The licensing matrix

Financial Services Permission (FSP) from the FSRA to carry on one or more 'Regulated Activities' in relation to Virtual Assets under the ADGM Financial Services and Markets Regulations (FSMR), e.g. Operating a Multilateral Trading Facility (exchange), Providing Custody, Dealing in Investments as Principal/Agent (broker-dealer), Managing Assets, or Advising on Investments, each 'in relation to Virtual Assets.' The framework was originally branded 'Operating a Crypto Asset Business' (2018 Guidance) and has since been folded into the broader Virtual Asset regulated-activities regime under the 'Guidance - Regulation of Virtual Asset Activities in ADGM' (most recent version 10 June 2025). A related but separate activity/licence covers issuing Fiat-Referenced Tokens (FRTs, i.e. stablecoins).

Financial Services Regulatory Authority (FSRA) of Abu Dhabi Global Market (ADGM)

June 10, 2025: FSRA implemented major amendments, shifted from FSRA pre-approval for Virtual Assets to a notification-based process built on applicant self-assessment; introduced express prohibition on privacy tokens and algorithmic stablecoins; revised capital requirements and fees for VA firms; added product-intervention power for virtual assets. September 2025 (Abu Dhabi Finance Week): FSRA published Consultation Paper No. 10 of 2025 proposing a staking framework. Finalised Fiat-Referenced Token (FRT) framework followed, with FEES Rulebook amendments effective 1 January 2026 (published 31 October 2025). April 29, 2026: FSRA finalised the Virtual Asset staking regulatory framework after consultation. December 2025/January 2026: Binance received FSRA approval (announced 7 December 2025) to operate its global Binance.com platform in ADGM via three regulated entities, described as the first global platform-level licence of this kind under the ADGM framework, operations beginning 5 January 2026. On 7 Jul 2026 the FSRA granted a Financial Services Permission to BTCS (Middle East), the Abu Dhabi subsidiary of Bitcoin Suisse, covering spot trading in accepted virtual assets, institutional custody and derivatives for institutional and professional clients. On 23 July 2026 the FSRA recognised Tether Gold (XAUT) as an Accepted Spot Commodity in ADGM, a spot-commodities recognition distinct from the virtual-asset regulated activities, allowing appropriately permissioned firms to offer the token.

MiCA CASP Authorisation granted by the Austrian Financial Market Authority (FMA)

Finanzmarktaufsicht (FMA) Österreich

Austria set 30 June 2026 as the end of its transitional regime (shorter runway than the EU default 1 July 2026 deadline), creating pressure for existing FM-GwG registered VASPs to secure full CASP authorisation; Bybit reported as licensed in Austria per exchange-tracking source OSL EU GmbH was authorised on 7 July 2026 (per ESMA's interim register), the eleventh Austrian CASP.

Crypto-Asset Service Licence under CBB Rulebook Volume 6 (Capital Markets), Crypto-Asset Module (CRA), issued under Decree Law No. 64 of 2006 (CBB Law). Four categories: Category 1 (reception/transmission of orders, investment advice), Category 2 (Cat-1 activities plus trading as agent, portfolio management, custody), Category 3 (Cat-2 activities plus trading as principal/dealing on own account), Category 4 (operating a licensed crypto-asset exchange plus custody). A separate Stablecoin Issuance and Offering (SIO) Module (also Volume 6) now licenses stablecoin issuers.

Central Bank of Bahrain (CBB)

In July 2025 the CBB issued a new Stablecoin Issuance and Offering (SIO) Module, added to Rulebook Volume 6, creating Bahrain's first dedicated stablecoin licensing framework. It covers issuance, minting, burning, and reserve management of single-currency stablecoins backed by BHD, USD, or other CBB-accepted fiat currencies; requires issuers to incorporate as a Bahraini B.S.C.; mandates perpetual redemption rights for holders; and explicitly permits yield-bearing stablecoins (subject to CBB-set limits). On 3 June 2026 AX Coin Bahrain B.S.C. (c), a subsidiary of Nasdaq-listed Solowin Holdings, announced it had been granted the first licence under this framework, for stablecoin issuer activities (per the issuer's announcement; a CBB press release confirming the grant is pending direct confirmation). Separately, CBB granted a new Category 3 crypto-asset licence to Fasset Financial Services W.L.L. in January 2025. In May 2026 the CBB restructured the approved-persons section (CRA-1.7) of the Crypto-Asset Module, regrouping its fit-and-proper, prior-approval and notification rules under relocated headings (Rulebook revision of 6 May 2026).

MiCA CASP authorisation under Article 63 MiCA, given domestic legal effect by the Belgian Act of 11 December 2025 (published in the Belgian Official Gazette 24 December 2025, entered into force 3 January 2026). Before this Act, MiCA was directly applicable EU law but Belgium lacked a domestic supervisory/sanctioning framework, creating a practical gap.

FSMA (Financial Services and Markets Authority) is the competent authority for CASPs that are not credit institutions or stockbroking firms, this covers the great majority of pure-play exchanges and custodians and includes both prudential and conduct-of-business supervision under Article 63. The National Bank of Belgium (NBB) takes the prudential lead where the CASP is (or is part of) a credit institution.

The Act of 11 December 2025 (Belgium's MiCA implementing law) was the single biggest development: it was published 24 December 2025 and entered into force 3 January 2026, only then giving FSMA/NBB a full domestic legal basis for authorisation, supervision and sanctions. Before that date Belgium had a live enforcement gap despite MiCA being EU law since December 2024. As of last check, 0 CASPs were authorised in Belgium, consistent with the regime being newly operative. As of 3 Jul 2026 the FSMA's own list of authorised Belgian CASPs still records zero authorisations. On 3 Jul 2026 the FSMA also adopted ESMA's guidelines (FSMA_2026_16) on when a non-EU firm is treated as soliciting EU clients, relevant to enforcement against unauthorised third-country platforms. The FSMA's list now separately signposts ESMA's register for CASPs supervised by the National Bank of Belgium; that register records KBC Bank NV as Belgium's first such entry (updated 13 May 2026).

Digital Asset Business (DAB) licence under the Digital Asset Business Act 2018 (DABA), with three tiers: Class T (Test/sandbox licence for early-stage/proof-of-concept businesses, time-limited ~3-12 months), Class M (Modified licence for limited-scope/lower-risk operations, a stepping stone to full authorization), and Class F (Full, unrestricted licence covering the complete range of digital asset business activities, issuance, exchange, custody, payment services, dealing as principal, etc., with no expiry, subject to ongoing supervision).

