The licensing matrix

Today: FCA registration under the Money Laundering Regs 2017 (AML/CTF only). Incoming: full FSMA authorisation for cryptoassets (SI 2026/102, made 4 Feb 2026, laid 5 Feb) - gateway opens 30 Sep 2026, mandatory regime commences 25 Oct 2027; no automatic conversion from MLR registration.

Financial Conduct Authority (FCA); HM Treasury sets the legislative perimeter; Bank of England for systemic stablecoin issuers.

No minimum initial capital under the current MLR registration. The incoming FSMA regime's final prudential rules (PS26/12, 30 Jun 2026) set Permanent Minimum Requirements by activity: GBP 75,000 (arranging/dealing as agent), 150,000 (custody, trading platform, staking), 350,000 (stablecoin issuance), 750,000 (dealing as principal).

MLR registration: 3-month statutory clock from a COMPLETE application, but realistically ~9-12 months including pre-application; historically low approval rate.

Business must be carried on in the UK (UK entity in practice); an MLRO / nominated officer (Reg 21(3)) who is UK-based, genuinely competent, independent and closely involved.

FCA application fee GBP 11,150 (Category 6, non-refundable) plus typically GBP 50k-150k in professional fees; ~GBP 90k all-in representative (~EUR 105k at 1.16).

Annual FCA periodic fee under fee-block G.30 (renumbered from G.23): minimum GBP 2,229 for 2025/26 plus GBP 15.13 per GBP 1,000 of cryptoasset income above GBP 100,000. Plus AML operations, annual audit and compliance headcount; costs rise materially under the incoming FSMA regime.

No - post-Brexit the UK regime is standalone; no EU/EEA passport and no MiCA equivalence in either direction.

Not applicable: non-MiCA jurisdiction, no CASP regime. See this jurisdiction's own licence route.

Cryptoasset financial promotions regime (since 8 Oct 2023): mandatory risk warnings, 24-hour cooling-off for first-timers, ban on incentives; plus significant bank de-risking / de-banking of crypto firms.

SI 2026/102 made 4 Feb 2026 (laid 5 Feb); FCA final rules published 30 Jun 2026 (PS26/10 stablecoins, PS26/11 regulated activities, PS26/12 prudential); authorisation gateway 30 Sep 2026-28 Feb 2027; mandatory FSMA regime from 25 Oct 2027.

4 - rigorous AML bar, historically low approval rate and severe bank-access friction; the incoming FSMA prudential/conduct regime raises the bar further.

MiCA Crypto-Asset Service Provider (CASP) authorisation under Title V of Reg (EU) 2023/1114; replaced the national VASP registration. Single passportable licence covering the services applied for.

Bank of Lithuania (Lietuvos bankas) - single competent authority. Publicly selective stance: wants few, solid firms rather than the ~370-strong legacy VASP pool.

Lithuania used a shortened 12-month grandfathering - legacy VASP cover ended 1 Jan 2026 (vs the EU 1 Jul 2026 backstop). First CASP: Robinhood Europe (29 May 2025); only ~4 CASPs authorised by Mar 2026.

MiCA CASP authorisation implemented by Lei n.o 69/2025 (22 Dec 2025). Replaces the legacy Banco de Portugal VASP (AML) registration.

Twin-peaks: BANCO DE PORTUGAL is the CASP authorisation authority + prudential/AML supervisor (single application front door); CMVM is the conduct-of-business and market-abuse supervisor. (Corrects the seed - not CMVM-led.)

Lei 69/2025 (MiCA) + Lei 70/2025 (Travel Rule) published 22 Dec 2025 - ~1 year late. Legacy-VASP transitional window closes 1 Jul 2026 (today). Few Portugal-AUTHORISED CASPs so far.

No dedicated public-facing crypto licence. Ley Fintech (2018) offers the IFPE (e-money institution) and IFC (crowdfunding) routes; virtual-asset operations by regulated entities need Banxico authorisation (internal-only, effectively not granted for customer crypto).

CNBV authorises/supervises ITFs (with the Comite Interinstitucional); Banco de Mexico (Banxico) controls virtual-asset authorisations and payments; SHCP/SAT/UIF for AML; CONDUSEF for consumer protection.

Major AML Law reform enacted 16 Jul 2025 (VASPs serving Mexican residents in scope; Travel Rule; 10-yr records). Banxico (Dec 2025) reiterated stablecoins pose financial-stability risks. A Fintech Law 2.0 is discussed but NOT enacted.

MiCA CASP authorisation granted by the Central Bank of Ireland; replaces the legacy VASP registration (CJA 2010, AML). No simplified VASP->CASP conversion - all applicants face the full process.

Central Bank of Ireland (CBI) - sole competent authority; runs an Innovation Hub. Known as a demanding, gatekeeper-style regulator.

Transitional period ended 30 Dec 2025 (12 months; simplified route declined). ~10 CASPs authorised by late 2025 (Kraken Jun 2025, Coinbase, StoneX 10th). Revised Consumer Protection Code from 24 Mar 2026.

MiCA CASP authorisation under the Markets in Crypto-Assets Act (Cap. 647); replaces the legacy VFA licence (VFA Act 2018) via a fast-track conversion. Malta granted one of the EU's first full CASP licences (Jan 2025).

Malta Financial Services Authority (MFSA) - single competent authority; a long-standing crypto supervisor since the 2018 VFA regime.

First-mover: Crypto.com licensed 27 Jan 2025; ~13 CASPs now authorised (OKX, Gemini, Gate, Blockchain.com). ESMA's 10 Jul 2025 peer review criticised the MFSA's authorisation of one CASP, tightening scrutiny. Transition ends 1 Jul 2026.

MiCA CASP authorisation (French 'agrement PSCA'); replaces the legacy PSAN regime (mandatory AML registration + optional licence). A single authorisation covers the 10 MiCA services.

AMF (Autorite des marches financiers) grants and supervises the CASP authorisation; ACPR (Banque de France) gives binding assent on AML/CFT and prudential aspects via a joint examination team.

France used the full 18-month transition, ending 1 Jul 2026 (today). Deblock first CASP (May 2025), SG-Forge (Oct 2025); ~18 CASPs authorised by 28 May 2026. AMF adopted ESMA staff knowledge/competence guidelines (Mar 2026).

