Crypto License: VASP, CASP & MiCA Authorisation Across 50 Jurisdictions

What Is Crypto Licensing?

A crypto licence is a regulatory authorisation or registration that permits a legal entity to provide one or more specified crypto-asset services to clients in a specified jurisdiction. The instrument can take three shapes: a registration-only regime that adds anti-money-laundering supervision to an otherwise unlicensed activity, a full authorisation that imposes prudential, conduct, and governance requirements alongside AML/CFT obligations, or a hybrid that pairs both layers.

Three terminology systems compete for the same regulatory concept. The Financial Action Task Force (FATF) introduced virtual asset service provider (VASP) in October 2018, framing the activity around AML/CFT supervision and bringing crypto-asset firms inside the global money-laundering perimeter. The European Union built its own term, crypto-asset service provider (CASP), into Regulation (EU) 2023/1114 (MiCA), extending the FATF baseline into a full prudential and conduct regime with passporting rights across all 30 European Economic Area states.^[1][2]

National regulators outside the EU have continued to mint their own labels: Singapore uses DPT service provider under the Payment Services Act 2019 and added DTSP under the Financial Services and Markets Act Part 9 from 30 June 2025; Hong Kong uses VATP (Virtual Asset Trading Platform) under the Securities and Futures Ordinance and AMLO Part 5B; Australia uses VASP registration under the AML/CTF Act 2006, which replaced Digital Currency Exchange (DCE) registration on 31 March 2026; the United Arab Emirates uses VARA VASP under Dubai Law (4) of 2022.

Crypto licensing sits alongside, not within, the other regulated-finance verticals. Gambling and iGaming licensing, forex broker licensing, EMI and payment institution licensing, fund and investment structuring and prediction market licensing each have their own regulators, statutes, and capital thresholds; the boundaries matter because a crypto-native neobank that touches fiat e-money typically needs at least two of the above in parallel.^[3]

The rest of this page covers the FATF and EU concepts in depth (Sections 2 and 3), the 50 jurisdictions compared in the tables (Section 4), the United States regulatory patchwork (Section 5), MiCA's national implementation across the EEA (Section 6), the requirements that recur across regimes (Section 7), costs and timelines (Section 8), the decision framework (Section 9), and the formation and engagement model that sits behind a licensing project carried out by an independent specialist introduced by Jagelski & Partners (Sections 10 and 11).

VASP vs. CASP: The Two Terms Explained

VASP and CASP describe the same underlying activity (the provision of crypto-asset services on a professional basis) but they originate from different rule-making bodies and carry different regulatory consequences. The FATF VASP definition is the international AML/CFT baseline. The EU CASP definition is a prudential and conduct framework that sits on top of that baseline. Confusing the two is the most common terminological error in the market.

What Is a VASP?

A virtual asset service provider is any natural or legal person who, as a business and not covered elsewhere in the FATF Recommendations, conducts one or more of five activities for or on behalf of another person.^[1] The FATF Glossary defines those five activities precisely: (i) exchange between virtual assets and fiat currencies; (ii) exchange between forms of virtual assets; (iii) transfer of virtual assets; (iv) safekeeping or administration of virtual assets or instruments enabling control over virtual assets; and (v) participation in and provision of financial services related to an issuer's offer or sale of a virtual asset.^[1]

The framework dates to October 2018, when the FATF revised Recommendation 15 (R.15) to bring virtual assets and VASPs inside the global AML/CFT perimeter. The Interpretive Note to R.15 followed in June 2019 and clarified the risk-based approach and the Travel Rule's application to crypto-asset transfers.

Both the Glossary definitions and the Interpretive Note remain in force; the FATF's July 2026 Targeted Update on virtual assets reported that 91 of 109 responding jurisdictions (83%) had passed Travel Rule legislation, up from 85 of 117 (73%) in 2025.^[4]

National law determines which activities require registration or authorisation and what obligations follow. A registration can extend beyond AML/CFT: the BVI VASP Act, sections 10–23 requires financial soundness, approved directors, an auditor, and protection of client assets. The label alone does not establish the compliance burden or market access.

What Is a CASP?

