How exchanges are licensed

There is no single, worldwide “crypto exchange licence.” A platform that lets people buy, sell and hold crypto-assets is regulated according to where it operates and what it actually does, and it often needs several different authorisations at once. This article explains, at an educational level, the main licensing routes and the requirements they share.

This is a general explainer, not legal or compliance advice. Accounting standards and licensing regimes differ by jurisdiction and change frequently, so any real-world licensing question should go to a qualified professional familiar with the relevant regime.

Why there is no universal licence

An exchange can perform several economically distinct functions: matching buyers and sellers, holding customer assets in custody, converting crypto to and from ordinary currency, and sometimes offering derivatives or lending. Different bodies of law claim different parts of that activity. Whether a token is treated as a payment instrument, a commodity or a security can change which regulator is in charge. As a result, licensing is fragmented both across countries and within them.

The European Union: authorisation under MiCA

In the EU, an exchange is treated as a crypto-asset service provider (CASP), and operating a trading platform for crypto-assets is one of the services covered by the Markets in Crypto-Assets Regulation (MiCA). A firm must be authorised by a national competent authority in one member state, after which the authorisation can be passported to operate across the EU. Our overview of what MiCA covers goes into the framework in more depth. Authorisation brings ongoing obligations around governance, safeguarding client assets, complaint handling, conflicts of interest and market-abuse controls.

The United States: a layered, fragmented approach

The US has no single federal spot-crypto-exchange licence. Instead, a platform typically has to satisfy several regimes at once:

• Federal AML registration. A crypto exchange usually qualifies as a money services business and must register with the Financial Crimes Enforcement Network (FinCEN) and comply with Bank Secrecy Act obligations, including customer identification and suspicious-activity reporting.
• State money-transmission licensing. Transmitting or holding customer funds generally requires money-transmitter licences state by state. New York additionally runs a dedicated regime, the BitLicense, administered by its Department of Financial Services.
• Securities regulation. If any asset traded is a security, the Securities and Exchange Commission’s rules can require registration as a national securities exchange, a broker-dealer, or an alternative trading system.
• Commodities and derivatives. If the platform offers crypto derivatives, the Commodity Futures Trading Commission’s rules come into play.

Because these regimes overlap, a US platform can hold dozens of state licences plus federal registrations, and still face uncertainty about which assets trigger securities rules.

The United Kingdom: AML registration and promotions rules

In the UK, firms carrying on certain cryptoasset activities must register with the Financial Conduct Authority (FCA) for anti-money-laundering supervision under the Money Laundering Regulations, meeting standards on customer due diligence, monitoring and governance before they can operate. Separately, the FCA’s financial-promotions regime governs how cryptoassets may be marketed to UK consumers, with rules on risk warnings and incentives. The UK has signalled a broader regulatory framework for cryptoassets is being developed over time.

Asia-Pacific: dedicated regimes

Several Asia-Pacific jurisdictions have built their own frameworks rather than borrowing from securities or money-transmission law alone. Singapore, for instance, regulates digital-payment-token services under a payments-focused licensing regime overseen by its financial regulator, with a strong emphasis on anti-money-laundering controls and, increasingly, consumer-protection measures. Japan requires crypto-exchange operators to register with its financial regulator and applies detailed rules on the custody and segregation of customer assets. The details differ, but the pattern echoes elsewhere: register or license the operator, impose AML duties, and protect customer holdings.

Requirements that appear almost everywhere

Although the labels differ, most credible regimes ask an exchange to demonstrate a similar core set of controls:

• Anti-money-laundering and counter-terrorist-financing. Know-your-customer identity checks, ongoing transaction monitoring and reporting of suspicious activity. Internationally, the Financial Action Task Force (FATF) sets standards that many countries implement, including the “travel rule” requiring certain originator and beneficiary information to accompany transfers between virtual-asset service providers.
• Safeguarding of client assets. Rules on how customer crypto and cash are held, often requiring segregation from the firm’s own assets and sound custody of private keys.
• Governance and fit-and-proper tests. Assessment of the people running the business, plus systems and controls, risk management and record-keeping.
• Prudential requirements. Minimum capital or financial-resource thresholds so the firm can absorb losses and wind down in an orderly way.
• Cybersecurity and operational resilience. Protections against hacking, outages and internal fraud.

These recurring themes are why a firm that has done the work to be authorised in one credible regime often finds the requirements of another familiar, even when the paperwork and regulator differ. The underlying questions — who are your customers, where are their assets, who runs the firm, and can it survive a shock — are broadly universal, even though the answers must be documented separately for each jurisdiction a platform serves. That is also why entering a new market is rarely a formality: each regime wants its own evidence.

Custody deserves particular attention, because it is where customer losses most often crystallise. Regulators increasingly expect clear separation between customer assets and the firm’s own balance sheet, controls over who can move funds, and sound management of the private keys that ultimately control crypto-assets. Some firms publish attestations intended to show that customer assets are backed; these vary widely in rigour and are not a substitute for the legal protections a regime provides. Understanding how an exchange holds assets is as important as knowing which licence it carries.

Registration is not the same as approval

A common misunderstanding is that being “registered” means a regulator endorses a platform or guarantees customer money. It does not. AML registration typically means a firm has met anti-money-laundering supervisory requirements — not that the regulator has vetted its business model, approved the assets it lists, or insured customer holdings. Reading a licence or registration as a stamp of safety is a mistake the rules themselves warn against.

The scope of a permission also matters. A firm may be authorised for one activity — say, custody or spot exchange — but not for others, such as offering derivatives or lending, and marketing that stretches beyond the actual permission is a warning sign. Checking what a firm is genuinely authorised to do, in which country, and for which services, tells you more than the mere existence of a licence number.

What this means

Licensing a crypto exchange is less about one document and more about assembling the right combination of authorisations for the activities performed and the places served. In the EU that increasingly centres on MiCA authorisation; in the US it means stacking federal AML registration, state money-transmitter licences and, where relevant, securities or commodities rules; in the UK it starts with FCA anti-money-laundering registration and marketing rules. Underneath the different labels, the same themes recur: know your customers, safeguard their assets, run the firm competently and hold enough capital.

For anyone studying the landscape, three points are worth carrying away: there is no global licence, the classification of the assets traded can decide which regulator applies, and registration is not a safety guarantee. Because these regimes are complex, overlapping and frequently updated, and because they differ markedly between countries, treat this as background and rely on a qualified professional for any specific situation.