MiCA CASP authorisation granted by BaFin under national law FinmadiG/KMAG; replaces the legacy KWG crypto-custody business licence, with a simplified transition for existing KWG-licensed firms.

BaFin (Bundesanstalt fur Finanzdienstleistungsaufsicht) with Deutsche Bundesbank involvement; applications go to both. Widely regarded as the EU's most demanding CASP regulator.

FinmadiG + KMAG in force 27 Dec 2024; Germany used a 12-month grandfathering (apply before 8 Oct 2025; effective end-2025). By mid-2026 the EU's #1 hub - ~57 CASP authorisations (~23% of the EU's ~244), incl. Trade Republic, N26, Commerzbank, Bitpanda.

No single crypto licence - regulated by economic function (FINMA token taxonomy; DLT Act 2021). Typical exchange/custodian/broker needs SRO/AMLA affiliation (e.g. VQF) plus, where deposits/custody are involved, a FinTech licence (Banking Act Art. 1b); larger deposit-taking needs a banking licence; a DLT trading facility needs FinMIA authorisation.

FINMA (Swiss Financial Market Supervisory Authority) grants all prudential licences; for AML only, firms affiliate with a FINMA-recognised SRO (e.g. VQF).

FINMA licensed the first DLT trading facility (BX Digital, 18 Mar 2025); Federal Council consultation (22 Oct 2025 - 6 Feb 2026) proposes to ABOLISH the FinTech licence and replace it with two new categories, Payment Instrument Institutions and Crypto-Institutions, under an amended Financial Institutions Act (FinIA). Confirmed timeline as of this check: new provisions are not expected to enter into force before 2027; existing FinTech-licensed firms will be automatically transitioned to the new Payment Instrument Institution licence without a fresh application, provided they meet the new rules within one year of entry into force. The reform also removes the current CHF 100m deposit cap and adds client-fund segregation on insolvency. FINMA Guidance 01/2026 on crypto custody (12 Jan 2026).

VARA VASP licence under the Virtual Assets and Related Activities Regulations 2023 - licensed PER ACTIVITY (Advisory, Broker-Dealer, Custody, Exchange, Lending & Borrowing, Management & Investment, Transfer & Settlement, plus VA Issuance). A DET/free-zone commercial licence is also required.

VARA (Virtual Assets Regulatory Authority) - sole authority across the Emirate of Dubai except the DIFC. Parallel UAE regimes exist: ADGM/FSRA (Abu Dhabi), DFSA (DIFC), and federal SCA/Central Bank.

'Rulebook 2.0' reissued all twelve rulebooks effective 19 Jun 2025 (mandatory Travel Rule, wind-down plans, TLPT, a new VA Issuance rulebook). AML circular (Mar 2026) and token-issuance guidance (Apr 2026). VARA penalised ~19 unlicensed firms.

Payment Services Act 2019 Digital Payment Token (DPT) service licence, held as a Standard (SPI) or Major Payment Institution (MPI) - most crypto firms are MPIs. Plus the newer DTSP regime (FSMA 2022 Part 9) and a finalised (not-yet-legislated) stablecoin issuer framework.

Monetary Authority of Singapore (MAS) - central bank and integrated regulator; administers the PSA, the DTSP regime, the SFA and the stablecoin framework.

DTSP regime (FSMA Part 9) commenced 30 Jun 2025 - Singapore firms serving only overseas customers must be licensed, and MAS 'will generally not issue' such licences (no transition). MPI DPT licensees ~37 by mid-2026. MAS revoked Bsquared Technology's MPI licence (May 2026). Stablecoin legislation still in drafting.

SFC Virtual Asset Trading Platform (VATP) licence on a dual basis: under the AMLO and, for tokens that are securities, under the SFO (Type 1 dealing + Type 7 automated trading). Stablecoin issuance is separately licensed by the HKMA under the Stablecoins Ordinance (Cap. 656).

SFC regulates VATPs and security-token activity; HKMA regulates stablecoin issuers and banks' VA activities. Staking and intermediary VA activity are covered by joint SFC-HKMA circulars.

SFC 'ASPIRe' roadmap (19 Feb 2025); VATP staking guidance (7 Apr 2025); HKMA Stablecoins Ordinance commenced 1 Aug 2025 with the first two issuer licences (HSBC, Anchorpoint) granted 10 Apr 2026; VA dealing (OTC) and custody licensing consultation conclusions 24 Dec 2025 (legislation targeted 2026). ~13 VATPs licensed by mid-2026 - confirm live count on the SFC list.

GFSC DLT Provider licence under the Financial Services (DLT Providers) Regulations 2020 (in force since 1 Jan 2018), required of any firm using DLT to store or transmit value belonging to others in/from Gibraltar. Principles-based (10 core principles), not a MiCA-style category licence.

Gibraltar Financial Services Commission (GFSC), with a dedicated DLT/innovation team running pre-application engagement; also the AML/CFT supervisor under the Proceeds of Crime Act 2015.

Fee increases in force 1 Apr 2025 (application GBP 45k; annual trade-fee cap GBP 90k); world-first Digital Clearing & Settlement Framework announced 13 May 2025; Restricted Promotions rules (May 2025); CARF adoption from 2026; and a DLT Regs overhaul with progressive MiCA-alignment signalled Feb 2026 (draft expected 2026). UK transitional passporting extended to 31 Dec 2026.

