Offshore Crypto Licenses
What Changed on 1 July 2026
Most articles on this subject were written for a world that ended on 1 July 2026. On that date the transitional period under the EU’s Markets in Crypto-Assets Regulation closed across all 27 member states. Since then, any firm providing crypto-asset services to clients in the EU without a MiCA authorisation is in breach of EU law — and ESMA has been explicit that this applies to non-EU firms too.
A licence outside the EU does not buy you access to the EU. It buys you access to the markets that licence actually covers.
That is not a small distinction. It is the entire basis of a sound licensing decision, and it is the thing most guides on this topic still get wrong. A third-country entity cannot provide MiCA services to EU clients or solicit them, in B2C or B2B arrangements. If your target customers are in Germany, France, Spain or the Netherlands, no VASP registration in the Caribbean or the Caucasus will make that lawful.
If your target customers are in the Gulf, Southeast Asia, Africa or Latin America, a non-EU licence may be exactly the right answer — and often a faster and more proportionate one than MiCA. We help clients in both directions. If the EU is the market, we work on the MiCA licence through Lithuania or the CySEC-regulated route in Cyprus. If the EU is not the market, the jurisdictions below are where the work gets done.
On “reverse solicitation”. Some providers still sell an offshore licence on the basis that EU clients can be served under the reverse solicitation exemption. Treat this claim as a warning sign about the provider.
Reverse solicitation is a narrow exception for services a client genuinely initiates entirely on their own. ESMA’s guidelines cover marketing very broadly: a website, advertising banners, pop-ups, emails, social media, influencer promotion, even sponsorship of an event that EU participants enter, can all amount to soliciting EU clients and remove the exemption.
Since 1 July 2026 national regulators — the CSSF among the first — have publicly warned that firms are abusing the exemption and that they intend to act. Reverse solicitation is not a business model. It is not a licensing strategy. Anyone presenting it as one is selling you an enforcement risk.
MiCA vs Global Crypto Asset Regulations
The honest starting point is that MiCA did not create an incentive to go offshore — it created a hard boundary. Inside the boundary you need a MiCA authorisation. Outside it, you need a licence that fits the market you are actually serving.
Below we assess the realistic alternatives one by one, including several that appear on competitor pages as “offshore options” and are nothing of the kind. Where a jurisdiction has tightened, we say so — a licence obtained on outdated advice costs far more than the fee. If the EU is genuinely your market, see the MiCA CASP route in Lithuania.
The Jurisdictions, Honestly Assessed
Genuinely open to new entrants
Crypto License in the United Arab Emirates
In the Middle East, the United Arab Emirates is the most active licensing market outside the EU — and it operates three separate regimes that are frequently confused. VARA regulates virtual asset activity in Dubai outside the financial free zones. ADGM, through the FSRA, has one of the longest-established digital asset frameworks in the region. DIFC operates its own regime under the DFSA. Each has different capital, governance and activity categories, and choosing the wrong one costs months.
On tax: the headline UAE corporate rate is 9% on profits above AED 375,000, but a Qualifying Free Zone Person meeting the substance and qualifying-income conditions can be taxed at 0% on qualifying income. Whether your activity qualifies is a technical question, not a marketing claim — treat any provider quoting a flat “0% in free zones” with caution.
Realistic assessment: strong regulatory credibility, real banking access, genuine substance expectations, and a competitive but not trivial process.
Crypto License in Kazakhstan
Kazakhstan operates the Astana International Financial Centre, a common-law framework with an English-language court and a dedicated digital asset regime under the AFSA, built out following the 2023 Law on Digital Assets. AIFC participants benefit from tax exemptions running to 2066.
Realistic assessment: a serious, well-structured regime that remains relatively accessible, with growing relevance for Central Asian and CIS-facing businesses.
Crypto License in Labuan
The territory of Labuan, part of Malaysia, has operated a digital asset exchange framework since 2018, with no local partner requirement and access to Malaysia’s extensive treaty network.
Realistic assessment: workable and comparatively low-cost, but banking and counterparty acceptance is narrower than the Gulf. Best suited to businesses with an existing Asian footprint.
Crypto License in Gibraltar
The DLT provider framework of Gibraltar, built on a set of regulatory principles and supervised by the GFSC, was among the first purpose-built crypto regimes anywhere and retains a good reputation. Note that Gibraltar is outside the EU and outside MiCA, so a Gibraltar licence carries no EU passport.
Realistic assessment: credible and well-regarded, moderate cost, no EU access.
Crypto License in Georgia
Virtual asset service providers in Georgia register with the National Bank of Georgia. The free-zone arrangement described in older guides — obtain a licence in Kutaisi and avoid the National Bank entirely — no longer exists.
