A crypto business is a company that provides products or services involving cryptocurrencies or other crypto-assets. Examples include cryptocurrency exchanges, crypto brokerage platforms, custody and wallet providers, crypto payment businesses, trading platforms, token-related services, and certain advisory or portfolio-management services.
The regulatory requirements depend on what the business does, where it operates, which customers it serves, and which assets or services it handles. There is no single worldwide “crypto license” that automatically authorizes a company to operate everywhere.
For businesses serving customers in the European Union, the Markets in Crypto-Assets Regulation (MiCA) is particularly important. MiCA establishes an EU-wide framework for crypto-assets and requires covered crypto-asset service providers (CASPs) to obtain authorization or qualify under one of the specific regulatory pathways provided by the regulation.
That means launching a crypto business should begin with a regulatory assessment of the business model, rather than simply searching for the cheapest or fastest crypto license.
Which Types of Crypto Businesses Are Regulated?
Crypto regulation generally focuses on activities that involve providing services to customers, handling client assets, operating trading infrastructure, or facilitating transactions.
Depending on the jurisdiction and business model, regulated activities can include:
- Operating a crypto-asset trading platform
- Exchanging crypto-assets for fiat currency
- Exchanging one crypto-asset for another
- Providing custody and administration of crypto-assets
- Providing transfer services for crypto-assets on behalf of clients
- Receiving and transmitting orders
- Executing crypto-asset orders
- Providing crypto-asset advice
- Providing portfolio management
- Placing crypto-assets
Under MiCA, these activities fall within the regulatory framework for crypto-asset service providers. The precise authorization required depends on the services the company intends to provide.
Not every blockchain business is automatically a CASP. A software company that develops blockchain infrastructure, for example, may have a very different regulatory profile from an exchange that holds customer assets.
Crypto Business Models and Regulatory Considerations
| Business model | Examples | Key regulatory considerations |
|---|---|---|
| Crypto exchange | Fiat-to-crypto and crypto-to-crypto trading | CASP authorization, AML/KYC, market conduct |
| Crypto brokerage | Buying or selling crypto on behalf of clients | Authorization, client protection, AML/KYC |
| Custody provider | Holding crypto-assets for customers | Custody controls, segregation, security |
| Crypto wallet | Hosted wallets and transaction services | Depends on whether the business controls or provides regulated services involving client assets |
| Crypto payments | Merchant payments, crypto-fiat conversion | Crypto regulation plus possible payment-services requirements |
| Trading platform | Marketplace for crypto-assets | Authorization, governance, market integrity |
| Token project | Issuing or offering crypto-assets | MiCA and/or other applicable securities or financial regulation |
| Blockchain software | Infrastructure and development tools | Regulatory treatment depends on the actual service and customer interaction |
The classification should be determined before incorporating the company or applying for authorization because the regulatory perimeter can materially affect the business structure.
What Is a Crypto License?
A crypto license is a general commercial term for regulatory authorization or registration allowing a company to perform specified cryptocurrency-related activities.
The exact legal terminology varies by country. In the European Union, businesses covered by MiCA generally deal with authorization as a crypto-asset service provider (CASP) rather than one generic license covering every crypto activity.
MiCA states that a person generally cannot provide crypto-asset services in the EU unless it is authorized as a CASP or qualifies under one of the specific routes available to certain already regulated financial entities.
This distinction matters because a company should not assume that a simple company registration, AML registration, or entry in a local crypto register is equivalent to a full regulatory authorization.
Why Does a Crypto Business Need Regulatory Authorization?
The primary reason is legal compliance. Depending on the jurisdiction and business model, authorization or registration may be necessary before a company can provide regulated crypto services.
Regulation can also affect practical aspects of operating a crypto business, including:
- Customer onboarding
- Identity verification
- Transaction monitoring
- Suspicious transaction reporting
- Asset custody
- Client-asset protection
- Governance
- Cybersecurity
- Complaints handling
- Record keeping
- Marketing and disclosures
- Banking and payment relationships
- Cross-border expansion
FATF standards also call for countries to regulate and supervise virtual asset service providers and require relevant businesses to implement AML/CFT controls such as customer due diligence, record keeping and suspicious transaction reporting. F
FATF+1
Authorization therefore should not be treated simply as a certificate that permits a business to operate. For many crypto businesses, it is part of a continuing compliance framework.
What Is MiCA and Why Does It Matter to a Crypto Business?
MiCA, or the Markets in Crypto-Assets Regulation, is the European Union’s harmonized regulatory framework for specified crypto-assets and crypto-asset services.
For covered service providers, MiCA establishes requirements relating to authorization, governance, conduct, client protection, prudential safeguards and other operational matters.