MiCA CASP Authorisation (Crypto-Asset Service Provider), granted by AFM; DNB co-assesses fitness/propriety and AML for licence holders

Autoriteit Financiële Markten (AFM) - lead conduct regulator and licensing authority; De Nederlandsche Bank (DNB) supports with prudential/AML input

Netherlands became one of the highest-volume MiCA jurisdictions through H1 2026 as the 1 July 2026 EU-wide transitional deadline approached; notable authorisations include Bitvavo, Amdax, MoonPay, Finst, Fiat Republic, and Banxa (Oct 2025); dedicated 'ARI10' authorisation added Feb 2026 per one tracker

MiCA CASP Authorisation granted by CySEC; existing Cyprus Investment Firms (CIFs) can extend their licence to cover crypto-asset services under a simplified process

Cyprus Securities and Exchange Commission (CySEC) - sole National Competent Authority for MiCA in Cyprus

CySEC set a hard 27 February 2026 deadline for existing national-regime CASPs to submit MiCA applications; preliminary assessment phase opened 13 Nov 2024, formal applications from 1 Jan 2025; national transitional regime and full MiCA regime now running in parallel toward the 1 July 2026 EU-wide cutover

MiCA CASP Authorisation granted by the Austrian Financial Market Authority (FMA)

Finanzmarktaufsicht (FMA) Österreich

Austria set 30 June 2026 as the end of its transitional regime (shorter runway than the EU default 1 July 2026 deadline), creating pressure for existing FM-GwG registered VASPs to secure full CASP authorisation; Bybit reported as licensed in Austria per exchange-tracking source

MiCA CASP Authorisation granted by FMA Liechtenstein, operating alongside (and increasingly converged with) the pre-existing domestic TVTG (Token and VT Service Provider Act) registration regime

Finanzmarktaufsicht (FMA) Liechtenstein

Bank Frick received MiCAR authorisation from FMA Liechtenstein on 20 January 2026, one of the first in the country under the new regime; FMA also authorised Bitcoin Suisse (Europe), the European arm of the Swiss group, covering trading, custody and staking for institutional/HNW clients

MiCA CASP Authorisation granted by the Commission de Surveillance du Secteur Financier (CSSF)

Commission de Surveillance du Secteur Financier (CSSF)

Rapid growth in H1 2026: as of 30 June 2026, 11 active CASPs including B2C2 Europe, Banking Circle, Bitstamp Europe, Bridge Building, Clearstream Banking, Coinbase Luxembourg, Stokr, Standard Chartered Luxembourg, Swissquote Bank Europe, Zodia Custody Europe and BitFlyer; BitFlyer authorised 26 June 2026, Stokr 22 June 2026, Bridge Building 29 June 2026, all just before the transitional deadline expired on 1 July 2026

MiCA CASP Authorisation granted by the Comisión Nacional del Mercado de Valores (CNMV); Banco de España separately supervises stablecoin (ART/EMT) issuance

Comisión Nacional del Mercado de Valores (CNMV) - lead CASP authority; Banco de España co-supervises stablecoin issuers

By early 2026, CNMV had granted MiCA CASP licenses to six banks (BBVA, Cecabank, Openbank, Renta 4, CaixaBank and Kutxabank) plus five fintechs, reflecting a bank-led adoption pattern distinct from most other EEA jurisdictions; CNMV published updated MiCA Q&A guidance in Dec 2025 ahead of full application from 1 July 2026

MiCA CASP authorisation under EU Regulation 2023/1114, transposed via Legislative Decree 129/2025 and implemented through Consob Resolution 23700/2025. Pre-MiCA VASPs (registered under the OAM register per AML Decree 90/2017) had to convert to full CASP authorisation; transitional regime for existing VASPs was extended to 1 July 2026.

Split regulator model: Consob (Commissione Nazionale per le Società e la Borsa) is the lead competent authority issuing CASP authorisation and supervising conduct-of-business/market integrity; Banca d'Italia is consulted on and supervises prudential aspects (capital, governance, AML) and directly handles credit institutions/e-money institutions offering crypto services (e.g. Banca Sella's notification route).

Consob Resolution 23700/2025 (introducing the EUR 20,000 fee) took effect 1 December 2025; the transitional regime for pre-MiCA VASPs was extended to 1 July 2026 (later than the original MiCA default cut-off), giving Italian firms extra runway. As of 1 July 2026, 8 firms hold full CASP authorisation, a sharp jump from near-zero conversions reported earlier in 2026, though still a small fraction of the pre-MiCA registered population.

MiCA CASP authorisation under Article 63 MiCA, given domestic legal effect by the Belgian Act of 11 December 2025 (published in the Belgian Official Gazette 24 December 2025, entered into force 3 January 2026). Before this Act, MiCA was directly applicable EU law but Belgium lacked a domestic supervisory/sanctioning framework, creating a practical gap.

FSMA (Financial Services and Markets Authority) is the competent authority for CASPs that are not credit institutions or stockbroking firms, this covers the great majority of pure-play exchanges and custodians and includes both prudential and conduct-of-business supervision under Article 63. The National Bank of Belgium (NBB) takes the prudential lead where the CASP is (or is part of) a credit institution.

The Act of 11 December 2025 (Belgium's MiCA implementing law) was the single biggest development: it was published 24 December 2025 and entered into force 3 January 2026, only then giving FSMA/NBB a full domestic legal basis for authorisation, supervision and sanctions. Before that date Belgium had a live enforcement gap despite MiCA being EU law since December 2024. As of last check, 0 CASPs were authorised in Belgium, consistent with the regime being newly operative.

MiCA CASP authorisation is legally required (MiCA is directly applicable EU law) but Poland has NO functioning domestic legal basis to grant it: the Crypto-Assets Market Act, which would designate KNF as competent authority and set out the licensing procedure, has been vetoed by the President three times (1 December 2025, 12 February 2026, and again in June 2026 per later reporting). Three competing draft bills (government, Poland 2050, Konfederacja) remain stuck in the legislative process.

KNF (Komisja Nadzoru Finansowego / Polish Financial Supervision Authority) is the intended competent authority under the stalled Crypto-Assets Market Act, but KNF currently has NO statutory power to accept or process CASP applications because no law has designated it as the Article 3(1)(35)(a) MiCA competent authority. This is a genuine regulatory vacuum, not merely a slow regulator.

MiCA CASP authorisation under EU Regulation 2023/1114, with the Czech National Bank (CNB) designated as the domestic competent authority. The CNB accepts applications in English, which practitioners cite as a distinguishing feature versus other Member States.

Česká národní banka (Czech National Bank, CNB), sole competent authority for both authorisation and ongoing supervision of CASPs in Czechia.

Authorisation count growth confirmed: 0 authorised CASPs as of February 2026 baseline moved to the CNB's first 6 authorisations issued 11 February 2026, then to 7 authorised CASPs by May 2026 (per Helms Advisory tracker), matching and confirming the user's known starting point. Czechia is described by multiple sources as the fastest-moving MiCA CASP jurisdiction in the EU in 2026, processing English-language applications from a pool of 248 filings.

