How to Start a VASP, CASP or Crypto Company in 2026 — The Complete Licensing Guide

The window for operating a crypto business without regulatory authorization is closing — faster than most operators expected. In the EU, the MiCA transitional period expires on 1 July 2026. ESMA's April 2026 communication was unambiguous: no CASP license, no EU market access. As of June 2026, only approximately 183 companies hold full MiCA authorization across 27 EU member states — and just 14 are authorized to operate a trading platform. Over 1,200 entities held national VASP registrations before MiCA. The conversion rate tells the story.

Outside the EU, the picture is equally clear. Dubai VARA has issued fewer than 25 full licenses. Mauritius FSC has authorized a limited cohort of VAITOS licensees. Singapore MAS continues to tighten its VASP framework. Cayman CIMA's VASP regime admitted only 19 licensees by early 2026.

Regulatory scarcity is not a barrier to entry — it is a competitive advantage for licensed operators. A VASP or CASP license in 2026 is not a compliance cost. It is the commercial asset that unlocks banking, institutional liquidity, card scheme access, and the trust of users who have learned to verify before they deposit. This guide covers every decision in the correct order — business model first, license type second, jurisdiction third.

Part 1 — What Type of Crypto Business Are You Building?

Crypto regulation is activity-specific, not entity-specific. The license you need depends entirely on which services your platform provides to users. Define this before contacting a regulator, choosing a jurisdiction, or commissioning technology.

Crypto Exchange (CEX): Operates an order book or matching engine. Users deposit fiat or crypto, trade pairs, withdraw. The operator holds custody of user assets during trading. Requires exchange/trading platform authorization in virtually every jurisdiction.

OTC / Broker-Dealer: Executes trades bilaterally or via RFQ at negotiated prices, typically for institutional or high-volume clients. Requires broker-dealer VASP authorization, often the same class as exchange in most frameworks but with lighter infrastructure requirements.

Custodian / Wallet Provider: Holds or safeguards private keys or crypto assets on behalf of users. The custody function is regulated separately in many jurisdictions — Mauritius VAITOS Class O, MiCA Article 75 custody authorization, Dubai VARA custody activity. A custodian that does not trade still needs authorization.

On-Ramp / Off-Ramp / Fiat Gateway: Converts fiat to crypto or crypto to fiat. Requires VASP authorization for the virtual asset activity plus a payment or EMI license for the fiat-side processing. Two license types are often required simultaneously.

Investment Manager / Fund:Manages discretionary crypto portfolios or operates a crypto-focused fund. Requires investment management VASP license (MiCA Article 75(4), Mauritius Class I, Dubai VARA Management & Investment Services). Subject to additional fund regulation in most institutional jurisdictions.

Stablecoin Issuer: Issues a digital token pegged to a fiat currency. Under MiCA, this requires separate authorization as an e-money token (EMT) or asset-referenced token (ART) issuer — more demanding than a standard CASP license. Mauritius requires 1:1 reserve backing in segregated accounts. This is among the most demanding crypto authorization categories globally.

DeFi / Web3 Protocol:Decentralized protocols remain largely outside the VASP framework in most jurisdictions as of 2026 — but operators of interfaces or front-ends may be captured. MiCA's treatment of DeFi remains under active ESMA guidance. Cayman, BVI, and El Salvador offer the most structuring flexibility for Web3 ventures.

NFT Platform / Tokenization:NFTs and tokenized assets generally outside VASP scope unless they function as financial instruments. Cayman's March 2026 Tokenised Funds framework specifically regulates tokenized investment fund interests.

Define your activity set precisely. Many platforms combine exchange, custody, and on-ramp in a single product — each activity is separately regulated and may require separate license classes or supplementary authorizations.

Part 2 — The Global Licensing Landscape in 2026

The EU — MiCA CASP: The New Global Benchmark

MiCA (Markets in Crypto-Assets Regulation, EU 2023/1114) fully applied from 30 December 2024 and is now the primary authorization framework for all crypto service providers operating in or targeting EU clients. The MiCA transitional period — allowing existing national VASP registrations to continue temporarily — expires on 1 July 2026. After that date, any entity providing crypto-asset services to EU clients without a CASP authorization is in breach of EU law.

What MiCA CASP authorization covers: Exchange of crypto-assets for fiat, exchange between crypto assets, execution of orders, reception and transmission of orders, portfolio management, advice, transfer services, placing of crypto-assets, and operating a trading platform.

