Cryptocurrency regulations by country: 24 markets compared

Picture an exchange that wants customers in Tokyo, Dubai and Frankfurt. It needs a registration from Japan's Financial Services Agency, a license from VARA in Dubai and a MiCA authorization from one EU national authority, which then covers Germany as well. Three regulators, three application files, and no agreement between them on what a token is.

Some governments license the business and want it. Some allow it under tight limits. One large economy, China, bans it outright. This guide maps 24 markets by region, gives each one's lead regulator and licensing route with a link to the primary source, and sorts them by posture. Onboarding rules differ along the same lines, and those are mapped separately in KYC requirements by country.

Why do crypto rules differ from country to country?

Each government makes four choices on its own. It picks the lead regulator, decides what a token is in law, sets how far it goes with the FATF standards and decides whether it wants the industry at all.

The lead regulator varies more than most readers expect. Securities regulators hold the file in Malaysia, Thailand and Nigeria. The central bank holds it in Brazil. Japan uses its integrated Financial Services Agency, and the Philippines splits the work between the central bank and the securities regulator.

Classification follows from that choice. A token can be a security in one market and a payment instrument or a commodity in the next, and the license, the capital rules and the disclosure duties change with it. Nigeria counts virtual and digital assets as securities. Japan is moving them into its securities statute as a financial product of their own, separate from securities.

Intent is the last choice and the easiest to read. A licensing regime is built to bring firms in. A ban is built to keep them out. Crypto policy is also separate from a country's general AML standing, which the FATF tracks in its high risk country lists.

What do all markets share? Recommendation 15 and the travel rule

The national rules start from one text. In October 2018 the FATF revised Recommendation 15 and added "virtual asset" and "virtual asset service provider" to its glossary, and in June 2019 it added the interpretive note that tells countries how to apply it (amendment table in the FATF Recommendations, updated June 2026). Countries are asked to assess the risk, license or register the providers and supervise them. How Recommendation 15 sits among the other 39 is set out in the FATF Recommendations guide.

A virtual asset service provider, in the FATF glossary, is a business that exchanges virtual assets for fiat money or for other virtual assets, transfers them, holds or administers them for others, or takes part in financial services around an issuer's offer. The test is the activity. A firm is caught whatever it calls itself.

The travel rule sits on top. Under paragraph 7(b) of the interpretive note to Recommendation 15, the sending provider obtains and holds originator and beneficiary information, submits it to the receiving provider "immediately and securely" and makes it available to authorities. The receiving provider holds the originator data, and the rest of Recommendation 16 applies to it too, including freezing and refusing transfers that involve designated persons. The FATF lets a country set a de minimis threshold, "no higher than USD/EUR 1 000", below which cross border transfers carry less data. The EU set none: its transfer of funds regulation says crypto transfers are covered "regardless of their amount" (recital 30 of Regulation (EU) 2023/1113, applying from 30 December 2024).

The FATF measured the gap on 16 July 2026 in its seventh targeted update on virtual assets. Of 109 jurisdictions that answered the travel rule questions, 91, or 83 percent, had passed travel rule legislation, up from 73 percent (85 of 117) in 2025, and 11 more said it was under way. Supervision trails the law. Of those 91, 55, or 60 percent, had not yet issued findings or directives or taken enforcement or other supervisory action on travel rule compliance. The same report says most identified on chain illicit activity now involves stablecoins. The red flags FATF lists for virtual assets used to fund terrorism are covered in the terrorist financing guide.

How do the 24 markets compare?

The table gives each market's lead regulator, the route a provider takes, the posture and the main primary source, checked on 12 October 2026. Posture is our classification of the rules described below, as they stood on that date. The regional notes after the table name the source for every other rule.

North America

The United States splits oversight. The SEC applies the federal securities laws to crypto assets that are securities, and the CFTC treats virtual currencies such as Bitcoin as commodities. FinCEN treats exchangers and hosted wallet providers as money transmitters, which must register with FinCEN within 180 days of being established and follow its funds travel rule (FinCEN guidance FIN-2019-G001). States can add their own license, and New York's BitLicense, in effect since 2015, is the best known.

Congress has acted on stablecoins only. The GENIUS Act, Public Law 119-27 of 18 July 2025, created a federal framework for payment stablecoins. The CLARITY Act, which would set the line between the SEC and the CFTC, passed the House 294 to 134 on 17 July 2025. On 15 September 2026 the Senate failed to invoke cloture on the motion to proceed, 49 to 50, and a motion to reconsider was entered, so the bill can return (the bill's actions on congress.gov).

Canada splits the work between securities and AML regulators. Crypto trading platforms register with the provincial securities regulators, coordinated through the Canadian Securities Administrators, and since August 2024 new platforms apply directly to CIRO, as the Ontario Securities Commission explains. FINTRAC treats dealing in virtual currency as a money services business that registers before it operates, and its travel rule guidance has applied since 1 June 2021.

