How exchanges are licensed

There’s no single, worldwide “crypto exchange licence.” A platform that lets people buy, sell and hold crypto-assets is licensed according to where it operates and what it actually does — and it usually needs several authorisations at once, not one. This article explains, at an educational level, the main licensing routes and the requirements they share.

Quick caveat first: this is a general explainer, not legal or compliance advice. Accounting standards and licensing regimes differ by jurisdiction and change often, so any real-world licensing question should go to a qualified professional who knows the relevant regime.

Why there is no universal licence

An exchange does several economically distinct jobs. It matches buyers and sellers, holds customer assets in custody, converts crypto to and from ordinary currency, and sometimes offers derivatives or lending. Different bodies of law reach for different pieces of that. Whether a token counts as a payment instrument, a commodity or a security can flip which regulator is in charge. So licensing ends up fragmented — both across countries and inside them.

The European Union: authorisation under MiCA

In the EU, an exchange is treated as a crypto-asset service provider (CASP), and running a trading platform for crypto-assets is one of the services covered by the Markets in Crypto-Assets Regulation (MiCA). A firm has to be authorised by a national competent authority in one member state; from there, the authorisation can be passported to operate across the EU. Our overview of what MiCA covers goes into the framework in more depth. Authorisation brings ongoing duties — governance, safeguarding client assets, complaint handling, conflicts of interest, market-abuse controls, and more.

The United States: a layered, fragmented approach

The US has no single federal spot-crypto-exchange licence. Instead, a platform typically has to satisfy several regimes at once:

• Federal AML registration. A crypto exchange usually qualifies as a money services business and must register with the Financial Crimes Enforcement Network (FinCEN) and comply with Bank Secrecy Act obligations, including customer identification and suspicious-activity reporting.
• State money-transmission licensing. Transmitting or holding customer funds generally requires money-transmitter licences state by state. New York adds its own dedicated regime, the BitLicense, run by its Department of Financial Services.
• Securities regulation. If any asset traded is a security, the Securities and Exchange Commission’s rules can require registration as a national securities exchange, a broker-dealer, or an alternative trading system.
• Commodities and derivatives. Offer crypto derivatives and the Commodity Futures Trading Commission’s rules come into play.

Because these regimes overlap, a single US platform can hold dozens of state licences plus federal registrations — and still not know for certain which assets trip securities rules. It’s a genuinely awkward position to build a business on.

The United Kingdom: AML registration and promotions rules

In the UK, firms carrying on certain cryptoasset activities must register with the Financial Conduct Authority (FCA) for anti-money-laundering supervision under the Money Laundering Regulations — meeting standards on customer due diligence, monitoring and governance before they can operate. Separately, the FCA’s financial-promotions regime governs how cryptoassets may be marketed to UK consumers, with rules on risk warnings and incentives. The UK has signalled that a broader regulatory framework for cryptoassets is being developed over time.

Asia-Pacific: dedicated regimes

Several Asia-Pacific jurisdictions have built their own frameworks rather than stretching securities or money-transmission law to fit. Singapore, for instance, regulates digital-payment-token services under a payments-focused licensing regime overseen by its financial regulator, with a heavy emphasis on anti-money-laundering controls and, increasingly, consumer-protection measures. Japan requires crypto-exchange operators to register with its financial regulator and applies detailed rules on custody and segregation of customer assets. The details vary, but the pattern rhymes with everywhere else: register or license the operator, impose AML duties, protect customer holdings.

Requirements that appear almost everywhere

The labels differ from country to country, yet most credible regimes ask an exchange to show a similar core set of controls:

• Anti-money-laundering and counter-terrorist-financing. Know-your-customer identity checks, ongoing transaction monitoring and reporting of suspicious activity. Internationally, the Financial Action Task Force (FATF) sets standards that many countries implement, including the “travel rule” that requires certain originator and beneficiary information to travel with transfers between virtual-asset service providers.
• Safeguarding of client assets. Rules on how customer crypto and cash are held, often requiring segregation from the firm’s own assets and sound custody of private keys.
• Governance and fit-and-proper tests. Assessment of the people running the business, plus systems and controls, risk management and record-keeping.
• Prudential requirements. Minimum capital or financial-resource thresholds so the firm can absorb losses and wind down in an orderly way.
• Cybersecurity and operational resilience. Protections against hacking, outages and internal fraud.

This overlap is why a firm that’s done the work to get authorised in one credible regime often finds the next one’s requirements familiar, even when the regulator and the paperwork change. The underlying questions barely move: who are your customers, where are their assets, who runs the firm, and can it survive a shock? The answers just have to be documented separately for each jurisdiction a platform serves. Which is also why entering a new market is rarely a formality — every regime wants its own evidence.

Custody deserves a closer look, because it’s where customer losses tend to crystallise. Regulators increasingly expect a clear wall between customer assets and the firm’s own balance sheet, controls over who can move funds, and sound management of the private keys that ultimately control the crypto. Some firms publish attestations meant to show customer assets are backed — but these vary widely in rigour, and they’re no substitute for the legal protections a regime provides. Understanding how an exchange holds assets is every bit as important as knowing which licence it carries.

Registration is not the same as approval

A common mix-up: people read “registered” as a regulator endorsing a platform or guaranteeing customer money. It does neither. AML registration typically means a firm has met anti-money-laundering supervisory requirements — not that the regulator has vetted its business model, approved the assets it lists, or insured customer holdings. Treating a licence or registration as a stamp of safety is exactly the mistake the rules themselves warn against.

Scope matters too. A firm might be authorised for one activity — custody, or spot exchange — but not for others, like derivatives or lending, and marketing that reaches past the actual permission is a warning sign. Checking what a firm is genuinely authorised to do, in which country, and for which services, tells you far more than the bare existence of a licence number.

What this means

Licensing a crypto exchange is less about one document and more about assembling the right combination of authorisations for the activities performed and the places served. In the EU that increasingly centres on MiCA authorisation. In the US it means stacking federal AML registration, state money-transmitter licences and, where relevant, securities or commodities rules. In the UK it starts with FCA anti-money-laundering registration and marketing rules. Strip away the different labels and the same themes surface: know your customers, safeguard their assets, run the firm competently, hold enough capital.

If you carry away three things, make it these. There’s no global licence. The classification of the assets traded can decide which regulator applies. And registration is not a safety guarantee. Because these regimes are complex, overlapping and frequently updated — and because they differ so markedly between countries — treat this as background, and rely on a qualified professional for any specific situation.