An authorized CASP can generally provide its authorized crypto-asset services throughout the EU under the framework’s cross-border rules, subject to the applicable requirements.
What Does a MiCA Application Involve?
A MiCA authorization application can require substantial information about the applicant and its proposed operations.
MiCA Article 62 includes information such as:
- Legal name and legal form
- Registered address
- Website and contact information
- Organizational information
- The proposed crypto-asset services
- The business’s programme of operations
- Governance and management arrangements
- Compliance arrangements
- Other information required by the regulation and applicable regulatory standards
The competent authority assesses the completed application against the applicable requirements before granting or refusing authorization.
What Are the AML and KYC Requirements for a Crypto Business?
AML means Anti-Money Laundering, while KYC means Know Your Customer.
For a regulated crypto business, compliance typically involves identifying customers, understanding customer risk, monitoring transactions and maintaining appropriate records.
Depending on the business and jurisdiction, a compliance framework may include:
- Customer identification and verification
- Customer risk assessment
- Beneficial-owner identification
- Sanctions screening
- Transaction monitoring
- Suspicious transaction reporting
- Record keeping
- Source-of-funds or source-of-wealth checks where appropriate
- AML policies and procedures
- Ongoing customer due diligence
- Staff training
- Compliance testing and reporting
FATF’s standards specifically address virtual asset service providers and emphasize licensing or registration, supervision, customer due diligence, record keeping and suspicious transaction reporting.
Crypto businesses should also consider the Travel Rule, which can require information about the originator and beneficiary to accompany certain crypto-asset transfers. Poland’s Ministry of Finance has highlighted the application of EU transfer-of-funds requirements to relevant virtual-asset businesses.
How Do You Start a Crypto Business?
A practical crypto business launch can be divided into several stages.
1. Define the Business Model
Start by documenting exactly what the company will do.
For example:
“The company will provide a platform allowing customers to exchange crypto-assets for fiat currency and hold crypto-assets in custody.”
This is more useful for regulatory analysis than simply describing the company as a “crypto platform.”
Identify:
- Services offered
- Customer types
- Target countries
- Supported crypto-assets
- Fiat currencies
- Custody arrangements
- Payment providers
- Technology providers
- Marketing channels
- Whether the company operates its own trading infrastructure
2. Determine the Regulatory Perimeter
The next step is to determine which laws apply.
A business may need to consider:
- Crypto-asset regulation
- AML/CFT requirements
- Payment-services regulation
- Data protection
- Consumer protection
- Tax rules
- Securities or investment regulation
- Sanctions requirements
- Advertising restrictions
- Cybersecurity obligations
This assessment should be performed before choosing a jurisdiction.
3. Choose the Jurisdiction
There is no universally “best” jurisdiction for every crypto business.
The appropriate jurisdiction depends on factors such as:
- Target market
- Services offered
- Regulatory framework
- Capital requirements
- Management requirements
- Compliance obligations
- Banking access
- Tax considerations
- Local substance requirements
- Regulatory timelines
- Cross-border permissions
- Availability of qualified compliance professionals
A jurisdiction should therefore be selected based on the entire operating model rather than license cost alone.
4. Establish the Company and Governance Structure
Where required, establish the appropriate legal entity and prepare the ownership and management structure. Regulators may assess the suitability, experience and reputation of individuals involved in managing the business or holding qualifying interests.
For an EU CASP, MiCA requires the applicant to have a registered office in a Member State and an effective management presence in the Union, with at least one director resident in the EU.
Before launch, the company should develop the policies and controls appropriate to its activities.
5. Build the Compliance Framework
Before launch, the company should develop the policies and controls appropriate to its activities.
This can include:
- AML/KYC policies
- Customer onboarding procedures
- Risk assessment methodology
- Transaction monitoring
- Sanctions screening
- Complaints procedures
- Conflicts-of-interest policies
- Custody controls
- Information-security policies
- Business continuity procedures
- Incident management
- Outsourcing controls
- Record-retention procedures
The compliance framework should reflect the actual business model rather than being a generic collection of templates.
6. Prepare the Regulatory Application
The application package should accurately explain how the company will operate.
A regulator may expect information concerning the company’s:
- Business model
- Services
- Governance
- Management
- Ownership
- Financial resources
- Compliance framework
- Technology
- Security controls
- Outsourcing
- Customer protection
- Risk management
Incomplete or inconsistent information can create additional regulatory questions and delays.
7. Apply and Respond to Regulatory Requests
After submission, the relevant authority reviews the application.
The company may need to answer follow-up questions, provide additional documents or clarify aspects of its operating model.