Realistic assessment: fast and inexpensive by comparison with the Gulf, but the regime has tightened considerably, and banking is the practical constraint. Confirm the current requirements before committing — this is one of the faster-moving frameworks on the list.
Crypto License in South Africa
Crypto asset service providers in South Africa must be licensed by the Financial Sector Conduct Authority as financial service providers, with crypto assets designated as financial products. Companies must comply with stringent Anti-Money Laundering and Counter-Terrorism Financing requirements.
Realistic assessment: the most developed regime on the African continent, genuinely open, and increasingly the natural base for African-market operations.
Crypto License in Argentina
Virtual asset service providers in Argentina register with the Comisión Nacional de Valores under the framework introduced in March 2024. This licensing ensures compliance with international AML and CFT norms.
Realistic assessment: relevant if Latin America is your market; less relevant otherwise, and the macroeconomic environment is a factor in its own right.
Crypto License in El Salvador
El Salvador requires a correction that most guides have not made. The Legislative Assembly amended the Bitcoin Law on 29 January 2025 as a condition of a $1.4 billion IMF facility. Bitcoin is no longer characterised as currency, acceptance by businesses is voluntary rather than mandatory, and it can no longer be used to pay taxes or government debts.
The country retains a digital asset licensing framework and an active pro-crypto policy stance, but the “Bitcoin is legal tender” headline that appears on most competitor pages is out of date by more than eighteen months.
Serious regimes, not shortcuts
These jurisdictions appear on almost every “offshore crypto licence” list. In 2026 that classification is simply wrong, and choosing one on the assumption that it is light-touch will cost you time and money.
Crypto License in Singapore — No Longer an Offshore Option
This is the single biggest change most guides have missed. Since 30 June 2025, the Digital Token Service Provider regime under Part 9 of the Financial Services and Markets Act 2022 requires any Singapore-incorporated entity, or any entity operating from a place of business in Singapore, to hold a DTSP licence if it provides digital token services to customers anywhere in the world — including where it serves no Singapore clients at all.
MAS has stated it has set the bar high and will generally not issue such a licence, citing money laundering risk and its inability to supervise activity conducted entirely offshore. There was no transitional period. Existing providers serving only overseas customers were required to cease. Operating without the licence carries fines up to SGD 250,000 and up to three years’ imprisonment.
Realistic assessment: Singapore closed the exact structure this page category is named after. It remains an excellent jurisdiction for a business genuinely operating in and from Singapore under the Payment Services Act — but it is no longer a base for serving foreign markets from a distance.
Crypto License in Hong Kong
In Hong Kong, the VATP licensing regime under the AMLO commenced on 1 June 2023, and it has been building outward ever since. The Stablecoins Ordinance took effect on 1 August 2025, requiring HKD 25 million in paid-up capital and full reserve backing; the HKMA granted its first two stablecoin issuer licences in April 2026, deliberately few.
Consultation conclusions on licensing virtual asset dealing and custody were published in December 2025, with a bill expected before the Legislative Council in 2026, and conclusions on advisory and management followed in May 2026 — with no transitional arrangements proposed.
Realistic assessment: a top-tier regime with real institutional access, requiring a genuine Hong Kong presence, an SFC-approved Responsible Officer resident in Hong Kong, substantial capital and a timeline measured in many months. Worth it if you are building an institutional business in Asia. Not a shortcut.
Crypto License in the Cayman Islands
The licensing regime under the Cayman Islands Virtual Asset (Service Providers) Act commenced on 1 April 2025, requiring providers of virtual asset custody services and operators of virtual asset trading platforms to hold a CIMA licence, with an accompanying Rule and Statement of Guidance. Descriptions of Cayman as offering lighter compliance requirements and swift setup describe the pre-2025 registration regime, not the current one.
Realistic assessment: still highly relevant for funds and institutional structures, and still tax-neutral — but a supervised licensing regime, priced and timed accordingly.
Crypto License in Australia
In Australia there are two regulators, not one. AUSTRAC handles digital currency exchange registration and AML/CTF obligations; ASIC applies where a crypto asset is a financial product requiring an AFS licence. Guides that name only ASIC are describing half the requirement. Broader digital asset platform legislation has been in preparation and should be checked for current status before planning.
Realistic assessment: a stable, well-regulated market — and a domestic one, not an offshore base.
Other Offshore
Crypto Licenses
There are also opportunities to obtain specific types of licences in jurisdictions such as Panama, Mauritius, Bermuda and Bosnia. Their legislative frameworks for cryptocurrencies and digital assets remain at an earlier stage of development and lack the clarity and stability of the regimes above.
