A crypto exchange license is an authorization from a financial regulator to offer crypto trading, exchange or custody services to customers in the regulator's country or region. A business can apply for its own license, buy a company that already holds one or operate through a licensed partner. Each route has different costs, timelines and risks, and this guide compares them along with the main regimes in 2026.
Three routes to a cryptocurrency exchange license
Apply for your own license
With this route, the license clearly belongs to the business. The business sets up a local company, appoints qualified managers and compliance staff, writes policies, shows its technology and security, meets the capital requirement and goes through the regulator's review. The process often takes many months, and more than a year in strict jurisdictions.
Buy a licensed company
Some firms advertise ready-made licensed companies for sale. In serious jurisdictions, a change of control needs the regulator's approval in advance, and the new owners and managers must pass the same fit-and-proper assessment as a new applicant. The buyer also inherits the company's history, including any compliance failures. Because the regulator can refuse the new owners or withdraw the license after the sale, the company is worth far less than the seller's asking price.
Partner with a licensed provider
A business can run its own brand and app while a licensed partner provides the regulated services, usually through brokerage, custody and crypto-as-a-service agreements. Such an arrangement is legitimate when the partner stays responsible for the customers and controls the regulated activity. It is not legitimate when a license holder only lends its name while the branded business runs everything, and regulators treat that setup as unlicensed activity by the branded business and a failure by the license holder.
The main regimes compared
| Jurisdiction | Regime | Key points |
|---|---|---|
| European Union | MiCA crypto-asset service provider (CASP) authorization | A national authority grants the authorization, and through MiCA's passport, one authorization covers the whole European Economic Area (EEA). A trading platform needs at least €150,000 in capital. The transition periods ended on 1 July 2026, so firms that serve EU customers now need MiCA authorization. |
| United States | FinCEN MSB registration plus state licenses | Most states require a money transmitter license. New York requires a BitLicense or a limited-purpose trust charter. California's Digital Financial Assets Law adds a state license. Securities and commodities law add federal duties, depending on the assets traded. |
| Dubai (UAE) | VARA license | VARA licenses eight activity types, including exchange, broker-dealer and custody services, each through a two-stage process. Abu Dhabi Global Market runs a separate regime through its regulator, the FSRA. |
| United Kingdom | FCA registration under the money laundering regulations | Since 2020, the FCA has approved only a minority of registration applications; many applicants withdrew after FCA questions, and the FCA refused others. Crypto marketing falls under the financial promotions rules. A full FCA authorization regime starts on 25 October 2027, and the application window opened on 30 September 2026. |
| Singapore | MAS license under the Payment Services Act | Digital payment token services need a license. Since 30 June 2025, Singapore firms that serve only overseas customers also need a license, but MAS said it would generally not grant that license, so such firms had to stop or move. |
| Hong Kong | SFC license for virtual asset trading platforms | The Securities and Futures Commission (SFC) licenses virtual asset trading platforms and requires each one to keep most client assets in cold storage and to limit retail trading to approved tokens. |
The official text of the EU regime is Regulation (EU) 2023/1114 (MiCA). Under Article 63, the national authority has 25 working days to check that an application is complete, then 40 working days to assess it, and it can pause that period to ask for more information.
VARA license for a crypto exchange in Dubai
Dubai's Virtual Assets Regulatory Authority (VARA) regulates virtual assets in mainland Dubai and its free zones, except the Dubai International Financial Centre (DIFC), which has its own regulator. VARA licenses these eight activities:
- advisory services
- broker-dealer services
- custody services
- exchange services
- lending and borrowing services
- management and investment services
- transfer and settlement services
- virtual asset issuance (Category 1 issuance, as VARA names it)
The VARA application process has two stages:
- Approval to Incorporate. The applicant files a disclosure questionnaire with Dubai Economy and Tourism, or with the authority of a Dubai free zone, together with a business plan and details of owners and managers, and pays an initial fee, usually half of the license application fee. The approval lets the company incorporate and set up operations, but not offer virtual asset services.