Authorization is therefore a process rather than simply an administrative filing.
Is Poland a Good Place to Start a Crypto Business?
Poland requires particular care because its regulatory position has changed significantly under MiCA.
Historically, Poland maintained a Register of Virtual Currency Activities for certain businesses under its domestic AML framework. However, that registration should not be described as equivalent to a full crypto license or MiCA authorization. Poland’s Ministry of Finance explicitly stated that the register was record-keeping in nature and did not constitute a license or supervisory authorization.
The position changed further with the end of the MiCA transitional period.
What Changed in Poland in 2026?
According to the Polish Tax Administration Chamber in Katowice, the MiCA transitional period ended on July 1, 2026. The authority states that an entry in Poland’s Virtual Currency Activities Register does not authorize a business to provide crypto-asset services under MiCA.
The Polish Financial Supervision Authority has likewise highlighted that the transitional period for qualifying providers ended on July 1, 2026. Kknf.gov.pl
Therefore, an article published in 2026 should not tell readers that simply obtaining an entry in Poland’s former virtual-currency register gives them a current “Polish crypto license.”
For a business intending to provide regulated crypto-asset services in the EU, the relevant question is whether it has the authorization required under MiCA.
How Can You Verify a Crypto Authorization in Europe?
ESMA maintains a public MiCA register containing information on authorized crypto-asset service providers. The register includes information such as the provider’s name, competent authority and authorized crypto-asset services.
This provides a useful verification step for founders, customers and business partners.
Do not rely solely on a consultant’s website, a company-registration certificate or an old national crypto register when determining whether a business is authorized to provide regulated crypto services.
What Documents Does a Crypto Business Usually Need?
The exact documentation varies by jurisdiction and business model, but a regulated crypto business may need documents covering:
After submission, the relevant authority reviews the application.
Is Poland a Good Place to Start a Crypto Business?
Poland requires particular care because its regulatory position has changed significantly under MiCA.
The position changed further with the end of the MiCA transitional period.
What Changed in Poland in 2026?
According to the Polish Tax Administration Chamber in Katowice, the MiCA transitional period ended on July 1, 2026. The authority states that an entry in Poland’s Virtual Currency Activities Register does not authorize a business to provide crypto-asset services under MiCA.
Therefore, an article published in 2026 should not tell readers that simply obtaining an entry in Poland’s former virtual-currency register gives them a current “Polish crypto license.”
This provides a useful verification step for founders, customers and business partners.
What Documents Does a Crypto Business Usually Need?
- Corporate structure
- Shareholders and beneficial owners
- Directors and senior management
- Business plan
- Programme of operations
- Financial projections
- AML/KYC framework
- Risk-management framework
- Compliance policies
- Customer onboarding
- Transaction monitoring
- Cybersecurity
- Custody arrangements
- Outsourcing
- Data protection
- Business continuity
- Complaints handling
- Internal controls
The objective is to demonstrate that the company understands its risks and has practical controls for managing them.
How Much Does It Cost to Start a Crypto Business?
There is no reliable single global price for launching a crypto business.
Total costs can include:
- Company formation
- Legal advice
- Regulatory application fees
- Regulatory capital or own-funds requirements
- Compliance personnel
- Technology
- KYC/KYB providers
- Blockchain analytics
- Transaction monitoring
- Cybersecurity
- Audit
- Insurance
- Banking and payment infrastructure
- Ongoing regulatory reporting
The cost also varies dramatically between a software company and a regulated exchange or custody provider.
For this reason, claims such as “get a crypto license for X dollars” should be treated cautiously unless they clearly identify the jurisdiction, business model, regulator, government fees and ongoing compliance costs.
What Are the Biggest Mistakes When Launching a Crypto Business?
Several mistakes can create unnecessary regulatory and commercial risk.
Choosing a jurisdiction before defining the business
A jurisdiction should follow the regulatory analysis, not replace it.
Treating registration as authorization
A registration in a commercial or AML register does not necessarily authorize every activity a crypto company wants to perform.
Underestimating ongoing compliance
Regulatory compliance continues after authorization. Policies, monitoring systems, personnel, reporting and governance need to remain operational.
Ignoring the target customer markets
A company incorporated in one country does not automatically have permission to market regulated financial services everywhere.
Cross-border activity should be assessed separately.
Relying on generic compliance templates
Policies should match the company’s actual products, customers, transaction flows and risk profile.
Assuming crypto regulation is only about AML
AML is important, but a crypto business may also need to consider consumer protection, custody, cybersecurity, market-abuse controls, payments, data protection and other financial regulations.
How Should You Choose a Crypto Licensing Consultant?
