One crypto product, many regulators. Map the activities first.

Most crypto founders ask the licensing question country by country. Do we need a licence in France? In Dubai? In Singapore? Each answer takes weeks, and each one starts from scratch because the lawyer first has to work out what the product actually does.

There is a faster way. Regulators across the EU, the UK, the US, Asia and the Middle East mostly regulate activities, not tokens. If you write down once, in plain terms, what your product does, for whom and from where, every local conversation starts from the same map. That map is the most useful compliance document a multi-market crypto business can own.

This article explains how to build that map, then walks through how the main regimes read it. It is a starting point for planning, not a substitute for local advice in each market you enter.

Start with activities, not tokens

Founders often begin with the token: is it a security, a utility token or a stablecoin? That matters, but it is only half the picture. Most licensing regimes are triggered by the service you provide around crypto-assets, whatever the token is called.

The same handful of activities appears in almost every regime, from the EU’s MiCA to Singapore’s Payment Services Act and Dubai’s VARA rulebooks. Names differ, but the substance is close. If your product performs any of these for customers, assume a licence or registration question somewhere.

Exchanging crypto for money, or one crypto-asset for another
Operating a trading platform that matches buyers and sellers
Holding customers’ assets or private keys (custody)
Transferring crypto on behalf of customers
Receiving and passing on orders, or executing them for clients
Giving advice or managing portfolios of crypto-assets
Issuing a token, especially one pegged to a currency (a stablecoin)

What goes on the activity map

The map is a short table, not a legal memo. For each feature, record the activity, who the customer is and where they are, and which entity in your group provides it. Add how money and crypto flow in and out. A one-page version is enough for a first conversation with counsel in any market.

Be honest about edge cases. A “non-custodial” wallet that can freeze funds, or a swap feature routed through a partner, may look different to a regulator than it does in your pitch deck. It is cheaper to flag these early than to discover them during an application.

Service: which of the activities above each feature performs
Customers: retail or professional, and their countries of residence
Custody: who controls the keys at each step
Fiat on- and off-ramps: which banks or payment partners are involved
Token types: payment, stablecoin, security-like or utility
Entity and staff: where the contracting company and key people sit
Marketing: which countries you actively target, and in which languages

EU: MiCA, one authorisation and a passport

The Markets in Crypto-Assets Regulation (MiCA) has applied in full since December 2024. A crypto-asset service provider, or CASP, must be authorised in one EU member state. Once authorised, it can “passport” its services, meaning it can serve clients across the EU after notifying regulators rather than applying again in each country.

The transitional period for firms that operated under older national regimes ended on 1 July 2026. Any business serving EU clients today without a MiCA authorisation, or a clear exemption, is out of line with EU law. MiCA’s exemption for clients who approach you entirely on their own initiative, known as reverse solicitation, is narrow and should not be your market-entry plan.

Token issuers face separate rules. Most public token offers need a white paper, a standard disclosure document, and marketing must be fair and consistent with it. Stablecoins are split into e-money tokens, which reference one official currency, and asset-referenced tokens, which reference other assets. Both carry reserve and redemption duties that applied from June 2024.

Two other EU laws travel with MiCA. The Transfer of Funds Regulation applies the Travel Rule to crypto transfers between providers from 30 December 2024, regardless of the amount. DORA, the EU’s digital operational resilience law, adds ICT risk, incident reporting and vendor contract duties for CASPs.

UK: a new regime arriving in 2027

Today, UK crypto businesses register with the Financial Conduct Authority (FCA) for anti-money-laundering purposes, and promotions of crypto-assets to UK consumers must follow the FCA’s financial promotion rules. Registration is not a full licence, and it does not cover conduct in the way MiCA does.

That changes. Legislation made in 2026 brings crypto activities such as trading platforms, dealing, custody and stablecoin issuance into the UK’s main financial services perimeter. Law firm briefings report a go-live date of 25 October 2027, with firms needing to apply for FCA permission in an application window before then. Existing registrations do not convert automatically, so a firm already on the UK register still needs a plan.

US: federal and state layers

The US has no single crypto licence. Businesses that transmit value usually register with FinCEN, the Treasury’s financial intelligence unit, as a money services business. Most states then require their own money transmitter licence, and New York has a dedicated BitLicense regime. Whether a token is a security under federal law remains a separate, fact-specific question.