What MiCA CASP authorization provides: Single authorization valid across all 27 EU member states. Passporting rights equivalent to MiFID II for investment firms. The most credible crypto regulatory status in the world for EU market access.

Best EU jurisdiction for CASP authorization:Lithuania (Bank of Lithuania) — fastest turnaround in the EU (approximately 6 months for clean files), dedicated fintech support infrastructure (LBChain sandbox), and the ability to obtain both a CASP authorization and a MiCA-compliant EMI license from the same regulator. Cyprus (CySEC) — relevant for operators already holding or considering a CIF investment firm license, leveraging Zitadelle AG's direct CySEC access from our Limassol headquarters. The MiCA Article 60 pathway allows CIF-licensed entities to add CASP services with a simplified notification procedure.

MiCA reverse solicitation trap: Non-EU exchanges serving EU clients cannot rely on the “reverse solicitation” exception (MiCA Article 61) unless the client initiated contact entirely on their own. ESMA's February 2025 guidelines read solicitation broadly — websites, apps, SEO, social media, advertising, affiliates, and influencers all count as solicitation. A disclaimer does not change the underlying facts. See our Cyprus CIF + MiCA CASP License service page.

Dubai — VARA: The MENA and Institutional Standard

The Virtual Assets Regulatory Authority (VARA), established under Dubai Law No. 4 of 2022, is the world's first dedicated virtual asset regulator. VARA's Rulebook Version 2.0 (in effect June 2025) covers all virtual asset activities in Dubai (excluding the DIFC, which has its own DFSA framework).

VARA license categories and annual supervision fees:

• VA Advisory Services: AED 100,000 capital, from USD $17,400/year
• VA Broker-Dealer Services: AED 400,000–600,000 capital, from USD $17,400/year
• VA Exchange Services: AED 5,000,000 capital, from USD $21,350/year
• VA Custody Services: from USD $21,350/year
• VA Management & Investment Services: from USD $21,350/year

Timeline: 4–7 months. Physical presence in Dubai (mainland or free zone, excluding DIFC) mandatory. 23+ licensed VASPs including Binance, OKX, Bybit, Crypto.com, and Backpack.Exchange.

Why VARA: Zero corporate tax. Institutional credibility for MENA and Asian institutional counterparties. 0% capital gains tax. Strong banking access in UAE. Growing institutional crypto ecosystem. Best jurisdiction for operators targeting the Gulf, CIS, Asia, and HNW/family office clients globally. See our Dubai VARA VASP License service page.

Mauritius — VAITOS: Africa, Asia, and Global Offshore

The FSC Mauritius operates the VASP framework under the Virtual Assets and Initial Token Offering Services Act 2021 (VAITOS). Five license classes with capital requirements ranging from MUR 2 million to MUR 6.5 million (~USD $45,000 to ~$145,000). Processing fees: USD $1,000–$3,000. Annual licensing fees: USD $1,900–$5,000 depending on class. Timeline: 5–9 months.

VAITOS License Classes:

• Class M (Virtual Asset Broker-Dealer): Exchange, OTC, order-book matching for crypto-fiat and crypto-crypto
• Class O (Virtual Asset Custodian): Client asset custody, private key safeguarding, multisig infrastructure
• Class R (Virtual Asset Marketplace): Token marketplace and listing platform operations
• Class I (Virtual Asset Investment Manager): Discretionary portfolio management, fund management
• Class S (VA Advisory Services): Investment advice, token advisory, ICO/ITO structuring

2026 compliance requirements: Annual independent cybersecurity audit (ISO 27001 alignment strongly recommended). 72-hour cybersecurity incident reporting to FSC. FATF Travel Rule (IVMS101 standard). 1:1 reserve backing for stablecoin issuers. DeFi, staking, and DAO activities now within VAITOS scope. 2 resident directors + Compliance Officer + MLRO required (outsourcing partially permitted).

Why Mauritius: ~3% effective corporate tax. 45+ DTAAs covering Africa, India, China, UAE, and key ASEAN markets. Africa and Indian Ocean gateway — no other offshore VASP jurisdiction provides equivalent access to African banking and institutional relationships. Zitadelle AG has licensed 5+ Mauritius VASPs since 2024 and operates directly from our Port Louis (1F River Court, 6 St. Denis Street) administration office. See our Mauritius VASP License (VAITOS) service page.