Bermuda Monetary Authority (BMA)

In January 2026, at the WEF Annual Meeting in Davos, the Government of Bermuda announced a partnership with Circle and Coinbase (and Stellar) to build what it describes as the world's first 'fully onchain' national economy, including plans for a sovereign Bermuda digital dollar. The BMA has begun real-world pilots, airdropping USDC to residents, enabling payments at a pop-up marketplace, and preparing to accept digital assets for government fees. Bermuda also hosts regulated derivatives operations tied to major exchanges including Coinbase and Kraken. The BMA's 2025 annual report shows licensed digital asset businesses rose to 49 by end of 2025 (up from 36 a year earlier). The DABA Code of Practice was also updated in 2024 with more detailed marketing/promotion and governance requirements. Bitcoin Suisse (International) Ltd was granted a Class F digital asset business licence with Class B investment business registration, reported 13 May 2026, pre-operational pending standard conditions. On tokenisation, the BMA issued a stakeholder letter on 30 March 2026 and a consultation paper on 9 April 2026 (feedback to 30 June 2026); on 21 July 2026 it opened a further consultation on letting certain insurers, ILS structures and investment funds use fully fiat-backed stablecoins for subscriptions, treasury and premium or claims payments (comments to 30 September 2026).

VASP registration under the Virtual Assets Service Providers Act, 2022 (in force 1 February 2023). Three categories: (1) General VASP registration (e.g. transfer/brokerage/advisory services not falling into the other two categories), (2) Virtual Assets Custody Service registration, (3) Virtual Assets Exchange registration. Entities can hold multiple categories if they pay the applicable fee for each. ICO/ITO token issuance alone does not require registration if no other regulated virtual asset service is provided (per FSC Circular 43/2025 FAQ).

British Virgin Islands Financial Services Commission (BVI FSC)

November 2025: FSC issued Industry Circular 43 of 2025, publishing a comprehensive 'Understanding Virtual Assets and VASP Regulation' FAQ document clarifying scope (e.g., confirming pure ICO/ITO token issuance without other regulated activity does not require VASP registration). March 2025: BVI launched the Virtual Asset Service Providers Advisory Committee (VASPAC), a public-private body to enhance regulation/supervision of the sector, first meeting 27 March 2025. The FSC's Compliance Inspection Unit began a major round of onsite VASP/TCSP/Investment Business inspections in 2025 running through Q1 2026, focused on AML/CFT/CPF controls, internal audit, and staff training.

MiCA CASP licence under the national Markets in Crypto-Assets Act (BG MiCA Act), adopted 20 June 2025, in force 8 July 2025.

Financial Supervision Commission (FSC) for most CASPs; Bulgarian National Bank (BNB) supervises e-money token issuers separately.

BG MiCA Act adopted 20 June 2025, entered force 8 July 2025 - a relatively late national implementer among EEA states; grandfathering deadline (8 Oct 2025) has already passed.

Dual-track regime. Securities: registration as a Crypto Asset Trading Platform (CTP), since 6 August 2024 this requires full 'Investment Dealer' registration plus Canadian Investment Regulatory Organization (CIRO) Dealer Member status (the previous temporary 'restricted dealer' registration and Pre-Registration Undertaking (PRU) route are both closed to new entrants). AML/CFT: registration as a Money Services Business (MSB) or Foreign MSB (FMSB) with FINTRAC under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA).

Three bodies: Canadian Securities Administrators (CSA), umbrella of provincial/territorial securities regulators (e.g. Ontario Securities Commission, OSC) setting policy; Canadian Investment Regulatory Organization (CIRO), the national self-regulatory organization CTPs must join as Dealer Members; FINTRAC (Financial Transactions and Reports Analysis Centre of Canada), federal AML/CTF regulator for MSB/FMSB registration.

6 August 2024: CSA closed the restricted-dealer/PRU interim pathway to new CTP applicants, the most material structural change, pushing all new entrants to full CIRO Investment Dealer membership. December 2024: OSC Staff Notice 33-757 published findings from a compliance review of six Ontario-registered restricted-dealer CTPs. February 2026: CIRO published a Notice on its Digital Asset Custody Framework with tiered custodian capital requirements. March 2026: legislative amendments to the PCMLTFA (via the Strengthening Canada's Immigration System and Borders Act and Budget 2025 Implementation Act) established a new 'Stablecoin Act' with dedicated AML/CFT requirements for stablecoin issuers. Ongoing FINTRAC enforcement crackdown in 2026, with reports of roughly 50 MSB registrations revoked in a single quarter.

Two-tier regime under the Virtual Asset (Service Providers) Act (VASP Act, as amended). Phase 1 (in force since 2020): VASP Registration, required for virtual asset services generally that are not custody or trading-platform operation; AML/CFT-focused, lighter touch. Phase 2 (in force since 1 April 2025): VASP Licence, mandatory for entities operating a virtual asset custody service or a virtual asset trading platform; registration is no longer available for these two activity categories. A narrow waiver from registration/licensing is available for entities already licensed under another Cayman regulatory law.

Cayman Islands Monetary Authority (CIMA)

Phase 2 licensing (custody and trading platforms) came into force 1 April 2025, with a 90-day transition deadline of 30 June 2025 for existing registrants to convert to a licence. CIMA updated the VASP application forms, Rule, and Statement of Guidance in December 2024 ahead of Phase 2. From 1 December 2025, CIMA introduced a new quarterly financial reporting requirement via the REEFS portal, layered on top of the existing annual audited accounts requirement. CIMA conducted a Thematic Desk-Based Review of 11 regulated VASPs (September 2024-February 2025), with findings published November 2025 and a further legal briefing in February 2026, identifying gaps in board composition, cybersecurity governance, staff training, and sanctions-screening practices. A Phase 3 is expected but not yet commenced as of mid-2026.

MiCA CASP authorisation under Regulation (EU) 2023/1114, implemented nationally via Croatia's MiCA Implementation Act (passed 27 July 2024, in force alongside EU MiCA from 30 December 2024).

HANFA (Croatian Financial Services Supervisory Agency); HNB (Croatian National Bank) supervises ART/EMT issuers.

HANFA granted Croatia's first MiCA CASP licence to Zagreb-based Electrocoin in April 2026 - the first authorisation issued in-country.

MiCA CASP Authorisation granted by CySEC; existing Cyprus Investment Firms (CIFs) can extend their licence to cover crypto-asset services under a simplified process

Cyprus Securities and Exchange Commission (CySEC) - sole National Competent Authority for MiCA in Cyprus

CySEC set a hard 27 February 2026 deadline for existing national-regime CASPs to submit MiCA applications; preliminary assessment phase opened 13 Nov 2024, formal applications from 1 Jan 2025; national transitional regime and full MiCA regime now running in parallel toward the 1 July 2026 EU-wide cutover

MiCA CASP authorisation under EU Regulation 2023/1114, with the Czech National Bank (CNB) designated as the domestic competent authority. The CNB accepts applications in English, which practitioners cite as a distinguishing feature versus other Member States.

Česká národní banka (Czech National Bank, CNB), sole competent authority for both authorisation and ongoing supervision of CASPs in Czechia.