A crypto-asset service provider is, per Article 3(1)(15) of Regulation (EU) 2023/1114, "a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis, and that is allowed to provide crypto-asset services in accordance with Article 59".^[2] MiCA's Article 3(1)(16) lists 10 such services, materially broader than the FATF's five VASP activities: (a) custody and administration; (b) operation of a trading platform; (c) exchange of crypto-assets for funds; (d) exchange of crypto-assets for other crypto-assets; (e) execution of orders; (f) placing of crypto-assets; (g) reception and transmission of orders; (h) providing advice; (i) providing portfolio management; (j) providing transfer services.^[2]

Authorisation is granted by a national competent authority (NCA) under MiCA Article 63 and passports across the 27 EU Member States plus Iceland, Liechtenstein, and Norway, which apply MiCA under the European Economic Area (EEA) Agreement, by notification under Article 65.^[24] The Article 3(1)(16) services map to three capital classes in MiCA Annex IV, and the prudential safeguards can be met by own funds (Common Equity Tier 1 after deductions), an insurance policy or a comparable guarantee, or a combination under Article 67(4)–(6).^[2] The complete deep dive on MiCA, including the Annex IV mapping, sits in Section 3 below.

Key Differences

Where the two regimes diverge matters operationally, not academically. A VASP registration in the BVI does not let a Singapore-incorporated stablecoin issuer provide crypto-asset services to Italian retail clients. EU market access requires the applicable MiCA route: a CASP authorisation, or an eligible financial entity’s Article 60 notification, covering the specific Article 3(1)(16) services, and the separate Title III or Title IV requirements for issuing an ART or EMT.^[2][5]

For MiCA CASPs, prudential safeguards must equal at least the higher of the applicable Annex IV class floor and 25% of the previous year’s fixed overheads. A new firm uses projected fixed overheads for its first 12 months; the permitted deductions apply. Qualifying own funds, an insurance policy or comparable guarantee, or a combination may meet the requirement. MiCA Article 67(1)–(4).

MiCA: The EU Crypto Regulatory Framework

MiCA is one of the most consequential pieces of crypto regulation enacted to date. It replaced 27 fragmented national VASP regimes with a single authorisation regime, introduced statutory prudential and conduct standards, and created a passport that allows one CASP authorisation to serve clients across the EEA. The political process behind it took five years; the operational reality of CASP authorisation is now reshaping where crypto-asset businesses incorporate.

What Is MiCA?

MiCA stands for Markets in Crypto-Assets, the short title of Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937.^[2] The regulation was adopted on 31 May 2023, published in the Official Journal of the European Union on 9 June 2023 (OJ L 150) and entered into force on 29 June 2023.^[2]

Phased application split the regulation into two tranches. Titles III and IV, governing asset-referenced tokens (ARTs, MiCA Article 3(1)(6)) and e-money tokens (EMTs, Article 3(1)(7)), became applicable on 30 June 2024. Title V, governing the authorisation and conduct of crypto-asset service providers, became applicable on 30 December 2024.^[2]

A third category, "other crypto-assets" (Article 3(1)(5)), covers everything that is neither an ART nor an EMT, with utility tokens called out separately at Article 3(1)(9).

The Article 143(3) transitional regime allowed Member States to grant up to 18 months of grandfathering relief to pre-30 December 2024 incumbents, anchored to the EU-wide outer deadline of 1 July 2026. ESMA's statement of 17 April 2026 (ESMA75-113276571-1679) confirmed that the period would expire across the EU on that date and that any unauthorised CASP must by then have implemented its wind-down plan; its public statement of 23 June 2026 (ESMA75-113276571-1710) told unauthorised providers to stop onboarding and marketing and to wind down their EU business.^[6] MiCA Article 111 requires Member States to set maximum fines of at least EUR 5 million or 5% of annual turnover for a company providing crypto-asset services without authorisation.^[2] Per-Member-State windows are not uniform: several already lapsed in 2025 (Section 6 carries the full breakdown).

CASP Authorisation Requirements

CASP authorisation under MiCA Title V is a substantive prudential licence, not a registration. Articles 67 to 75 set its capital adequacy, governance, AML/CFT, ICT-security, business-continuity, complaints, conflict-of-interest, and custody requirements, several with Level 2 detail in regulatory technical standards (RTS) drafted by ESMA and adopted by the Commission. Outsourcing of any MiCA service is permitted under Article 73 but the CASP retains full residual liability.