Seychelles — FSA VASP: Fast Offshore Credibility

The Seychelles Financial Services Authority operates a dedicated VASP Act (enacted 2024) alongside the Securities Dealer License framework. FATF-aligned. IOSCO member. Annual fee: USD $6,000. Crypto-CFDs confirmed without separate VASP license (February 2025 FSA Circular). Perpetual license (no expiry). Timeline: 8–12 months (VASP) or combined with SDL.

Why Seychelles for crypto: Cost-efficient, IOSCO-member credibility, perpetual license, no leverage cap, institutional acceptance improving post-2024 VASP Act. IC Markets, eToro, and Fusion Markets all hold Seychelles FSA licenses. Best for global crypto brokers, crypto-CFD platforms, and operators wanting a combined investment + VASP framework in a single jurisdiction. See our Seychelles FSA VASP License service page.

Cayman Islands — CIMA VASP: Institutional Offshore Standard

CIMA's VASP licensing regime (Phase 2, effective April 2025) is the most institutionally credible offshore crypto jurisdiction globally. Only 19 VASP licenses issued by early 2026. Combined with the March 2026 Tokenised Funds framework (Mutual Funds and Private Funds Amendment Acts), Cayman now provides the only offshore jurisdiction where tokenized investment fund interests can be regulated within an established institutional fund framework — not as VASP entities.

Why Cayman for crypto: Unmatched institutional credibility. 40 of the world's 50 largest banks have Cayman presence. 0% tax. 20-year Tax Exemption Certificate. The standard jurisdiction for institutional crypto funds, PE/VC vehicles with digital asset exposure, and crypto family office structures. Best for institutional fund managers, crypto hedge funds, family offices. See our Cayman Islands Company Formation service page.

El Salvador — DASP: Bitcoin-Native Jurisdiction

El Salvador's Digital Asset Service Provider (DASP) regime under the Bitcoin Law (as amended 2025) remains in force for crypto service providers. The 2025 IMF amendment affected macroeconomic Bitcoin policy but left the DASP licensing framework intact. 25% dividend withholding tax risk applies for shareholders resident in tax haven jurisdictions — founders should verify their personal tax position. Timeline: 3–6 months. Best for Bitcoin-focused exchanges, Lightning Network infrastructure, and Web3 ventures seeking a Bitcoin-native jurisdiction. See our El Salvador DASP License service page.

Labuan, Malaysia — DFS: Asian VASP Framework

The LFSA Labuan issues a Digital Financial Services (DFS) license covering cryptocurrency exchange and digital asset operations. MYR 500,000 (~USD $110,000) minimum capital. USD $10,000/year license fee. 3–6 month timeline. 3% tax or flat USD $20,000/year. Can be added to a Labuan Money Broker license for a combined forex + crypto structure. Best for Asia-Pacific crypto operators wanting a credible ASEAN license with speed and cost efficiency. See our Labuan VASP / DFS License service page.

Jurisdiction Selection Decision Framework

Most serious crypto operators in 2026 hold two licenses: a primary license for their main market (MiCA CASP or VARA) and an offshore license for global operations (Mauritius VAITOS or Seychelles VASP).

Part 3 — Corporate Structure

Every VASP license requires a locally incorporated entity. The corporate structure above the licensed entity determines your tax efficiency, investor optionality, and how capital flows through the group.

Standard approach for offshore VASP groups: Cayman Islands or BVI holding company at the top of the group → licensed operating entities in each jurisdiction (Mauritius GBC for VAITOS, Seychelles IBC for FSA VASP, UAE mainland entity for VARA) → separate regulated entity per additional license.

The holding company layer separates the regulated operating entity from the beneficial ownership structure and provides clean capital flow management for dividend routing. It also ensures that regulatory action against one operating entity does not directly affect group assets or other licensed entities. Relevant structuring options include Cayman Islands company formation, BVI company formation, and a Mauritius GBC for the VAITOS holding structure.

Part 4 — Technology Stack for Crypto Companies

A crypto exchange or VASP technology stack has seven critical layers. Every layer is a build-versus-buy decision with significant cost and timeline implications.

Layer 1 — Matching Engine / Trading Core. The heart of a centralized exchange. Custom build: $50,000–$200,000+ for a high-frequency trading engine with order matching and execution. White-label alternative: platforms like Crassula, B2Broker (B2TRADER), and AlphaPoint provide production-ready matching engines, order books, and full exchange infrastructure. White-label launch: 6–14 weeks versus 9–18 months custom. Build only if your differentiation lives in the engine itself (ultra-low-latency derivatives, novel AMM, unique clearing model). For all other cases, white-label is faster, cheaper, and operationally safer.

