How to Start a VASP, CASP or Crypto Company in 2026 — The Complete Licensing Guide

MiCA's transitional periods ended on 1 July 2026. Since then, any firm providing crypto-asset services to EU clients needs a MiCA authorisation as a crypto-asset service provider (CASP) — national VASP registrations no longer count, and far fewer firms obtained MiCA authorisation than previously held national registrations.

Outside the EU, regulators in Dubai, Mauritius, Seychelles, the Cayman Islands and Labuan have built full licensing regimes of their own. The result is the same everywhere: a licence is now the price of access to banks, payment partners, institutional liquidity and users who check before they deposit.

Regulatory scarcity is not a barrier to entry — it is a competitive advantage for licensed operators. A VASP or CASP license in 2026 is not a compliance cost. It is the commercial asset that unlocks banking, institutional liquidity, card scheme access, and the trust of users who have learned to verify before they deposit. This guide covers every decision in the correct order — business model first, license type second, jurisdiction third.

Crypto regulation is activity-specific, not entity-specific. The license you need depends entirely on which services your platform provides to users. Define this before contacting a regulator, choosing a jurisdiction, or commissioning technology.

Crypto Exchange (CEX): Operates an order book or matching engine. Users deposit fiat or crypto, trade pairs, withdraw. The operator holds custody of user assets during trading. Requires exchange/trading platform authorization in virtually every jurisdiction.

OTC / Broker-Dealer: Executes trades bilaterally or via RFQ at negotiated prices, typically for institutional or high-volume clients. Requires broker-dealer VASP authorization, often the same class as exchange in most frameworks but with lighter infrastructure requirements.

Custodian / Wallet Provider: Holds or safeguards private keys or crypto assets on behalf of users. The custody function is regulated separately in many jurisdictions — Mauritius Class R (custodian), MiCA custody and administration, Dubai VARA custody. A custodian that does not trade still needs authorization.

On-Ramp / Off-Ramp / Fiat Gateway: Converts fiat to crypto or crypto to fiat. Requires VASP authorization for the virtual asset activity plus a payment or EMI license for the fiat-side processing. Two license types are often required simultaneously.

Investment Manager / Fund:Manages discretionary crypto portfolios or operates a crypto-focused fund. Requires investment management VASP license (MiCA portfolio management, Dubai VARA Management & Investment Services; in Mauritius, crypto fund management falls under the fund and investment framework rather than a separate VASP class). Subject to additional fund regulation in most institutional jurisdictions.

Stablecoin Issuer: Issues a digital token pegged to a fiat currency. Under MiCA, this requires separate authorization as an e-money token (EMT) or asset-referenced token (ART) issuer — more demanding than a standard CASP license. This is among the most demanding crypto authorization categories globally.

DeFi / Web3 Protocol:Decentralized protocols remain largely outside the VASP framework in most jurisdictions as of 2026 — but operators of interfaces or front-ends may be captured. MiCA's treatment of DeFi remains under active ESMA guidance. Cayman, BVI, and El Salvador offer the most structuring flexibility for Web3 ventures.

NFT Platform / Tokenization: NFTs and tokenized assets generally outside VASP scope unless they function as financial instruments.

Define your activity set precisely. Many platforms combine exchange, custody, and on-ramp in a single product — each activity is separately regulated and may require separate license classes or supplementary authorizations.

The EU — MiCA CASP: The New Global Benchmark

MiCA (Markets in Crypto-Assets Regulation, EU 2023/1114) fully applied from 30 December 2024 and is now the primary authorization framework for all crypto service providers operating in or targeting EU clients. MiCA's transitional periods, which let existing national VASP registrations continue temporarily, ended on 1 July 2026 at the latest — earlier in several member states. Providing crypto-asset services to EU clients without a CASP authorisation is now a breach of EU law.

What MiCA CASP authorization covers: Exchange of crypto-assets for fiat, exchange between crypto assets, execution of orders, reception and transmission of orders, portfolio management, advice, transfer services, placing of crypto-assets, and operating a trading platform.

What MiCA CASP authorization provides: Single authorization valid across all 27 EU member states. Passporting rights equivalent to MiFID II for investment firms. The most credible crypto regulatory status in the world for EU market access.

