A Crypto Licensing Readiness Checklist

What this checklist is, and isn't

This is a practical starting checklist for a prospective crypto business thinking about licensing -- the questions worth having real answers to before approaching a regulator or a lawyer, not a legal eligibility determination. Requirements genuinely differ by jurisdiction and activity (see Kaavon's "What Is a Crypto Licence?" guide and Global Crypto Licensing Directory). This doesn't tell you whether you qualify for anything.

Business model and activities

• What does the business actually do -- exchange, custody, lending, payments, issuance, advisory, something else? (See Kaavon's business-model guides for how differently these are often treated.)
• Which specific activities, named individually, does the business perform? A licence is usually activity-specific, not a blanket crypto permission.
• Does the business take custody of client assets at any point, even temporarily? This single question changes the analysis in almost every jurisdiction researched so far.
• Does the business trade as principal (its own book) or purely as agent (matching other people's orders)? Several regimes treat these very differently.

Clients and jurisdictions

• Which countries will actual clients be located in, not just where the company is incorporated?
• Is the business targeting retail customers, institutional/professional customers, or both? Several regimes impose additional restrictions specifically on retail access.
• Does serving a given country's residents require a local licence, or can it be done under a licence from elsewhere (e.g. via passporting, where that exists)?

Corporate structure and governance

• Legal entity structure, jurisdiction of incorporation, and whether local incorporation is actually required where you intend to operate.
• Who are the directors and senior management, and do they meet the kind of "fit and proper" standard most regulators apply (no disqualifying criminal record, relevant experience)?
• Who are the beneficial owners, and is ownership structured in a way a regulator can actually trace?

Compliance and risk

• AML/CFT programme: policies, a named compliance officer, customer due diligence, and transaction monitoring.
• Sanctions screening and, where applicable, Travel Rule compliance for transfers between platforms (see Kaavon's "Travel Rule" glossary definition).
• Risk management framework appropriate to the specific activities (custody risk, counterparty risk, market risk, as applicable).
• Cybersecurity and technology risk controls, including key management if custody is involved.

Financial resources

• Minimum regulatory capital, where a jurisdiction publishes one -- verify the exact current figure directly with the regulator, never estimate from a secondary source.
• Client-asset safeguarding/segregation arrangements if the business holds client funds or crypto.
• Realistic financial projections covering the costs of the application and the first period of ongoing supervision.

Documentation and ongoing obligations

• Business plan, compliance policies, and governance documents ready for regulator review.
• Clarity on ongoing reporting, audit, and notification obligations after a licence is granted -- licensing isn't a one-time event.
• A realistic view of application timelines and costs -- see Kaavon's licensing application preparation and cost-framework guides.

Limitations and review information

Last verified: November 5, 2026. This checklist is general and educational -- it does not determine whether any specific business qualifies for any specific jurisdiction's licence, and it is not a substitute for direct regulator engagement or qualified legal advice.