They can be the right answer for a specific model, but they should be entered with open eyes: the risk here is less the regulator than the banking, counterparty and audit consequences of holding a licence nobody recognises.
The Three Constraints That Decide the Outcome
Choosing a jurisdiction is the visible part of the decision. These three factors determine whether the licence is actually usable.
1. Fiat rails. The licence is rarely the bottleneck — banking is. A licence a bank does not recognise, in a jurisdiction its correspondent network is uncomfortable with, produces an entity that cannot receive customer funds. Establish the banking and payment route in parallel with the licence application, not after it. Where a commercial bank is not available, a regulated EMI or payment institution may be, and we structure for that from the start.
2. The FATF Travel Rule and grey-list exposure. FATF Recommendation 15 requires originator and beneficiary information to travel with virtual asset transfers, and implementation is now the norm rather than the exception. Separately, a jurisdiction’s FATF grey-list status directly affects your correspondent banking, your ability to onboard institutional counterparties, and the enhanced due diligence others must apply to you. Check the current list before choosing — it changes at every plenary.
3. Automatic exchange of information. The OECD’s Crypto-Asset Reporting Framework and, within the EU, DAC8 bring crypto-asset transactions into the same automatic exchange machinery that already covers bank accounts. Reporting obligations are phasing in across adopting jurisdictions. Structures built on the assumption that crypto activity stays invisible are being built for a world that is closing.
Varieties of Cryptocurrency Licensing
Licences generally fall into two families: purpose-built virtual asset authorisations, and traditional financial licences extended to cover digital assets. Which you need depends on the activity, not on what you call your product — most regulators assess substance over label.
Exchange / trading platform. For firms matching orders or trading crypto against fiat or other crypto. Requires KYC/AML infrastructure, capital, and increasingly client asset segregation.
Custody. For holding client assets or private keys. Now separately licensed in a growing number of jurisdictions, including Hong Kong and the Cayman Islands, with key management and operational independence requirements.
Broker / dealer. For arranging or executing transactions as intermediary. Increasingly carved out as its own category.
Token issuance (ICO/STO/stablecoin). Requires a documented project, business plan and continuing disclosure. Fiat-referenced stablecoins now have dedicated regimes with bank-like requirements in several jurisdictions.
Crypto banking, lending and deposit-taking. The heaviest category, with capital and prudential standards approaching those of a bank.
Mining. Where regulated, primarily an energy and environmental compliance question rather than a financial one.
Advisory and asset management. A newer category, being brought into scope in Hong Kong and elsewhere.
The Licensing Process, Step by Step
1. Market and scope analysis. Which customers, in which countries, doing what. This determines the jurisdiction — not the other way around. Getting this backwards is the most common and most expensive mistake we see.
2. Jurisdiction selection. Permitted legal forms, capital requirements, residency conditions for founders and officers, fit-and-proper standards for directors and beneficial owners, realistic timelines, and — critically — banking feasibility.
3. Entity formation. Larger operations frequently use multiple entities across jurisdictions to separate the licensed activity from the group holding structure. Build this correctly at the outset; retrofitting is expensive. See corporate structuring and redomiciliation.
4. Documentation. Business plan, service descriptions, ownership chart, financial projections, governance framework, and the full AML/CFT policy suite. Application quality is the single strongest predictor of outcome.
5. Corporate account. Usually required, preferably in the same jurisdiction. Start early.
6. Key personnel. A compliance officer and MLRO are near-universal requirements, and several regimes require them to be resident locally and approved by the regulator personally.
7. Security, technology and operational readiness. Custody architecture, key management, cyber controls, data protection, and business continuity. Increasingly assessed by an external assessor before the regulator decides.
8. Submission and review. Expect follow-up questions, regulator meetings, and in some jurisdictions a pre-application process that materially improves the outcome.
Once these phases are completed and the regulator is satisfied, the licence is granted, legally authorising the company to operate within the scope applied for.
Standard AML Compliance Measures
Every credible regime builds on the FATF standards. The specifics differ; the architecture does not.
Customer due diligence (KYC). Identity verification, beneficial ownership, and risk classification at onboarding, with enhanced measures for higher-risk relationships.
Transaction monitoring. Systems capable of detecting unusual patterns, plus blockchain analytics for counterparty and wallet screening — now an expectation rather than a differentiator.
Travel Rule compliance. Transmitting originator and beneficiary data with transfers, and handling incoming data from counterparties.
Sanctions screening. Against all applicable lists, continuously rather than at onboarding only.
Risk assessment. A documented business-wide money laundering and terrorist financing risk assessment, reviewed and updated.
Internal policies and procedures. Written, board-approved, and actually followed — regulators test the second part.
