A virtual asset license is the general name for the permission a company needs from a financial regulator before it can offer services involving crypto assets to the public. The licensed business is usually called a virtual asset service provider, though national laws use other labels. Typical licensed activities are operating an exchange, converting between crypto assets and ordinary money, transferring crypto assets for customers, holding them in custody, and providing brokerage, advice or portfolio management.
There is no single international license. Each country or bloc has its own regime, with its own name, scope and conditions, and a firm that serves customers in several places may need authorization in each. What the regimes share is a common origin in anti-money laundering standards and, increasingly, a second layer of rules on consumer protection, custody and market conduct.
Origin in international standards
The term virtual asset comes from the Financial Action Task Force. In 2018 and 2019 it revised its standards to require that countries either license or register virtual asset service providers, supervise them for anti-money laundering and counter-terrorist financing purposes, and apply the same preventive measures that apply to other financial institutions, or else prohibit the activity. The revised FATF Recommendations also extended the Travel Rule to crypto transfers.
Countries implemented this in different ways. Some created a light registration focused only on financial crime controls. Others built full licensing regimes comparable to those for payment or securities firms. Several have moved from the first model to the second over time.
Main regimes
- European Union. The Markets in Crypto-Assets Regulation requires authorization as a crypto-asset service provider. Its provisions for service providers have applied since the end of 2024, and the transitional period for firms already operating under national rules ended on 1 July 2026. An authorization granted in one member state can be used across the Union.
- United States. There is no dedicated federal license. Businesses register with FinCEN as money services businesses, obtain state money transmitter licenses and, in New York, a BitLicense or trust charter. Securities and derivatives laws apply to some activities.
- United Kingdom. Crypto businesses must register with the Financial Conduct Authority under the money laundering regulations, and a broader authorization regime is being introduced.
- Singapore. Digital payment token services are licensed by the Monetary Authority of Singapore under the Payment Services Act.
- Hong Kong. Virtual asset trading platforms require a license from the Securities and Futures Commission.
- United Arab Emirates. Dubai has a dedicated Virtual Assets Regulatory Authority, while the financial free zones in Dubai and Abu Dhabi run their own regimes.
- Offshore centers. Jurisdictions such as the Cayman Islands, Bermuda and the Bahamas have enacted specific virtual asset laws.
Typical requirements
Although details vary, applicants in most serious regimes must show the following.
- Fit and proper owners and managers. Regulators run a fit and proper assessment on directors, senior managers and significant shareholders.
- Capital and financial resources. A minimum capital requirement, often scaled to the services offered, plus evidence of funding for the business plan.
- Financial crime controls. A risk assessment, customer due diligence, transaction and blockchain monitoring, sanctions screening, Travel Rule compliance and a qualified compliance officer.
- Safeguarding of client assets. Segregation of customer crypto and money from the firm's own, secure key management and rules on crypto custody.
- Governance and local presence. A registered office, resident directors or senior staff, and real decision-making in the jurisdiction.
- Technology and security. Cybersecurity standards, independent audits, business continuity and incident reporting.
- Conduct rules. Clear disclosures, complaint handling, conflict of interest policies and restrictions on marketing.
Applying and maintaining a license
An application normally includes a detailed business plan, financial projections, policies and procedures, descriptions of systems and outsourcing, and personal questionnaires for key individuals. Regulators ask follow-up questions and may interview management. Timelines range from a few months to more than a year, and approval is often granted in stages or with conditions.
After authorization the firm must file regular reports, undergo audits, notify the regulator of material changes and obtain change in control approval before ownership changes. Adding a new service usually requires a variation of the license. Regulators can impose fines, restrict business or withdraw authorization.
Choice of jurisdiction
Firms choose where to seek a license according to where their customers are, how the regime treats their business model, cost, speed and reputation. A license covers only the jurisdiction that issued it, apart from arrangements such as European passporting. Serving customers elsewhere on the strength of a foreign license can breach local law.
Banks and counterparties also judge a firm by the quality of its regulator. A registration from a jurisdiction with minimal supervision may satisfy a legal formality but do little to help the holder open bank accounts or win institutional clients. Promoters who sell quick licenses from such places are sometimes described as running a license mill, and regulators in major markets have warned that these licenses do not authorize activity within their borders.