Crypto Licences Explained: MiCA CASP, VARA, MAS, FCA and US MTLs
How crypto licences work in 2026: MiCA CASP authorisation, US money transmitter licences, NY BitLicense, Dubai VARA capital, MAS and the UK FCA regime.
Key takeaways
- MiCA's grandfathering period ended on 1 July 2026, so crypto firms serving EU clients now need a CASP authorisation, which can then be passported across the EU.
- Dubai's VARA publishes exact capital floors per activity, from AED 100,000 for advisory to AED 1.5 million for an exchange, or 25% of fixed overheads if higher.
- The UK's FCA application window runs from 30 September 2026 to 28 February 2027 ahead of a full FSMA crypto regime expected on 25 October 2027.
Two founders in Bengaluru want to let Gulf-based workers buy a dollar stablecoin and send it home. Before writing a line of code they hit the question that decides their burn rate for the next two years: which licence, where? A Dubai licence for an exchange means locking up at least AED 1.5 million of paid-up capital. An EU authorisation gives them 27 member states at once but meant a hard deadline for anyone operating under old national rules. The US means a licence in nearly every state. India asks only for registration with its financial intelligence unit. Same product, five very different paths.
The vocabulary alone is confusing. The FATF calls these firms virtual asset service providers (VASPs). The EU calls them crypto-asset service providers (CASPs). The US mostly treats them as money transmitters. The UK has registered them for anti-money laundering purposes and is now moving to full authorisation. This guide sorts out what each regime requires, what it costs, and how long it takes.
Why licensing became the main battleground
The FATF's July 2026 targeted update found that 95 of 130 responding jurisdictions (73%) require VASPs to be licensed or registered, but only 76 have actually licensed or registered one. Just 59 of 149 assessed jurisdictions met or mostly met the FATF's licensing criterion, and 39 of 114 extend licensing to certain offshore VASPs serving their residents. Everything else in crypto regulation, from the Travel Rule to sanctions screening, depends on knowing who the regulated firms are. Our Travel Rule explainer shows how those obligations sit on top of a licence.
European Union: the MiCA CASP authorisation
The Markets in Crypto-Assets Regulation entered into force in June 2023 and applied in full from 30 December 2024. A CASP authorised by one national regulator can passport its services across the EU without separate licences in each member state. Prudential requirements are set either as a fixed minimum or in proportion to the previous year's fixed overheads, depending on the services offered.
The key date for 2026 was 1 July. Under MiCA's grandfathering clause, firms already serving clients under national law before 30 December 2024 could keep operating until 1 July 2026 or until their MiCA application was decided, according to ESMA. That window has now shut. In a June 2026 statement, ESMA told unauthorised firms to stop onboarding EU clients and marketing immediately, limit activity to helping clients sell, transfer or close positions, and keep anti-money laundering controls running throughout the wind-down. Non-EU firms cannot solicit EU clients, and custody cannot be outsourced to an unauthorised entity.
For users, the practical check is ESMA's interim MiCA register, updated weekly, which lists authorised CASPs alongside a separate file of non-compliant entities. Stablecoin issuers follow a separate track under MiCA, explained in our guide to MiCA e-money and asset-referenced tokens.
United Kingdom: from registration to full authorisation
For several years the UK has required crypto firms within scope of the Money Laundering Regulations to register with the FCA. That registration is narrow: it covers anti-money laundering supervision, not conduct, capital or client asset protection. The FCA says it has three months to decide an application, but the clock only starts once it has everything it needs, and case officers are very likely to ask for more, per its application guidance. Refused or withdrawn applications get no fee refund.
A full regime is now coming. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 were made on 4 February 2026, and the FCA published final rules on 30 June 2026. The FCA's timeline opens the application window on 30 September 2026, closes it on 28 February 2027, and expects the regime to take effect on 25 October 2027. The FCA has published transitional provisions for firms already registered under the MLRs, which will need FSMA permission under the new regime. Our piece on the UK stablecoin regime covers the parallel rules for issuers.
