Crypto exchange license requirements cover the company, its people, its capital and its daily controls. A regulator expects a company with real local substance, qualified people, minimum capital, anti-money-laundering controls, rules for custody and listings, fair marketing, tax reporting and sanctions screening. This page explains each requirement and how it shapes the exchange platform.
The crypto exchange license guide compares the licenses themselves: which regimes exist, the routes to a license and the fees. This page covers what a regulator checks before it grants a license and what the exchange must keep doing afterwards.
Crypto exchange license requirements at a glance
| Requirement | What regulators expect | Effect on the platform |
|---|---|---|
| Company and substance | A local operating company with local directors and real decision-making | The company that signs customer contracts, the license holder and the company that holds assets must be the same or clearly linked |
| People | Fit-and-proper directors and owners, a compliance officer and a money laundering reporting officer (MLRO) | User roles in the back office, so only these people can approve high-risk customers and large withdrawals |
| Capital | Minimum own funds, for example €150,000 for a trading platform under the EU's Markets in Crypto-Assets Regulation (MiCA) | Financial reporting that shows capital at all times |
| AML and travel rule | KYC, transaction monitoring, reporting, travel rule data | KYC flows, analytics, travel rule messaging |
| Sanctions | Screening of customers, counterparties and wallet addresses | Screening at onboarding and on every transfer |
| Custody | Client assets kept separate and recorded per client | Ledger, wallet structure and daily reconciliation |
| Listings and market integrity | A written listing policy and market abuse surveillance | Listing workflow, trade surveillance tools |
| Consumer protection and marketing | Clear terms, fee disclosure, risk warnings, complaints handling | Disclosures in apps, complaint queue, marketing review |
| Tax reporting | Collection of tax residence and reports to tax authorities | Onboarding fields and report exports |
| Data and operational resilience | Privacy law, ICT risk management, incident reporting | Security controls, vendor oversight, incident logs |
1. Company structure and substance
Most exchanges run an operating company in the licensing jurisdiction, and some add a holding company elsewhere and separate companies for different services or regions. Regulators look for real substance, meaning local directors, a compliance officer, an MLRO and decisions made where the license is held, and they increasingly reject shell companies whose operations sit in another country.
The company that signs customer contracts, the license holder and the company that holds customer assets should be the same, or the links between them should be clear. When these three differ, auditors cannot easily trace who owes what to whom, and customers may struggle to claim their assets in an insolvency.
2. People and fit-and-proper tests
Regulators assess directors, senior managers and owners with significant stakes, checking experience, criminal records, past regulatory actions and the source of the owners' funds. VARA, Dubai's crypto regulator, for example, asks for fit-and-proper confirmations, CVs, source-of-funds evidence and a list of ultimate beneficial owners with each application.
3. Capital
Most regimes set minimum capital. Under MiCA, the minimum is €50,000, €125,000 or €150,000, depending on the services, and operating a trading platform falls in the €150,000 class. Dubai's Virtual Assets Regulatory Authority (VARA) sets the paid-up capital of an exchange at AED 1,500,000 or 25% of fixed annual overheads, whichever is higher. VARA may set a lower figure, AED 800,000 or 15% of fixed annual overheads, when it approves the exchange's custody arrangements during licensing. Capital must stay above the minimum after the license is granted, so the finance team reports it regularly.
4. Anti-money laundering and counter-terrorist financing
Most countries follow the standards of the FATF, the global body that sets anti-money laundering rules. The FATF standards treat exchanges as virtual asset service providers, which leads to these duties:
- Customer due diligence. The exchange verifies identity, rates each customer's risk and runs enhanced checks on higher-risk customers and politically exposed persons.
- Transaction monitoring. The exchange monitors fiat and on-chain activity, using blockchain analytics to flag funds linked to hacks, darknet markets or sanctioned addresses.
- Suspicious activity reports. The exchange reports suspicious activity to the national financial intelligence unit.
- Travel rule. The exchange sends and receives sender and recipient information with each transfer to another provider. Each country also sets rules for transfers to self-hosted wallets, such as proof that the customer controls the receiving wallet. In the EU, the Transfer of Funds Regulation has applied this rule since 30 December 2024, with no minimum amount for crypto transfers between providers.
- Record keeping. The exchange keeps records for the legal period, usually five years or more.
5. Sanctions
Sanctions screening is separate from AML and stricter. AML rules let an exchange match its checks to each customer's risk, but sanctions law usually allows no such flexibility, so the exchange must block every confirmed match. It screens customers, counterparties and wallet addresses against lists from the US Treasury's Office of Foreign Assets Control (OFAC), the EU, the UK and other relevant authorities, and blocks access from sanctioned regions. Sanctions and AML failures have led to some of the largest penalties in the industry. In November 2023, Binance agreed to pay about US$4.3 billion to US authorities, including OFAC, to settle AML and sanctions charges.