- VASP License. The applicant submits the full document set, answers VARA's questions and interviews, then pays the remaining fees and the first year's supervision fee. The license may carry conditions, such as limits on the services or customer types the firm may serve.
| VARA activity | License application fee | Annual supervision fee | Minimum paid-up capital |
|---|---|---|---|
| Exchange services | AED 100,000 | AED 200,000 | AED 1,500,000 or 25% of fixed annual overheads, whichever is higher. VARA may set a lower figure, AED 800,000 or 15% of fixed annual overheads, when it approves the exchange's custody arrangements during licensing. |
| Broker-dealer services | AED 100,000 | AED 200,000 | AED 600,000 or 25% of fixed annual overheads (lower when a VARA-licensed custodian holds assets) |
| Custody services | AED 100,000 | AED 200,000 | AED 600,000 or 25% of fixed annual overheads |
The fees come from Schedule 2 of VARA's Virtual Assets and Related Activities Regulations 2023, and the capital figures come from VARA's Company Rulebook. An exchange that also offers custody or broker-dealer services pays fees for each activity, and VARA publishes licensed firms on its public register.
What regulators examine
- People. Regulators assess directors and major shareholders, the compliance officer and the money laundering reporting officer.
- Business plan. The plan sets out services, target markets, the revenue model and financial projections.
- Capital and safeguarding. The firm holds minimum own funds and keeps client assets separate and protected.
- Policies. The firm writes policies for AML and counter-terrorist financing, custody, conflicts of interest, complaints, listings, business continuity and outsourcing.
- Technology. The firm documents its security architecture, key management, penetration test results and oversight of any white label crypto exchange vendor.
- Substance. The firm has real local staff and makes its decisions locally.
The crypto exchange license requirements guide explains each requirement and its effect on the platform.
Choosing a jurisdiction
Choose the jurisdiction from the location of your customers, not from the price of the license. A license from a lightly regulated offshore jurisdiction rarely allows a business to serve the EU, US or UK, and it can make banks and payment firms less willing to work with the business. Questions to answer:
- In which countries will most of your customers live?
- Does one license give access to those countries, as a MiCA passport does across the EEA?
- Can you meet the substance requirements with real staff?
- Will banks and payment providers work with license holders from that jurisdiction?
- Does the regime cover every service you plan, such as staking, derivatives or stablecoins?
Red flags in license packages
- guaranteed approval or a fixed approval date
- licenses from jurisdictions that do not regulate crypto exchanges, presented as if they do
- nominee directors with no real role, offered to meet substance rules
- no mention of ongoing duties such as audits, reports, capital and compliance staff
The crypto exchange development guide shows where licensing fits in a launch plan, while a platform that trades tokenized securities falls under securities rules instead, as the security token offering guide explains.
Frequently asked questions
How long does a crypto exchange license take?
The time depends on the regulator and on how complete the application is. Plan for many months, and longer in strict jurisdictions or when the regulator asks many follow-up questions. MiCA sets formal review periods of 25 working days for completeness and 40 working days for assessment, but preparation takes much longer.
How much does a VARA license cost?
For exchange services, VARA charges a license application fee of AED 100,000 and an annual supervision fee of AED 200,000. The exchange must also hold paid-up capital of AED 1,500,000 or 25% of fixed annual overheads, whichever is higher, or a lower figure when VARA approves the custody setup during licensing.
Can an exchange operate while its application is pending?
Generally no, because serving customers before authorization is usually an offense. Some regimes had transition periods, but the MiCA transition periods ended on 1 July 2026.
Is buying a licensed company faster?
Sometimes. The regulator must still approve the change of control and assess the new owners, so the time saved is often smaller than sellers claim.
Does one cryptocurrency exchange license cover the whole world?
No. A MiCA authorization covers the EEA, but other markets need their own licenses, or the exchange must block their residents.