How to get a crypto license: EU, US, UK and Brazil routes

The UK, Brazil and Texas each set a date this autumn.

1. 30 September 2026. The FCA opened the application period for the new UK cryptoasset regime, which closes on 28 February 2027.
2. 30 October 2026. The 270 days that BCB Resolution 520 gave providers already operating in Brazil to apply for authorization ran out.
3. 6 November 2026. The Texas Department of Banking signed a consent order with Pionex, a platform whose money transmission license was never granted.

Whether crypto is legal at all comes first, and the answer differs across the 24 markets in the crypto regulations by country reference. Where it is legal, the next question is which permission the market asks for, and the EU, the US, the UK and Brazil each answer it with their own authority and their own file.

Which crypto license does your business need?

You need the permission of every market whose customers you serve, issued by the authority that market names.

Table 1. Crypto license routes in the EU, the US, the UK and Brazil (sources read 12 November 2026)

Every route has two layers. One is the permission to operate. The other is the AML side, which the regulator reads in the file. In the UK the two sit apart until 2027: firms register with the FCA under the Money Laundering Regulations today and need FSMA authorization from 25 October 2027. In the US they stay separate filings with separate authorities, FinCEN for the registration and each state for its license.

The permission follows the customers. Texas acted against Pionex for moving Texas customers' money without a Texas license. The same logic settles the best country question: a license or registration in one of the crypto friendly countries does not open the EU, the US, the UK or Brazil.

MiCA gives institutions that already hold a license a second door. Article 59(1) lets a credit institution, investment firm, electronic money institution or another listed entity provide crypto asset services under Article 60, by notification, instead of applying for authorization under Article 63.

How do you get a CASP license under MiCA?

A firm gets a CASP license by applying for authorization under Article 63 to the competent authority in its home member state. Under Article 59(1) of MiCA, nobody may provide crypto asset services in the Union without that authorization or an Article 60 notification.

The transition is over. Article 143(3) let firms that operated lawfully under national rules before 30 December 2024 carry on until a decision on their application or 1 July 2026, whichever came sooner. No adaptation route is left in November 2026, so a provider that is neither authorized nor notified must stop serving clients in the Union.

Article 62 sets the file. Its point (i) asks for the applicant's "internal control mechanisms, policies and procedures to identify, assess and manage risks, including money laundering and terrorist financing risks", the AML core of a MiCA compliance program. Point (h) asks for every shareholder with a qualifying holding, the size of the holding and proof that each holder is of sufficiently good repute.

Once authorized, a crypto asset service provider (CASP) may serve the whole Union under Article 59(7). It can set up in another member state, a branch included, or serve clients there cross border under the freedom to provide services.

ESMA's interim register shows how firms use the two doors. Its CASP file of 11 November 2026 lists 404 entries with no end date, from 28 home states: 164 Article 60 notifications, 148 Article 63 authorizations, 8 marked as both and 84 with no legal basis given. Standalone authorizations gather in a few home states: France 30, the Netherlands 21, Cyprus 20 and Malta 19 of the 156 entries with Article 63. Germany has the most entries, 130. Of those, 122 are Article 60 notifications.

A crypto license in Italy, the Netherlands or Malta is this same MiCA authorization, applied for at that country's authority.

How do you get a crypto license in the US: FinCEN, state licenses and the BitLicense?

Pionex applied to the Texas Department of Banking for a money transmission license in August 2025, and the file came back incomplete. A second application, filed on 2 September 2025, was not granted, and Pionex withdrew it effective 23 July 2026. In the consent order signed on 6 November 2026, Pionex agreed, without admitting or denying the findings, to a $63,000 penalty for unlicensed money transmission under Texas Finance Code chapter 152. It told the Department it had taken no new Texas money transmission business since 8 August 2026. By 30 June 2027 it must transfer Texas customers' money and monetary value, to the extent feasible.

An application on file authorized nothing. In the US a firm registers with FinCEN, then holds a license in each state that requires one where its customers live.

The federal layer is registration. Under 31 CFR 1022.380, a money services business registers with FinCEN within 180 days of the day after it is established, licensed by a state or not, and renews for each two calendar year period after that. An agent that acts only for another money services business and a seller of prepaid access do not register. A change of ownership or control that makes a state register the business again means a new Form 107 within 180 days, according to FinCEN's registration page. So does a sale of more than a tenth of its voting power or equity, unless the business reports that transfer to the SEC.

Payment stablecoins got a federal law of their own in the GENIUS Act, approved on 18 July 2025.

Which states require a money transmitter license for crypto?

Each state answers by its own statute, so the test is the state's definition of money transmission. Texas shows how far that definition reaches: the order quotes Finance Code section 152.003(19), under which monetary value "includes stablecoin" that is pegged to a sovereign currency, fully backed by reserve assets and redeemable for sovereign currency from the issuer.

By the count of the Conference of State Bank Supervisors (CSBS), 31 states have adopted its model Money Transmission Modernization Act, wholly or partly. Transmitters licensed in at least one of those states account for 99 percent of reported money transmission activity. Adoption runs state by state, and so does the license.

When do you need New York's BitLicense?

New York requires a license from the superintendent of the Department of Financial Services for any virtual currency business activity: under 23 NYCRR 200.3(a), no person may engage in it without one. A company chartered under the New York Banking Law, such as a limited purpose trust company, may do that business without a BitLicense once the superintendent approves it. The application fee is $5,000 under 23 NYCRR 200.5, and it is not refunded if the application is denied or withdrawn. Once licensed, the firm reassesses its risks at least once a year and adjusts its AML program to match, under 23 NYCRR 200.15.