Layer 2 — Custody and Wallet Infrastructure. For custodial exchanges: hot and cold wallet architecture, multi-signature signing, Hardware Security Modules (HSMs), and MPC (Multi-Party Computation) wallets. The industry standard is Fireblocks or BitGo for institutional-grade MPC custody. Integration cost: $25,000–$80,000+. Annual custody infrastructure cost: $20,000–$100,000+ depending on asset volume and insurance requirements. Non-custodial (DEX/self-custody wallet) eliminates custody risk and regulatory liability for user funds — but creates liquidity depth challenges and limits payment card and fiat-on-ramp integration.

Layer 3 — Fiat On/Off Ramp. Converting fiat to crypto and back. Requires a payment license in most jurisdictions (separate from the VASP license). Integration with a PSP or EMI for card-based fiat rails. SEPA/SWIFT connectivity for bank transfer on-ramps. A Mauritius PIS license or Lithuania EMI license is the standard pairing with an offshore VASP license for fiat capability.

Layer 4 — KYC/AML and Onboarding. Regulatory requirement in every VASP jurisdiction. Identity verification (Sumsub, Onfido, Jumio, Veriff). Document verification and liveness checks. Sanctions screening (OFAC, EU, UN, HM Treasury) at onboarding and ongoing. PEP screening and adverse media monitoring. Cost: $0.50–$3.00 per verification. Enterprise platforms: $2,000–$10,000/month.

Layer 5 — Travel Rule Compliance.The FATF Travel Rule (Recommendation 16) requires VASPs to collect and transmit originator and beneficiary information for virtual asset transfers above the USD/EUR 1,000 threshold. Enforced in 85+ jurisdictions as of 2026. Data standard: IVMS101 (InterVASP Messaging Standard 101). Leading compliance solutions: Notabene, TRISA, TRP (Travel Rule Protocol), Sygna. The “Sunrise Issue” — uneven global implementation — means your platform must handle counterparty VASPs that do not yet comply. Annual cost: $5,000–$30,000 depending on transaction volume and solution choice.

Layer 6 — Transaction Monitoring and Blockchain Analytics. On-chain transaction monitoring for suspicious activity. Blockchain analytics platforms (Chainalysis, Elliptic, TRM Labs) provide address screening, transaction risk scoring, and VASP identification for Travel Rule purposes. Regulators (FSC Mauritius, CIMA Cayman, VARA Dubai) all reference blockchain analytics as part of their compliance expectations. Annual cost: $15,000–$80,000+ depending on volume and jurisdiction.

Layer 7 — Cybersecurity Infrastructure. Mandatory in most VASP jurisdictions in 2026. ISO 27001 certification or alignment is now a de facto requirement for Mauritius VAITOS and strongly recommended for VARA and MiCA CASP. Annual independent cybersecurity audit required in Mauritius. 72-hour incident reporting to FSC mandatory. Core infrastructure: penetration testing (annual, $10,000–$30,000), bug bounty program, DDoS protection, secure development lifecycle (SDL).

Part 5 — AML/CFT Framework for VASPs

The AML/CFT framework for a VASP is substantially more complex than for a standard financial services company because it must address both traditional financial crime and blockchain-specific risks. Required components across all major jurisdictions:

• AML/CFT Policy and Procedures manual — jurisdiction-specific, covering risk appetite, customer risk scoring, due diligence levels, and reporting obligations.
• Customer Due Diligence (CDD) — standard KYC for all users. Enhanced Due Diligence (EDD) for high-risk clients: PEPs, users from high-risk jurisdictions, large deposit volumes, unusual transaction patterns.
• Transaction Monitoring — real-time and retrospective. Automated alerts for unusual volume spikes, transactions to/from flagged addresses, structuring patterns (smurfing), rapid cycling between assets, unusual withdrawal destinations.
• Blockchain Analytics — screening all on-chain deposits and withdrawals against known illicit addresses, darknet market associations, mixer outputs, and sanctioned entity clusters. Required by VARA, VAITOS, Seychelles FSA, and expected by MiCA supervisors.
• Travel Rule Implementation — IVMS101-compliant data exchange with counterparty VASPs for transactions above the threshold. Self-hosted wallet policy: for transfers to/from unhosted wallets, collection of wallet ownership evidence from the customer.
• MLRO (Money Laundering Reporting Officer) — named qualified individual. Many offshore VASP jurisdictions permit outsourced MLRO. Mauritius requires physical local presence (partial outsourcing permitted).
• SAR/STR Reporting — Suspicious Activity/Transaction Reports filed with the relevant FIU on prescribed timelines.
• Sanctions Screening — real-time screening of all users and counterparties against OFAC, EU, UN, and relevant national sanctions lists. Immediate freeze and reporting obligation on sanctions matches.