Best EU jurisdictions for CASP authorisation:

• Latvia (Latvijas Banka) — the most active Baltic regulator: twelve MiCA authorisations by the end of September 2026, nine of them standalone CASPs granted in 2026, and three companies licensed for MiCA and payment services on the same day. €2,500 application fee and free pre-licensing consultations. See our Latvia MiCA CASP page.
• Lithuania (Bank of Lithuania)— historically the EU's largest crypto and EMI hub, able to authorise both a CASP and an EMI.
• Cyprus (CySEC) — for groups already holding or considering a CIF licence: under MiCA Article 60, an authorised investment firm can add equivalent crypto-asset services through a notification procedure.

MiCA reverse solicitation trap: Non-EU exchanges serving EU clients cannot rely on the “reverse solicitation” exception (MiCA Article 61) unless the client initiated contact entirely on their own. ESMA's guidelines read solicitation broadly — websites, apps, SEO, social media, advertising, affiliates, and influencers all count as solicitation. A disclaimer does not change the underlying facts. See our Cyprus CIF + MiCA CASP License service page.

Dubai — VARA: The MENA and Institutional Standard

The Virtual Assets Regulatory Authority (VARA), established under Dubai Law No. 4 of 2022, is the world's first dedicated virtual asset regulator. VARA's Rulebook Version 2.0 (in effect June 2025) covers all virtual asset activities in Dubai (excluding the DIFC, which has its own DFSA framework).

VARA license categories and annual supervision fees:

• VA Advisory Services: AED 100,000 capital, from USD $17,400/year
• VA Broker-Dealer Services: AED 400,000–600,000 capital, from USD $17,400/year
• VA Exchange Services: AED 5,000,000 capital, from USD $21,350/year
• VA Custody Services: from USD $21,350/year
• VA Management & Investment Services: from USD $21,350/year

Timeline: 4–7 months. Physical presence in Dubai (mainland or free zone, excluding DIFC) mandatory. Licensees include Binance, OKX, Bybit and Crypto.com.

Why VARA: 0% on qualifying income only; 9% otherwise. Institutional credibility for MENA and Asian institutional counterparties. 0% capital gains tax. Strong banking access in UAE. Growing institutional crypto ecosystem. Best jurisdiction for operators targeting the Gulf, CIS, Asia, and HNW/family office clients globally. See our Dubai VARA VASP License service page.

Mauritius — VAITOS: Africa, Asia, and Global Offshore

The FSC Mauritius operates the VASP framework under the Virtual Assets and Initial Token Offering Services Act 2021 (VAITOS). Five licence classes, with minimum capital from MUR 2,000,000 (about USD 45,000) for a broker-dealer and MUR 5,000,000 for a custodian. FSC fees were revised from 1 July 2026 — see our Mauritius VASP page for the current schedule. Timeline: 5–9 months.

VAITOS License Classes:

• Class M (Virtual Asset Broker-Dealer): exchange between virtual assets and fiat, and between virtual assets
• Class O (Virtual Asset Wallet Services): transfer of virtual assets
• Class R (Virtual Asset Custodian): safekeeping and administration of virtual assets
• Class I (Virtual Asset Advisory Services): services related to an issuer's offer or sale of virtual assets
• Class S (Virtual Asset Market Place): operating a virtual asset exchange or marketplace

Ongoing requirements include the FATF Travel Rule, cybersecurity and custody standards set by FSC rules, a physical office in Mauritius, two resident directors, a compliance officer and an MLRO.

Why Mauritius: ~3% effective corporate tax. 46+ double taxation agreements, including with India, China, Singapore, South Africa, the UAE, the UK and France. Africa and Indian Ocean gateway — no other offshore VASP jurisdiction provides equivalent access to African banking and institutional relationships. Zitadelle AG has licensed multiple Mauritius VASPs and works from our representative office in Port Louis. See our Mauritius VASP License (VAITOS) service page.