Employee training. Regular and evidenced.
Record keeping. Customer and transaction records retained for the statutory period.
Reporting obligations. Suspicious transaction reports and periodic returns to the relevant financial intelligence unit — AUSTRAC in Australia, the Financial Crimes Enforcement Network (FinCEN) in the United States, the FIU in each other jurisdiction.
Differences in local legal requirements mean that crypto businesses need to be vigilant about varying standards for information collection, retention periods and reporting protocols. Meeting these obligations is vital to avoiding penalties.
Ready to take your crypto business to the next level? Navigating the regulatory landscape is a challenge, but you do not have to do it alone. Our team provides worldwide legal, compliance and licensing services for the crypto industry — more about us.
We will tell you when the answer is that your plan does not work as described. That conversation is cheaper than a refused application.
What is included in our list of services for obtaining crypto licences
Jurisdiction Analysis. An honest assessment of whether your target market makes the jurisdiction you have in mind viable at all.
Corporate Services Provider. Company formation, structuring, registered offices and ongoing administration.
VASP Licensing. Obtaining licences for virtual asset service providers involved in exchange and custody.
Compliance Programs. AML/CFT frameworks, policies and Travel Rule implementation for regulated businesses.
Auxiliary Services. Licensing for additional services related to virtual assets.
Digital Asset Funds. Registration support for investment funds dealing in digital assets.
ICO/IEO Projects. Legal assistance for initial coin offerings, initial exchange offerings and stablecoin issuance.
Legal Assessment. Crafting well-informed legal opinions, including token classification.
Banking and Payment Rails. Introductions and application support, run alongside the licensing track.
MiCA Licensing in the EU. Where the European Union is genuinely your market.
This is only a small part of what we can help you with. Tell us what your product does, where your customers are and what your timeline is — we will tell you which jurisdictions genuinely fit.
We have other solutions for crypto licensing, which are available here.
Get a personal offer!
Common Questions About Crypto Licensing
Can an offshore crypto licence be used to serve EU customers?
No. Since 1 July 2026, providing crypto-asset services to EU clients without MiCA authorisation breaches EU law, and ESMA has confirmed this applies to third-country firms in both B2C and B2B contexts.
The only route to the EU market is a MiCA licence obtained through an EU or EEA entity. Reverse solicitation is a narrow exception for services a client initiates entirely on their own, not a business model — any marketing directed at the EU removes it, and national regulators have warned publicly that they intend to act against firms abusing it.
Steps to obtain a cryptocurrency permit
The process is tailored to the regulations of each jurisdiction, and both complexity and duration vary widely. Generally it involves determining the legal structure, validating the reputation of the founders and officers, providing a registered address, opening a corporate account, building AML and KYC procedures, and hiring specialised personnel such as a compliance officer and MLRO.
Review periods commonly run from one to six months, and preparation before filing often takes as long again. Application quality is the single strongest predictor of the outcome — a complete, well-evidenced file moves faster than an incomplete one in a “fast” jurisdiction.
Costs associated with acquiring a crypto licence
Costs vary by an order of magnitude. Accessible jurisdictions start in the tens of thousands of dollars; a Hong Kong VASP licence can exceed a million all-in. Beyond the state fee, budget for minimum capital, the compliance build, local staffing, office space where required, external assessment and ongoing supervision costs.
Minimum capital is not a fee — it is your money, held as own funds. Any quotation that omits it is quoting only part of the picture.
Which jurisdiction is fastest?
Speed is the wrong first question; usability is. A licence obtained in six weeks that no bank will support is worth less than one that takes six months and works.
That said, Georgia, Labuan and certain Caribbean routes remain comparatively quick, while Hong Kong, the UAE financial free zones and the Cayman Islands are measured in many months.
Tax obligations for cryptocurrency enterprises
Taxation frameworks vary and not every country has finalised its policy for crypto-assets. In the UAE, the headline corporate rate is 9% above AED 375,000, with 0% available to a Qualifying Free Zone Person meeting the substance and qualifying-income conditions.
The point most pages skip is that low local tax is not the same as low tax for you. Your own country of residence may tax the company through controlled foreign company rules, or treat it as resident where it is actually managed. The OECD Crypto-Asset Reporting Framework and, in the EU, DAC8 also bring crypto transactions into automatic exchange of information. We assess both sides before recommending anything.
Do I need local substance?
Increasingly, yes. Most credible regimes now require a local office, locally resident and regulator-approved officers, and demonstrable local decision-making. Purely nominal presence is the pattern regulators are actively targeting.
Where a jurisdiction still permits a light footprint, the constraint usually reappears at the bank instead.