DORA matters in practice because the Level 2 measures are dense and operational. The Register of Information template under Commission Implementing Regulation (EU) 2024/2956 has triggered material first-year compliance work for every CASP; the obligation to test ICT third-party risk and, for significant firms, complete threat-led penetration tests (TLPT) materially raises the operational floor compared with pre-MiCA national regimes.^[7]

MiCA Service Categories and Capital Requirements

MiCA Annex IV maps the 10 Article 3(1)(16) services to three prudential classes. The applicant's permitted services determine the class; a CASP authorised for trading-platform operation is automatically subject to the Class 3 floor even where its other services would otherwise sit in Class 1 or Class 2. These figures sit at the centre of every jurisdictional cost discussion.

Two practitioner observations sit alongside these figures. The "one-quarter of fixed overheads" floor at Article 67(1)(b) often bites harder than the headline capital figure for any CASP with serious operating costs: a Class 2 CASP running EUR 2 million of annual fixed overhead carries a EUR 500,000 prudential-safeguards requirement, not EUR 125,000.

For MiCA CASPs, prudential safeguards must equal at least the higher of the applicable Annex IV class floor and 25% of the previous year’s fixed overheads. A new firm uses projected fixed overheads for its first 12 months; the permitted deductions apply. Qualifying own funds, an insurance policy or comparable guarantee, or a combination may meet the requirement. MiCA Article 67(1)–(4).

The Article 67 higher-of test applies at authorisation and throughout operation; NCAs routinely require materially higher buffers as a pre-condition for issuance, particularly for trading-platform applicants and for stablecoin-adjacent firms that need to demonstrate orderly wind-down funding.

Crypto Licensing by Jurisdiction

The tables below compare 50 of the 51 published jurisdiction guides; the Macau guide explains why Macau, which has no crypto licensing or registration regime, is not tabled. Jagelski & Partners scopes entity formation, applicable authorisation, banking, and ongoing compliance through its partner network. Authorisation requires an operative regime; a jurisdiction guide does not mean a licence is available there. Comoros/Anjouan is an excluded licensing case.^[8] Click any jurisdiction to open its dedicated page.

Compare jurisdictions interactively. Use the crypto licensing jurisdiction explorer to filter the field by budget, market access, tax, capital, and substance, then jump straight to the jurisdictions that fit.

European Economic Area (13)

The EEA cluster is the only block where a single CASP authorisation under MiCA Article 59 passports across multiple states. Liechtenstein additionally maintains its TVTG token framework (parallel to its CASP scope); as of 4 September 2026, Poland's implementing act had not entered into force after the failed override, so the domestic CASP authorisation route was not operational. National MiCA implementation and domestic CASP application availability vary considerably across the rest of the bloc; Section 6 below carries the per-Member-State breakdown.

Other Regulated (19)

Major non-EU regulated regimes and emerging-market frameworks. Capital floors and prudential models vary far more than within the MiCA bloc.

Offshore International Finance Centres (18)

IFC regimes include BVI VASP registration and full authorisation in Bermuda and Cayman Phase 2; the Marshall Islands has no crypto registration or licence at all, only the DAO LLC corporate vehicle. FATF status varies; BVI was added to the FATF grey list on 13 June 2025 and to the EU AML high-risk list with effect from 29 January 2026.^[9][30]

The figures follow each jurisdiction guide as last reviewed in August or September 2026. Currency, tax rate, and timeline ranges are sourced from each jurisdiction's regulator publications, primary statute, and the cited tier-1 legal briefings; the specific application cost in any one mandate depends on capital strategy, applicant complexity, and the regulator's queue at the time of filing. The detailed cost breakdown sits on the jurisdiction page in each case.

Crypto Licensing in the United States: MSB, State Licences, and the BitLicense

The United States is the largest crypto market without a single national crypto licence. Its regulatory perimeter is assembled from three cumulative layers: a federal AML registration, a state-by-state money-transmission patchwork, and a securities/commodities split between two federal market regulators. That structure is why the US appears in none of the comparison tables above; there is no one authorisation to put in a row.

