARITY Act, the broader market-structure bill that would allocate spot-market jurisdiction between the SEC and CFTC, passed the House 294–134 on 17 July 2025 and cleared the Senate Banking Committee in May 2026. As of June 2026 it has not been enacted, and exchange licensing remains a state-by-state exercise layered over federal registration.^[17]

Jagelski & Partners does not provide services to US persons; this section is informational.

Key Requirements and the Application Process

The file a crypto exchange submits looks structurally similar everywhere: capital, governance, custody architecture, AML and CFT, technology resilience, and a credible business plan. What differs is the evidence standard, the statutory clock, and how much the regulator probes before grant.

Capital and own funds

Statutory floors are only the entry point; most regimes add a formula that scales with the business. In the EU, ongoing own funds are the higher of the class floor or 25% of the preceding year's fixed overheads.^[1] Hong Kong requires liquid capital at or above 120% of the requirement with monthly monitoring.^[10] ADGM applies an Expenditure-Based Capital Minimum of 13/52 of annual audited expenditure. Seychelles adds 2.5% of annual turnover from year three where that exceeds the USD 100,000 floor. Even the no-floor regimes are not capital-free: the BVI FSC expects evidence of 6–12 months of operating expenses against three-year projections.

Substance and key persons

Resident-officer rules decide where the team actually sits. Lithuania requires a Lithuanian-resident MLRO on an employment contract; Malta expects at least 2 directors with 1 Malta-resident executive. The UAE regimes require UAE-resident senior officers (SEO, MLRO, Compliance Officer). Hong Kong requires at least 2 Responsible Officers, at least 1 of them Hong Kong-resident and at least 1 an executive director. The BVI requires 2 individual directors; Cayman-licensed platforms need 3 directors including 1 independent. Hiring the MLRO and compliance lead in the licensing jurisdiction before filing, not after grant, is the single highest-leverage credibility step on any application.

Custody and client assets

Every authorisation regime now treats client-asset segregation as a core gate rather than an operational detail. MiCA requires client funds to be safeguarded at a credit institution and client crypto-assets to be segregated from the firm's own book. Hong Kong requires custody through a wholly-owned associated entity, with a compensation arrangement covering 50% of cold-storage and 100% of hot-storage assets. Cayman made custody and trading-platform activity licensable rather than registrable from 1 April 2025 precisely to bring custody architecture under direct supervision.^[12] Expect the custody policy, wallet-management procedure and key-ceremony documentation to be read closely in every regime.

AML and the Travel Rule

FATF Recommendation 15 made exchanges full AML-obliged entities everywhere, and the Travel Rule is now operational in every jurisdiction on this page. In the EU, Regulation (EU) 2023/1113 applies the rule with no de minimis threshold for CASP-to-CASP transfers and a €1,000 threshold for self-hosted wallet verification.^[3] The BVI and Cayman apply USD 1,000 thresholds; Hong Kong applies HKD 8,000. The application file must show working Travel Rule tooling, sanctions screening with regulator-grade evidence trails, and a risk assessment built at customer-segment level, not firm level.

ICT and operational resilience

In the EU, DORA (Regulation (EU) 2022/2554) has applied to CASPs since 17 January 2025: an ICT risk-management framework, major-incident reporting, a register of ICT third-party providers, and periodic resilience testing.^[4] VARA imposes its Technology & Information Rulebook with annual penetration testing; the SFC requires the pre-grant external assessment plus an annual penetration test thereafter. Exchanges carry the heaviest technology files of any licence class because the matching engine, wallet infrastructure and market-surveillance stack are all in scope.

The application arc

The process arc is consistent across regimes, and the statutory clocks are knowable in advance:

• Pre-application engagement: VARA's Initial Disclosure Questionnaire, ADGM's pre-application meetings toward In-Principle Approval, the Bank of Lithuania's Newcomer Programme, CIMA's Innovation Unit meeting.
• Completeness check: MiCA fixes it at 25 working days; the Seychelles FSA treats an application as received only once complete.
• Substantive review: MiCA allows 40 working days plus a 20-working-day extension for information requests; the SFC's service standard is 15 weeks once the file is complete; the BVI FSC gives initial feedback in roughly 6 weeks and decides within 6 months.
• Interviews and inspection: officer interviews are standard in the Gulf; operational-readiness reviews precede grant at ADGM and VARA; Hong Kong adds the external assessment gate.
• Grant and post-grant: conditions, reporting calendars, and in the EU the Article 65 passport notifications that open the other 29 EEA markets.

The honest planning number is the end-to-end range in the table below, not the statutory clock: completeness disputes, information-request cycles and banking evidence dominate real timelines.

How Much Does a Crypto Exchange License Cost?

Year-1 all-in cost spans two orders of magnitude: from USD 40,000 at the BVI entry point to USD 2.7 million equivalent at the top of the Dubai range. The line items are the same everywhere: government fees, regulatory capital (sometimes inside the all-in figure, sometimes on top), advisory and drafting, resident substance, technology and compliance tooling, and audit.

Government fees alone illustrate the spread: the FCA charges £2,000–£10,000; VARA charges AED 40,000–100,000 at application plus AED 80,000–200,000 in annual supervision; the Cayman VATP licence grant fee is USD 121,951; the Seychelles Exchange category pays an annual licence fee of SCR 375,000 on a SCR 75,000 base; BVI registration fees run USD 12,500–60,000 by category.

Cheap and credible pull in opposite directions. The BVI's USD 40,000 entry point comes with FATF grey-list counterparty friction; Hong Kong's HKD 8 million capital buys the deepest institutional acceptance in Asia. The right way to read the table is to fix the target market first, then let the regime list collapse: an EU retail exchange has two realistic rows, a Gulf institutional venue has two different ones, and a non-EU global startup is choosing within the offshore tier.

Banking for Licensed Crypto Exchanges

A licence without banking is a certificate on the wall. An exchange needs three account layers, each with a different acceptability profile: client fiat accounts for deposits and withdrawals, an operating account for the firm's own funds, and where the regime requires it, a safeguarding account. Under MiCA the safeguarding layer must sit at a credit institution, and that is the binding constraint in practice: in the Baltic CASP market a full safeguarding account takes roughly 8–15 applications and 4–7 months to land. In the offshore tier the constraint is sharper still: BVI-registered exchanges bank almost entirely outside the territory, through EU and UK fintech rails.

This is why banking feasibility belongs at the start of the licensing decision, not the end. The partner network maintains live account-opening routes in every jurisdiction Jagelski & Partners services, and banking feasibility is confirmed at the scoping stage, before any licence application is filed. In 2025 the network placed fourteen billion euros across 90+ institutions for 500+ clients in crypto, fintech and other high-risk verticals.

For banking placement, Jagelski & Partners is paid by the institution, not by the client. We do not mark up institutional pricing. We do not charge an onboarding fee. The institutional rates the client sees are the rates the institution applies. Crypto-to-fiat settlement rails are scoped through crypto & fiat settlement banking, and the wider account architecture through high-risk business accounts.

Frequently Asked Questions

References