Stablecoins now have a federal framework. The GENIUS Act, signed in July 2025, creates a licensing regime for payment stablecoin issuers. It takes effect on the earlier of 18 January 2027 or 120 days after regulators issue final implementing rules. Congress has also debated broader market-structure legislation, so check its status before you plan a US launch around it.

Asia and the Middle East: purpose-built regimes

Singapore licenses digital payment token services under the Payment Services Act, supervised by the Monetary Authority of Singapore (MAS). Since 30 June 2025, firms operating from Singapore that serve only overseas customers also need a licence, and MAS has said it will grant these only in very limited cases. A Singapore entity is not a shortcut to global reach.

Hong Kong requires centralised trading platforms to be licensed by the Securities and Futures Commission, and its Stablecoins Ordinance requires issuers of fiat-referenced stablecoins to be licensed by the Hong Kong Monetary Authority. In the UAE, Dubai’s Virtual Assets Regulatory Authority (VARA) has licensed virtual-asset activities since 2023, while the ADGM and DIFC financial free zones run their own regimes.

Each of these hubs has its own capital, custody and conduct expectations. Market entry is usually a local-counsel question. The activity map, risk disclosures and AML controls you bring to that conversation decide how fast it goes.

India: AML registration and tax

India has no dedicated crypto licensing law. It regulates the sector mainly through tax and anti-money-laundering rules. Since March 2023, “virtual digital asset” (VDA) service providers that exchange, transfer, safekeep or administer VDAs for Indian users are reporting entities under the Prevention of Money-laundering Act (PMLA), and must register with FIU-IND, India’s financial intelligence unit.

This applies to offshore platforms too. FIU-IND has issued notices to unregistered offshore exchanges and asked for their websites to be blocked. On the tax side, gains on VDA transfers are taxed at 30%, and 1% tax deducted at source (TDS) applies to many transfers, which affects pricing and product design for Indian users.

Reuse the map across every market

Some controls are common to nearly every regime. FATF, the global anti-money-laundering standard-setter, expects countries to apply the Travel Rule, meaning originator and beneficiary details travel with transfers between providers. Customer due diligence, sanctions screening and transaction monitoring are expected everywhere. Build these once, to the strictest market you serve, and choose Travel Rule tooling that works across counterparties in all of them.

Other decisions are local and should be made deliberately. Which markets will you actively market to? Where will you geo-block? Which entity contracts with which customers? A clear activity map lets you answer these consistently, and lets you show a regulator, a bank partner or an investor that you have thought about them.

Checklist

List every feature and the crypto activity it performs, in plain language.
Record where customers are, whether they are retail or professional, and how you reach them.
Map who controls private keys at each step of every flow.
Identify every fiat on- and off-ramp partner and the licences they hold.
Classify each token you issue or list, and flag any stablecoins.
Confirm whether EU clients are served under a granted MiCA authorisation.
Plan for the UK FCA application window if UK customers matter to you.
Implement Travel Rule, sanctions and KYC controls to your strictest market’s standard.
Decide which markets you will actively target and which you will geo-block.
Review the map whenever you add a feature, a partner or a market.

FAQs

We are non-custodial. Do we still need a licence?

Often less, but not always nothing. If you never control customer assets and do not exchange or transfer them on customers’ behalf, many regimes will not apply. But features such as integrated swaps, fee collection or the ability to freeze funds can change the analysis, so map them carefully.

Does a MiCA authorisation let us serve customers outside the EU?

No. MiCA passporting works only within the EU. Serving the UK, the US, Singapore, the UAE or India needs its own analysis under each local regime, although your MiCA controls will make those conversations easier.

Can we rely on customers finding us themselves?

Rarely. Reverse solicitation exemptions are narrow, and regulators look at your marketing, language choices, app store listings and influencer campaigns. If you are visibly targeting a market, assume its rules apply.

Is the Travel Rule the same everywhere?

The FATF standard is common, but implementation differs. The EU applies it to crypto transfers regardless of amount, while other countries use thresholds and different data fields. Choose tooling that can handle these variations.

Where should we set up first?

It depends on where your customers are, not where licensing looks easiest. Start from the activity map and your customer base. Then pick the regime that covers your largest market and gives you controls you can reuse elsewhere.

Primary sources

EUR-Lex · Markets in Crypto-assets Regulation FIU-IND · Financial Intelligence Unit India

General information, not legal advice.