MiCA CASP authorisation under EU Regulation 2023/1114, administered directly by Finansinspektionen (FI) under Sweden's existing financial supervisory framework (no major new primary legislation was flagged as required, unlike Belgium/Poland). Sweden's national transitional period for pre-MiCA providers closed 30 September 2025.

Finansinspektionen (FI), Sweden's single competent authority for CASP authorisation and supervision under MiCA.

Sweden's transitional period closed 30 September 2025, after which all CASPs needed full MiCA authorisation to continue operating, a materially earlier cutoff than the EU default. As of 3 March 2026, Sweden had exactly 1 CASP authorisation, per a Bank of Lithuania comparative announcement; no more recent Sweden-specific update was found beyond that date in this search round, so the current (July 2026) figure could be marginally higher.

MiCA CASP authorisation applies to Norway via the EEA Agreement (Norway is not an EU member but MiCA is being incorporated into the EEA framework). Notably, Norway's first authorised firm, AK Jensen Norway AS, was approved under MiCA Article 60 (the simplified route for existing authorised investment firms/securities firms to add crypto-asset services) rather than a fresh standalone CASP application, illustrating that Norway's incumbent-firm pathway is active even before/alongside full standalone CASP processing.

Finanstilsynet (the Financial Supervisory Authority of Norway), sole competent authority for CASP authorisation and supervision, operating under the EEA-incorporated MiCA framework rather than as an EU member state authority.

AK Jensen Norway AS became Norway's first MiCA-authorised firm (Article 60 route), effective 2 February 2026. Firi, the largest Nordic crypto exchange (400,000+ users), was authorised by Finanstilsynet in May 2026, becoming one of the first full standalone Nordic crypto exchanges under the new framework. Norway's national VASP registry is being wound down ahead of the 30 June 2026 EEA-wide MiCA transitional deadline.

MiCA CASP authorisation under Regulation (EU) 2023/1114, with Finanstilsynet designated as competent authority under Danish implementing provisions.

Finanstilsynet (Danish Financial Supervisory Authority)

Grandfathering deadline for legacy VASPs passed 30 December 2025, pushing remaining Danish crypto firms into full MiCA authorisation or market exit.

MiCA CASP authorisation (Articles 60-62), replacing Finland's prior national virtual-currency-provider registration regime (in force since 2019).

Finanssivalvonta (FIN-FSA, Finnish Financial Supervisory Authority)

FIN-FSA launched a public register of authorised CASPs and a warning list of unauthorised providers; the 6-month transition period closed 30 June 2025, requiring firms to already hold full MiCA authorisation.

MiCA CASP licence under the national Markets in Crypto-Assets Act (BG MiCA Act), adopted 20 June 2025, in force 8 July 2025.

Financial Supervision Commission (FSC) for most CASPs; Bulgarian National Bank (BNB) supervises e-money token issuers separately.

BG MiCA Act adopted 20 June 2025, entered force 8 July 2025 - a relatively late national implementer among EEA states; grandfathering deadline (8 Oct 2025) has already passed.

MiCA CASP authorisation under Regulation (EU) 2023/1114, implemented nationally via Croatia's MiCA Implementation Act (passed 27 July 2024, in force alongside EU MiCA from 30 December 2024).

HANFA (Croatian Financial Services Supervisory Agency); HNB (Croatian National Bank) supervises ART/EMT issuers.

HANFA granted Croatia's first MiCA CASP licence to Zagreb-based Electrocoin in April 2026 - the first authorisation issued in-country.

MiCA CASP authorisation; implemented via the Crypto-Assets Market Act (Kruptovarade turu seadus, KrüTS), in force 1 July 2024.

Finantsinspektsioon (Estonian Financial Supervision and Resolution Authority)

Estonia's VASP population collapsed from 641 valid licences (mid-2021 peak) to 36 remaining by early 2026; as of recent reporting only one entity (Lightspark Payments Europe AS) had received full MiCA CASP authorisation. From 18 March 2026, CASP applications must go through FI's new application portal.

MiCA CASP authorisation under Law 5193/2025 (enacted 11 April 2025), operationalised by HCMC Board Decision 8/1059 of 30 July 2025.

Hellenic Capital Market Commission (HCMC) for CASP authorisation; Bank of Greece for ART/EMT prudential oversight.

Law 5193/2025 passed 11 April 2025; HCMC Decision 8/1059 (CASP licensing procedure) issued 30 July 2025; national compliance deadline of 30 December 2025 has already passed as of this research (July 2026).

MiCA CASP authorisation (Regulation (EU) 2023/1114, Art. 62) under Hungary's Act VII of 2024 on Crypto-Assets, transposing MiCA.

Magyar Nemzeti Bank (MNB) grants the core CASP licence; SZTFH (Supervisory Authority for Regulated Activities) separately runs a national crypto-asset conversion validation-certificate scheme (effective 27 Dec 2025), required in addition to the MNB CASP licence for crypto-fiat/crypto-crypto exchange - a Hungary-specific dual-track layer.

The European Commission opened a MiCA infringement case against Hungary (implications for market participants unclear); the transitional period for ex-VASPs ended 1 July 2025; the SZTFH validation-certificate requirement took effect 27 December 2025, with the first provider registered shortly after.

MiCA CASP authorisation under Regulation (EU) 2023/1114, administered nationally by Latvijas Banka; specific Latvian implementing statute name not confirmed in this research pass.

Latvijas Banka (Bank of Latvia) is the lead CASP licensing/supervisory authority; sources note some residual/overlapping role for the FCMC on broader financial-market alignment, not fully reconciled in this pass.

Latvijas Banka has issued multiple CASP licences during 2025-2026, including to SIA AlphaRoute and Backpack, and reportedly Paybis (May 2026, per one directory source). Latvia offers free pre-licensing consultations and a formal Innovation Hub.

MiCA CASP authorisation under Government Emergency Ordinance (GEO) 10/2025, in force from 13 March 2025, transposing MiCA into Romanian law.

Autoritatea de Supraveghere Financiara (ASF, Financial Supervisory Authority). A technical pre-clearance of IT systems by the Authority for Digitalisation of Romania (ADR) is also required before ASF grants a licence - a Romania-specific extra step.

