Two questions sort the entire field, and both come before any comparison of regimes. Does the business hold client crypto or client money, and which residents will it accept? Custody drags in capital, segregation, audit and insurance wherever you go. Client geography decides whose rules apply to your marketing, no matter where the company is registered.
Answer those two and the list of viable jurisdictions usually collapses from twenty to three.
The regimes fall into three tiers
At the top sit full prudential regimes: authorisation with capital requirements, custody obligations, governance review, ongoing supervision and reporting. The EU under MiCA belongs here, as do Singapore, Hong Kong, Japan and the two Emirati frameworks. Applications take many months, sometimes longer, and the supervisor engages with the business model rather than the paperwork.
In the middle are jurisdictions with a defined crypto regime that is lighter on prudential requirements but still supervised, often built on a securities or payments statute extended to digital assets. The Caribbean financial centres largely sit here now, having replaced their early registration approaches.
At the bottom are registration regimes: an entry in a register, an AML programme, a local officer, and comparatively little else. These are quick and inexpensive. Their limitation is not legal, it is commercial, and the reason is banking.
What the main destinations actually offer
| Jurisdiction | Regulator and regime | Suits |
|---|---|---|
| European Union | National competent authorities under MiCA, as a crypto-asset service provider | Firms whose main market is the EU and who want one authorisation to cover it |
| Dubai | VARA for the emirate, DFSA for the DIFC financial centre | Regional presence, exchanges and brokers building substance in the Gulf |
| Abu Dhabi | FSRA in ADGM | Institutional and custody businesses that want a common law framework |
| Singapore | MAS, digital payment token services under the payments legislation | Payments, transfers and exchange businesses with Asian institutional clients |
| Hong Kong | SFC, virtual asset trading platform licensing | Trading platforms prepared for a demanding custody and conduct standard |
| Cayman, BVI, Bahamas | CIMA, BVI FSC, the Bahamas securities regulator | Funds and institutional structures, and firms serving non EU retail |
| Small register jurisdictions | Registration with an AML supervisor | Early stage products, non custodial services, proof of concept |
The EU column deserves a footnote. The registration era there is over, and the transition from the old national regimes is covered in detail in the comparison of MiCA and national VASP regimes. Dubai is worth reading carefully too, because the emirate and the DIFC are separate perimeters with separate regulators, and firms occasionally apply to the wrong one. The DFSA framework covers the financial centre only.
A licence you cannot bank is a licence you cannot use. Correspondent banks and payment providers keep their own view of which regulators they accept, and that view is stricter than any official list. Ask a prospective banking partner about a jurisdiction before you pay an application fee, not after.
The costs that do not appear in the comparison tables
Application fees are visible and small relative to the rest. What moves the budget is everything the permission obliges you to keep running: an audit by a firm the regulator accepts, a compliance officer and a money laundering reporting officer who genuinely reside where they claim, directors with relevant experience, professional indemnity cover, and in several jurisdictions a local office with real staff rather than a registered address.
Substance requirements have tightened almost everywhere over the past few years, driven by international tax and AML assessment work. A company with a mailbox and a nominee director is now a problem in most of the places where that used to be the model, which is the quiet story of offshore licensing over the past decade.
Add the technology obligations. Wallet infrastructure, key management, transaction monitoring for on chain activity, and travel rule messaging with counterparty providers all cost money whether the licence names them or not.
Marketing scope is the constraint founders underestimate
A licence authorises activity in the place that issued it. It does not license you into someone else's market. Three regimes have made that explicit in recent years: the EU restricts solicitation of its residents by firms authorised elsewhere, the UK requires financial promotions about cryptoassets to be approved or issued under its own regime, and several Asian supervisors take a similar line on advertising to their residents.
So the practical question about any jurisdiction is not what it permits you to do, but who it permits you to reach. A firm holding a small register permission and running paid campaigns aimed at German or British consumers has a compliance problem in Germany and Britain, and the register that issued its licence will not defend it. Where the business genuinely takes only inbound approaches from clients abroad, the scope of that exemption is far narrower than most operators assume, as covered in the piece on reverse solicitation.
Choosing without wasting a year
Start from the client base, not the map. Write down where your first thousand clients will actually come from, then find the regimes that permit servicing those residents. If they are European, the answer is European authorisation or a partnership with someone who holds it. If they are institutional and Gulf based, the Emirati frameworks are the natural fit. If the product is non custodial and the market is broad, a lighter regime may hold up.
Then test the banking before committing. A short conversation with two prospective payment partners and one bank will tell you more about a jurisdiction's usability than any comparison table, including this one. Firms that hold both a securities permission and a digital asset permission face an extra question about whether one entity can carry both, which is the subject of the comparison between a forex licence and a crypto licence.
Regimes move. Application requirements, transitional arrangements and permitted activities all change on the regulator's timetable, so treat any summary, including this one, as a starting point for a conversation with local counsel rather than a current statement of law.
"Nobody has ever failed because their licence came from the wrong island. They fail because they picked a jurisdiction their payment partners quietly refuse to touch."
— Roman Onta, Executive Director, SINGUARD
Key Takeaways
- Custody and client geography decide the shortlist before any regime comparison starts.
- Banking acceptance, not the application fee, is what makes a jurisdiction usable in practice.
- Dubai and the DIFC are separate perimeters with separate regulators and separate applications.
- A licence never authorises marketing into another country's market, whatever the brochure implies.
Frequently Asked Questions
Which crypto licence is the cheapest to obtain?
Registration style regimes in small jurisdictions are the least expensive to apply for, but application cost is the smallest line in the budget. Banking access, audit, local substance and ongoing compliance staffing usually exceed the licence fee many times over, and a permission that no bank will support has no commercial value.
Does a crypto licence let me serve clients anywhere?
No. A licence authorises activity in the jurisdiction that issued it, plus wherever a treaty or passporting arrangement extends it. Serving residents of another country generally requires that country's permission, and the EU, the UK and several Asian regimes actively restrict solicitation by firms authorised elsewhere.
Can one entity hold both a forex licence and a crypto licence?
Sometimes, and sometimes not. Certain jurisdictions permit a single investment firm to add crypto services under an extended permission, while others require a separate legal entity with its own capital and governance. The activity definitions differ enough that the question has to be asked of the specific regulator rather than answered generically.