No regulator issues an "exchange licence". You are authorised for the activities you actually perform — matching, custody, fiat conversion, transfers — and every jurisdiction bundles them differently. Settle the activity list first, then the jurisdiction, then whether the instrument is a registration or a full authorisation.
Most enquiries begin the same way: we are launching an exchange, which licence do we need? Right instinct, wrong unit of measurement. "Exchange" is a product category, and regulators do not license product categories. They license conduct — enumerated things you do with other people's money or other people's crypto-assets. The licence you need is whatever set of conduct your product happens to contain.
That turns one question into three, in strict order: what am I actually doing, whose users am I doing it to, and what kind of instrument does that jurisdiction issue for it. Answered in that order, the shortlist writes itself. Answered out of order, you end up holding a permission that covers half your roadmap.
Why is there no such thing as an "exchange licence"?
Look at how three unrelated regulators carve up the same ground and the pattern is unmistakable. Singapore's Monetary Authority regulates seven payment services under the Payment Services Act, and its digital payment token service is defined not as a business but as a list of acts: "buying or selling digital payment tokens", "providing a platform to allow persons to exchange DPTs", "transmitting or arranging for the transmission of DPTs", "provision of custodian wallet services for DPTs", and "actively facilitating the buying or selling of DPTs without possession of monies or DPTs".
The Central Bank of Bahrain performs the same surgery with a different vocabulary. Its Crypto-asset Module enumerates reception and transmission of orders, execution of orders on behalf of clients, dealing on own account, portfolio management, crypto-asset custody, investment advice and operating a crypto-asset exchange — then states at rule CRA-1.1.1 that "No person may market or undertake the activities, by way of business, within or from the Kingdom of Bahrain, comprised of regulated crypto-asset services without obtaining a license from the CBB."
Latvijas Banka, applying the EU framework, publishes its own list of ten crypto-asset services requiring authorisation, from custody and the operation of a trading platform through to transfer services and portfolio management. Three regulators, three vocabularies, one method: unbundle the product, then price each part.
Map the product onto the activity list
| What your product does | How regulators name it | Why it matters |
|---|---|---|
| Matches user orders against one another on an order book | Operation of a trading platform (EU); crypto-asset exchange (Bahrain); providing a platform to exchange DPTs (Singapore) | Normally the heaviest permission available in that jurisdiction |
| Fills users from your own book — OTC desk, market making | Dealing on own account (Bahrain); exchange of crypto-assets for funds (EU); buying or selling DPTs (Singapore) | Lighter than running a venue, but rarely unregulated |
| Holds user balances in wallets you control | Custody and administration on behalf of clients (EU); crypto-asset custodian (Bahrain); custodian wallet services (Singapore) | The trigger for the strictest capital, segregation and audit rules |
| Takes fiat in and pays fiat out | A payment service in its own right — money transfer, account issuance, money service | Frequently a second licence, from a second regulator |
| Routes user orders to a third-party venue | Reception and transmission of orders (Bahrain); actively facilitating buying or selling without possession (Singapore) | "We hold nothing" is not by itself an exemption |
| Issues a card spendable from a crypto balance | Payments and e-money territory rather than crypto-asset territory | Places you in a different rulebook, with different capital rules |
Registration or authorisation — which one are you actually buying?
Two very different products are sold under the single English word "licence", and confusing them is the most expensive mistake on this page.
The first is a registration. You file, you become a supervised obligor, and your anti-money-laundering duties begin. FinCEN states that with few exceptions "each money services business (MSB) must register with the Department of the Treasury", using FinCEN Form 107, "within 180 days after the date on which the MSB is established", renewed every two years. FINTRAC is equally direct: "Before beginning to operate in Canada, you must register your money services business or foreign money services business with FINTRAC" — and dealing in virtual currency counts as an MSB activity. New Zealand's Financial Service Providers Register exists, in the Companies Office's own words, to "promote transparency of public information related to financial service providers".
The second is an authorisation. A regulator reads your business model, governance, systems and people, and then decides. ADGM states that financial services entities wishing to carry on digital-asset activities "must apply for a Financial Services Permission from the Financial Services Regulatory Authority (FSRA)". Hong Kong's SFC advises platform operators to apply "for licences under both the SFO and AMLO regimes", noting the regime reaches platforms "carrying on their businesses in Hong Kong, or actively marketing their services to Hong Kong investors". Latvijas Banka publishes the shape of its own review: a completeness check of 25 working days, a substantive assessment of 40 working days once completeness is confirmed, and an application fee of EUR 2,500. Those are the regulator's published indicative windows, not a promise about your file.
The difference is commercial before it is legal. A registration says you filed. An authorisation says a regulator looked. Banks, payment partners and institutional counterparties price that gap, which is why the cheapest route to a piece of paper is so often the most expensive route to a bank account. We treat banking and card issuing as part of the licensing question rather than a step that follows it.