Seychelles — FSA VASP: Fast Offshore Credibility

The Seychelles Financial Services Authority operates a dedicated VASP Act (enacted 2024) alongside the Securities Dealer License framework. IOSCO member. Under FSA Circular No. 3 of 2025, CFDs on virtual assets fall under the Securities Act, so a Securities Dealer can offer crypto CFDs without a separate VASP licence; spot crypto exchange and custody need a VASP licence. Timeline: 8–12 months.

Why Seychelles for crypto: Cost-efficient, IOSCO-member credibility, no leverage cap, institutional acceptance improving post-2024 VASP Act. IC Markets, eToro and Fusion Markets hold Seychelles Securities Dealer licences. Best for global crypto brokers, crypto-CFD platforms, and operators wanting a combined investment + VASP framework in a single jurisdiction. See our Seychelles FSA VASP License service page.

Cayman Islands — CIMA VASP: Institutional Offshore Standard

CIMA's VASP licensing regime (Phase 2, effective April 2025) is the most institutionally credible offshore crypto jurisdiction globally.

Why Cayman for crypto: Unmatched institutional credibility. 0% tax. 20-year Tax Exemption Certificate. The standard jurisdiction for institutional crypto funds, PE/VC vehicles with digital asset exposure, and crypto family office structures. Best for institutional fund managers, crypto hedge funds, family offices. See our Cayman Islands Company Formation service page.

El Salvador — DASP: Bitcoin-Native Jurisdiction

El Salvador's Digital Asset Service Provider (DASP) regime under the Bitcoin Law (as amended 2025) remains in force for crypto service providers. The 2025 IMF amendment affected macroeconomic Bitcoin policy but left the DASP licensing framework intact. 25% dividend withholding tax risk applies for shareholders resident in tax haven jurisdictions — founders should verify their personal tax position. Timeline: 3–6 months. Best for Bitcoin-focused exchanges, Lightning Network infrastructure, and Web3 ventures seeking a Bitcoin-native jurisdiction. See our El Salvador DASP License service page.

Labuan, Malaysia — Digital Assets Within Labuan FSA Licences

Labuan FSA licenses digital-asset activity inside its existing licence types. A Labuan money broker can add digital-asset broking with RM1,500,000 paid-up capital and a USD 10,000 annual fee from 2026; client leverage on digital assets is capped at 1:1. Labuan FSA's draft guidelines for Payment System Operators place digital-asset transfer and custody in a RM1,500,000 capital tier. Profits are taxed at 3% of net audited profits, subject to substance. Best for: Asia-Pacific operators that want a Labuan base for intermediary crypto broking or custody. See our Labuan VASP service page.

Jurisdiction Selection Decision Framework

Many crypto groups hold two licences: a primary license for their main market (MiCA CASP or VARA) and an offshore license for global operations (Mauritius VAITOS or Seychelles VASP).

Every VASP license requires a locally incorporated entity. The corporate structure above the licensed entity determines your tax efficiency, investor optionality, and how capital flows through the group.

Standard approach for offshore VASP groups: Cayman Islands or BVI holding company at the top of the group → licensed operating entities in each jurisdiction (Mauritius GBC for VAITOS, Seychelles IBC for FSA VASP, UAE mainland entity for VARA) → separate regulated entity per additional license.

The holding company layer separates the regulated operating entity from the beneficial ownership structure and provides clean capital flow management for dividend routing. It also ensures that regulatory action against one operating entity does not directly affect group assets or other licensed entities. Relevant structuring options include Cayman Islands company formation, BVI company formation, and a Mauritius GBC for the VAITOS holding structure.

A crypto exchange or VASP technology stack has seven critical layers. Every layer is a build-versus-buy decision with significant cost and timeline implications.

Layer 1 — Matching Engine / Trading Core. The heart of a centralized exchange. Custom build: $50,000–$200,000+ for a high-frequency trading engine with order matching and execution. White-label alternative: platforms like Crassula, B2Broker (B2TRADER), and AlphaPoint provide production-ready matching engines, order books, and full exchange infrastructure. White-label launch: 6–14 weeks versus 9–18 months custom. Build only if your differentiation lives in the engine itself (ultra-low-latency derivatives, novel AMM, unique clearing model). For all other cases, white-label is faster, cheaper, and operationally safer.