Authorisation count growth confirmed: 0 authorised CASPs as of February 2026, moving to the CNB's first 6 authorisations issued 11 February 2026, then to 7 authorised CASPs by May 2026 (per Helms Advisory tracker). Czechia is described by multiple sources as the fastest-moving MiCA CASP jurisdiction in the EU in 2026, processing English-language applications from a pool of 248 filings.

MiCA CASP authorisation under Regulation (EU) 2023/1114, with Finanstilsynet designated as competent authority under Danish implementing provisions.

Finanstilsynet (Danish Financial Supervisory Authority)

Denmark's MiCA transitional arrangement for legacy crypto-asset service providers who applied before 30 December 2024 runs for up to 18 months from that date, lapsing around 1 July 2026 in line with the EU-wide backstop. Finanstilsynet has published an application form, via virk.dk, covering both full CASP authorisation and Article 60 notifications, applicable since the crypto-asset-service rules took effect on 30 December 2024.

Digital Asset Service Provider (DASP) licence, locally 'Proveedor de Servicios de Activos Digitales' (PSAD), plus a separate Digital Asset Issuer / stablecoin issuer authorization, both under the Ley de Emisión de Activos Digitales (LEAD, enacted January 2023). DASP covers exchanges, custodians, wallet providers, brokers, OTC desks and token issuers under Article 19 of the law; issuers of digital assets/stablecoins register separately with CNAD.

Comisión Nacional de Activos Digitales (CNAD), National Digital Assets Commission, the sole competent authority for licensing, supervision and enforcement of digital asset issuers and service providers in El Salvador, created under LEAD (2023).

(1) January-February 2025: Bitcoin Law amended to remove mandatory merchant acceptance and tax-payment use, as an IMF program condition; IMF Extended Fund Facility approved. (2) August 2024-January 2025: CNAD granted Tether a DASP licence and a stablecoin issuer-related authorization; Tether announced relocation of its group headquarters to El Salvador (January 2025). (3) Bitfinex Derivatives received a DASP licence (January 2025) and Bitfinex's core platform/securities arm expanded its CNAD-supervised licence coverage across spot and derivatives (reported May 2026). (4) Continued steady growth in DASP approvals through 2025-2026, including named entities such as B2BINPAY (November 2025), Freedx (April 2025) and Finprime.pro (October 2025), with Binance also reported to hold CNAD DASP authorization. (5) CNAD has begun processing stablecoin issuer registrations under its Public Offering of Stable Coins regulations, requiring three years of externally audited financial statements and publication of a 'Relevant Information Document' (DIR).

MiCA CASP authorisation; implemented via the Crypto-Assets Market Act (Kruptovarade turu seadus, KrüTS), in force 1 July 2024.

Finantsinspektsioon (Estonian Financial Supervision and Resolution Authority)

Estonia's VASP population collapsed from 641 valid licences (mid-2021 peak) to 36 remaining by early 2026; as of recent reporting only one entity (Lightspark Payments Europe AS) had received full MiCA CASP authorisation. From 18 March 2026, CASP applications must go through FI's new application portal.

MiCA CASP authorisation (Articles 60-62), replacing Finland's prior national virtual-currency-provider registration regime (in force since 2019).

Finanssivalvonta (FIN-FSA, Finnish Financial Supervisory Authority)

FIN-FSA launched a public register of authorised CASPs and a warning list of unauthorised providers; the 6-month transition period closed 30 June 2025, requiring firms to already hold full MiCA authorisation.

MiCA CASP authorisation (French 'agrement PSCA'); replaces the legacy PSAN regime (mandatory AML registration + optional licence). A single authorisation covers the 10 MiCA services.

AMF (Autorite des marches financiers) grants and supervises the CASP authorisation; ACPR (Banque de France) gives binding assent on AML/CFT and prudential aspects via a joint examination team.

France used the full 18-month transition, ending 1 Jul 2026 (today). Deblock first CASP (May 2025), SG-Forge (Oct 2025); ~18 CASPs authorised by 28 May 2026. AMF adopted ESMA staff knowledge/competence guidelines (Mar 2026).

MiCA CASP authorisation granted by BaFin under national law FinmadiG/KMAG; replaces the legacy KWG crypto-custody business licence, with a simplified transition for existing KWG-licensed firms.

BaFin (Bundesanstalt fur Finanzdienstleistungsaufsicht) with Deutsche Bundesbank involvement; applications go to both. Widely regarded as the EU's most demanding CASP regulator.

FinmadiG + KMAG in force 27 Dec 2024; Germany used a 12-month grandfathering (apply before 8 Oct 2025; effective end-2025). By mid-2026 the EU's #1 hub - ~57 CASP authorisations (~23% of the EU's ~244), incl. Trade Republic, N26, Commerzbank, Bitpanda. BaFin's KMAnzV notification ordinance under KMAG (issued 20 May 2026, Federal Gazette 26 May 2026) standardises CASP notification forms and procedures. ESMA's interim register recorded 61 German CASP entries at its 24 July 2026 refresh, including cooperative banks Raiffeisenbank Auerbach-Freihung eG (19 June 2026) and Volksbank Schwarzwald-Donau-Neckar eG (2 July 2026), both for order execution only.

GFSC permission under the Financial Services (DLT Providers and VAA Providers) Regulations 2020. The framework covers firms using DLT to store or transmit value belonging to others and, since 27 October 2025, VAA providers exchanging virtual assets for money or other virtual assets. It is a principles-based permission, not a MiCA category licence.

Gibraltar Financial Services Commission (GFSC), with a dedicated DLT/innovation team running pre-application engagement; also the AML/CFT supervisor under the Proceeds of Crime Act 2015.

LN 2025/254 expanded the 2020 Regulations to DLT Providers and VAA Providers from 27 October 2025, expressly capturing virtual-asset exchange arrangements. LN 2026/053 took effect on 26 March 2026 and introduced 30-day pre-notification and GFSC no-objection requirements for dividends by DLT and VAA providers. The wider DLT-regime overhaul signalled in February 2026 still has no published draft or Bill in the official legislation register as of 15 August 2026.

MiCA CASP authorisation under Law 5193/2025 (enacted 11 April 2025), operationalised by HCMC Board Decision 8/1059 of 30 July 2025.

Hellenic Capital Market Commission (HCMC) for CASP authorisation; Bank of Greece for ART/EMT prudential oversight.

Law 5193/2025 passed 11 April 2025; HCMC Decision 8/1059 (CASP licensing procedure) issued 30 July 2025; national compliance deadline of 30 December 2025 has already passed as of this research (July 2026).

Part III VASP Licence under the Lending, Credit and Finance (Bailiwick of Guernsey) Law, 2022 ('LCF Law'). Covers virtual asset exchange, transfer, safekeeping/custody, administration, and issuance/ICO services. This is a genuine substantive licensing regime (not merely AML registration), which came into full effect 1 July 2023 (application window opened 1 February 2023).