If a business uses a legal or regulatory consultant, evaluate the provider based on the substance of its work rather than promises of a “fast” or “guaranteed” license.
Useful questions include:
- Which exact regulated activities does the proposed authorization cover?
- Which regulator grants the authorization?
- What laws apply after authorization?
- What are the ongoing compliance obligations?
- What local substance or management requirements apply?
- Which services can be offered cross-border?
- What are the government fees?
- What are the expected professional and compliance costs?
- How will AML/KYC systems be implemented?
- How can the authorization be independently verified?
For example, Fintech Harbor publicly describes itself as a fintech consulting business providing crypto licensing and related legal and compliance services. Those are the company’s own service descriptions and should be evaluated independently against the applicable regulator’s requirements.
Crypto Business Compliance Checklist
Before launching a regulated crypto business, founders should be able to answer these questions:
A company incorporated in one country does not automatically have permission to market regulated financial services everywhere.
How Should You Choose a Crypto Licensing Consultant?
Useful questions include:
- Which exact regulated activities does the proposed authorization cover?
- Which regulator grants the authorization?
- What laws apply after authorization?
- What are the ongoing compliance obligations?
- What local substance or management requirements apply?
- Which services can be offered cross-border?
- What are the government fees?
- What are the expected professional and compliance costs?
- How will AML/KYC systems be implemented?
- How can the authorization be independently verified?
Crypto Business Compliance Checklist
- What exact crypto services will the company provide?
- Which countries will it serve?
- Which regulator has jurisdiction?
- Does the business require authorization, registration or another regulatory permission?
- Is the proposed authorization valid for every intended service?
- Is the corporate structure suitable?
- Are beneficial owners and managers eligible?
- Is the AML/KYC framework operational?
- Are transaction-monitoring controls in place?
- Are sanctions-screening procedures established?
- Is the Travel Rule addressed where applicable?
- Are customer assets properly protected?
- Are cybersecurity controls documented?
- Are outsourcing arrangements compliant?
- Are complaints and incident procedures established?
- Are ongoing reporting requirements understood?
- Can the authorization be independently verified through an official register?
Frequently Asked Questions About Crypto Businesses
What is a crypto business?
A crypto business is a company that provides products or services involving cryptocurrencies or other crypto-assets. Examples include exchanges, brokers, custody providers, payment businesses and certain crypto trading or advisory services.
Do I need a crypto license to start a crypto business?
It depends on the activities and jurisdictions involved. Businesses providing regulated crypto-asset services may need authorization or registration before operating. In the EU, covered crypto-asset service providers generally require authorization under MiCA unless another specific regulatory pathway applies.
What is the difference between a VASP and a CASP?
VASP means Virtual Asset Service Provider and is terminology commonly associated with FATF and national AML frameworks. CASP, or Crypto-Asset Service Provider, is the terminology used by MiCA for covered crypto-asset services in the EU. The exact scope of each term depends on the applicable legal framework.
Is a Polish virtual currency registration a MiCA license?
No. Poland’s authorities state that entry in the Virtual Currency Activities Register does not constitute MiCA authorization and, after the end of the transitional period, does not authorize the provision of crypto-asset services.
Can a MiCA-authorized company operate across the EU?
MiCA provides an EU framework under which authorized CASPs can provide their authorized services throughout the Union through the applicable freedom of establishment or freedom to provide services, subject to the regulation’s requirements.
What is the Travel Rule in crypto?
The Travel Rule refers to requirements for information accompanying certain transfers of funds and crypto-assets. It is intended to improve transparency around the originator and beneficiary of transfers and forms an important part of the regulatory compliance framework for relevant crypto businesses.
How can I verify whether a European crypto company is authorized?
For MiCA-authorized businesses, ESMA maintains a public register containing information on crypto-asset service providers and their authorized services.
Final Takeaway
Starting a crypto business is no longer simply a matter of incorporating a company and launching a website. The regulatory requirements depend on the services offered, customer base, jurisdictions involved and the way the business handles crypto-assets and client funds.
For businesses operating in Europe, MiCA is now a central part of the regulatory analysis. In Poland specifically, founders should be careful with older information about the country’s Virtual Currency Activities Register: Polish authorities state that this registration is not equivalent to MiCA authorization, and the relevant transitional period ended on July 1, 2026.
The safest approach is to define the business model first, map the applicable regulations, select an appropriate jurisdiction, establish the required compliance framework and independently verify the resulting authorization through official regulatory sources.
Because crypto regulation changes frequently, licensing requirements should always be confirmed with the relevant regulator and qualified legal counsel before a business launches or expands into a new market.