Layer 2 — Custody and Wallet Infrastructure. For custodial exchanges: hot and cold wallet architecture, multi-signature signing, Hardware Security Modules (HSMs), and MPC (Multi-Party Computation) wallets. The industry standard is Fireblocks or BitGo for institutional-grade MPC custody. Integration cost: $25,000–$80,000+. Annual custody infrastructure cost: $20,000–$100,000+ depending on asset volume and insurance requirements. Non-custodial (DEX/self-custody wallet) eliminates custody risk and regulatory liability for user funds — but creates liquidity depth challenges and limits payment card and fiat-on-ramp integration.

Layer 3 — Fiat On/Off Ramp. Converting fiat to crypto and back. Requires a payment license in most jurisdictions (separate from the VASP license). Integration with a PSP or EMI for card-based fiat rails. SEPA/SWIFT connectivity for bank transfer on-ramps. A Mauritius PIS license or Lithuania EMI license is the standard pairing with an offshore VASP license for fiat capability.

Layer 4 — KYC/AML and Onboarding. Regulatory requirement in every VASP jurisdiction. Identity verification (Sumsub, Onfido, Jumio, Veriff). Document verification and liveness checks. Sanctions screening (OFAC, EU, UN, HM Treasury) at onboarding and ongoing. PEP screening and adverse media monitoring. Cost: $0.50–$3.00 per verification. Enterprise platforms: $2,000–$10,000/month.

Layer 5 — Travel Rule Compliance.The FATF Travel Rule (Recommendation 16) requires VASPs to collect and transmit originator and beneficiary information for virtual asset transfers above the USD/EUR 1,000 threshold. Enforced in 85+ jurisdictions as of 2026. Data standard: IVMS101 (InterVASP Messaging Standard 101). Leading compliance solutions: Notabene, TRISA, TRP (Travel Rule Protocol), Sygna. The “Sunrise Issue” — uneven global implementation — means your platform must handle counterparty VASPs that do not yet comply. Annual cost: $5,000–$30,000 depending on transaction volume and solution choice.

Layer 6 — Transaction Monitoring and Blockchain Analytics. On-chain transaction monitoring for suspicious activity. Blockchain analytics platforms (Chainalysis, Elliptic, TRM Labs) provide address screening, transaction risk scoring, and VASP identification for Travel Rule purposes. Regulators (FSC Mauritius, CIMA Cayman, VARA Dubai) all reference blockchain analytics as part of their compliance expectations. Annual cost: $15,000–$80,000+ depending on volume and jurisdiction.

Layer 7 — Cybersecurity Infrastructure. Mandatory in most VASP jurisdictions in 2026. ISO 27001 certification or alignment is now a de facto requirement for Mauritius VAITOS and strongly recommended for VARA and MiCA CASP. Annual independent cybersecurity audit required in Mauritius. 72-hour incident reporting to FSC mandatory. Core infrastructure: penetration testing (annual, $10,000–$30,000), bug bounty program, DDoS protection, secure development lifecycle (SDL).

The AML/CFT framework for a VASP is substantially more complex than for a standard financial services company because it must address both traditional financial crime and blockchain-specific risks. Required components across all major jurisdictions:

• AML/CFT Policy and Procedures manual — jurisdiction-specific, covering risk appetite, customer risk scoring, due diligence levels, and reporting obligations.
• Customer Due Diligence (CDD) — standard KYC for all users. Enhanced Due Diligence (EDD) for high-risk clients: PEPs, users from high-risk jurisdictions, large deposit volumes, unusual transaction patterns.
• Transaction Monitoring — real-time and retrospective. Automated alerts for unusual volume spikes, transactions to/from flagged addresses, structuring patterns (smurfing), rapid cycling between assets, unusual withdrawal destinations.
• Blockchain Analytics — screening all on-chain deposits and withdrawals against known illicit addresses, darknet market associations, mixer outputs, and sanctioned entity clusters. Required by VARA, VAITOS, Seychelles FSA, and expected by MiCA supervisors.
• Travel Rule Implementation — IVMS101-compliant data exchange with counterparty VASPs for transactions above the threshold. Self-hosted wallet policy: for transfers to/from unhosted wallets, collection of wallet ownership evidence from the customer.
• MLRO (Money Laundering Reporting Officer) — named qualified individual. Many offshore VASP jurisdictions permit outsourced MLRO. Mauritius requires physical local presence (partial outsourcing permitted).
• SAR/STR Reporting — Suspicious Activity/Transaction Reports filed with the relevant FIU on prescribed timelines.
• Sanctions Screening — real-time screening of all users and counterparties against OFAC, EU, UN, and relevant national sanctions lists. Immediate freeze and reporting obligation on sanctions matches.