Guernsey Financial Services Commission (GFSC).

On 24 July 2026 the GFSC published its Supporting Growth with Digital Finance feedback paper. Revised Part 10 rules are intended to take effect on 1 October 2026, permitting VASPs to serve retail customers and deleting the VASP-specific environmental declaration. Retail-facing firms must notify the GFSC and hold proportionate resources. Separate relief from dual licensing for some existing regulated firms remains proposed, with the section 40 notice consultation closing 31 August 2026. Stablecoin rules are expected in autumn 2026.

SFC Virtual Asset Trading Platform (VATP) licence on a dual basis: under the AMLO and, for tokens that are securities, under the SFO (Type 1 dealing + Type 7 automated trading). Stablecoin issuance is separately licensed by the HKMA under the Stablecoins Ordinance (Cap. 656).

SFC regulates VATPs and security-token activity; HKMA regulates stablecoin issuers and banks' VA activities. Staking and intermediary VA activity are covered by joint SFC-HKMA circulars.

SFC ASPIRe roadmap (19 Feb 2025); VATP staking guidance (7 Apr 2025); HKMA Stablecoins Ordinance in force 1 August 2025, with the first two issuer licences (HSBC, Anchorpoint) granted 10 April 2026; the HKMA register lists only these two issuers as of 23 April 2026. FSTB and SFC published consultation conclusions on virtual asset dealing and custodian licensing on 24 December 2025, then published consultation conclusions on virtual asset advisory and management service provider licensing on 26 May 2026. All four new licensing regimes, dealing, custodian, advisory and management, have now completed consultation; FSTB and SFC are finalising the legislative proposals, with a single bill covering all four regimes still targeted for introduction into the Legislative Council within 2026 (not yet introduced). 13 VATPs are licensed by the SFC, unchanged since the last review (most recently NewBX, licensed 18 May 2026). A June 2026 Legislative Council reply confirmed the HKMA received 36 stablecoin-licence applications in the first window and expects the overall number of licences to remain very limited.

MiCA CASP authorisation (Regulation (EU) 2023/1114, Art. 62) under Hungary's Act VII of 2024 on Crypto-Assets, transposing MiCA.

Magyar Nemzeti Bank (MNB) grants the core CASP licence; SZTFH (Supervisory Authority for Regulated Activities) separately runs a national crypto-asset conversion validation-certificate scheme (effective 27 Dec 2025), required in addition to the MNB CASP licence for crypto-fiat/crypto-crypto exchange - a Hungary-specific dual-track layer.

Act XXXVIII of 2026 repealed Hungary's separate SZTFH crypto-asset conversion validation scheme. Parliament adopted the repeal on 28 July 2026, it was promulgated in Magyar Kozlony on 30 July and took effect on 7 August 2026. Validator permissions lapsed and pending validator proceedings ended, leaving the ordinary MNB and MiCA framework. Strong press reporting of a first MNB CASP licence remains pending primary confirmation and is not counted here.

Crypto-Asset Service Provider (CASP) authorisation under MiCA (Regulation (EU) 2023/1114), given domestic legal effect by Act No. 101/2025 on markets for crypto-assets (markadir fyrir syndareignir)

Central Bank of Iceland (Sedlabanki Islands), Financial Supervision (Fjarmalaeftirlitid), the sole competent authority under Act No. 101/2025

Iceland enacted Act No. 101/2025 on markets for crypto-assets on 24 December 2025, in force from 1 January 2026, giving MiCA (Regulation (EU) 2023/1114) legal effect domestically with the adaptations in EEA Joint Committee Decision 41/2025 (adopted 20 February 2025, in force in the EEA from 24 June 2025). The transitional period for providers active before 30 December 2024 ran until 1 July 2026 or until a licence was granted or refused, whichever came first. On 25 June 2026 the Central Bank granted Myntkaup ehf an operating licence as a virtual asset service provider, Iceland's first CASP authorisation.

Crypto Asset Trader/Exchange licence (Pedagang Aset Keuangan Digital, PAKD) under POJK 27/2024 (as amended by POJK 23/2025), plus related infrastructure licences: Bourse operator (Penyelenggara Bursa Aset Keuangan Digital, CFX), Clearing House, and Custodian. Legal basis: Government Regulation No. 49/2024 (transfer of authority) plus POJK 27/2024 and POJK 23/2025 (December 2025 amendment adding a crypto derivatives framework).

Otoritas Jasa Keuangan (OJK), Financial Services Authority; took over from Bappebti (commodity futures regulator) on 10 Jan 2025 under Government Regulation No. 49/2024. Market infrastructure now spans two bourses (PT Bursa Komoditi Nusantara, CFX, and PT Fortuna Integritas Mandiri, ICEx, licensed 5 Jan 2026), two clearing institutions (PT Kliring Komoditi Indonesia and PT Pranata Karya Solusi, licensed 2 Mar 2026) and two custodians (PT Kustodian Koin Indonesia and PT Arganis Konsultindo Utama, licensed 2 Mar 2026).

10 January 2025: regulatory authority formally transferred from Bappebti to OJK; POJK 27/2024 took effect the same date. 10 July 2025: deadline for existing operators to complete governance, data-protection and consumer-protection upgrades. December 2025: OJK issued POJK 23/2025 amending POJK 27/2024, introducing a formal crypto derivatives trading framework. 19 December 2025: OJK published a whitelist of 29 licensed or registered digital financial asset and crypto asset trading operators; OJK's own subsequent lists (12 March 2026 and 21 April 2026) both show 25 licensed PAKD operators, which is the current figure. 30 June 2026: OJK issued PADK No. 3 of 2026, setting out detailed reporting mechanics under POJK 27/2024 and POJK 23/2025; it takes effect 1 September 2026 and replaces parts of Circular Letter 20/SEOJK.07/2024 from that date, with a further tranche of that circular repealed from 1 January 2027. PADK No. 3/2026 (enacted 30 June 2026) applies from 1 September 2026, with a first tranche of the superseded 2024 circular repealed from 1 July 2026 and the remainder from 1 January 2027.

MiCA CASP authorisation granted by the Central Bank of Ireland; replaces the legacy VASP registration (CJA 2010, AML). No simplified VASP->CASP conversion - all applicants face the full process.

Central Bank of Ireland (CBI) - sole competent authority; runs an Innovation Hub. Known as a demanding, gatekeeper-style regulator.

Transitional period ended 30 Dec 2025 (12 months; simplified route declined). ~10 CASPs authorised by late 2025 (Kraken Jun 2025, Coinbase, StoneX 10th). Revised Consumer Protection Code from 24 Mar 2026.