GEO 10/2025 entered force 13 March 2025; the full 18-month EU-wide transition period ended 1 July 2026, meaning all previously-operating providers must now hold full MiCA authorisation.

MiCA CASP authorisation under Regulation (EU) 2023/1114, supplemented nationally by Act No. 248/2024 Coll. on certain obligations and authorisations in the field of crypto-assets (adopted September 2024).

Narodna banka Slovenska (NBS, National Bank of Slovakia)

Act No. 248/2024 Coll. entered into force to implement MiCA nationally; the transitional/grandfathering deadline for existing VASPs expired 30 December 2025, meaning all Slovak crypto firms must now hold full NBS CASP authorisation.

MiCA CASP authorisation under Regulation (EU) 2023/1114, supplemented by the national Law on the Implementation of the EU Regulation on Crypto-Asset Markets (ZIUTK), in force from 23 November 2024.

Agencija za trg vrednostnih papirjev (ATVP, Securities Market Agency) for ordinary CASP authorisation, supervision, qualifying holdings, and white-paper matters; Banka Slovenije handles e-money-token matters.

ZIUTK in force since November 2024 as the national implementing law; the national transitional/grandfathering period for legacy providers expired 1 July 2025, earlier than Slovakia's, tightening the runway for unlicensed Slovenian crypto firms.

Financial Services Permission (FSP) from the FSRA to carry on one or more 'Regulated Activities' in relation to Virtual Assets under the ADGM Financial Services and Markets Regulations (FSMR), e.g. Operating a Multilateral Trading Facility (exchange), Providing Custody, Dealing in Investments as Principal/Agent (broker-dealer), Managing Assets, or Advising on Investments, each 'in relation to Virtual Assets.' The framework was originally branded 'Operating a Crypto Asset Business' (2018 Guidance) and has since been folded into the broader Virtual Asset regulated-activities regime under the 'Guidance – Regulation of Virtual Asset Activities in ADGM' (most recent version 10 June 2025). A related but separate activity/licence covers issuing Fiat-Referenced Tokens (FRTs, i.e. stablecoins).

Financial Services Regulatory Authority (FSRA) of Abu Dhabi Global Market (ADGM)

June 10, 2025: FSRA implemented major amendments, shifted from FSRA pre-approval for Virtual Assets to a notification-based process built on applicant self-assessment; introduced express prohibition on privacy tokens and algorithmic stablecoins; revised capital requirements and fees for VA firms; added product-intervention power for virtual assets. September 2025 (Abu Dhabi Finance Week): FSRA published Consultation Paper No. 10 of 2025 proposing a staking framework. Finalised Fiat-Referenced Token (FRT) framework followed, with FEES Rulebook amendments effective 1 January 2026 (published 31 October 2025). April 29, 2026: FSRA finalised the Virtual Asset staking regulatory framework after consultation. December 2025/January 2026: Binance received FSRA approval (announced 7 December 2025) to operate its global Binance.com platform in ADGM via three regulated entities, described as the first global platform-level licence of this kind under the ADGM framework, operations beginning 5 January 2026.

Crypto-Asset Service Licence under CBB Rulebook Volume 6 (Capital Markets), Crypto-Asset Module (CRA), issued under Decree Law No. 64 of 2006 (CBB Law). Four categories: Category 1 (reception/transmission of orders, investment advice), Category 2 (Cat-1 activities plus trading as agent, portfolio management, custody), Category 3 (Cat-2 activities plus trading as principal/dealing on own account), Category 4 (operating a licensed crypto-asset exchange plus custody). A separate Stablecoin Issuance and Offering (SIO) Module (also Volume 6) now licenses stablecoin issuers.

Central Bank of Bahrain (CBB)

CONFIRMED: In July 2025 the CBB issued a new Stablecoin Issuance and Offering (SIO) Module, added to Rulebook Volume 6, creating Bahrain's first dedicated stablecoin licensing framework. It covers issuance, minting, burning, and reserve management of single-currency stablecoins backed by BHD, USD, or other CBB-accepted fiat currencies; requires issuers to incorporate as a Bahraini B.S.C.; mandates perpetual redemption rights for holders; and explicitly permits yield-bearing stablecoins (subject to CBB-set limits), a more permissive stance than many other jurisdictions. This confirms the '2025 stablecoin module' claim. Separately, CBB granted a new Category 3 crypto-asset licence to Fasset Financial Services W.L.L. in January 2025.

Crypto-Asset Exchange Service Provider (CAESP) registration with the Prime Minister (delegated to the FSA), under Article 63-2 of the Payment Services Act (PSA). Crypto derivatives trading is separately regulated as a Type I Financial Instruments Business under the Financial Instruments and Exchange Act (FIEA). A parallel intermediary-only registration category was introduced by the 2025 PSA/LPAI amendments.

Financial Services Agency of Japan (FSA / JFSA), registration authority, acting via the Prime Minister's delegated power and Local Finance Bureaus. The Japan Virtual and Crypto-assets Exchange Association (JVCEA) is the FSA-certified self-regulatory organisation that runs mandatory token-listing screening and conduct rules; JVCEA membership is the de facto baseline for registration even though not a strict legal requirement.

Major overhaul underway: Japan's Cabinet approved an FIEA amendment bill (10 April 2026) to reclassify crypto-assets as 'financial instruments,' moving oversight from the PSA to FIEA, applying insider-trading rules, disclosure obligations, and market-conduct rules akin to securities law, alongside sharply increased criminal penalties (up to 10 years imprisonment / JPY 10 million fines for unregistered solicitation). The Lower House passed the bill 11 June 2026; it awaits Upper House passage, with effect expected as early as 2027. A flat 20% capital-gains tax on crypto (replacing progressive rates up to 55%) has been approved in principle. On 1 May 2025, PSA/LPAI amendments took effect introducing a new intermediary-only registration category and tightening stablecoin/EPI rules; a further overseas trust-type stablecoin equivalence framework takes effect 13 June 2026.