Federal Layer: FinCEN MSB Registration and the SEC/CFTC Split

Exchangers and administrators of convertible virtual currency are money transmitters under the Bank Secrecy Act and must register with FinCEN as a money services business (MSB) under 31 CFR 1010.100(ff), per FinCEN's 2019 consolidated guidance.^[20] Registration is an AML/CFT baseline, not a licence: it carries programme, reporting, and Travel Rule obligations but no capital requirement, no fit-and-proper test, and no authorisation decision.

Market oversight then splits by asset: the SEC asserts jurisdiction where a token is offered as a security, while the CFTC supervises derivatives and polices fraud in spot markets, treating bitcoin and ether as commodities.

Federal legislation is partially landed. The GENIUS Act (Public Law 119-27, enacted 18 July 2025) created the first federal regime for payment-stablecoin issuers, with implementing rules still at the proposal stage in September 2026.^[22] The market-structure bill, the Digital Asset Market Clarity Act (H.R. 3633), passed the House 294–134 on 17 July 2025 and cleared the Senate Banking Committee 15–9 on 14 May 2026; on 15 September 2026 a Senate cloture motion on proceeding to the bill failed 49–50, and it has not been enacted. Without legislation, the SEC/CFTC boundary rests on agency interpretation, notably the SEC’s interpretive release of 23 March 2026 with CFTC guidance, as well as on enforcement and case law.^[22]

State Layer: Money Transmitter Licences and the NYDFS BitLicense

Below the federal floor sits a patchwork of roughly 50 state and territory money-transmission regimes, most of which capture crypto exchange and custody. Each state licenses separately, with its own surety bond, net-worth minimum, fees, and examinations; the Money Transmission Modernization Act model law and the NMLS filing platform harmonise standards and centralise applications, but there is no passporting between states.

New York adds the best-known state-specific regime: the NYDFS BitLicense (23 NYCRR Part 200, adopted June 2015), required for virtual currency business activity involving New York or its residents and held by only a few dozen firms a decade after adoption.^[21] A nationwide US licensing build-out routinely takes 1–3 years end to end.

Jagelski & Partners does not accept company formation or licensing enquiries from persons located, resident, or incorporated in the United States. Banking and payments enquiries remain eligible; this section is informational only. Operators weighing the US patchwork against single-authorisation regimes can use the licensable routes covered on this page, and the exchange-specific comparison, including how the US federal and state layers map against MiCA, VARA, and the APAC regimes, sits in the crypto exchange licensing guide.

MiCA Implementation Across EU Member States

A single MiCA regulation does not produce a single national experience. Each EEA state legislated its own implementing law and chose its own Article 143(3) transitional window. The aggregate EU outer deadline was 1 July 2026, confirmed by ESMA on 17 April 2026; per-state windows ranged from already-lapsed (Netherlands closed on 30 June 2025; Ireland and Slovakia closed on 30 December 2025 and Germany on 31 December 2025, and Lithuania on 31 December 2025 under Law XV-185) to the full 18-month window that ran to 1 July 2026 (among them Cyprus, the Czech Republic, Estonia, France, Italy, Liechtenstein, Luxembourg, Malta, Portugal, Romania, and Spain).^[6][11] Latvia closed filing on 30 June 2025 but let providers that had applied by then continue until Latvijas Banka decided, within the 1 July 2026 ceiling.^[26]

The European Securities and Markets Authority (ESMA) maintains the central interim CASP register. As of 24 September 2026, the register lists 338 CASPs across 24 member states (357 including Iceland, Liechtenstein, and Norway), a count that includes banks and other financial entities providing crypto-asset services by Article 60 notification. Germany hosts the largest pool (95, nearly half of them Volksbanken and Raiffeisenbanken, alongside exchange and custody authorisations), followed by France (36), the Netherlands (28), Cyprus (24), Malta (22), and Spain (15).