No dedicated/bespoke crypto licence exists. Virtual asset/virtual-currency businesses not otherwise regulated must register as a 'Designated Business' with the Isle of Man Financial Services Authority (IOMFSA) under the Designated Businesses (Registration and Oversight) Act 2015 (DBRO Act). This is an AML/CTF registration regime only, it confers no market authorisation, conduct-of-business, or prudential status akin to a licence.

Isle of Man Financial Services Authority (IOMFSA), administering DBRO Act registration (oversight of some professions may be delegated to a recognised delegated oversight body, e.g. legal/accountancy bodies).

Following its 2024 consultation on a more substantive crypto licensing regime, the IOMFSA retained the current DBRO-Act registration approach for now and may reconsider it in a future policy cycle. The consolidated Isle of Man Financial Services Authority (Fees) Order 2026, following a consultation that closed on 18 December 2025 and a feedback statement on 17 February 2026, took effect on 1 April 2026 and raised most fees, including designated-business fees, by about 2.9 per cent in line with CPI.

MiCA CASP authorisation under EU Regulation 2023/1114, transposed via Legislative Decree 129/2025 and implemented through Consob Resolution 23700/2025. Pre-MiCA VASPs (registered under the OAM register per AML Decree 90/2017) had to convert to full CASP authorisation; transitional regime for existing VASPs was extended to 1 July 2026.

Split regulator model: Consob (Commissione Nazionale per le Società e la Borsa) is the lead competent authority issuing CASP authorisation and supervising conduct-of-business/market integrity; Banca d'Italia is consulted on and supervises prudential aspects (capital, governance, AML) and directly handles credit institutions/e-money institutions offering crypto services (e.g. Banca Sella's notification route).

Consob Resolution 23700/2025 (introducing the EUR 20,000 fee) took effect 1 December 2025; the transitional regime for pre-MiCA VASPs was extended to 1 July 2026 (later than the original MiCA default cut-off), giving Italian firms extra runway. As of 1 July 2026, 8 firms hold full CASP authorisation, a sharp jump from near-zero conversions reported earlier in 2026, though still a small fraction of the pre-MiCA registered population.

Crypto-Asset Exchange Service Provider (CAESP) registration with the Prime Minister (delegated to the FSA), under Article 63-2 of the Payment Services Act (PSA). Crypto derivatives trading is separately regulated as a Type I Financial Instruments Business under the Financial Instruments and Exchange Act (FIEA). A parallel intermediary-only registration category was introduced by the 2025 PSA/LPAI amendments.

Financial Services Agency of Japan (FSA / JFSA), registration authority, acting via the Prime Minister's delegated power and Local Finance Bureaus. The Japan Virtual and Crypto-assets Exchange Association (JVCEA) is the FSA-certified self-regulatory organisation that runs mandatory token-listing screening and conduct rules; JVCEA membership is the de facto baseline for registration even though not a strict legal requirement.

The FIEA and Payment Services Act amendment was promulgated on 23 July 2026. The first tranche, raising penalties for unregistered business and expanding SESC investigative powers, took effect on 12 August 2026. The core crypto-to-FIEA reclassification takes effect within one year of promulgation on a day to be fixed by cabinet order, so the exact date remains pending and cannot be later than 23 July 2027.

Virtual Asset Service Provider (VASP) registration, not a bespoke prudential licence. Legal basis: the Proceeds of Crime (Supervisory Bodies) (Jersey) Law 2008, the Money Laundering (Jersey) Order 2008, and the JFSC's AML/CFT/CPF Handbook, implementing FATF VASP Guidance (effective from early 2023). This is fundamentally an AML/CFT registration, without a conduct-of-business or prudential capital regime. As of mid-2026, Jersey has not introduced a dedicated substantive VASP licensing framework with conduct/prudential requirements.

Jersey Financial Services Commission (JFSC).

JFSC proposed enhancements to the AML/CFT/CPF Handbook (consultation published June 2025), taking effect 1 January 2026, including new sector-specific guidance for VASPs/DNFBPs partly in response to MONEYVAL's 2024 evaluation of Jersey. Jersey is implementing the OECD Crypto-Asset Reporting Framework (CARF): consultation began November 2024, legislation expected 2025, first CARF reporting due 2027. A government consultation (July-Sept 2025) on repealing the Control of Borrowing (COBO) framework proposes replacement legislation for digital-asset-related structures with a 12-24 month transition. In 2024 Jersey launched its first real-world-asset tokenisation platform under JFSC guidance.

MiCA CASP authorisation under Regulation (EU) 2023/1114, administered nationally by Latvijas Banka; specific Latvian implementing statute name not confirmed in this research pass.

Latvijas Banka (Bank of Latvia) is the lead CASP licensing/supervisory authority; sources note some residual/overlapping role for the FCMC on broader financial-market alignment, not fully reconciled in this pass.

Latvijas Banka has issued multiple CASP licences during 2025-2026, including to SIA AlphaRoute and Backpack, and reportedly Paybis (May 2026, per one directory source). Latvia offers free pre-licensing consultations and a formal Innovation Hub.

MiCA CASP Authorisation granted by FMA Liechtenstein, operating alongside (and increasingly converged with) the pre-existing domestic TVTG (Token and VT Service Provider Act) registration regime

Finanzmarktaufsicht (FMA) Liechtenstein

Bank Frick received MiCAR authorisation from FMA Liechtenstein on 20 January 2026, one of the first in the country under the new regime; FMA also authorised Bitcoin Suisse (Europe), the European arm of the Swiss group, covering trading, custody and staking for institutional/HNW clients. Smart Valor was authorised as a CASP under MiCAR Article 63 with effect from 1 Jul 2026, and Kaiser Partner Privatbank was authorised for certain crypto-asset services via the Article 60 notification route from 29 Jun 2026; the FMA confirmed the MiCAR transitional period ended on schedule on 1 Jul 2026. Further FMA authorisations followed: Floin AG (10 June 2026), Sygnum Europe AG (26 June 2026) and Damoon Technology (Europe) AG (10 July 2026), all announced on the FMA's own news feed.

MiCA Crypto-Asset Service Provider (CASP) authorisation under Title V of Reg (EU) 2023/1114; replaced the national VASP registration. Single passportable licence covering the services applied for.

Bank of Lithuania (Lietuvos bankas) - single competent authority. Publicly selective stance: wants few, solid firms rather than the ~370-strong legacy VASP pool.

Lithuania used a shortened 12-month grandfathering - legacy VASP cover ended 1 Jan 2026 (vs the EU 1 Jul 2026 backstop). First CASP: Robinhood Europe (29 May 2025); only ~4 CASPs authorised by Mar 2026.