Europe

The European Union regulates crypto through MiCA, Regulation (EU) 2023/1114. A national authority authorizes a crypto asset service provider, and the authorization then lets it serve clients throughout the Union. ESMA keeps the interim MiCA register. Member states could let existing firms keep operating for up to 18 months, and under Article 143(3) the last of those transition periods ran until 1 July 2026.

The Netherlands registered providers with De Nederlandsche Bank before MiCA. The AFM now grants MiCA licenses and DNB assesses the prudential requirements. The Dutch transition lasted six months and ended on 30 June 2025 (AFM on the start of MiCA), the shortest period on ESMA's list, shared with five other member states.

Italy took the long road. Virtual asset providers there only had to register with the OAM, and registered firms that applied for MiCA authorization could keep operating until 30 June 2026 at the latest. Consob authorizes providers in coordination with the Bank of Italy, and by 30 June 2026 it had authorized eight, according to the joint statement of Consob and the Bank of Italy. Firms without a MiCA authorization in any member state had to stop.

The United Kingdom has registered cryptoasset businesses for AML purposes with the FCA since 10 January 2020 (SI 2019/1511) and is moving to full authorization. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 were made on 4 February 2026 and bring the regime into force on 25 October 2027 (SI 2026/102). The FCA published its final rules on 30 June 2026 and opened applications on 30 September 2026 (the FCA's new cryptoasset regime).

Switzerland has regulated through its DLT Act since 1 August 2021, and FINMA licenses DLT trading facilities. The Federal Council consulted until 6 February 2026 on two new license categories: payment instrument institutions, which could issue a type of stablecoin, and crypto institutions, which hold or trade crypto assets for clients (the Federal Council's consultation release).

Turkey licenses the business and bans the payment. Law No. 7518, published in the Official Gazette on 2 July 2024, requires crypto asset service providers to get permission from the Capital Markets Board before they start. The central bank's regulation on the disuse of crypto assets in payments, in force since 30 April 2021, still says crypto assets cannot be used in payments, directly or indirectly. Holding and trading through a licensed platform are allowed. Paying with crypto is not.

Middle East

The United Arab Emirates runs several regimes side by side: VARA in Dubai, the FSRA in the Abu Dhabi Global Market, the DFSA in the Dubai International Financial Centre and, at federal level, the Capital Market Authority, which took over from the Securities and Commodities Authority on 1 January 2026. VARA published guidance on its virtual asset issuance rulebook on 9 April 2026, covering issuance categories, licensing and whitepaper disclosure.

Asia Pacific

Japan has registered crypto exchange operators under the amended Payment Services Act since 1 April 2017. On 15 July 2026 the Diet passed amendments that move crypto regulation into the Financial Instruments and Exchange Act as a financial product separate from securities. They add insider trading rules and issuer disclosure and raise the maximum prison term for unregistered operators from three to ten years (FSA page on the 2026 amendment act, in Japanese). The act was promulgated on 23 July 2026 (House of Councillors record, in Japanese), and the crypto provisions take effect within a year.

Singapore licenses digital payment token services through the Monetary Authority of Singapore under the Payment Services Act 2019, in force since 28 January 2020. Since 30 June 2025, Singapore firms that serve only customers outside Singapore have needed a license under the Financial Services and Markets Act 2022, and MAS said it would generally not issue one (MAS statement on digital token service providers).

Hong Kong licenses virtual asset trading platforms through the SFC, and since 1 August 2025 the HKMA has licensed stablecoin issuers under the Stablecoins Ordinance (Cap. 656). In December 2025 the government published consultation conclusions on virtual asset dealing and custody with a target of a bill in 2026. The 2026 Policy Address supplement expects it in the fourth quarter, and existing dealing and custody providers will not be deemed licensed, according to the consultation conclusions on dealing.

South Korea has required providers to register with the Korea Financial Intelligence Unit since 2021, under the Act on Reporting and Using Specified Financial Transaction Information, which also applies to foreign providers serving Korea (KoFIU notice on registration). It has enforced the Act on the Protection of Virtual Asset Users since 19 July 2024. It covers the safekeeping of user deposits and assets, unfair trading such as market manipulation, and the regulators' supervisory powers. The Financial Services Commission described a framework law on digital assets as pending in April 2026, and stablecoin legislation as pending in September 2026.

Australia passed the Corporations Amendment (Digital Assets Framework) Act in April 2026, and it brings digital asset platforms under ASIC's financial services licensing from 9 April 2027. Firms relying on ASIC's no action position had until 30 September 2026 to apply for a license; from 1 October, those that had not applied risk breaching the law (ASIC's digital asset licensing deadline). AUSTRAC registers providers for AML purposes on its Virtual Asset Service Provider Register, kept under section 76B of the Anti Money Laundering and Counter Terrorism Financing Act 2006.