Poland and Romania have no entities on the register, and Portugal has one.^[10] Polish operators are particularly exposed; the implementing law was vetoed three times by the President (1 December 2025, 12 February 2026 and 11 June 2026), and on 4 September 2026 the Sejm failed to override the third veto, so no Polish competent authority has been designated.^[25]

The pattern matters. Lapsed jurisdictions (Germany, Ireland, Lithuania, Netherlands, Slovakia) now require MiCA authorisation (or Article 60 status for an eligible financial entity) for any crypto-asset service to EU clients; legacy national regimes are closed.^[2] Jurisdictions that ran the full transitional window let incumbents operate under national law until 1 July 2026; with that ceiling now passed, those windows have closed too and every new application goes directly through MiCA. Latvia closed filing on 30 June 2025 but let timely applicants continue until decision within the same ceiling.

Where it matters most for jurisdiction selection: end-to-end planning ranges differ by authority, from 4–8 months at Lietuvos bankas in Lithuania to 12–18 months at the Central Bank of Ireland in the EEA table (the Central Bank’s own 2025 average from Key Facts Document to decision, for a cohort mostly of former VASPs, was 171 calendar days), while BaFin publishes no elapsed-time figure.^[27]

Common Requirements Across Jurisdictions

A small number of requirements recur across virtually every VASP and CASP regime worldwide. They sit at the FATF baseline and are extended (rather than replaced) by national prudential overlays. Operators planning multi-jurisdictional structures should treat these as the irreducible minimum.

AML/CFT programme. A documented anti-money-laundering and counter-terrorist-financing programme is universal: written policies, designated MLRO/AML officer, customer due diligence (CDD), enhanced due diligence for higher-risk customers, ongoing monitoring, sanctions screening, suspicious-activity reporting, training, and independent testing. Programmes must be risk-based per FATF Recommendation 10 and operationalised through a transaction-monitoring tool (typically a third-party blockchain analytics platform) with sanctions and PEP screening overlays.

Travel Rule (FATF R.15(b) / R.16). Originator and beneficiary information must accompany crypto-asset transfers. The EU Transfer of Funds Regulation (Regulation (EU) 2023/1113) imposes no de minimis for CASP-to-CASP transfers; the EUR 1,000 threshold triggers only the additional self-hosted-wallet verification obligation under Articles 14(5) and 16(2).^[12] The EBA Travel Rule Guidelines (EBA/GL/2024/11) operationalise these information-accompaniment obligations across the CASP and ICASP populations.^[13] By the FATF's July 2026 Targeted Update, 91 of the 109 responding jurisdictions had passed Travel Rule legislation.^[4]

Fit-and-proper testing. Directors, senior managers, UBOs, and significant shareholders are typically subject to clean-criminal-record requirements, financial-soundness checks, prior-regulatory-history disclosure, and minimum experience standards (typically three to five years in a relevant role). MiCA codifies this at Article 68 with the qualifying-holdings threshold of 10% at Article 84; comparable thresholds apply elsewhere.

Custody segregation. Client crypto-assets must be segregated from CASP proprietary assets, individually accounted for at the client level, and protected from CASP insolvency. Under MiCA Article 75(8), a custodian is liable for the loss of client crypto-assets through an incident attributable to it, capped at their market value, and not for events it shows occurred independently of its service or operations. Hong Kong's SFC requires VATPs to keep 98% of client virtual assets in cold storage and to hold an SFC-approved compensation arrangement covering 50% of cold-storage and 100% of other client assets; the UAE's VARA requires 100% one-to-one like-kind reserve assets with daily reconciliation.

Operational substance. Mailbox-only structures are now effectively extinct in any jurisdiction that applies the FATF standards. Singapore requires at least one executive director who is a citizen or permanent resident (or an Employment Pass holder alongside a citizen or permanent-resident director) and MAS expects a resident compliance officer; Hong Kong requires at least one HK-resident Responsible Officer; VARA in Dubai requires UAE-resident senior officers (MLRO, Compliance Officer and Senior Executive Officer or equivalent); MiCA requires a registered office in the authorising Member State, the place of effective management in the Union, and at least one director resident in the Union (Article 59(2)). Even offshore regimes set local roles: the BVI requires an FSC-approved, BVI-based authorised representative, and Cayman VASPs appoint AML officers who are in practice Cayman-resident.

