Crypto Licensing for Exchanges and Service Providers
What a crypto license means for exchanges and service providers, how registration differs from authorization, and how to check a platform's status yourself.
A crypto license is permission from a government regulator that allows a company to provide specific crypto services — such as running an exchange, holding customer assets or transferring crypto — in a particular jurisdiction, subject to ongoing rules and supervision. What it actually requires varies widely: some regimes focus mostly on anti-money-laundering checks, while others impose capital, custody and consumer-protection standards similar to traditional finance.
For users, licensing is one of the most useful signals when choosing a platform, but only if you understand what the specific permission covers. A company that says it is "licensed" may hold anything from a basic registration in a small jurisdiction to a full authorization in a major market.
Who Needs a Crypto License
Regulators often use the terms virtual asset service provider (VASP), from the international standard-setter FATF, or crypto-asset service provider (CASP), the EU term. Activities that commonly trigger licensing include:
- Operating a trading platform or exchange.
- Exchanging crypto for fiat currency or for other crypto.
- Custody — holding crypto or private keys on behalf of customers.
- Transferring crypto for customers.
- Brokerage, order execution and portfolio management.
- Issuing certain types of tokens, notably stablecoins, in some jurisdictions.
Purely self-custodial software, where the developer never controls user funds, is often treated differently, but the boundaries are debated and vary by country.
Registration vs Authorization
| Type | What it usually involves | What it usually does not mean |
|---|---|---|
| AML registration | Customer identity checks, transaction monitoring, suspicious activity reporting | Full review of capital, custody or conduct |
| Money transmission or payment license | Capital or bonding requirements, safeguarding rules, inspections | Coverage of every product the firm offers |
| Full crypto authorization (e.g. MiCA CASP) | Governance, capital, custody and segregation, conduct and disclosure rules | Protection from market losses or guaranteed compensation |
Firms sometimes market an AML registration as a "license." That is not necessarily false, but it can create an impression of more oversight than exists. Our explainer on KYC and AML in crypto covers what the anti-money-laundering side involves.
Examples of Major Licensing Approaches
Rules are evolving, so treat these as an overview and check official sources for current requirements:
- European Union. The Markets in Crypto-Assets Regulation (MiCA) introduced authorization for crypto-asset service providers, letting an authorized firm passport its services across EU member states. National transition periods affected when existing providers had to comply. See our MiCA explainer.
- United States. There is no single federal crypto license. Businesses that transmit money generally register with FinCEN and may need state money transmitter licenses; New York has its own BitLicense regime run by the state's financial regulator. Securities and derivatives rules can also apply depending on the activity.
- United Kingdom. Crypto businesses have had to register with the Financial Conduct Authority for anti-money-laundering purposes, and the government has been developing a broader regime.
- Asia and the Middle East. Japan, Singapore, Hong Kong and Dubai, among others, have dedicated registration or licensing frameworks for crypto service providers.
What a License Typically Requires
Strong regimes commonly require:
- 1Fit-and-proper owners and managers, with background checks.
- 2Minimum capital so the firm can absorb losses.
- 3Segregation of client assets, keeping customer crypto separate from company funds.
- 4Custody and cybersecurity standards, including controls over private keys.
- 5AML and sanctions compliance, including the Travel Rule in many jurisdictions.
- 6Disclosures and complaint handling for retail customers.
- 7Regular reporting and audits to the regulator.
None of this removes market risk. A licensed exchange can still list volatile tokens, and you can still lose money trading them.
How to Verify an Exchange's License
- 1Find the legal entity. Look in the terms of service or footer for the company name and registration number serving your country.
- 2Go to the regulator's site directly. Type the address yourself or search for the regulator; do not use a link from the exchange.
- 3Search the public register. Confirm the entity name, permission type, status and any restrictions.
- 4Check warning lists. Many regulators publish lists of unauthorized firms and clone firms that impersonate real ones.
- 5Match the service to the permission. A license for custody does not automatically cover derivatives trading, for example.
Our step-by-step guide on how to check whether an exchange is licensed goes deeper, and you can compare platforms on our exchanges page.
Why Licensing Matters to Ordinary Users
Licensing is mostly invisible when things go well. It matters when something goes wrong. A supervised platform is more likely to have documented custody procedures, an independent audit trail and a complaints process, and a regulator has powers to step in if it fails.
Licensing can also shape what happens in an insolvency. In jurisdictions with strict segregation rules, customer assets are more likely to be treated as belonging to customers rather than to the company's creditors, although outcomes depend on local law and the facts of each case. Our article on what happens to your crypto if an exchange goes bankrupt explores this.
The reverse is also true: an unlicensed platform serving your country may be operating illegally, and you may have little or no legal recourse if it freezes withdrawals.
Red Flags Around Licensing Claims
- A license number with no matching entry on the regulator's register.
- A license from a jurisdiction where the platform clearly does not operate, used to market services everywhere.
- Badges or logos of regulators on the site with no verifiable details.
- An entity name that differs slightly from the one on the register — a sign of a clone firm.
- Claims that a license "guarantees" returns or the safety of deposits.
Bottom line
A crypto license tells you a regulator has accepted a specific company for specific activities in a specific place — nothing more. Check what kind of permission it is, confirm it on the official register and remember that rules differ by country and change frequently. For decisions with legal or tax consequences, consult official sources or a qualified professional in your jurisdiction.
Frequently asked questions
Does a crypto license mean my funds are protected?
Not necessarily. What a license requires depends on the country and the type of permission. Some regimes mainly cover anti-money-laundering checks, while others add rules on capital, custody, segregation of client assets and complaint handling. Crypto holdings are often not covered by deposit insurance or investor compensation schemes, so read what the specific license covers.
What is the difference between registration and a license?
In many countries, registration means the firm has been accepted onto a list for anti-money-laundering supervision. A license or authorization usually involves a broader assessment of the business, its owners, finances and conduct, with ongoing supervision. Firms sometimes describe a registration as a license, so check the exact wording on the regulator's register.
Can an exchange licensed in one country serve customers everywhere?
Generally no. A license usually covers activity in the issuing jurisdiction. Some frameworks allow passporting, such as the EU's MiCA regime, which lets an authorized provider serve other EU member states. Outside such arrangements, a firm may need separate permissions in each country where it actively serves customers.
How do I check if an exchange is licensed?
Find the legal entity name in the exchange's terms of service, then search that name on the official public register of the regulator it claims. Reach the register through the regulator's own website, not a link from the exchange. Confirm the entity, permission type and status all match.