United States: a licence in nearly every state
The US has no single federal crypto licence for spot trading. A business that exchanges, transfers or holds crypto for customers registers with FinCEN as a money services business, then needs a money transmitter licence in each state where it operates. Notabene's US profile notes that Montana is the exception. New York requires its own BitLicense, and Wyoming offers a special-purpose depository institution charter.
Each state runs its own application, surety bond, net worth test and examination schedule. That is why large US platforms spend years accumulating licences and why many foreign firms simply exclude US users. The CFTC's October 2026 rulemaking on leveraged retail crypto trading would create an optional federal registration category as an alternative to state licensing for those products, as The Block reported. A broader federal regime depends on Congress; see our guide to US crypto market structure law.
Dubai: VARA's two-step licence and hard capital numbers
Dubai's Virtual Assets Regulatory Authority licenses virtual asset activity in the emirate. Its process has two stages, set out on VARA's licence page. First comes an Approval to Incorporate, issued after an initial disclosure questionnaire, a business plan, details of owners and managers, and payment of about half the application fee. The firm can set up but cannot yet carry on virtual asset activity. Then comes the full VASP licence, after further documentation, interviews and payment of the remaining fee and the first year's supervision fee.
VARA is unusually precise about capital. Its Company Rulebook sets paid-up capital per activity, held in a UAE bank trust account or a surety bond naming VARA as beneficiary.
| VARA activity | Paid-up capital (higher of) |
|---|---|
| Exchange services | AED 1,500,000 or 25% of fixed annual overheads |
| Broker-dealer services | AED 600,000 or 25% of fixed annual overheads |
| Custody services | AED 600,000 or 25% of fixed annual overheads |
| Lending and borrowing | AED 500,000 or 25% of fixed annual overheads |
| Transfer and settlement | AED 500,000 or 25% of fixed annual overheads |
| Management and investment | AED 500,000 or 25% of fixed annual overheads |
| Advisory | AED 100,000 |
Lower figures apply to exchanges, broker-dealers and managers that use a separately licensed custodian. For more on the wider UAE picture, including the federal central bank and Abu Dhabi's ADGM, see our guide to UAE crypto regulation.
- EUMiCA applies in full to CASPs
- UKCryptoassets Regulations 2026 made
- UKFCA publishes final crypto rules
- EUMiCA grandfathering ends for CASPs
- UKFCA application window opens
- UKApplication window closes
- UKNew FSMA crypto regime takes effect
Source ESMA; FCA
Worked example: capital for a Dubai exchange with custody
Suppose the Bengaluru founders apply to VARA for exchange and custody services and run their own custody. VARA requires a separate calculation for each activity, using only that activity's share of fixed annual overheads.
- Exchange: fixed overheads of AED 7,000,000. Twenty-five percent is AED 1,750,000, which beats the AED 1,500,000 floor. Requirement: AED 1,750,000.
- Custody: fixed overheads of AED 2,000,000. Twenty-five percent is AED 500,000, below the AED 600,000 floor. Requirement: AED 600,000.
- Total locked up: AED 2,350,000, reconciled monthly.
- Alternative: outsource custody to a licensed custodian, drop the custody licence, and the exchange floor falls to the higher of AED 800,000 or 15% of overheads. On AED 7,000,000 that is AED 1,050,000, less than half the original requirement.
The lesson generalises. In most regimes, the cheapest licence is the one for the activities you do not perform yourself, and custody is the activity regulators price highest.
The cheapest crypto licence is usually the one for the activity you outsource.
Singapore and India: two lighter-touch starting points
Singapore licenses digital payment token (DPT) services under the Payment Services Act 2019. Firms whose volumes stay under SGD 3 million a month across regulated services, or SGD 1.5 million for a single service, can hold a Standard Payment Institution licence; above that, they need a Major Payment Institution licence, according to a Tookitaki summary. DPT licensees must follow MAS Notice PSN02, including Travel Rule data on transfers. Our overview of stablecoin regulation in Asia and the Gulf covers MAS's separate stablecoin framework.