Cybersecurity and operational resilience. EU CASPs face DORA (Regulation (EU) 2022/2554), in force from 17 January 2025, which sets ICT risk-management, incident reporting, threat-led penetration testing, and ICT third-party risk obligations.^[7] Outside the EU, Singapore's MAS TRM Guidelines, Hong Kong's SFC technology standards, the UAE's VARA Technology Rulebook, and the international counterparty-driven benchmarks (NIST CSF 2.0, SOC 2 Type II, ISO/IEC 27001:2022) operate as the de-facto floor.

Reporting and audit. Annual audited financials (typically IFRS), periodic prudential and AML returns, material-change notifications, and SAR/STR reporting are universal. EU CASPs additionally face DORA supervisory reporting and the MiCA Article 88 disclosure regime. Hong Kong SFC monthly FRR returns and Singapore MAS half-yearly returns are the most demanding cadences in the major jurisdictions.

What Crypto Licensing Costs

Crypto licensing costs cluster into four buckets: regulator fees, professional advisory, capital, and operating substance, and ongoing compliance infrastructure. The headline figure is rarely the binding constraint; the operating substance and ongoing compliance load typically exceed government fees by an order of magnitude in the first year. Fee, capital and tier figures below follow the jurisdiction guides as last reviewed in August or September 2026; advisory and tooling ranges are typical market estimates.

Regulator fees. Offshore application fees run from under USD 1,000 (Labuan USD 500; Saint Lucia EC$1,000) to USD 50,000 in Vanuatu and GBP 45,000 in Gibraltar, and the registration, grant or licence fee that follows is often larger (BVI FSC: application USD 5,000 standard, USD 10,000 custody or exchange and USD 20,000 for both, then a USD 7,500–40,000 initial registration fee; Cayman CIMA: KYD 5,000 licence application, then a KYD 30,000 or 100,000 grant fee and a revenue-banded annual fee).^[31] MiCA NCA application fees run from nothing at the Banco de Portugal to about EUR 64,000 for a typical four-to-six-service CySEC file, plus in most states an annual supervisory fee (CySEC: fixed components per service plus a turnover-based variable component, charged pro rata from the month services start).

Singapore MAS fees run SGD 5,000–10,000 annual.^[16] Hong Kong SFC application fees of HKD 4,740 per regulated activity (HKD 14,220 for Type 1, Type 7 and the AMLO VA service) are a fraction of total cost.^[28] UAE VARA fees are heavier (AED 40,000–100,000 application and AED 80,000–200,000 annual supervision per activity).^[18]

Capital lockup. Minimum capital is not paid to the regulator; it sits in the licensed entity, often in a regulated bank or in liquid assets, and cannot be deployed for operations. MiCA is the exception: EUR 50,000 (Class 1), EUR 125,000 (Class 2), and EUR 150,000 (Class 3) are Annex IV class floors. Prudential safeguards must equal at least the higher of the applicable Annex IV class floor and 25% of the previous year’s fixed overheads. A new firm uses projected fixed overheads for its first 12 months; the permitted deductions apply. Qualifying own funds, an insurance policy or comparable guarantee, or a combination may meet the requirement. MiCA requires no locked cash deposit.^[2] Singapore MPI SGD 250,000 + SGD 100,000–200,000 security deposit.

Hong Kong VATPs must hold HKD 5,000,000 paid-up share capital. Separately, required liquid capital is the higher of HKD 3,000,000 and the basic amount, and the platform must maintain liquid assets equivalent to at least 12 months of actual operating expenses. These are distinct tests, not a fixed HKD 8,000,000 sum. The "one-quarter of fixed overheads" floor in MiCA Article 67(1)(b) typically bites harder than the headline number.

Professional advisory. Legal and licensing-consultancy fees for application preparation typically run USD 25,000 to USD 200,000+ depending on jurisdiction, applicant complexity, and policy-framework maturity. AML programme design (policies, KYC/CDD platform, transaction monitoring, training) adds USD 15,000 to USD 100,000 in Year 1. Local director appointments and senior compliance hires range from USD 20,000–80,000 p.a. offshore to USD 80,000–250,000+ p.a. in MiCA, Singapore, Hong Kong, Switzerland, and Dubai.