MiCA CASP Authorisation granted by the Commission de Surveillance du Secteur Financier (CSSF)

Commission de Surveillance du Secteur Financier (CSSF)

Rapid growth in H1 2026: as of 30 June 2026, 11 active CASPs including B2C2 Europe, Banking Circle, Bitstamp Europe, Bridge Building, Clearstream Banking, Coinbase Luxembourg, Stokr, Standard Chartered Luxembourg, Swissquote Bank Europe, Zodia Custody Europe and BitFlyer; BitFlyer authorised 26 June 2026, Stokr 22 June 2026, Bridge Building 29 June 2026, all just before the transitional deadline expired on 1 July 2026

MiCA CASP authorisation under the Markets in Crypto-Assets Act (Cap. 647); replaces the legacy VFA licence (VFA Act 2018) via a fast-track conversion. Malta granted one of the EU's first full CASP licences (Jan 2025).

Malta Financial Services Authority (MFSA) - single competent authority; a long-standing crypto supervisor since the 2018 VFA regime.

First-mover: Crypto.com licensed 27 Jan 2025; ~13 CASPs now authorised (OKX, Gemini, Gate, Blockchain.com). ESMA's 10 Jul 2025 peer review criticised the MFSA's authorisation of one CASP, tightening scrutiny. Transition ends 1 Jul 2026.

No dedicated public-facing crypto licence. Ley Fintech (2018) offers the IFPE (e-money institution) and IFC (crowdfunding) routes; virtual-asset operations by regulated entities need Banxico authorisation (internal-only, effectively not granted for customer crypto).

CNBV authorises/supervises ITFs (with the Comite Interinstitucional); Banco de Mexico (Banxico) controls virtual-asset authorisations and payments; SHCP/SAT/UIF for AML; CONDUSEF for consumer protection.

Major AML Law reform enacted 16 Jul 2025 (VASPs serving Mexican residents in scope; Travel Rule; 10-yr records). Banxico (Dec 2025) reiterated stablecoins pose financial-stability risks. A Fintech Law 2.0 is discussed but NOT enacted. On 6 May 2026 Senator Alejandro Murat introduced a Senate bill to regulate peso-pegged stablecoins (Activos Virtuales Estables), restricting issuance to authorised ITFs and credit institutions under Banxico supervision; it remains a bill before committee, not enacted law.

MiCA CASP Authorisation (Crypto-Asset Service Provider), granted by AFM; DNB co-assesses fitness/propriety and AML for licence holders

Autoriteit Financiële Markten (AFM) - lead conduct regulator and licensing authority; De Nederlandsche Bank (DNB) supports with prudential/AML input

Netherlands became one of the highest-volume MiCA jurisdictions through H1 2026 as the 1 July 2026 EU-wide transitional deadline approached; notable authorisations include Bitvavo, Amdax, MoonPay, Finst, Fiat Republic, and Banxa (Oct 2025); dedicated 'ARI10' authorisation added Feb 2026 per one tracker

MiCA CASP authorisation applies to Norway via the EEA Agreement (Norway is not an EU member but MiCA is being incorporated into the EEA framework). Notably, Norway's first authorised firm, AK Jensen Norway AS, was approved under MiCA Article 60 (the simplified route for existing authorised investment firms/securities firms to add crypto-asset services) rather than a fresh standalone CASP application, illustrating that Norway's incumbent-firm pathway is active even before/alongside full standalone CASP processing.

Finanstilsynet (the Financial Supervisory Authority of Norway), sole competent authority for CASP authorisation and supervision, operating under the EEA-incorporated MiCA framework rather than as an EU member state authority.

AK Jensen Norway AS became Norway's first MiCA-authorised firm (Article 60 route), effective 2 February 2026. Firi, the largest Nordic crypto exchange (400,000+ users), was authorised by Finanstilsynet in May 2026, becoming one of the first full standalone Nordic crypto exchanges under the new framework. Norway's national VASP registry is being wound down ahead of the 30 June 2026 EEA-wide MiCA transitional deadline. Finanstilsynet's own announcements date the first Article 63 authorisations precisely: Tyr Markets AS applies from 18 May 2026 and Firi AS from 22 May 2026 (announced 29 May 2026); Norwegian Block Exchange AS followed on 30 June 2026.

MiCA CASP authorisation is legally required (MiCA is directly applicable EU law) but Poland has NO functioning domestic legal basis to grant it: the Crypto-Assets Market Act, which would designate KNF as competent authority and set out the licensing procedure, has been vetoed by the President three times (1 December 2025, 12 February 2026, and again in June 2026 per later reporting). Three competing draft bills (government, Poland 2050, Konfederacja) remain stuck in the legislative process.

KNF (Komisja Nadzoru Finansowego / Polish Financial Supervision Authority) is the intended competent authority under the stalled Crypto-Assets Market Act, but KNF currently has NO statutory power to accept or process CASP applications because no law has designated it as the Article 3(1)(35)(a) MiCA competent authority. This is a genuine regulatory vacuum, not merely a slow regulator.

MiCA CASP authorisation implemented by Lei n.o 69/2025 (22 Dec 2025). Replaces the legacy Banco de Portugal VASP (AML) registration.

Twin-peaks: BANCO DE PORTUGAL is the CASP authorisation authority + prudential/AML supervisor (single application front door); CMVM is the conduct-of-business and market-abuse supervisor. (Corrects the seed - not CMVM-led.)

Lei 69/2025 (MiCA) and Lei 70/2025 (Travel Rule) published 22 Dec 2025, about a year late. The legacy-VASP transitional window closed 1 Jul 2026. Bison Bank became Portugal's first MiCA-authorised CASP in late Jun 2026, following approval from Banco de Portugal and the CMVM.

MiCA CASP authorisation (EU Regulation 2023/1114, directly applicable). National implementation is unsettled: 2025 commentary cited GEO 10/2025 as the transposition instrument in force from 13 Mar 2025, while ASF stated on 1 Jul 2026 that the designating act is still a draft and no competent authority is yet in place; see recent changes.

Autoritatea de Supraveghere Financiara (ASF, Financial Supervisory Authority). A technical pre-clearance of IT systems by the Authority for Digitalisation of Romania (ADR) is also required before ASF grants a licence - a Romania-specific extra step.

Romania's MiCA implementation is unsettled and sources conflict. 2025 commentary cited GEO 10/2025 (reported in force from 13 Mar 2025) as designating ASF and BNR, but that ordinance amends Romania's AML law rather than designating MiCA authorities. ASF stated on the record on 1 Jul 2026, and again directly to StartupCafe on 5 Jul 2026, that no Romanian authority has been designated as competent for MiCA, that the implementing act remains a Ministry of Finance draft emergency ordinance, and that ASF cannot receive or resolve authorisation applications. Parliament returns from recess on 1 Sep 2026, the earliest point at which the stalled draft could resume progress. The EU-wide transitional period ended 1 Jul 2026, leaving Romanian firms reliant on passporting from other member states in the interim.

Payment Services Act 2019 Digital Payment Token (DPT) service licence, held as a Standard (SPI) or Major Payment Institution (MPI) - most crypto firms are MPIs. Plus the newer DTSP regime (FSMA 2022 Part 9) and a finalised (not-yet-legislated) stablecoin issuer framework.