VASP registration (not a discretionary licence) under the Act on Reporting and Using Specified Financial Transaction Information (the 'FTRA'/AML Reporting Act, amended effective 25 Mar 2021), which requires: (1) ISMS certification from KISA (Korea Internet & Security Agency); (2) for KRW fiat on/off-ramp services, a bank-issued real-name verified account; plus fit-and-proper/AML program requirements. Layered on top since 19 July 2024 is the Act on the Protection of Virtual Asset Users (VAUPA), which adds customer-asset segregation, insurance/reserve, and market-abuse rules but does not replace the underlying FTRA registration.

Financial Services Commission (FSC), Korea's top financial policymaker; Korea Financial Intelligence Unit (KoFIU, also referred to as FIU), an FSC-subordinate unit established 2001 under the FTRA that receives and processes VASP registrations and AML reporting; day-to-day supervision/inspection is delegated to the Financial Supervisory Service (FSS), which set up dedicated Virtual Asset Supervision/Investigation bureaus (announced 29 Nov 2023). FSC retains final sanctioning authority.

The 20 Aug 2026 tightening is now identifiable as Act No. 21358 (amendment to the FTRA/AML Reporting Act), promulgated 19 Feb 2026 and taking effect 20 Aug 2026. It removes the KRW 1,000,000 Travel Rule de minimis threshold and separately expands VASP entry screening: adds a statutory definition of major shareholders, extends fit-and-proper disqualification checks to major shareholders, adds financial condition, social credibility, organisational, staffing and IT review factors, and authorises KoFIU to attach conditions when accepting a VASP report. Existing registered VASPs must re-report under the amended Article 7 within 3 months of the effective date (by approximately 20 Nov 2026). Separately, a Foreign Exchange Transactions Act amendment creating cross-border VASP registration passed 7 May 2026 (effective date disputed, 2 Aug vs 2 Dec 2026).

Two-tier regime under the Virtual Asset (Service Providers) Act (VASP Act, as amended). Phase 1 (in force since 2020): VASP Registration, required for virtual asset services generally that are not custody or trading-platform operation; AML/CFT-focused, lighter touch. Phase 2 (in force since 1 April 2025): VASP Licence, mandatory for entities operating a virtual asset custody service or a virtual asset trading platform; registration is no longer available for these two activity categories. A narrow waiver from registration/licensing is available for entities already licensed under another Cayman regulatory law.

Cayman Islands Monetary Authority (CIMA)

Phase 2 licensing (custody and trading platforms) came into force 1 April 2025, with a 90-day transition deadline of 30 June 2025 for existing registrants to convert to a licence. CIMA updated the VASP application forms, Rule, and Statement of Guidance in December 2024 ahead of Phase 2. From 1 December 2025, CIMA introduced a new quarterly financial reporting requirement via the REEFS portal, layered on top of the existing annual audited accounts requirement. CIMA conducted a Thematic Desk-Based Review of 11 regulated VASPs (September 2024-February 2025), with findings published November 2025 and a further legal briefing in February 2026, identifying gaps in board composition, cybersecurity governance, staff training, and sanctions-screening practices. A Phase 3 is expected but not yet commenced as of mid-2026.

Digital Asset Business (DAB) licence under the Digital Asset Business Act 2018 (DABA), with three tiers: Class T (Test/sandbox licence for early-stage/proof-of-concept businesses, time-limited ~3-12 months), Class M (Modified licence for limited-scope/lower-risk operations, a stepping stone to full authorization), and Class F (Full, unrestricted licence covering the complete range of digital asset business activities, issuance, exchange, custody, payment services, dealing as principal, etc., with no expiry, subject to ongoing supervision).

Bermuda Monetary Authority (BMA)

In January 2026, at the WEF Annual Meeting in Davos, the Government of Bermuda announced a partnership with Circle and Coinbase (and Stellar) to build what it describes as the world's first 'fully onchain' national economy, including plans for a sovereign Bermuda digital dollar. The BMA has begun real-world pilots, airdropping USDC to residents, enabling payments at a pop-up marketplace, and preparing to accept digital assets for government fees. Bermuda also hosts regulated derivatives operations tied to major exchanges including Coinbase and Kraken. The BMA's 2025 annual report shows licensed digital asset businesses rose to 49 by end of 2025 (up from 36 a year earlier). The DABA Code of Practice was also updated in 2024 with more detailed marketing/promotion and governance requirements.

VASP registration under the Virtual Assets Service Providers Act, 2022 (in force 1 February 2023). Three categories: (1) General VASP registration (e.g. transfer/brokerage/advisory services not falling into the other two categories), (2) Virtual Assets Custody Service registration, (3) Virtual Assets Exchange registration. Entities can hold multiple categories if they pay the applicable fee for each. ICO/ITO token issuance alone does not require registration if no other regulated virtual asset service is provided (per FSC Circular 43/2025 FAQ).

British Virgin Islands Financial Services Commission (BVI FSC)

November 2025: FSC issued Industry Circular 43 of 2025, publishing a comprehensive 'Understanding Virtual Assets and VASP Regulation' FAQ document clarifying scope (e.g., confirming pure ICO/ITO token issuance without other regulated activity does not require VASP registration). March 2025: BVI launched the Virtual Asset Service Providers Advisory Committee (VASPAC), a public-private body to enhance regulation/supervision of the sector, first meeting 27 March 2025. The FSC's Compliance Inspection Unit began a major round of onsite VASP/TCSP/Investment Business inspections in 2025 running through Q1 2026, focused on AML/CFT/CPF controls, internal audit, and staff training.

Digital Asset Service Provider (DASP) licence, locally 'Proveedor de Servicios de Activos Digitales' (PSAD), plus a separate Digital Asset Issuer / stablecoin issuer authorization, both under the Ley de Emisión de Activos Digitales (LEAD, enacted January 2023). DASP covers exchanges, custodians, wallet providers, brokers, OTC desks and token issuers under Article 19 of the law; issuers of digital assets/stablecoins register separately with CNAD.

Comisión Nacional de Activos Digitales (CNAD), National Digital Assets Commission, the sole competent authority for licensing, supervision and enforcement of digital asset issuers and service providers in El Salvador, created under LEAD (2023).