India does not license crypto exchanges at all. Since March 2023, VDA service providers have had to register with the Financial Intelligence Unit as reporting entities under the Prevention of Money Laundering Act, as Mondaq explains. FIU-IND has also blocked web access for several platforms over non-compliance with the Act. Our explainer on India's crypto regulation has the detail.
The licence map side by side
| Jurisdiction | Licence | Regulator | Scope | Key 2026-27 date |
|---|---|---|---|---|
| EU | MiCA CASP authorisation | National authority, ESMA register | Passport to all member states | Grandfathering ended 1 Jul 2026 |
| UK | MLR registration, then FSMA authorisation | FCA | UK only | Window 30 Sep 2026 to 28 Feb 2027; live 25 Oct 2027 |
| US | FinCEN MSB plus state MTLs; NY BitLicense | FinCEN, state regulators, NYDFS | State by state | CFTC federal path proposed Oct 2026 |
| Dubai | VASP licence per activity | VARA | Dubai | Company Rulebook effective 19 Jun 2025 |
| Singapore | SPI or MPI licence for DPT services | MAS | Singapore | PSN02 Travel Rule in force since Jan 2020 |
| India | Reporting entity registration | FIU-IND | AML only, no conduct licence | CARF reporting from 2027 |
Our view: the EU passport has become the most valuable single licence in crypto, because it converts one approval into a market of 27 countries while the US still requires dozens. The UK's 2027 regime will test whether a mid-sized market can compete on clarity rather than scale. And Dubai's published capital tables are a model other regulators should copy. Founders can price a licence before they apply.
What to watch next
- 30 September 2026 to 28 February 2027: the FCA's application window for the new UK regime. How many registered firms apply, and how many are turned away, will shape UK market structure.
- 12 November 2026: the EBA begins direct supervision of USDC as the EU's first significant e-money token, per its October 2026 announcement.
- Late 2026 into 2027: the European Commission's MiCA review; ESMA's September 2026 response called for changes to make the rules clearer and ready for emerging services.
- 25 October 2027: the UK's FSMA crypto regime takes effect.
- US: final text of the CFTC's federal registration category, and whether Congress revives the market structure bill after the November 2026 elections.
This article describes licensing regimes in general terms for information only and is not legal advice. Requirements change frequently; firms should confirm current rules and fees with the relevant regulator and qualified counsel.
Frequently asked questions
What happened to crypto firms without a MiCA licence after 1 July 2026?
ESMA told unauthorised firms to stop onboarding EU clients and marketing, limit activity to an orderly wind-down such as helping clients sell or transfer assets, and keep anti-money laundering controls running until they wind down.
How much capital do you need for a VARA crypto exchange licence in Dubai?
VARA's Company Rulebook requires paid-up capital of the higher of AED 1,500,000 or 25% of fixed annual overheads for exchange services, falling to AED 800,000 or 15% if a separately licensed custodian is used.
How long does FCA crypto registration take?
The FCA has three months to decide once it has all the information it needs, but it very often requests more, so the overall process can run longer. The new FSMA authorisation regime is expected to start on 25 October 2027.
Do crypto exchanges need a licence in every US state?
Generally yes. Firms register with FinCEN as money services businesses and need a money transmitter licence in each state where they operate, with Montana the exception, plus a BitLicense in New York.
Sources and further reading
- FATF: Targeted Update on VAs and VASPs (July 2026)
- ESMA: Markets in Crypto-Assets Regulation (MiCA)
- ESMA: Public statement on the end of the MiCA transitional period
- FCA: Cryptoassets information and new regime timeline
- FCA: How to apply for cryptoasset registration
- VARA: Licence applications
- VARA Company Rulebook: Paid-up capital
- Notabene: United States VASP regulation
- Tookitaki: Payment Services Act Singapore AML obligations
- EBA: USDC classified as first significant e-money token
This article is for general information and is not financial, legal or tax advice. Figures are as reported by the sources above at the time of writing.