How do you get FCA authorization for a UK crypto license?

A firm gets a UK crypto license by applying to the FCA for authorization under the Financial Services and Markets Act 2000 (FSMA) between 30 September 2026 and 28 February 2027. S.I. 2026/102, made on 4 February 2026, brings the regime fully into force on 25 October 2027 under its regulation 1(2). The FCA's page on the new regime dates its final rules and guidance to 30 June 2026.

Firms that already hold FSMA permissions for other regulated activities vary those permissions instead of applying anew. Registration under the Money Laundering Regulations, the core of the UK AML regime, does not carry over: the FCA says registered firms get "no automatic conversion" and must secure authorization under FSMA.

Until the new regime starts, a firm providing cryptoasset services in the UK must still register before it trades. The FCA has 3 months to decide a registration, so its guidance on MLR registration before the new regime tells firms not to apply after 31 July 2027.

As at 31 October 2026, the FCA had received 92 requests for pre application meetings (14 in October), held 54 meetings and rejected 18 requests. It had received no authorization application and 2 applications to vary an existing permission. It had decided none. Requests have been accepted since 11 May 2026 and meetings held since 1 July 2026.

What happens to a UK firm that misses 28 February 2027?

A firm that applies within the period and is still waiting on 25 October 2027 can keep providing cryptoasset services until its application is finally determined, under a saving provision in the Treasury's statutory instrument. A firm that applies after the period closes but before the regime starts, and is not authorized by 25 October 2027, enters the transitional provision by operation of law. A firm that does not apply must run off its UK cryptoasset business before the regime starts, with no saving or transitional protection.

How do you get a crypto license in Brazil?

A firm gets a Brazilian crypto license by applying to the BCB for authorization as a virtual asset service provider, which the BCB calls a sociedade prestadora de serviços de ativos virtuais (SPSAV). Searches often call it a DASP license. Resolution 520 of 10 November 2025 came into force on 2 February 2026, and article 88 gave providers already operating 270 days to apply.

From the filing to the end of phase 1, applicants send client data to the national client register (CCS), daily balance and custody data, and a monthly proof of reserves. Under article 88, paragraph 1, the adaptation period ends when the BCB rules on phase 1. From then on, under paragraph 3, the provider must comply with Law 14,478 and the BCB's rules in full, even without a final decision on its authorization.

The BCB announced two lists in a note of 9 November 2026, and the list page warns that appearing on the applicant list does not mean authorization. The applicant list, last updated on 6 November 2026, holds 120 providers that applied under article 88: 119 under review and 1 refused. None is shown as authorized. By type, 73 are intermediaries, 46 brokers and 1 a custodian. The second list names 24 institutions the BCB already authorizes that are eligible to provide virtual asset services under article 22, 16 for intermediation and 8 for custody and intermediation.

Article 91, as amended by Resolution 589 of 23 September 2026, sets a date for banks and payment firms. From 6 November 2026, financial institutions, payment institutions and other institutions the BCB authorizes may not carry out, or make possible, virtual asset market operations whose counterparty is a provider the BCB has not authorized to operate in Brazil, other than in the forms the Resolution expressly allows.

What does a regulator check in the AML part of the application?

Each regulator reads the AML side at its own stage. The EU, the UK and Brazil ask for it in the application, New York asks for a fresh risk assessment every year, and the US federal rule wants the program in place within 90 days of the business starting.

Table 2. The AML part of the file, route by route (sources read 12 November 2026)

Which documents does a VASP file for its AML program?

These rules, taken together, ask a virtual asset service provider (VASP) for six things in its AML file.

1. The risk assessment. It comes first because the program is built on it. New York asks for an initial assessment of legal, compliance, financial and reputational risks, and 31 CFR 1022.210(b) makes the federal program commensurate with the firm's risks.
2. The written program. The federal rule requires it "in writing", the EU file describes the policies and procedures, and Brazil's application must prove they meet the rules.
3. A named compliance person, training and an independent review. The federal rule asks for a person who assures day to day compliance and for training of the staff concerned. An officer or employee may carry out the independent review, as long as it is not that same person.
4. Customer and transaction controls. These are the AML controls a crypto firm runs every day: the federal rule lists verifying customer identification in the program, and the FCA asks how the firm will prevent financial crime.
5. Sanctions procedures. Brazil asks for procedures to carry out the measures of Law 13,810, which applies UN Security Council sanctions in Brazil, asset freezes included. In complead's client screening and ongoing monitoring, an API trigger puts a name on watch or takes it off, and the lists behind each screen total 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes.
6. Travel rule arrangements. A firm that moves crypto for customers sends and receives the payer and payee data the travel rule requires. In the US the threshold for transfers that begin or end abroad stays at $3,000, because FinCEN and the Federal Reserve withdrew the 2020 proposal to cut it to $250 on 9 November 2026.

Which crypto license dates fell in 2026?

1. 2 February. BCB Resolution 520 came into force and started the 270 day clock for providers already operating in Brazil.
2. 1 July. MiCA's transition under Article 143(3) ended, at the latest, for every provider still relying on it.
3. 30 September. The FCA began taking applications for authorization under the UK regime.
4. 6 November. Brazil's article 91 date arrived, and the BCB updated its applicant list: 120 providers, none authorized.
5. 9 November. The US travel rule threshold for cross border transfers stayed at $3,000, as FinCEN and the Federal Reserve dropped their 2020 plan to lower it to $250.

The FCA's gateway table and the BCB's lists both carry a date, so reread them before a file goes in.