Ongoing compliance infrastructure. Blockchain analytics platform subscriptions (referenced by institution type rather than by name) run USD 15,000 entry-tier to USD 150,000+ enterprise per year, with the largest exchanges paying USD 500,000+ for combined sanctions, KYT, and investigation stacks. SOC 2 Type II audits cost USD 25,000–80,000 initial with recurring 50–75%. ISO/IEC 27001 certification adds USD 30,000–80,000 initial plus surveillance and three-yearly recertification.

An independent specialist introduced by Jagelski & Partners sequences licensing budgets so that capital, banking, and substance hires land in the order the regulator expects to see them: getting a regulator past completeness review at the second filing rather than the fifth is the single biggest cost saver, and it depends almost entirely on pre-filing preparation rather than on the application fee.

How to Choose the Right Jurisdiction

Jurisdiction selection is rarely a one-variable decision. The five most decision-relevant axes are EU market access, total cost of ownership, banking accessibility, applicant timeline tolerance, and the regulator's substance expectations. Each axis pushes toward a different short-list.

If EU market access is the requirement. Authorisation must be obtained from an EU/EEA NCA under MiCA; nothing else passports. The EEA table's timeline column gives Lietuvos bankas 4–8 months, NBS in Slovakia 5–10 months, CySEC in Cyprus 8–14 months and MFSA in Malta 9–18 months.

BaFin in Germany and the Central Bank of Ireland carry a credibility premium with institutional counterparties.

If cost is the binding constraint and EU passporting IS required. Year-1 cost depends on the service class and on what each estimate includes, so compare the country pages for Bulgaria, the Czech Republic, Latvia, Lithuania and Slovakia on the same basis before ranking them. Romania has no operative route yet. Estonia is a tax play, not a cost play.

If cost is the binding constraint and EU passporting is not required. On the tables' Year-1 ranges, the lower-cost offshore routes include Saint Lucia (USD 34k–59k), Saint Vincent and the Grenadines (USD 27k–50k), the BVI registration route (USD 45k–161k), Seychelles (USD 57.5k–158k) and Saint Kitts (USD 94.8k–120k); the Cayman Islands (from USD 180k) and Bermuda (USD 377k–1.61m for Class F) cost more and carry institutional-grade recognition.

If timeline pressure dominates. The Marshall Islands corporate vehicle can be established without a bespoke financial-licensing process, but incorporation is not permission to provide regulated services. Georgia has a separate VASP registration route. Comoros / Anjouan is excluded from a licensing-speed comparison because no recognised VASP authorisation or statutory decision clock has been identified. Costa Rica likewise requires a distinction between corporate formation, AML registration and permission for the proposed activity.

No MiCA route is fast: the statutory clocks are the same in every member state, and on the EEA table’s planning ranges Lithuania runs 4–8 months and Slovakia 5–10 end to end.

If tax efficiency matters most. BVI, Cayman, Bermuda (0% corporate income tax, with a 15% corporate income tax for in-scope multinational groups from 2025), Estonia (0% on retained earnings, 22% only on distributions), and Marshall Islands (NRD foreign-source exemption; DAO tax treatment from October 2026 requires confirmation; off the EU tax list since October 2023) require different tax analyses.

Always read the tax position alongside FATF and EU AML high-risk status: BVI's June 2025 FATF grey-listing and EU listing as a high-risk third country under Commission Delegated Regulation (EU) 2026/83 (adopted 4 December 2025, OJ L published 9 January 2026) materially affect counterparty banking access.^[9][30]

If banking access is the dealbreaker. Banking access is downstream of jurisdiction, not independent of it. Tier-1 banking is more accessible from Cyprus, Malta, Lithuania, Switzerland and UAE / Dubai than from grey-listed or counterparty-flagged jurisdictions; we cover the institution-archetype mapping on the Banking Hub and the high-risk-specific specialisation on the High-Risk Business Accounts page.

A good way to read the matrix: pick two of the five axes that are decision-relevant, then narrow to the jurisdictions that score on both. Selection on a single axis (typically cost) is the most common mistake we see in pre-filing assessments.

Entity Requirements

Every VASP and CASP regime requires the applicant to be a legal entity registered or authorised in the relevant jurisdiction. The form, capital structure, and governance of that entity must align with the licence; we plan formation backward from the licence specification rather than forward from a "favourite" structure.

