What Is a Crypto Licence? VASP Registration vs. CASP Authorisation, Explained

What this guide covers

"Crypto licence" gets used as if it were one thing. It isn't. Depending on the jurisdiction and the activity, a crypto business might need an anti-money-laundering (AML) registration, a full financial-services authorisation, an activity-specific permission from one of several possible regulators, or some combination of these -- and holding one of them doesn't automatically mean the others don't apply. This guide explains the real distinctions, using jurisdictions Kaavon has directly researched (not a comprehensive global survey) as concrete, sourced examples. It's educational information about how these frameworks work, not legal advice, and it doesn't tell you which jurisdiction to choose -- that depends on your specific business model, customers, and risk tolerance.

Why "crypto licence" is not one thing

A Virtual Asset Service Provider (VASP) classification (see Kaavon's "Virtual Asset Service Provider" glossary definition) and a Crypto-Asset Service Provider (CASP) authorisation (see Kaavon's "Crypto-Asset Service Provider" glossary definition) sound interchangeable and often get used that way in casual writing, but they're structurally different things. VASP is the broader, FATF-driven global AML classification -- being registered as a VASP generally means a regulator has brought you into its anti-money-laundering supervision, not that it has authorised every kind of crypto business activity you might want to run. CASP is MiCA's specific EU authorisation category, tied to a defined list of crypto-asset services and, once granted, generally passportable across EU member states via a notification process (MiCA Articles 59, 63, and 65) -- a structurally different mechanism from a purely national, non-passportable registration.

Five genuinely different models, compared directly

A closer look: the EU's passportable model

MiCA's CASP authorisation is distinctive because of what happens after you get it. Article 62 sets out what an application must contain -- including the firm's programme of operations, governance arrangements, prudential safeguards, and (where relevant) custody policy, trading-platform rules, or execution policy for the specific services it intends to offer. Once a national competent authority grants authorisation under Article 63, Article 59 allows the firm to provide those same crypto-asset services throughout the EU, and Article 65 sets out a notification procedure -- rather than a fresh application -- for actually doing so in another member state. The Central Bank of Ireland, one EU national competent authority, describes a multi-stage process on its own site: an initial meeting, a Key Facts Document, a formal application (reviewed for completeness within a reported 25 working days), and a substantive assessment (a reported 40 working days, extendable by up to 20 more for further information).

A closer look: the UK's shift away from pure AML registration

The UK offers a useful contrast. Cryptoasset businesses have been registered under the UK's Money Laundering Regulations since January 2020 -- an AML registration, not a full financial-services authorisation. The UK's Cryptoassets Regulations 2026, passed by Parliament on 4 February 2026, create a new regime bringing specific regulated cryptoasset activities -- including trading, custody, staking, and lending and borrowing -- within the FCA's broader authorisation framework, with the FCA confirming the full scope of regulated activities expands from 25 October 2027. The FCA's own policy statements explicitly name firms already registered under the Money Laundering Regulations as a group affected by the new regime, distinct from firms applying for the new authorisation for the first time -- a concrete illustration of the AML-registration-versus-full-authorisation distinction this guide opened with.

A closer look: one city, three regulators

The United Arab Emirates illustrates why "a UAE crypto licence" is an incomplete question. VARA (the Virtual Assets Regulatory Authority) describes itself, on its own site, as regulating virtual assets across Dubai's free zones and mainland -- explicitly except within the Dubai International Financial Centre (DIFC). VARA's own licensed-activities page lists eight distinct categories (including Exchange Services, Custody Services, and Broker-Dealer Services), each requiring its own licence; custody specifically must sit in its own separate legal entity under VARA's rules. DIFC itself falls under a separate regulator, the DFSA, which reportedly overhauled its own "Crypto Token" regime in January 2026 (per secondary legal-industry reporting -- DFSA's own site could not be directly verified for this guide). Abu Dhabi's ADGM runs yet another framework through its FSRA, built around a defined list of "Accepted Virtual Assets" that, per a June 2025 rule change reported by legal commentary, firms can now self-assess against and notify the regulator about, rather than seeking case-by-case pre-approval for each one (ADGM's own site could not be directly verified for this guide either). Three cities' worth of regulators, inside what's commonly referred to as one jurisdiction.

A closer look: licensing by activity, not by a single "crypto" category

Singapore's Payment Services Act doesn't create a standalone "crypto licence" at all. "Digital payment token service" is one of several regulated payment services under the Act, and a firm providing it holds one of three licence types -- Standard Payment Institution, Major Payment Institution, or a Money-Changing Licence -- depending on transaction volume and which services it performs, confirmed directly from MAS's own licensing pages. MAS has also published guidance, since January 2022, that digital-payment-token service providers "should not promote their DPT services to the general public in Singapore" (PS-G02) -- a marketing restriction that exists alongside, not instead of, the underlying licensing requirement.

The broader global picture

FATF -- the global standard-setter behind the VASP concept and the Travel Rule (see Kaavon's "Travel Rule" glossary definition) -- periodically publishes targeted updates assessing how fully its member jurisdictions have actually implemented Recommendation 15, the virtual-asset standard. FATF published its seventh such update in July 2026. This guide does not cite specific compliance statistics from it: the report itself could not be independently accessed for this guide (the request returned an access error), and no specific percentage figure was corroborated well enough from secondary sources to state with confidence. The honest takeaway is directional, not statistical: FATF's recurring need to keep publishing these updates is itself evidence that global VASP-rule implementation remains uneven years after Recommendation 15 was adopted, not that it's been resolved.

What foreign founders should actually understand

• A licence or registration is activity-specific, not a blanket "crypto permission" -- always check the actual list of covered activities against your business model, not just whether a licensing regime exists.
• Incorporating a company in a jurisdiction is a different legal step from being authorised to operate a regulated crypto activity there -- the two are easy to conflate and commonly confused in marketing material from company-formation agents.
• A jurisdiction that's fast or cheap to get licensed in is not automatically a good fit -- consider which customers you can actually serve, what the regulator's reputation means for banking and payment-processor relationships, and how enforcement-active that regulator actually is.
• There is no single "best" jurisdiction for a crypto business -- the right fit depends on your specific activities, target customers, and risk tolerance, and this guide does not rank or recommend one.

Where to go deeper

Kaavon's Global Crypto Licensing Directory covers around 100 jurisdictions with a classified regulatory status, main regulator, and source for each -- 29 of them with a full, dedicated "Licensing a crypto business in X" section on their own crypto tax guide page, including their own primary-source citations and known gaps. Start there to find a specific jurisdiction, or see Kaavon's dedicated guides on stablecoin issuer licensing, exchange/broker/custodian licensing by activity, and DeFi protocol regulation for a business-model-first view instead of a country-first one.

Limitations and review information

Last verified: November 5, 2026. This guide and Kaavon's wider Global Crypto Licensing Directory draw on real research across roughly 100 jurisdictions, not an exhaustive survey of all ~195 sovereign states -- many entries rely on secondary legal/compliance reporting rather than a directly-fetched official source, and that is disclosed per jurisdiction rather than implied away. DFSA's and ADGM's own regulator sites could not be directly accessed for this guide's UAE section. FATF's seventh targeted update could not be read as text even after locating a regulator-mirrored copy, so no specific compliance statistic from it is cited here. This is educational information only, not legal advice -- confirm current requirements directly with the relevant regulator or a qualified local lawyer before acting.