Indonesia moved crypto supervision from Bappebti, the commodity futures regulator, to the Financial Services Authority (OJK) in January 2025. OJK supervises crypto as a digital financial asset (joint release on the transfer to OJK, in Indonesian).

Thailand licenses digital asset businesses under the Emergency Decree on Digital Asset Businesses B.E. 2561 (2018), and Thailand's Securities and Exchange Commission recognizes three types: exchange, broker and dealer.

Malaysia has required digital asset exchanges to register with the Securities Commission as recognized market operators since 2019. In May 2026 the Commission revised its guidelines to strengthen client asset safeguards and governance and to speed up product approvals, and it reported action against four exchanges operating without registration (Securities Commission Malaysia's revised exchange guidelines).

The Philippines splits the work. The central bank supervises virtual asset service providers and in August 2025 extended its moratorium on new licenses, subject to reassessment (BSP memorandum of August 2025). Crypto asset service providers register with the securities regulator. A central bank memorandum of January 2026 tells the financial institutions the central bank supervises to deal only with providers registered with and authorized by the central bank or the SEC, or licensed in their home country.

India has no dedicated crypto law. Gains on virtual digital assets are taxed at 30 percent, and 1 percent is deducted at source on transfers, now under sections 194 and 393 of the Income Tax Act 2025, in force since 1 April 2026. Since a notification of 7 March 2023, providers are reporting entities under the Prevention of Money Laundering Act and must register with FIU-IND. The Reserve Bank stays wary: a deputy governor said in December 2025 that the approach to stablecoins "must be guided by caution" (RBI speech).

China has prohibited crypto trading since September 2021, and an NDRC notice of the same month bars new mining projects. On 6 February 2026 the People's Bank of China and seven other agencies issued a new notice that supersedes the 2021 one and keeps the trading ban and the mining policy. It adds two rules: no one, in China or abroad, may issue a yuan pegged stablecoin offshore without approval, and tokenizing real world assets inside China is banned unless approved, while offshore tokenization of Chinese assets needs approval or a filing.

Latin America

Brazil's Law No. 14.478 of 2022 set the framework, and Decree No. 11.563 of 2023 named the Banco Central do Brasil as regulator. Central bank Resolutions 519, 520 and 521 of November 2025 took effect on 2 February 2026, some provisions of 521 later, covering authorization, governance, capital, AML controls and foreign exchange. Under Resolution 520, providers already operating have 270 days from that date, until 30 October 2026, to apply. From 6 November 2026, Resolution 589 bars authorized institutions from dealing with providers that are not authorized.

Mexico's 2018 fintech law lets Banco de México set the conditions and restrictions for virtual assets. Its Circular 4/2019 limits banks and fintech institutions to internal operations with virtual assets, with prior authorization, and does not let them offer exchange, transfer or custody to clients. The CNBV authorizes fintech institutions.

Africa

Nigeria's Investments and Securities Act 2025 counts virtual and digital assets as securities and tells the SEC to register and regulate digital asset exchanges and virtual asset service providers. In December 2023 the Central Bank of Nigeria issued guidelines for banks on operating accounts for virtual asset service providers.

South Africa declared crypto assets a financial product under the FAIS Act/cr3ad_document/$value), gazetted on 19 October 2022, and licenses providers through the FSCA, which had approved 310 of 533 license applications by 31 March 2026 (FSCA licensing update, April 2026). The Financial Intelligence Centre's travel rule, Directive 9, took effect on 30 April 2025.

What does a crypto compliance program need in every market?

The licenses differ, and the work behind them repeats. In 22 of the 24 markets on this page, a provider needs a local license, a registration or both, as the table shows. China bans the business. In Mexico, the rules read for this page cover banks and fintech institutions, which the central bank keeps to internal use of virtual assets. Once registered or authorized, a provider runs the program the supervisor assumes it has.

1. Customer due diligence. Identify and verify the customer at onboarding, understand the purpose of the relationship and apply enhanced checks to higher risk customers, including politically exposed persons.
2. Screening. Screen customers against sanctions and watchlists, and screen counterparties and wallet addresses, because OFAC may add digital currency addresses to the SDN List.
3. Transaction monitoring. Watch how each customer's activity moves over time, with rules for crypto patterns such as mixer exposure, transfers to unregistered providers and missing travel rule data, the crypto family in the transaction monitoring rules library.
4. The travel rule. Send and receive originator and beneficiary data with each transfer, and decide in advance what happens when the counterparty cannot receive it.
5. Reporting and records. File suspicious transaction reports with the financial intelligence unit, as set out in how to file a SAR, and keep the records the national law asks for.