Offshore Entry (Seychelles VASP + white-label exchange)

Mid-Market Offshore (Mauritius VAITOS Class M+O)

Dubai VARA (Exchange License)

EU MiCA CASP (Latvia or Lithuania)

MiCA's transitional periods ended on 1 July 2026. A legacy national VASP or AML registration no longer authorises crypto-asset services to EU clients, and a pending MiCA application does not on its own allow a firm to keep serving them.

Some member states ended their transitional periods early — the Netherlands, for example, closed its regime for previously registered providers on 30 June 2025.

If you still serve EU clients without a CASP authorisation, the realistic options are: stop serving EU clients until you are authorised; move EU clients to an authorised CASP partner; apply for authorisation in a member state such as Latvia or Lithuania; or acquire an existing authorised CASP. Groups with a CySEC investment firm licence can use the Article 60 notification route for equivalent services.

1. 1. Choosing jurisdiction before defining the activity set. A custody-only business needs different authorization than an exchange. An OTC desk needs different capital than a retail platform. Define activities first; license class follows automatically.
2. 2. Treating the technology stack as separate from the license application. Most regulators (VARA, FSC Mauritius, CySEC for MiCA) want to see technology infrastructure as part of the license application — not built later. Technology scoping must happen in parallel with the licensing process, not after approval.
3. 3. Ignoring the Travel Rule from launch. New VASPs frequently launch without a Travel Rule solution, planning to add it later. Regulators and banking partners increasingly require Travel Rule capability before or immediately after authorization. Build it into your compliance stack from day one.
4. 4. Assuming blockchain analytics is optional. Jurisdictions that do not mandate blockchain analytics by name still expect VASPs to screen on-chain activity. A regulator discovering that a licensed VASP had no on-chain monitoring capability is a serious supervisory finding. Chainalysis, Elliptic, or equivalent should be budgeted from launch.
5. 5. Banking last. Crypto exchanges need multiple banking relationships — for fiat deposits, operational accounts, and client fund segregation. Banks that accept VASP clients are a restricted pool. Banking due diligence begins at the same time as licensing, not after approval.
6. 6. Building for one jurisdiction. A Mauritius VAITOS license serves Africa and Asia well. It does not authorise services to EU clients, which need a MiCA authorisation. A Dubai VARA license is optimal for MENA but does not passport into the EU. Multi-jurisdiction structure planning from launch is substantially cheaper than retrofitting compliance for a new market after traction.

With MiCA authorisation now required, existing authorised CASPs are sought after. Acquiring one can shorten time to market, but the regulator must approve the new owner through a change of control application, and the target's compliance record, banking and custody arrangements need careful due diligence. Listings are published on our group's marketplace, Financial License Market, and we advise on due diligence and approval. See our M&A advisory.

Zitadelle AG has licensed multiple Mauritius VASPs and works from our representative office in Port Louis, manages CySEC CIF + MiCA pathway applications from our Limassol headquarters, and advises on Dubai VARA, Seychelles FSA, Cayman CIMA, and El Salvador DASP structures. Our Labuan administration office provides direct LFSA access for Asian VASP and DFS structures.

We provide licensing support across the full lifecycle: jurisdiction selection, entity formation, license application management, AML/CFT framework drafting, technology vendor coordination, and ongoing compliance. For a confidential assessment, contact Zitadelle AG.

Disclaimer: This guide is for informational purposes only and does not constitute legal or regulatory advice. Licensing requirements, fees, and timelines are subject to change. MiCA transitional periods ended on 1 July 2026. Last updated: October 2026.

Share: LinkedIn · WhatsApp · Telegram · Copy link