Monetary Authority of Singapore (MAS) - central bank and integrated regulator; administers the PSA, the DTSP regime, the SFA and the stablecoin framework.

DTSP regime (FSMA Part 9) commenced 30 Jun 2025 - Singapore firms serving only overseas customers must be licensed, and MAS 'will generally not issue' such licences (no transition). MPI DPT licensees ~37 by mid-2026. MAS revoked Bsquared Technology's MPI licence (May 2026). Stablecoin legislation still in drafting.

MiCA CASP authorisation under Regulation (EU) 2023/1114, supplemented nationally by Act No. 248/2024 Coll. on certain obligations and authorisations in the field of crypto-assets (adopted September 2024).

Narodna banka Slovenska (NBS, National Bank of Slovakia)

Act No. 248/2024 Coll. entered into force to implement MiCA nationally; the transitional/grandfathering deadline for existing VASPs expired 30 December 2025, meaning all Slovak crypto firms must now hold full NBS CASP authorisation.

MiCA CASP authorisation under Regulation (EU) 2023/1114, supplemented by the national Law on the Implementation of the EU Regulation on Crypto-Asset Markets (ZIUTK), in force from 23 November 2024.

Agencija za trg vrednostnih papirjev (ATVP, Securities Market Agency) for ordinary CASP authorisation, supervision, qualifying holdings, and white-paper matters; Banka Slovenije handles e-money-token matters.

ZIUTK in force since November 2024 as the national implementing law; the national transitional/grandfathering period for legacy providers expired 1 July 2025, earlier than Slovakia's, tightening the runway for unlicensed Slovenian crypto firms.

VASP registration (not a discretionary licence) under the Act on Reporting and Using Specified Financial Transaction Information (the 'FTRA'/AML Reporting Act, amended effective 25 Mar 2021), which requires: (1) ISMS certification from KISA (Korea Internet & Security Agency); (2) for KRW fiat on/off-ramp services, a bank-issued real-name verified account; plus fit-and-proper/AML program requirements. Layered on top since 19 July 2024 is the Act on the Protection of Virtual Asset Users (VAUPA), which adds customer-asset segregation, insurance/reserve, and market-abuse rules but does not replace the underlying FTRA registration.

Financial Services Commission (FSC), Korea's top financial policymaker; Korea Financial Intelligence Unit (KoFIU, also referred to as FIU), an FSC-subordinate unit established 2001 under the FTRA that receives and processes VASP registrations and AML reporting; day-to-day supervision/inspection is delegated to the Financial Supervisory Service (FSS), which set up dedicated Virtual Asset Supervision/Investigation bureaus (announced 29 Nov 2023). FSC retains final sanctioning authority.

The 20 Aug 2026 tightening is now identifiable as Act No. 21358 (amendment to the FTRA/AML Reporting Act), promulgated 19 Feb 2026 and taking effect 20 Aug 2026. It removes the KRW 1,000,000 Travel Rule de minimis threshold and separately expands VASP entry screening: adds a statutory definition of major shareholders, extends fit-and-proper disqualification checks to major shareholders, adds financial condition, social credibility, organisational, staffing and IT review factors, and authorises KoFIU to attach conditions when accepting a VASP report. Existing registered VASPs must re-report under the amended Article 7 within 3 months of the effective date (by approximately 20 Nov 2026). Separately, a Foreign Exchange Transactions Act amendment creating cross-border VASP registration passed 7 May 2026 (effective date disputed, 2 Aug vs 2 Dec 2026). The FSC's implementing-decree package (public comment 30 March to 11 May 2026) adds entry screening for VASP re-reports: a debt-ratio ceiling of 200 per cent excluding customer deposits, a three-year clean default record, fit-and-proper tests for officers and major shareholders, and AML staffing requirements; it removes the KRW 1,000,000 Travel Rule de minimis entirely and treats cross-border transfers of KRW 10,000,000 or more to foreign VASPs or private wallets as automatically suspicious.

MiCA CASP Authorisation granted by the Comisión Nacional del Mercado de Valores (CNMV); Banco de España separately supervises stablecoin (ART/EMT) issuance

Comisión Nacional del Mercado de Valores (CNMV) - lead CASP authority; Banco de España co-supervises stablecoin issuers

The CNMV's own register shows a bank-led adoption pattern: home-authorised providers include BBVA, CaixaBank, Cecabank, Kutxabank, Open Bank and Renta 4 alongside fintechs such as Bit2Me, Criptan Trade and Crossmint Europe, 10 in total by late Jun 2026. CNMV published updated MiCA Q&A guidance in Dec 2025 ahead of full application from 1 Jul 2026.

MiCA CASP authorisation under EU Regulation 2023/1114, administered directly by Finansinspektionen (FI) under Sweden's existing financial supervisory framework (no major new primary legislation was flagged as required, unlike Belgium/Poland). Sweden's national transitional period for pre-MiCA providers closed 30 September 2025.

Finansinspektionen (FI), Sweden's single competent authority for CASP authorisation and supervision under MiCA.

Sweden's transitional period closed 30 September 2025, after which all CASPs needed full MiCA authorisation to continue operating, a materially earlier cutoff than the EU default. As of 3 March 2026, Sweden had 1 CASP authorisation (source: Bank of Lithuania comparative announcement). No update since; the current figure may be marginally higher.

No single crypto licence - regulated by economic function (FINMA token taxonomy; DLT Act 2021). Typical exchange/custodian/broker needs SRO/AMLA affiliation (e.g. VQF) plus, where deposits/custody are involved, a FinTech licence (Banking Act Art. 1b); larger deposit-taking needs a banking licence; a DLT trading facility needs FinMIA authorisation.

FINMA (Swiss Financial Market Supervisory Authority) grants all prudential licences; for AML only, firms affiliate with a FINMA-recognised SRO (e.g. VQF).

FINMA licensed the first DLT trading facility (BX Digital, 18 Mar 2025); Federal Council consultation (22 Oct 2025 - 6 Feb 2026) proposes to ABOLISH the FinTech licence and replace it with two new categories, Payment Instrument Institutions and Crypto-Institutions, under an amended Financial Institutions Act (FinIA). Confirmed timeline as of this check: new provisions are not expected to enter into force before 2027; existing FinTech-licensed firms will be automatically transitioned to the new Payment Instrument Institution licence without a fresh application, provided they meet the new rules within one year of entry into force. The reform also removes the current CHF 100m deposit cap and adds client-fund segregation on insolvency. FINMA Guidance 01/2026 on crypto custody (12 Jan 2026).