6. Custody and client assets
After several exchange failures, most notably FTX in 2022, regulators require exchanges to keep customer assets separate from company assets and protected if the exchange fails. MiCA requires a crypto-asset service provider (CASP) that holds client crypto-assets to keep a record of each client's holdings, to keep those holdings separate from its own assets and to have a custody policy. MiCA also makes the provider liable to clients for crypto-assets lost through a hack or an operational failure that the provider caused.
The exchange's internal ledger must record each client's balance, its wallets must keep client assets apart from company funds, and daily reconciliation must match the ledger to on-chain balances. Ask a lawyer how your country's insolvency law treats client assets.
7. Listings and securities law
Each token listing is a legal decision. In the US, a token sold as an investment contract can be a security, and trading a security may require registration as a securities exchange or broker-dealer. In the EU, MiCA requires a compliant white paper for most crypto-assets admitted to trading, and the trading platform must also publish its admission rules and check each crypto-asset before admitting it. Most licensed exchanges keep a written listing policy that covers legal review, technical review, market integrity checks and delisting rules. The crypto exchange listing guide covers listings from the token issuer's side.
8. Market integrity
Regulators expect exchanges to prevent and detect market manipulation, wash trading and insider dealing. MiCA introduced a market abuse regime for crypto-assets, with surveillance and reporting duties for trading platforms. An affiliated trading desk that trades against customers is a conflict of interest, which the exchange must disclose and manage, or else ban the desk.
9. Consumer protection and marketing
Regulators expect clear terms of service, fee disclosures, risk warnings, complaint handling and fair treatment of retail customers. Marketing rules can be strict: the UK has applied its financial promotions regime to crypto since 8 October 2023, so crypto ads to UK consumers need approval and must carry the risk warnings that the FCA prescribes. Influencer campaigns and referral bonuses often break these rules. The crypto exchange marketing guide explains the effect on campaigns.
10. Tax reporting
Exchanges now collect tax data for governments. The EU's DAC8 directive requires crypto-asset service providers to collect user transaction data from 1 January 2026 and report it to tax authorities. In the US, brokers report digital asset sales to the IRS on Form 1099-DA, starting with transactions in 2025. Many other countries are adopting the OECD's Crypto-Asset Reporting Framework, so an exchange collects tax residence at onboarding and builds report exports into its back office.
11. Data protection and operational resilience
Exchanges process identity documents and financial data, so privacy law such as the EU's GDPR applies. In the EU, the Digital Operational Resilience Act (DORA) has applied to crypto-asset service providers since 17 January 2025. DORA covers ICT risk management, incident reporting and oversight of critical third-party providers, and an exchange's software vendor usually counts as one.
Cryptocurrency exchange regulations by region
- European Union. MiCA requires CASP authorization from a national authority, and its transition periods for firms already operating under national rules ended on 1 July 2026.
- United States. Exchanges register with FinCEN as money services businesses and need state money transmitter licenses, and New York requires a BitLicense. Congress has not passed a market structure law, which would decide which crypto assets the SEC oversees as securities and which the CFTC oversees as commodities.
- United Kingdom. Exchanges register with the FCA under the money laundering rules today, and a full FCA authorization regime starts on 25 October 2027.
- Dubai. VARA licenses eight types of virtual asset activity, including exchange services, but its rules do not apply in the Dubai International Financial Centre (DIFC), which has its own regulator.
- Singapore. MAS licenses digital payment token services under the Payment Services Act.
The crypto exchange license guide compares these regimes in more detail.
Incidents and disputes
Prepare incident response and communication plans with a lawyer before launch, covering hacks, frozen withdrawals, regulatory investigations and customer claims. The crypto litigation guide explains the kinds of disputes exchanges face.
Frequently asked questions
What are the main crypto exchange license requirements?
Most regulators require a local company with real substance, fit-and-proper managers and owners, minimum capital, AML and sanctions controls, client asset protection, written policies and secure technology. The exact list depends on the country and the services.
Can one exchange serve the whole world from one country?
Not safely. Many countries regulate services offered to their residents wherever the exchange is based, so an exchange needs a license in each market or effective blocks on customers from markets it does not cover.
Does a decentralized exchange have legal duties?
It can. Regulators examine who controls the DEX's website, its smart contracts and its fees. MiCA does not cover a fully decentralized protocol, but the rules can still cover the company that runs the protocol's web app and the issuer of its token.
Which documents does an exchange need at launch?
An exchange usually needs terms of service, a privacy policy, risk disclosures, a fee schedule, an AML and counter-terrorist financing policy with procedures, a listing policy, a custody policy and a complaints procedure. In the EU, listed assets may also need a crypto-asset white paper.
Who is responsible if a white label vendor's software fails?
Regulators hold the licensed operator responsible. The vendor contract can set liability between the two companies, but it does not move the operator's regulatory duty to the vendor.