(1) January-February 2025: Bitcoin Law amended to remove mandatory merchant acceptance and tax-payment use, as an IMF program condition; IMF Extended Fund Facility approved. (2) August 2024-January 2025: CNAD granted Tether a DASP licence and a stablecoin issuer-related authorization; Tether announced relocation of its group headquarters to El Salvador (January 2025). (3) Bitfinex Derivatives received a DASP licence (January 2025) and Bitfinex's core platform/securities arm expanded its CNAD-supervised licence coverage across spot and derivatives (reported May 2026). (4) Continued steady growth in DASP approvals through 2025-2026, including named entities such as B2BINPAY (November 2025), Freedx (April 2025) and Finprime.pro (October 2025), with Binance also reported to hold CNAD DASP authorization. (5) CNAD has begun processing stablecoin issuer registrations under its Public Offering of Stable Coins regulations, requiring three years of externally audited financial statements and publication of a 'Relevant Information Document' (DIR).

No dedicated/bespoke crypto licence exists. Virtual asset/virtual-currency businesses not otherwise regulated must register as a 'Designated Business' with the Isle of Man Financial Services Authority (IOMFSA) under the Designated Businesses (Registration and Oversight) Act 2015 (DBRO Act). This is an AML/CTF registration regime only, it confers no market authorisation, conduct-of-business, or prudential status akin to a licence.

Isle of Man Financial Services Authority (IOMFSA), administering DBRO Act registration (oversight of some professions may be delegated to a recognised delegated oversight body, e.g. legal/accountancy bodies).

After a 2024 consultation on introducing a more substantive crypto licensing regime, the IOMFSA confirmed (2025) it would retain the current DBRO-Act registration approach 'for the time being', while keeping the matter under review. Separately, an industry-funded fee model phased in from 2023 is being revisited via consultation CP25-04 (issued 6 November 2025) on the proposed IOMFSA Fees Order 2026.

Virtual Asset Service Provider (VASP) registration, not a bespoke prudential licence. Legal basis: the Proceeds of Crime (Supervisory Bodies) (Jersey) Law 2008, the Money Laundering (Jersey) Order 2008, and the JFSC's AML/CFT/CPF Handbook, implementing FATF VASP Guidance (effective from early 2023). This is fundamentally an AML/CFT registration, without a conduct-of-business or prudential capital regime. As of mid-2026, Jersey has not introduced a dedicated substantive VASP licensing framework with conduct/prudential requirements.

Jersey Financial Services Commission (JFSC).

JFSC proposed enhancements to the AML/CFT/CPF Handbook (consultation published June 2025), taking effect 1 January 2026, including new sector-specific guidance for VASPs/DNFBPs partly in response to MONEYVAL's 2024 evaluation of Jersey. Jersey is implementing the OECD Crypto-Asset Reporting Framework (CARF): consultation began November 2024, legislation expected 2025, first CARF reporting due 2027. A government consultation (July-Sept 2025) on repealing the Control of Borrowing (COBO) framework proposes replacement legislation for digital-asset-related structures with a 12-24 month transition. In 2024 Jersey launched its first real-world-asset tokenisation platform under JFSC guidance.

Part III VASP Licence under the Lending, Credit and Finance (Bailiwick of Guernsey) Law, 2022 ('LCF Law'). Covers virtual asset exchange, transfer, safekeeping/custody, administration, and issuance/ICO services. This is a genuine substantive licensing regime (not merely AML registration), which came into full effect 1 July 2023 (application window opened 1 February 2023).

Guernsey Financial Services Commission (GFSC).

GFSC launched a 'Digital Finance Initiative' (DFI) in September 2025 to reposition Guernsey as a digital finance hub, including a Digital Forum for industry engagement and a consultation on stablecoins/broader digital-asset policy running until 6 March 2026. For 2026, GFSC announced fee reductions specifically for VASP applications to encourage more firms to establish in the Bailiwick, implying low uptake of the regime to date.

Dual-track regime. Securities: registration as a Crypto Asset Trading Platform (CTP), since 6 August 2024 this requires full 'Investment Dealer' registration plus Canadian Investment Regulatory Organization (CIRO) Dealer Member status (the previous temporary 'restricted dealer' registration and Pre-Registration Undertaking (PRU) route are both closed to new entrants). AML/CFT: registration as a Money Services Business (MSB) or Foreign MSB (FMSB) with FINTRAC under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA).

Three bodies: Canadian Securities Administrators (CSA), umbrella of provincial/territorial securities regulators (e.g. Ontario Securities Commission, OSC) setting policy; Canadian Investment Regulatory Organization (CIRO), the national self-regulatory organization CTPs must join as Dealer Members; FINTRAC (Financial Transactions and Reports Analysis Centre of Canada), federal AML/CTF regulator for MSB/FMSB registration.

6 August 2024: CSA closed the restricted-dealer/PRU interim pathway to new CTP applicants, the most material structural change, pushing all new entrants to full CIRO Investment Dealer membership. December 2024: OSC Staff Notice 33-757 published findings from a compliance review of six Ontario-registered restricted-dealer CTPs. February 2026: CIRO published a Notice on its Digital Asset Custody Framework with tiered custodian capital requirements. March 2026: legislative amendments to the PCMLTFA (via the Strengthening Canada's Immigration System and Borders Act and Budget 2025 Implementation Act) established a new 'Stablecoin Act' with dedicated AML/CFT requirements for stablecoin issuers. Ongoing FINTRAC enforcement crackdown in 2026, with reports of roughly 50 MSB registrations revoked in a single quarter.

Crypto Asset Service Provider (CASP) operating licence/permit under Law No. 7518 (amendment to Capital Markets Law No. 6362), adopted 26 June 2024, in force 2 July 2024. Secondary regulation via Communiqués III-35/B.1 (establishment/operating principles) and III-35/B.2 (operating procedures and capital adequacy), published in Official Gazette No. 32840, 13 March 2025. Distinguishes platform operators (exchanges) from custody-only providers.

Capital Markets Board of Turkey (CMB / Sermaye Piyasası Kurulu, SPK). AML/CFT compliance is separately overseen by MASAK (Financial Crimes Investigation Board).