Part 6 — Realistic Cost Breakdown by Tier

Offshore Entry (Seychelles VASP + white-label exchange)

Mid-Market Offshore (Mauritius VAITOS Class M+O)

Dubai VARA (Exchange License)

EU MiCA CASP (Lithuania)

Part 7 — Timeline from Decision to Live Operations

Part 8 — MiCA Compliance for Existing Operators

If you currently operate a crypto service and serve EU clients — under a national VASP registration, an AML registration, or without any license — the July 1, 2026 deadline applies to you. Key facts:

A legacy VASP, DASP, or national AML registration no longer qualifies as authorization after July 1. A pending MiCA application alone does not continue your right to operate unless your home member state specifically extended grandfathering for applicants in process.

Several EU countries already closed their transitional windows early: the Netherlands ended its regime for DNB-registered providers on 30 June 2025; Sweden required applications or wind-down from 1 October 2025.

If your application is not submitted and you are serving EU clients on July 2, your options are: cease EU operations while your application is processed; migrate EU clients to an authorized CASP partner; or face enforcement action.

The fastest application path in the EU remains Lithuania — approximately 6 months for clean, complete files. CySEC's Article 60 pathway for existing CIF licensees is faster still — a simplified notification procedure for adding CASP services. Contact Zitadelle AG immediately if you need an emergency MiCA CASP application strategy.

Part 9 — The Six Most Common Mistakes

1. Choosing jurisdiction before defining the activity set. A custody-only business needs different authorization than an exchange. An OTC desk needs different capital than a retail platform. Define activities first; license class follows automatically.

2. Treating the technology stack as separate from the license application. Most regulators (VARA, FSC Mauritius, CySEC for MiCA) want to see technology infrastructure as part of the license application — not built later. Technology scoping must happen in parallel with the licensing process, not after approval.

3. Ignoring the Travel Rule from launch. New VASPs frequently launch without a Travel Rule solution, planning to add it later. Regulators and banking partners increasingly require Travel Rule capability before or immediately after authorization. Build it into your compliance stack from day one.

4. Assuming blockchain analytics is optional. Jurisdictions that do not mandate blockchain analytics by name still expect VASPs to screen on-chain activity. A regulator discovering that a licensed VASP had no on-chain monitoring capability is a serious supervisory finding. Chainalysis, Elliptic, or equivalent should be budgeted from launch.

5. Banking last. Crypto exchanges need multiple banking relationships — for fiat deposits, operational accounts, and client fund segregation. Banks that accept VASP clients are a restricted pool. Banking due diligence begins at the same time as licensing, not after approval.

6. Building for one jurisdiction. A Mauritius VAITOS license serves Africa and Asia well. It does not serve EU retail clients after July 2026. A Dubai VARA license is optimal for MENA but does not passport into the EU. Multi-jurisdiction structure planning from launch is substantially cheaper than retrofitting compliance for a new market after traction.

Why Zitadelle AG for VASP and CASP Licensing

Zitadelle AG has licensed 5+ Mauritius VASP entities under VAITOS since 2024, manages CySEC CIF + MiCA pathway applications from our Limassol headquarters, and advises on Dubai VARA, Seychelles FSA, Cayman CIMA, and El Salvador DASP structures. Our Labuan administration office provides direct LFSA access for Asian VASP and DFS structures.

We provide licensing support across the full lifecycle: jurisdiction selection, entity formation, license application management, AML/CFT framework drafting, technology vendor coordination, and ongoing compliance. For a confidential assessment, contact Zitadelle AG.

Disclaimer: This guide is for informational purposes only and does not constitute legal or regulatory advice. Licensing requirements, fees, and timelines are subject to change. The MiCA transitional period deadline information reflects ESMA guidance as of June 2026. Last updated: June 2026.