A founder arrives with a plan to offer EURUSD, gold and bitcoin on one platform, one wallet, one login. Commercially that is a single product. Legally it is at least two regulated businesses, because a contract for difference on bitcoin and the sale of an actual bitcoin are governed by different regimes with different supervisors, capital and client protections. Nothing about the platform tells you this. The rulebook does.
What each authorisation permits
The forex side is old law. Currency and commodity derivatives are financial instruments, so offering them means holding an investment firm licence, whether that is a CIF authorisation in Cyprus, an FCA permission in the United Kingdom, or the equivalent elsewhere. The permissions are granular: reception and transmission of orders, execution on behalf of clients, dealing on own account. A firm running a B book is dealing on own account, and the regulator will expect the application to say so plainly.
The crypto side is new law. In the EU it now runs through authorisation as a crypto-asset service provider, with permissions attached to specific services: custody, exchange of crypto for funds, execution of orders, transfer, advice, portfolio management. A firm that only converts euro to a token for its own deposit flow needs a different permission set from a firm that holds client coins on its balance sheet. The mechanics are set out in the guide to the MiCA licence.
The line that catches most founders is the derivative one. A CFD on bitcoin is a financial instrument, so it belongs to the investment firm regime, not the crypto regime, and it inherits every retail protection that comes with it. A crypto authorisation on its own does not permit it, and a forex licence on its own does not permit selling spot coins.
| Investment firm licence | Crypto-asset service provider | |
|---|---|---|
| Covers | FX, indices, commodity and crypto CFDs | Spot crypto exchange, custody, transfers |
| Core rulebook | MiFID II and MiFIR, prudential rules for investment firms | MiCA and its technical standards |
| Retail leverage | Capped by product intervention measures | Not applicable, spot only |
| Client assets | Money segregated at credit institutions | Crypto held in segregated wallets, with issuer and custodian liability |
| Compensation scheme | Investor compensation cover in many member states | No equivalent scheme |
| Reporting | Transaction reporting to the regulator | Transfer information under the travel rule |
Capital, people and the file
Both regimes set an initial capital figure that scales with the permissions requested, and both then apply an ongoing requirement based on fixed overheads and activity, so the number that matters is not the entry ticket but what the balance sheet has to carry in year two. Founders consistently underestimate this. The comparison of broker licence costs sets out the shape of it across jurisdictions.
The people requirement is where applications actually fail. Regulators want directors and senior managers with relevant experience, resident where the licence is, spending real time on the business, and they want more than one of them. A crypto file additionally needs someone who can explain key management, wallet architecture and how client coins are kept apart from house coins, in operational detail rather than in vendor slides. A forex file needs someone who can explain the risk book: what is hedged, with whom, and what happens when a single client makes the book directional.
Anti money laundering obligations apply to both, with the same officer roles and the same monitoring duties, and the crypto side adds transfer information requirements for every movement of tokens. Firms that already run onboarding for a brokerage find the incremental work manageable. Firms starting from nothing usually underestimate it by a factor.
Client money is the real dividing line
An investment firm holds client money in segregated accounts at credit institutions and, in most European jurisdictions, its clients sit behind an investor compensation scheme if the firm fails. That structure is a hundred years of banking law applied to a trading account, and it works because a bank is holding the money.
Crypto custody has no such comfort. Client tokens are held in wallets the firm controls, which means the firm's key management is the client protection. MiCA responds by making the custodian liable to the holder for loss of crypto assets it holds, which is a serious obligation for a small firm to absorb. A brokerage that decides to hold client coins has taken on an operational risk that a segregated bank account never carried, and no insurance product removes it cleanly.
This is why most trading firms that accept crypto do not custody it. Tokens arrive, convert to fiat within minutes, and the client balance is denominated in currency. That design keeps the firm out of custody permissions entirely, at the cost of a conversion spread. What can be accepted, and from which issuers, is the subject of the MiCA stablecoin rules.
Offshore does not mean the same thing in both worlds
The offshore forex market is mature. There is a well travelled path through Seychelles, Mauritius, Vanuatu and Belize, with known costs and known limitations, described in the overview of offshore broker licences. Everybody in the industry understands what those permissions are worth, and payment providers price accordingly.
Offshore crypto is messier. Many jurisdictions offer a registration rather than a licence, the label carries less weight with counterparties, and the binding constraint is rarely the regulator. It is the bank. A crypto business incorporated somewhere convenient can spend a year failing to open a corporate account that will accept exchange settlements, and the licence in the drawer does nothing about it.
In the launches SINGUARD's Executive Directors, Alex Onta & Roman Onta, have worked through with founding teams, the sequence that works is the same each time: decide the products, decide which entity offers each one, get the banking conversation started before the incorporation is final, and only then choose the jurisdiction. Doing it in the other order produces a licence that the payment stack cannot support.
One more warning worth stating plainly. A single entity marketing spot tokens and leveraged CFDs on one website, under one authorisation, is a compliance failure waiting for a routine inspection, and it is the most common structural mistake in the sector. Two products, two permissions, two sets of disclosures, and a client agreement that says which is which.
"Founders ask which licence is cheaper. The licence is the small number. The bank account behind it decides whether the business exists at all."
— Roman Onta, Executive Director, SINGUARD
Key Takeaways
- CFDs on crypto are financial instruments and need an investment firm licence; spot crypto services need a separate crypto authorisation.
- Capital is not the entry ticket but the ongoing requirement, and applications usually fail on the experience and residency of the named senior managers.
- Segregated client money at a bank and self custodied client tokens are different risks, which is why most trading firms convert crypto on receipt.
- Settle banking and payment arrangements before choosing a jurisdiction, because an offshore crypto registration with no account behind it is unusable.
Frequently Asked Questions
Can one licence cover both forex and crypto?
In the EU, no single authorisation covers both. Contracts for difference on currencies are financial instruments and require an investment firm licence, while services in spot crypto-assets require authorisation as a crypto-asset service provider. Groups that want both usually hold two authorisations, sometimes in two entities, and the group structure has to make clear which entity faces the client for which product.
Do I need a licence to offer crypto CFDs?
A contract for difference on bitcoin is a derivative and therefore a financial instrument, so in the EU it sits under the investment firm regime rather than the crypto regime. Offering it also brings the retail protections that come with that regime, including leverage limits set by product intervention measures and negative balance protection. A crypto authorisation on its own does not permit it.
Which authorisation is faster to obtain?
Both are measured in quarters rather than weeks, and the timetable depends far more on the quality of the file than on the regime. Applications stall on the same things in either case: an unconvincing business plan, directors whose experience does not match the permissions requested, unclear ownership, and no banking arrangement in place. Firms that submit a complete file with named senior managers move noticeably faster than firms that submit early and answer questions later.