A named AML compliance officer owns the program, and a risk assessment covering products, customers and geographies tells the firm how deep each step goes.

The screening step is where crypto differs most from a bank. A wallet is not a name, so a match has to be traced to the people behind it. You can check a wallet free with the free crypto wallet risk check from Complead, formerly Sanction Scanner, before deciding how to build the check into the flow.

For fiat payments the same check exists in Complead. Sanction Scanner, the screening product, is part of Complead. While a payment is processed, transaction screening checks its sender and its receiver through the API. Moldcell, a Moldovan telecom with 1.5 million users that moved into fintech, screened about 100,000 transactions with Complead and sent about 10,000 of them for review (the Moldcell case study, July 2026).

Monitoring is the step that ties the program to the travel rule. The data that arrives with a transfer is only useful if someone looks at the pattern across many transfers, which is what the transaction monitoring guide covers in depth.

Permissive, restrictive or banned: what separates them?

A permissive regime licenses the business and attaches conduct rules, capital requirements and supervision. A restrictive regime lets people hold and trade crypto but limits what businesses may do, by blocking payments, withholding a licensing route or regulating mainly through tax. A ban prohibits the activity. Mixed regimes license some activity and keep a significant prohibition or an open question beside it.

Permissive does not mean light. Japan, Singapore, Hong Kong and the EU expect an AML program, screening and travel rule compliance from every licensed firm, and Singapore has said it will generally not license firms that serve only customers abroad. What they offer in return is a known route and, in the EU, one authorization for every member state.

Restrictive regimes protect something specific. India permits trading, taxes it at 30 percent and registers providers for AML purposes without a licensing law. Mexico keeps banks and fintech institutions to internal use. Both protect the banking channel, and the FATF report notes the same pattern among partial prohibitions: the use of virtual assets as a means of payment is frequently prohibited while limited investment or trading is allowed.

Bans are more common than the headlines suggest. The FATF's 2026 survey found that 23 percent of responding jurisdictions had opted to prohibit virtual asset service providers, fully or partly, up from 11 percent in 2023. It also found that prohibition is hard to enforce: jurisdictions taking that approach "continue to face challenges in identifying and sanctioning illicit VASP activity". A ban moves the activity offshore and peer to peer. For a compliance team, it changes the question from how to get licensed to how to keep that country's residents off the books, which means checks on residence at onboarding, a country risk index in the risk assessment and screening of counterparties.

The mixed group is where most of the change happens. The United States has a stablecoin law and no market structure law. Turkey licenses providers and bans crypto payments. The Philippines registers providers through one regulator while the other keeps its licensing frozen. And postures move: in 2026 alone, Japan rewrote its statute, Australia passed a licensing act and the United Kingdom made its authorization regulations, so a firm planning five years ahead should expect at least one of its markets to change. Stablecoins run through most of these rewrites. The FATF says most identified on chain illicit activity now involves them, and the United States, Hong Kong and South Korea have written or are writing stablecoin rules. The methods behind that activity are described in money laundering typologies.

What does MiCA mean for a firm outside the EU?

MiCA matters beyond Europe because any firm that wants EU clients has to meet it. Regulation (EU) 2023/1114 covers crypto asset service providers, issuers of stablecoins and other crypto assets, and market abuse. Its stablecoin titles applied from 30 June 2024 and the rest from 30 December 2024.

Authorization comes from one national authority, such as the AFM or Consob, and then covers the whole Union. Since the last transition periods ended, a provider serving EU clients without it is outside the law. Reverse solicitation is no shortcut: ESMA's guidelines say it should be "very narrowly framed" and "must be regarded as the exception".

Some activity sits outside MiCA. Article 2(3) excludes crypto assets that are unique and not fungible, and the recitals leave out services provided in a fully decentralized manner and the lending and borrowing of crypto assets. AML duties come from separate EU law, including the transfer of funds regulation that brings the travel rule to every crypto transfer, so a MiCA authorization alone does not complete a firm's compliance.

How were these rules checked?

Each market's core rule on this page was verified on 12 October 2026 against the regulator, statute, official gazette or central bank source linked in the table. Rules change, so the page is reviewed every quarter and whenever a market changes its regime. Between reviews, the free AML News Radar pins each rule change to the jurisdiction it touches.

Before you enter the next market

The decision this page leaves with you is which markets to license and which to exclude, made before the product launches rather than after a regulator asks. Write it down per market: the regulator, the license you hold or need, the deadline that applies and the source you read it in. Brazil's 270 day window closes on 30 October 2026, and the UK regime starts on 25 October 2027. Recheck the list every quarter against each regulator's own page, not against a summary like this one. The controls that travel into every market, wallet screening, on chain monitoring and the travel rule, are set out in AML for crypto.