The licensing matrix

Today: FCA registration under the Money Laundering Regs 2017 (AML/CTF only). Incoming: full FSMA authorisation for cryptoassets (SI 2026/102, made 4 Feb 2026, laid 5 Feb) - gateway opens 30 Sep 2026, mandatory regime commences 25 Oct 2027; no automatic conversion from MLR registration.

Financial Conduct Authority (FCA); HM Treasury sets the legislative perimeter; Bank of England for systemic stablecoin issuers.

No minimum initial capital under the current MLR registration. The incoming FSMA regime's final prudential rules (PS26/12, 30 Jun 2026) set Permanent Minimum Requirements by activity: GBP 75,000 (arranging/dealing as agent), 150,000 (custody, trading platform, staking), 350,000 (stablecoin issuance), 750,000 (dealing as principal).

MLR registration: 3-month statutory clock from a COMPLETE application, but realistically ~9-12 months including pre-application; historically low approval rate.

Business must be carried on in the UK (UK entity in practice); an MLRO / nominated officer (Reg 21(3)) who is UK-based, genuinely competent, independent and closely involved.

FCA application fee GBP 11,150 (Category 6, non-refundable) plus typically GBP 50k-150k in professional fees; ~GBP 90k all-in representative (~EUR 105k at 1.16).

Annual FCA periodic fee under fee-block G.30 (renumbered from G.23): minimum GBP 2,229 for 2025/26 plus GBP 15.13 per GBP 1,000 of cryptoasset income above GBP 100,000. Plus AML operations, annual audit and compliance headcount; costs rise materially under the incoming FSMA regime.

No - post-Brexit the UK regime is standalone; no EU/EEA passport and no MiCA equivalence in either direction.

Not applicable: non-MiCA jurisdiction, no CASP regime. See this jurisdiction's own licence route.

Cryptoasset financial promotions regime (since 8 Oct 2023): mandatory risk warnings, 24-hour cooling-off for first-timers, ban on incentives; plus significant bank de-risking / de-banking of crypto firms.

SI 2026/102 made 4 Feb 2026 (laid 5 Feb); FCA final rules published 30 Jun 2026 (PS26/10 stablecoins, PS26/11 regulated activities, PS26/12 prudential); authorisation gateway 30 Sep 2026-28 Feb 2027; mandatory FSMA regime from 25 Oct 2027.

4 - rigorous AML bar, historically low approval rate and severe bank-access friction; the incoming FSMA prudential/conduct regime raises the bar further.

MiCA Crypto-Asset Service Provider (CASP) authorisation under Title V of Reg (EU) 2023/1114; replaced the national VASP registration. Single passportable licence covering the services applied for.

Bank of Lithuania (Lietuvos bankas) - single competent authority. Publicly selective stance: wants few, solid firms rather than the ~370-strong legacy VASP pool.

Lithuania used a shortened 12-month grandfathering - legacy VASP cover ended 1 Jan 2026 (vs the EU 1 Jul 2026 backstop). First CASP: Robinhood Europe (29 May 2025); only ~4 CASPs authorised by Mar 2026.

MiCA CASP authorisation implemented by Lei n.o 69/2025 (22 Dec 2025). Replaces the legacy Banco de Portugal VASP (AML) registration.

Twin-peaks: BANCO DE PORTUGAL is the CASP authorisation authority + prudential/AML supervisor (single application front door); CMVM is the conduct-of-business and market-abuse supervisor. (Corrects the seed - not CMVM-led.)

Lei 69/2025 (MiCA) + Lei 70/2025 (Travel Rule) published 22 Dec 2025 - ~1 year late. Legacy-VASP transitional window closes 1 Jul 2026 (today). Few Portugal-AUTHORISED CASPs so far.

No dedicated public-facing crypto licence. Ley Fintech (2018) offers the IFPE (e-money institution) and IFC (crowdfunding) routes; virtual-asset operations by regulated entities need Banxico authorisation (internal-only, effectively not granted for customer crypto).

CNBV authorises/supervises ITFs (with the Comite Interinstitucional); Banco de Mexico (Banxico) controls virtual-asset authorisations and payments; SHCP/SAT/UIF for AML; CONDUSEF for consumer protection.

Major AML Law reform enacted 16 Jul 2025 (VASPs serving Mexican residents in scope; Travel Rule; 10-yr records). Banxico (Dec 2025) reiterated stablecoins pose financial-stability risks. A Fintech Law 2.0 is discussed but NOT enacted.

MiCA CASP authorisation granted by the Central Bank of Ireland; replaces the legacy VASP registration (CJA 2010, AML). No simplified VASP->CASP conversion - all applicants face the full process.

Central Bank of Ireland (CBI) - sole competent authority; runs an Innovation Hub. Known as a demanding, gatekeeper-style regulator.

Transitional period ended 30 Dec 2025 (12 months; simplified route declined). ~10 CASPs authorised by late 2025 (Kraken Jun 2025, Coinbase, StoneX 10th). Revised Consumer Protection Code from 24 Mar 2026.

MiCA CASP authorisation under the Markets in Crypto-Assets Act (Cap. 647); replaces the legacy VFA licence (VFA Act 2018) via a fast-track conversion. Malta granted one of the EU's first full CASP licences (Jan 2025).

Malta Financial Services Authority (MFSA) - single competent authority; a long-standing crypto supervisor since the 2018 VFA regime.

First-mover: Crypto.com licensed 27 Jan 2025; ~13 CASPs now authorised (OKX, Gemini, Gate, Blockchain.com). ESMA's 10 Jul 2025 peer review criticised the MFSA's authorisation of one CASP, tightening scrutiny. Transition ends 1 Jul 2026.

