Frequently asked questions

It depends on whose assets you hold and whose value you move. Trading purely with your own capital is not a regulated activity in most jurisdictions. Once you hold assets for third parties, offer exchange or transfer services, or hold fiat balances on customers' behalf, you are usually inside the virtual-asset or payment-services perimeter. The test is against a specific jurisdiction's legal definitions, and it cannot be inferred from what the product is called.

We do not quote a duration, and we would be cautious about any firm that does. The stages we control move at the speed of your document turnaround; the stages a regulator controls move at the regulator's, and that pace is set by its own workload. What we will say is that your response time during the post-submission question round is the single largest variable either side can influence — and that while a regulator works through its queue, every other workstream continues in parallel.

We do not publish fees, because the variance between two applications in the same jurisdiction is large enough that a published figure would mislead. What is worth knowing is the shape: an application layer (regulator fees plus preparation), a substance layer (entity, address, compliance officer, tooling, and capital that must be held rather than spent), and a maintenance layer that recurs every year. Most people budget for the first and are surprised by the other two.

Sometimes, and it is a legitimate route. But it is not a company purchase with a regulatory footnote — it is a regulatory change-of-control approval with a company purchase attached, and the regulator assesses the incoming owners much as it would a new applicant. You also inherit the entity's full history, including anything the seller has not mentioned. Where the target is genuinely clean it can be materially faster; where it is not, a fresh application would have been quicker.

Yes — account opening in the UK, the EU and Singapore is part of what we do, because a licence you cannot bank does not let you operate. What decides the outcome is usually a flow-of-funds narrative a bank analyst can follow without asking a single clarifying question, plus ownership that resolves cleanly to natural persons. We introduce, prepare and support. We do not control a bank's compliance committee and we do not promise an account.

If you provide crypto-asset services to customers in the EU, yes. The transitional period under the Markets in Crypto-Assets Regulation ended on 1 July 2026, and a firm without CASP authorisation can no longer rely on a legacy national registration to serve EU clients. Swiss SRO affiliation does not substitute for it, and neither does a non-EU registration.

Substance is the regulator's test of whether your presence in a jurisdiction is real: a properly incorporated entity, a verifiable address, people who can genuinely perform their roles, and an operation matching the documents you filed. In practice most credible regimes do require at least a compliance officer with real capability in or connected to the jurisdiction. It cannot be outsourced — an adviser can source and sequence it, but the presence and the people have to be yours.

Three filters decide it, in order. Does the regime have a category that matches what you actually do? Can you meet its substance requirements honestly? And will the resulting permission be accepted by the banks and counterparties you need — which is a commercial question no regulator answers. Optimising for the fastest approval is the most expensive mistake in this area, because a permission nobody will bank leaves you licensed and unable to trade.

First, establish the real reason: the ground stated in a decision letter is frequently a narrow expression of a broader concern. Then decide whether it is remediable here or whether the model does not fit this regime at all. Assume the refusal is visible — future regulators, banks and acquirers all ask, and a candid account is received far better than a discovered one. Re-filing the same file with better wording is how a second refusal happens, and a pattern is much harder to explain than an event.

Annual audit, periodic regulatory reporting, evidenced staff training, procedure updates when rules change, and a risk assessment refreshed whenever the business materially changes. Certain changes — a new controller, a new regulated activity, a change of compliance officer — usually have to be notified or approved before they happen. Most revocations and penalties we see originate here rather than at the application stage.

We work on card programmes including U Card in Singapore and Hong Kong. A U Card is not a licence in itself: it is a product that sits on top of an e-money or equivalent permission plus a relationship with a scheme or issuing partner, each with its own onboarding standards independent of any regulator. The settlement mechanics also determine how much working capital the programme requires, which does not appear anywhere in a licence application.

Look us up. CryptoLicense is the trading name of CL GLOBAL SDN BHD, registration 1421939-T, in Malaysia — the entity that contracts with you. The group also holds CRYPTO LICENCE LTD in the UK, number 16303114, and Elmbridge Advisory Limited in Hong Kong, number 78559566. We publish the numbers and the registers rather than addresses, so that every claim can be checked at source rather than taken on trust.

10+ jurisdictions across 5 continents: Singapore and Hong Kong SAR in Asia; Abu Dhabi and Bahrain in the Middle East; Switzerland, Latvia and Malta in Europe; Canada, El Salvador and the United States in the Americas; Australia and New Zealand in Oceania. Swiss SRO membership is our single largest line of work. If a jurisdiction is not on that list, we do not claim experience in it.

No. CryptoLicense is an advisory firm — not a regulator, and not a law firm. Nothing on this site is legal advice. We draft applications, source the local elements a regime requires and represent you in correspondence; where a matter genuinely needs a legal opinion in a specific jurisdiction, the right answer is local counsel and we will say so.

No, and nobody can. Regulators retain full discretion over whether to approve an application, and a firm quoting an approval rate or promising an outcome is describing something it cannot know. What we commit to is that the classification work is done properly before drafting, that the file is written against your real operation, and that waiting is never dead time — the workstreams that are not blocked keep moving.

For a first conversation, four things: what the product actually does in operational terms, how funds move through it, where your customers legally are, and which markets you want to serve. For an engagement: corporate documents, ownership traced to natural persons, identification for directors and beneficial owners, financial information, and a description of your systems. We tell you exactly what each regime adds to that once the jurisdiction is settled.