Exchange, Broker, and Custodian Licensing: Why It's by Activity, Not by Country
Why a single "crypto licence" almost never covers every business model -- how real regulators split exchange, broker, and custody activities into separate permissions, with a direct comparison table.
Jump to section
What this guide covers
A crypto exchange, a crypto broker, and a crypto custodian do structurally different things -- and real regulators generally license them as structurally different things, even within a single country's single overall framework. This guide compares how four real, directly-researched jurisdictions actually split these activities, as a practical complement to Kaavon's "What Is a Crypto Licence?" guide. It's educational information, not legal advice.
The underlying distinction regulators actually care about
Across the jurisdictions below, the real dividing line isn't "exchange vs. broker vs. custodian" as marketing categories -- it's whether a business takes custody of client assets, whether it trades as principal (against its own book) or purely as agent (matching other people's orders), and whether it operates a venue other participants trade on. Those three structural questions, not the business's own label for itself, are what most licensing regimes actually key off.
A direct comparison
| Jurisdiction | How it splits these activities | Custody treated separately? |
|---|---|---|
| UAE (VARA, Dubai) | Eight distinct licensed activity categories confirmed directly from VARA's own site, including separately-named Exchange Services, Broker-Dealer Services, and Custody Services. | Yes -- VARA's own rules require custody to sit in its own separate legal entity, distinct from an exchange or broker-dealer licence. |
| EU (MiCA) | One CASP authorisation, but Article 62(2) requires different specific information depending on which named services you're applying for -- a custody policy is only required if you're actually applying to provide custody. | Separately specified within the same authorisation, not a separate licence category -- a CASP must name custody specifically among its authorised services to provide it. |
| Singapore (MAS, Payment Services Act) | "Digital payment token service" itself bundles several distinct activities (dealing, operating an exchange platform, transmitting, and custodian wallet services) confirmed directly from MAS's own licensing pages -- the licence class (SPI/MPI) depends on volume, not on which of these specific activities you perform. | Named as a distinct activity ("custodian wallet services") within the same DPT service category, not a separate licence. |
| United States (state money-transmitter model) | New York's BitLicense (23 NYCRR Part 200, confirmed directly from NYDFS's own site) defines a single "Virtual Currency Business Activity" covering transmission, exchange, custody, and more -- a different structural model from VARA's or MAS's activity-by-activity split. | Covered within the same single BitLicense category, not split out separately. |
How four real, directly-researched regulatory regimes split exchange/broker/custody-type activities. Each row is illustrative of that regime's own approach, not a universal standard.
A licence for one activity doesn't automatically authorise the others
VARA's own rules are explicit about this: a custody licence doesn't let you also run an exchange, and proprietary trading isn't permitted under any VARA licence at all -- it needs its own separate company. Even in jurisdictions that bundle several activities into one broader licence category (Singapore's DPT service, New York's BitLicense), always check the specific activity list a given licence actually authorises, rather than assuming a general crypto licence covers everything your business does.
Why custody specifically gets singled out so often
Taking custody of client assets creates a specific risk category -- client funds commingled with, or exposed to, the custodian's own operational or financial problems -- that trading-facilitation activity alone doesn't. That's the practical reason VARA requires a separate legal entity for custody, and why MiCA's Article 62 singles out a dedicated custody policy as required information only for firms actually offering it: regulators are consistently treating "do you hold other people's assets" as a different, usually stricter, question from "do you facilitate trades."
What to actually check for your business model
- Does your target jurisdiction license by named activity (like VARA's eight categories) or by a single bundled category (like a BitLicense)? This changes how many separate applications or approvals you may need.
- If you plan to take custody of client assets at any point, check whether that specifically requires a separate legal entity, a separate licence, or just a separate named permission within one licence -- the three have very different corporate-structuring implications.
- If you plan to trade as principal (against your own book) rather than purely matching client orders, check whether that's permitted at all under the licence you're pursuing -- several regimes (VARA among them) restrict or separately gate proprietary trading.
- Don't assume a licence that covers one of your activities covers all of them -- confirm the specific authorised-activity list directly with the regulator.
Limitations and review information
Last verified: November 5, 2026. This comparison draws on four directly-researched jurisdictions, not a global survey -- other regimes may split these activities differently again. This is educational information only, not legal advice; confirm the specific activity-licensing structure directly with the relevant regulator before structuring a business around it.
Related concepts
What Is a Crypto Licence? VASP Registration vs. CASP Authorisation, Explained
Read the full guide
Virtual Asset Service Provider
Read the Virtual Asset Service Provider glossary definition
Crypto-Asset Service Provider
Read the Crypto-Asset Service Provider glossary definition
Crypto Lending, Staking, and Yield: Why Regulators Treat Them as Separate Questions
Read the full guide