Secondary regulations (Communiques III-35/B.1 and III-35/B.2, 13 March 2025) operationalised Law 7518. New development: following a February 2026 amendment to the Turkish Capital Markets Association (TCMA/TSPB) statute (effective 27 Feb 2026), CMB-licensed Crypto Asset Service Providers must apply for TCMA membership within 3 months of obtaining their CMB operating permit, and a dedicated professional committee for CASPs has been created within the TCMA structure. In March 2026 the CMB extended certain deadlines on custody agreements and authorisation certificates. The final compliance deadline of 30 June 2026 for the transitional licensing cohort has passed as of this report; market consolidation continues, with only a small number of exchanges (reported as Paribu, BtcTurk, Koinim) confirmed as fully licensed against a much larger transitional applicant pool.

Digital Asset Business licence under the Emergency Decree on Digital Asset Businesses B.E. 2561 (2018), as amended (most significantly by an April 2025 amendment extending extraterritorial scope). Distinct categories: Digital Asset Exchange, Digital Asset Broker, Digital Asset Dealer, ICO Portal, and Digital Asset Fund Manager, each with its own capital tier and asset-keeping vs. non-asset-keeping sub-conditions.

Securities and Exchange Commission (SEC) Thailand is the primary licensing/supervisory authority; the Ministry of Finance formally grants the licence on SEC recommendation. The Ministry of Digital Economy and Society (MDES) holds blocking powers over unlicensed platforms (added by the 2025 amendment). The Bank of Thailand has a consultative role for certain payment-related and stablecoin aspects.

April 2025: extraterritorial scope amendment plus MDES no-court-order blocking powers, the biggest regulatory shift in this period. 1 November 2024: new capital requirement notification (KorThor. 28/2567) took effect, phased to full compliance by 1 November 2025. May-June 2025: first major enforcement wave blocking 5 offshore exchanges. Early 2026: criminal complaints filed against local/overseas joint-operation arrangements, signaling a shift from blocking to prosecution. ERX rebranded as KuCoin Thailand in 2025 following acquisition by KuCoin, illustrating global exchanges entering via licensed local subsidiaries.

Crypto Asset Trader/Exchange licence (Pedagang Aset Keuangan Digital, PAKD) under POJK 27/2024 (as amended by POJK 23/2025), plus related infrastructure licences: Bourse operator (Penyelenggara Bursa Aset Keuangan Digital, CFX), Clearing House, and Custodian. Legal basis: Government Regulation No. 49/2024 (transfer of authority) plus POJK 27/2024 and POJK 23/2025 (December 2025 amendment adding a crypto derivatives framework).

Otoritas Jasa Keuangan (OJK), Financial Services Authority. Took over regulatory authority from Bappebti (commodity futures regulator) effective 10 January 2025 per Government Regulation No. 49/2024. Market infrastructure: PT Bursa Komoditi Nusantara (CFX) as bourse, PT Kliring Komoditi Indonesia as clearing house, PT Kustodian Koin Indonesia / PT Tennet Depository Indonesia as custodians.

10 January 2025: regulatory authority formally transferred from Bappebti to OJK; POJK 27/2024 took effect the same date. 10 July 2025: deadline for existing operators to complete governance/data-protection/consumer-protection upgrades. December 2025: OJK issued POJK 23/2025 amending POJK 27/2024, introducing a formal crypto derivatives trading framework. 19 December 2025: OJK published a whitelist of 29 licensed/registered digital financial asset and crypto asset trading operators. A later secondary source (dated ~May 2026) cites 26 licensed PAKD entities, the discrepancy versus the 29-count is unreconciled in available sources.

No single federal crypto licence. Fragmented dual-layer regime: (a) State-level Money Transmitter Licence (MTL), required in 49 states (all except Montana) plus DC, applied for via NMLS (Nationwide Multistate Licensing System) under each state's money transmission statute (31 states have adopted the Money Transmission Modernization Act, MTMA, in full or part as of Feb 2026); (b) Federal FinCEN Money Services Business (MSB) registration under the Bank Secrecy Act, via FinCEN Form 107, required for any business acting as a money transmitter/administrator/exchanger of convertible virtual currency. Some states have specific regimes (e.g., NY BitLicense from NYDFS, 23 NYCRR Part 200) as an alternative/superseding requirement.

No single federal crypto regulator. Federally, FinCEN (US Treasury) handles MSB registration and BSA/AML oversight. At the state level, each state's banking/financial-services department (e.g., NYDFS in New York, DFPI in California) issues and supervises money transmitter licences via NMLS. The SEC and CFTC separately assert jurisdiction over certain crypto activities (securities/commodities), the allocation of that jurisdiction is the subject of the pending CLARITY Act.

GENIUS Act (stablecoin regulation): PASSED and SIGNED INTO LAW - House passed 17 July 2025, signed by the President 18 July 2025. Establishes a federal framework for 'payment stablecoins': permitted issuers must be a subsidiary of an insured depository institution, a federally-qualified nonbank issuer, or a state-qualified issuer; mandates 100% reserve backing in liquid assets with monthly public disclosures, no rehypothecation (limited exceptions), explicit BSA/AML obligations, a ban on deceptive marketing claims, and mandatory technical capability to freeze/seize/burn stablecoins under lawful order. Implementing rules: FinCEN/OFAC issued a joint Notice of Proposed Rulemaking on 10 April 2026 (Federal Register 2026-06963), comment period closed 9 June 2026; statutory deadline for the final rule is 18 July 2026, with enforcement no later than 18 Jan 2027. No final rule confirmed published as of 3 July 2026. CLARITY Act (market structure, SEC/CFTC jurisdiction split): STILL PENDING. Passed the House 17 July 2025 (294-134); Senate Banking Committee advanced its version 15-9 on 14 May 2026; sits unchanged on the Senate Legislative Calendar (Calendar No. 423) since 1 June 2026. Still requires reconciliation with the Senate Agriculture Committee's parallel bill (S. 3755, advanced 29 Jan 2026 on a party-line vote), a 60-vote Senate floor vote (needs roughly 7 Democratic crossover votes, none firmly committed), House-Senate reconciliation, and presidential signature. A bipartisan ethics-provision amendment was rejected 13-11 at the 14 May markup and related negotiations collapsed in June 2026. Independent passage-odds trackers show CLARITY Act odds falling from roughly 74% in early June to 44-50% by early July 2026, reflecting a tightening legislative calendar.