Digital Asset Business licence under the Emergency Decree on Digital Asset Businesses B.E. 2561 (2018), as amended (most significantly by an April 2025 amendment extending extraterritorial scope). Categories, each with its own capital tier: Digital Asset Exchange, Digital Asset Broker, Digital Asset Dealer, ICO Portal, Digital Asset Fund Manager, Digital Asset Advisory Service and Digital Asset Custodial Wallet Provider.

Securities and Exchange Commission (SEC) Thailand is the primary licensing/supervisory authority; the Ministry of Finance formally grants the licence on SEC recommendation. The Ministry of Digital Economy and Society (MDES) holds blocking powers over unlicensed platforms (added by the 2025 amendment). The Bank of Thailand has a consultative role for certain payment-related and stablecoin aspects.

April 2025: extraterritorial scope amendment plus MDES no-court-order blocking powers, the biggest regulatory shift in this period. 1 November 2024: new capital requirement notification (KorThor. 28/2567) took effect, phased to full compliance by 1 November 2025. May-June 2025: first major enforcement wave blocking 5 offshore exchanges. Early 2026: criminal complaints filed against local/overseas joint-operation arrangements, signaling a shift from blocking to prosecution. ERX rebranded as KuCoin Thailand in 2025 following acquisition by KuCoin, illustrating global exchanges entering via licensed local subsidiaries.

Crypto Asset Service Provider (CASP) operating licence/permit under Law No. 7518 (amendment to Capital Markets Law No. 6362), adopted 26 June 2024, in force 2 July 2024. Secondary regulation via Communiqués III-35/B.1 (establishment/operating principles) and III-35/B.2 (operating procedures and capital adequacy), published in Official Gazette No. 32840, 13 March 2025. Distinguishes platform operators (exchanges) from custody-only providers.

Capital Markets Board of Turkey (CMB / Sermaye Piyasası Kurulu, SPK). AML/CFT compliance is separately overseen by MASAK (Financial Crimes Investigation Board).

Secondary regulations (Communiques III-35/B.1 and III-35/B.2, 13 March 2025) operationalised Law 7518. Following a February 2026 amendment to the Turkish Capital Markets Association (TCMA/TSPB) statute (effective 27 Feb 2026), CMB-licensed Crypto Asset Service Providers must apply for TCMA membership within 3 months of obtaining their CMB operating permit, and a dedicated professional committee for CASPs has been created within the TCMA structure. In March 2026 the CMB extended certain deadlines on custody agreements and authorisation certificates. SPK's annual statutory revaluation (Bulletin 2025/68, Board Decision of 30 December 2025) raised the 2026 minimum capital under Communique III-35/B.2 from TRY 150,000,000 to TRY 250,000,000 for trading platforms and from TRY 500,000,000 to TRY 630,000,000 for custody providers. The final transitional compliance deadline of 30 June 2026 has passed; SPK's provisional lists (rechecked 15 July 2026) still show 56 entities declaring themselves in operation and 52 in liquidation, unchanged from 10 July 2026.

VARA VASP licence under the Virtual Assets and Related Activities Regulations 2023 - licensed PER ACTIVITY (Advisory, Broker-Dealer, Custody, Exchange, Lending & Borrowing, Management & Investment, Transfer & Settlement, plus VA Issuance). A DET/free-zone commercial licence is also required.

VARA (Virtual Assets Regulatory Authority) - sole authority across the Emirate of Dubai except the DIFC. Parallel UAE regimes exist: ADGM/FSRA (Abu Dhabi), DFSA (DIFC), and federal SCA/Central Bank.

'Rulebook 2.0' reissued all twelve rulebooks effective 19 Jun 2025 (mandatory Travel Rule, wind-down plans, TLPT, a new VA Issuance rulebook). VARA issued a circular implementing UAE federal anti-money laundering, counter-terrorism financing and proliferation financing requirements for VASPs (4 March 2026), an updated Travel Rule circular (24 February 2026), and an AML/CFT Business Risk Assessment Guidance (12 June 2026). VARA's rulebook site separately hosts a non-binding Guidance on the Virtual Asset Issuance Rulebook, covering two issuance pathways (Category 1: fiat- and asset-referenced tokens needing a VARA licence and reserve assets, except direct-ownership tokens; Category 2: other tokens, distributed only via VARA-licensed distributors or broker-dealers); this document carries no visible date on VARA's own rulebook page, but contemporaneous legal reporting consistently dates its publication to 9 April 2026. VARA has previously stated it penalised around 19 unlicensed firms. Legal-press reporting records VARA's 50th VASP licence (Tribe Tokenisation FZE) in early July 2026. No VARA news items have been published since 12 June 2026 as of 15 July 2026. VARA's own public register listed 52 licensed VASPs as of 1 August 2026, the most recent being Flipster FZE (exchange services, 14 July 2026); the register dates Tribe Tokenisation FZE, earlier reported by legal press as the 50th licensee, to 22 June 2026. No new VARA circular has been published since the 12 June 2026 AML/CFT Business Risk Assessment Guidance.

No single federal crypto licence. Fragmented dual-layer regime: (a) State-level Money Transmitter Licence (MTL), required in 49 states (all except Montana) plus DC, applied for via NMLS (Nationwide Multistate Licensing System) under each state's money transmission statute (31 states have adopted the Money Transmission Modernization Act, MTMA, in full or part as of Feb 2026); (b) Federal FinCEN Money Services Business (MSB) registration under the Bank Secrecy Act, via FinCEN Form 107, required for any business acting as a money transmitter/administrator/exchanger of convertible virtual currency. Some states have specific regimes (e.g., NY BitLicense from NYDFS, 23 NYCRR Part 200) as an alternative/superseding requirement.

No single federal crypto regulator. Federally, FinCEN (US Treasury) handles MSB registration and BSA/AML oversight. At the state level, each state's banking/financial-services department (e.g., NYDFS in New York, DFPI in California) issues and supervises money transmitter licences via NMLS. The SEC and CFTC separately assert jurisdiction over certain crypto activities (securities/commodities), the allocation of that jurisdiction is the subject of the pending CLARITY Act.

The GENIUS Act's 18 July 2026 deadline for federal implementing rules passed with no agency having finalised a rule: the OCC, FDIC, NCUA and Treasury (with FinCEN and OFAC) have issued proposed rules since December 2025, the Federal Reserve joined a five-agency customer identification proposal on 18 June 2026, and on 27 July 2026 the OCC sought approval for stablecoin issuer application forms (comments due 25 September 2026). The Act sets no penalty for the missed deadline; it takes effect on the earlier of 18 January 2027 or 120 days after final rules. The CLARITY Act remains stalled in the Senate: reported by the Banking Committee on 1 June 2026 with a substitute amendment, no cloture motion filed and no floor vote expected before the August recess; Senate Republicans circulated revised negotiating text on 22 July 2026. The SEC's three planned crypto rulemakings (token issuance safe harbour, broker-dealer capital and custody amendments, market structure) remained unpublished as of late July 2026.