Does the obligation follow you, or follow your users?
Founders tend to assume the regulatory map is drawn around the company. It is more often drawn around the customer, and three regulators say so in almost identical language.
- Bahrain. Activity is treated as undertaken "within or from" the Kingdom if the person is incorporated there, uses a Bahrain address for correspondence, or directly solicits clients within Bahrain.
- Hong Kong. The SFC regime reaches centralised platforms carrying on business in Hong Kong or actively marketing to Hong Kong investors.
- El Salvador. The CNAD defines a digital asset service provider to include a person that "is not domiciled in El Salvador, but actively promotes or markets its services to potential clients in the country".
Europe has already run out of patience on the same point. ESMA's transitional arrangement allowed entities providing crypto-asset services under national law before 30 December 2024 to continue "until 1 July 2026 or until they are granted or refused a MiCA authorisation". As at August 2026 that window is shut. Serving EU clients without CASP authorisation is not a legacy position; it is an unlicensed one.
Custody is the line that changes the budget
If one fact reorganises a licensing plan, it is whether you hold client assets. Switzerland is the cleanest illustration, because the same company gets three different answers depending on what it holds. Trading virtual currencies and operating a payment system fall under the Anti-Money Laundering Act, and FINMA's position is that if your business is subject to AMLA "you must become a member of a self-regulatory organisation (SRO)". Take collective custody of crypto-based assets, or accept client deposits, and you move up a tier: FINMA's FinTech licence covers client deposits up to a maximum of CHF 100 million where those deposits are neither invested nor interest-bearing. Operate a facility for DLT securities trading and that is a separate licence again. Our Swiss SRO walkthrough follows that ladder step by step.
What each jurisdiction we work in actually issues
These are the 10+ jurisdictions we cover, grouped as we group them internally. The column that matters is the last one: it tells you what kind of thing you would be holding at the end.
| Region | Jurisdiction | Authority | Instrument |
|---|---|---|---|
| Asia | Singapore | MAS | Payment Services Act licence; major payment institution where thresholds are exceeded |
| Asia | Hong Kong SAR | SFC; Customs and Excise | VATP licence under the SFO and AMLO; money service operator licence for remittance and money changing |
| Middle East | Abu Dhabi | ADGM FSRA | Financial Services Permission for the relevant regulated activity |
| Middle East | Bahrain | CBB | Crypto-asset service licence under the CRA Module |
| Europe | Switzerland | FINMA-recognised SRO | SRO membership under AMLA; a FINMA licence where deposits, custody or DLT trading are involved |
| Europe | Latvia | Latvijas Banka | CASP authorisation under MiCA |
| Europe | Malta | MFSA | CASP authorisation under the same MiCA regime |
| Americas | Canada | FINTRAC | MSB or foreign MSB registration |
| Americas | El Salvador | CNAD | Digital asset service provider registration, following pre-registration |
| Americas | United States | FinCEN | Federal MSB registration on Form 107 |
| Oceania | Australia | AUSTRAC | Registration as a digital currency exchange provider |
| Oceania | New Zealand | Companies Office (FSPR) | Financial service provider registration |
Two notes on that table. The United States row covers the federal filing only — FinCEN's own money services business pages also direct businesses to state contacts, and state requirements sit on top of the federal one. And every row should be re-checked against the regulator's own current pages before you rely on it: crypto rulebooks are amended more often than they are rewritten, and the amendment is usually the part that affects you. Our jurisdictions overview keeps the same list in one place.
How to sequence the decision
- Write the activity list before the jurisdiction list. One line per act, in the regulator's vocabulary rather than your pitch deck's.
- Mark the acts you would give up. Dropping custody, or dropping fiat, changes the answer more than changing country does.
- Map your users, not your incorporation. If a meaningful share sit in the EU, Hong Kong, Bahrain or El Salvador, those regimes have already reached you.
- Test the shortlist against banking. Ask what a payment partner will make of the instrument before you commit to it.
- Budget the second year. Annual audit, reporting, fit-and-proper renewals and training are recurring costs, and they start the day you are admitted, not later.
Where an adviser fits
CryptoLicense is an advisory firm — not a regulator and not a law firm, and nothing here is legal advice. What we do is end-to-end: we draft the application rather than review yours, and we source what the file requires, including bank account introductions, a local address and local personnel where a regime demands them. The team's experience covers 10+ jurisdictions across five continents.
No approval can be guaranteed. Every regulator on this page retains full discretion to refuse an application, and part of the timeline belongs to their workload rather than to either of us. What can be committed to is that waiting is not dead time: while one file sits with a regulator, the other workstreams — banking, policies, personnel, the second jurisdiction — keep moving. If you are still weighing routes rather than filing one, start with licence selection.
本文属于系列指南：完整指南见 牌照选型.