MiCA CASP authorisation (French 'agrement PSCA'); replaces the legacy PSAN regime (mandatory AML registration + optional licence). A single authorisation covers the 10 MiCA services.

AMF (Autorite des marches financiers) grants and supervises the CASP authorisation; ACPR (Banque de France) gives binding assent on AML/CFT and prudential aspects via a joint examination team.

France used the full 18-month transition, ending 1 Jul 2026 (today). Deblock first CASP (May 2025), SG-Forge (Oct 2025); ~18 CASPs authorised by 28 May 2026. AMF adopted ESMA staff knowledge/competence guidelines (Mar 2026).

MiCA CASP authorisation granted by BaFin under national law FinmadiG/KMAG; replaces the legacy KWG crypto-custody business licence, with a simplified transition for existing KWG-licensed firms.

BaFin (Bundesanstalt fur Finanzdienstleistungsaufsicht) with Deutsche Bundesbank involvement; applications go to both. Widely regarded as the EU's most demanding CASP regulator.

FinmadiG + KMAG in force 27 Dec 2024; Germany used a 12-month grandfathering (apply before 8 Oct 2025; effective end-2025). By mid-2026 the EU's #1 hub - ~57 CASP authorisations (~23% of the EU's ~244), incl. Trade Republic, N26, Commerzbank, Bitpanda.

No single crypto licence - regulated by economic function (FINMA token taxonomy; DLT Act 2021). Typical exchange/custodian/broker needs SRO/AMLA affiliation (e.g. VQF) plus, where deposits/custody are involved, a FinTech licence (Banking Act Art. 1b); larger deposit-taking needs a banking licence; a DLT trading facility needs FinMIA authorisation.

FINMA (Swiss Financial Market Supervisory Authority) grants all prudential licences; for AML only, firms affiliate with a FINMA-recognised SRO (e.g. VQF).

FINMA licensed the first DLT trading facility (BX Digital, 18 Mar 2025); Federal Council consultation (22 Oct 2025 - 6 Feb 2026) proposes to ABOLISH the FinTech licence and create Payment/Crypto Institution categories; FINMA Guidance 01/2026 on crypto custody (12 Jan 2026).

VARA VASP licence under the Virtual Assets and Related Activities Regulations 2023 - licensed PER ACTIVITY (Advisory, Broker-Dealer, Custody, Exchange, Lending & Borrowing, Management & Investment, Transfer & Settlement, plus VA Issuance). A DET/free-zone commercial licence is also required.

VARA (Virtual Assets Regulatory Authority) - sole authority across the Emirate of Dubai except the DIFC. Parallel UAE regimes exist: ADGM/FSRA (Abu Dhabi), DFSA (DIFC), and federal SCA/Central Bank.

'Rulebook 2.0' reissued all twelve rulebooks effective 19 Jun 2025 (mandatory Travel Rule, wind-down plans, TLPT, a new VA Issuance rulebook). AML circular (Mar 2026) and token-issuance guidance (Apr 2026). VARA penalised ~19 unlicensed firms.

Payment Services Act 2019 Digital Payment Token (DPT) service licence, held as a Standard (SPI) or Major Payment Institution (MPI) - most crypto firms are MPIs. Plus the newer DTSP regime (FSMA 2022 Part 9) and a finalised (not-yet-legislated) stablecoin issuer framework.

Monetary Authority of Singapore (MAS) - central bank and integrated regulator; administers the PSA, the DTSP regime, the SFA and the stablecoin framework.

DTSP regime (FSMA Part 9) commenced 30 Jun 2025 - Singapore firms serving only overseas customers must be licensed, and MAS 'will generally not issue' such licences (no transition). MPI DPT licensees ~37 by mid-2026. MAS revoked Bsquared Technology's MPI licence (May 2026). Stablecoin legislation still in drafting.

SFC Virtual Asset Trading Platform (VATP) licence on a dual basis: under the AMLO and, for tokens that are securities, under the SFO (Type 1 dealing + Type 7 automated trading). Stablecoin issuance is separately licensed by the HKMA under the Stablecoins Ordinance (Cap. 656).

SFC regulates VATPs and security-token activity; HKMA regulates stablecoin issuers and banks' VA activities. Staking and intermediary VA activity are covered by joint SFC-HKMA circulars.

SFC 'ASPIRe' roadmap (19 Feb 2025); VATP staking guidance (7 Apr 2025); HKMA Stablecoins Ordinance commenced 1 Aug 2025 with the first two issuer licences (HSBC, Anchorpoint) granted 10 Apr 2026; VA dealing (OTC) and custody licensing consultation conclusions 24 Dec 2025 (legislation targeted 2026). ~13 VATPs licensed by mid-2026 - confirm live count on the SFC list.

GFSC DLT Provider licence under the Financial Services (DLT Providers) Regulations 2020 (in force since 1 Jan 2018), required of any firm using DLT to store or transmit value belonging to others in/from Gibraltar. Principles-based (10 core principles), not a MiCA-style category licence.

Gibraltar Financial Services Commission (GFSC), with a dedicated DLT/innovation team running pre-application engagement; also the AML/CFT supervisor under the Proceeds of Crime Act 2015.

Fee increases in force 1 Apr 2025 (application GBP 45k; annual trade-fee cap GBP 90k); world-first Digital Clearing & Settlement Framework announced 13 May 2025; Restricted Promotions rules (May 2025); CARF adoption from 2026; and a DLT Regs overhaul with progressive MiCA-alignment signalled Feb 2026 (draft expected 2026). UK transitional passporting extended to 31 Dec 2026.