For MiCA CASP applicants, the entity must be a legal person or other undertaking with its registered office in the authorising EU Member State (or EEA state via the Agreement), where it provides at least part of its crypto-asset services; its place of effective management must be in the Union, and at least one director must be resident there (Article 59(2)). A pure-paper entity cannot meet that test.^[2] See European Company Formation for the EU formation deep dive and the regional decision framework.

For offshore VASP applicants, a local entity is the norm. BVI requires a BC (Business Company) under the BVI Business Companies Act 2004, with an Authorised Representative and registered office locally. Cayman accepts an exempted company or an LLC, among other vehicles, and also a registered foreign company. Bermuda uses the Exempted Company. The Marshall Islands offers the DAO LLC under the Marshall Islands DAO Act 2022, which is a corporate vehicle rather than a financial licence. See Offshore Company Formation for the offshore decision matrix.

For non-EU regulated regimes, entity formation rules are typically prescriptive. Singapore requires a company (usually a Pte Ltd) or the Singapore branch of a foreign corporation, with a permanent place of business or registered office in Singapore and at least one executive director who is a citizen or permanent resident, or an Employment Pass holder alongside a citizen or permanent-resident director.^[16][29] Hong Kong requires a company incorporated in Hong Kong, or an overseas company registered with the Companies Registry, with at least one Responsible Officer ordinarily resident in Hong Kong; there is no director-residency rule.^[28] In the UAE, VARA licenses entities in Dubai mainland and in Dubai’s free zones other than the DIFC; a DIFC firm applies to the DFSA and an ADGM firm to the FSRA. The Company Formation Hub carries the cross-jurisdictional formation matrix and the decision framework for entity-licence alignment.

How Jagelski & Partners' Licensing Service Works

An independent specialist introduced by Jagelski & Partners coordinates crypto licensing as a five-stage process that runs entity, licence, and banking workstreams in parallel rather than in series. The partner network brings 50+ legal, regulatory, and compliance specialists, with the licensing partners bringing 17+ years of regulatory advisory experience; the same partner network has been engaged by governments to draft national crypto and virtual-asset frameworks, which gives us an unusually direct view of how regulators read applications.

Stage 1: Pre-filing assessment. We scope the business model, map the activities to the FATF five-activity list and the MiCA Article 3(1)(16) services, and shortlist 2–3 jurisdictions that match the operational profile. The output is a written assessment, not a marketing deck.

Stage 2: Jurisdiction selection. We compare the shortlist on capital, timeline, banking realism, substance, ongoing supervisory cost, and the regulator's recent behaviour with applicants of a similar profile. The selection memo is co-signed before any incorporation work begins; reversing a wrong jurisdiction at month 6 is the most expensive mistake in the lifecycle.

Stage 3: Entity formation and substance. The independent specialist we introduce coordinates the incorporation, the appointment of local directors and senior compliance hires, and the substantive setup (office, MLRO/AML officer, IT infrastructure, blockchain analytics tooling). For EU applicants, the entity is established and operational ahead of the MiCA filing rather than as part of it; the timing affects the regulator's read on substance.

Stage 4: Application preparation and submission. The licensing partner drafts the regulatory business plan, AML policies, ICT, and DORA documentation, governance arrangements, and the prudential and operational annexes; we scope the file in writing before introducing the independent specialist. The specialist manages the timetable and submission and assesses the relevant regulator’s current process.

Stage 5: Banking and post-authorisation compliance. Banking access is pre-qualified through our partner network. Through that network, businesses placed more than fourteen billion euros in client turnover across banking and EMI relationships in 2025; pre-qualification runs across 90+ banking and payment institutions, with no markup and no onboarding fee. Post-authorisation, the independent specialist we introduce coordinates the first-year compliance cadence (periodic reporting, DORA Register of Information, AML programme reviews) to keep the licence in good standing. The High-Risk Business Accounts page covers the specific archetype mapping for crypto operators.

On the tables' planning ranges, end-to-end timelines run from 4–8 months (Lithuania) to as much as 18 months (Ireland, Malta and the Czech Republic) for MiCA, and from about 3–6 months to more than a year offshore, depending on the regime and licence class. The decision of when to start is a function of the regulator's queue, not of the applicant's readiness alone.

Frequently Asked Questions

References