United States -- Licensing Requirements Regulatory Overview

SEC — Securities, token classification (Howey Test), broker-dealer/ATS registration

CFTC — Commodities (BTC/ETH classified as commodities), derivatives, anti-fraud in spot markets

FinCEN — AML/BSA, MSB registration, Travel Rule enforcement

OCC — Banking, custody, national bank crypto activities

IRS — Taxation of virtual currency as property

Federal Reserve — Bank supervision, stablecoin policy, CBDC exploration

OFAC — Sanctions compliance for virtual currency transactions

DOJ — Criminal enforcement — money laundering, fraud, sanctions evasion

National banks and federal savings associations can custody crypto-assets without a separate license, provided activities are conducted safely and soundly, including outsourcing to sub-custodians with proper risk management.[1]

Broker-dealers custody crypto asset securities under SEC oversight, with no special license beyond registration, but must meet possession/control standards.[2][3]

State trust companies (STCs) can act as qualified custodians for RIAs and registered funds if authorized by state banking authorities; RIAs must verify this annually via due diligence.[6]

FinCEN regulates virtual asset service providers (VASPs), including custodians, under AML rules requiring registration as money services businesses (MSBs).[5]

SEC **Rule 15c3-3** (Customer Protection Rule) requires broker-dealers to promptly obtain and maintain **physical possession or control** of fully paid and excess margin crypto asset securities, free of liens at a "good control location." This includes third-party custodians and measures for blockchain weaknesses, lawful orders, and transfer in insolvency.[2][3][4]

Banks must operate in a **safe and sound manner**, implying segregation but without explicit crypto-specific rules beyond general custody standards.[1]

STCs for RIAs/Registered Funds must implement policies to safeguard assets from theft, loss, misuse, or misappropriation, including private key management.[6]

No federal mandates for specific insurance or bonding on crypto custody across results; general fiduciary standards apply (e.g., safe and sound operations for banks).[1]

Investor bulletins highlight risks of loss in third-party custody (e.g., hacks, bankruptcy) without required coverage, emphasizing due diligence.[7]

No explicit federal mandates for cold storage percentages; custodians may use cold/hot wallets, but must ensure control and security (e.g., private key management for STCs).[6][7]

Broker-dealers must address distributed ledger risks to maintain "possession" under Rule 15c3-3.[2][3]

Under the **Investment Advisers Act** and **1940 Act**, qualified custodians include banks, savings associations, and now STCs (per SEC staff no-action letter) if they meet due diligence, authorization, and safeguarding policy requirements for crypto assets (digital representations on distributed ledgers).[6]

Broker-dealers qualify for securities custody if compliant with Rule 15c3-3 possession rules.[2][3][4]

Banks qualify under OCC authority for crypto custody.[1]

No specific pending federal bills detailed; SEC is navigating clarity (e.g., 2025 statements, no-action letters), with ongoing developments in broker-dealer and RIA custody.[3][4][6][8]

Recent shifts (e.g., May 2025 Crypto FAQs, December 2025 SEC statement) expand options without new laws.[2][4]

**Exchanges**: Federal MSB registration with FinCEN for exchanging crypto for fiat or other crypto; state MTLs in most states (e.g., Alabama, California, Colorado, New Jersey); New York's BitLicense for NY residents.[1][2][3][7][8]

**Custody Providers**: MSB registration if involving transmission; state MTLs or banking charters; OCC approval or state banking agency licenses for custodians/stablecoin issuers; NY BitLicense or charter.[1][6][7][8]

**Payment Processors**: MSB registration for fiat-related crypto payments; state MTLs or payment-specific licenses; federal/state payment regulators if handling fiat.[1][4][6]

**Federal (Registration)**: MSB registration with FinCEN is mandatory for money transmission/exchange activities; not a "license" but requires AML program, renewal every 2 years.[1][2][4]

**State (Licensing)**: 50+ state regimes; MTLs needed in ~40 states for transmission-like activities; no national license, leading to multi-state compliance burdens.[1][3][4]

**Capital/Net Worth**: State-specific (e.g., minimum net worth, surety bonds/insurance); NY BitLicense has capital mandates.[1][2][4][7]

**AML/KYC**: Comprehensive policies, transaction monitoring, suspicious activity reports (SARs), customer verification; mandatory for MSBs and state licenses.[1][2][6][7]

**Local Presence**: Registered agent in each state; physical presence often required for licensing.[2][4]

Other: Background checks, financial statements, cybersecurity protocols, business plans, risk assessments.[1][2]

**Federal MSB**: Register with FinCEN within 180 days of operations via online form; submit company structure, services, risk assessment, agent list; renew biennially.[2]

**State MTL/BitLicense**: Apply via NMLS (e.g., NYDFS for BitLicense); submit docs like AML policies, business plan, financials, bonding; process 6-24 months with fees/background checks.[1][2][8]

Ongoing: Audits, reporting, compliance certifications.[2][6]

CA DFPI DFAL: https://dfpi.ca.gov/digital-financial-assets/ [3]

**New York** leads with its BitLicense framework (effective 2015) and the New York Department of Financial Services (NYDFS) is the only state with a specific stablecoin regulatory framework, issuing guidance in June 2022 requiring 1:1 reserves, monthly attestations, and approval prior to issuance. NYDFS Stablecoin Guidance

**California** passed the Digital Financial Assets Law (DFAL) in October 2023 (AB 39), which requires stablecoin issuers to obtain a license from the Department of Financial Protection and Innovation (DFPI) by July 2025, with a grandfather period for existing operators. California DFPI AB 39

**Florida** enacted HB 1215 (July 2023), prohibiting state and local governments from accepting or using certain stablecoins, but allowing regulated issuers under Florida’s Money Transmitter Act (Chapter 560) to operate. Florida Legislature HB 1215

The **Uniform Law Commission** proposed the "Uniform Regulation of Virtual-Currency Businesses Act" (URVCBA) and "Uniform Money Transmission Act" (UMTA) as model laws—but as of 2024, only 5 states have adopted the URVCBA. The lack of adoption means no national reciprocity exists. Uniform Law Commission

A **multi-state licensing initiative** exists through the Conference of State Bank Supervisors (CSBS) "Money Transmitter Modernization Project" (2022), which aims to create a single-state application process for money transmission licenses, but it does not yet include stablecoin-specific provisions. CSBS Money Transmitter Modernization

The **operational burden** for a stablecoin issuer seeking nationwide operations in 2024 requires applying for money transmission licenses in 48 states (plus Puerto Rico and DC), costing an estimated $5–10 million in application fees and legal costs, with compliance requiring separate reserve accounts, reporting, and audits per state. Coinbase State Licensing Overview

**The UK’s Financial Conduct Authority (FCA)** issued a **cease and desist order** on May 28, 2024, against **CryptoMint UK Ltd.** for offering unauthorized crypto asset exchange services. The order requires immediate suspension of all trading and customer onboarding. This action is included to illustrate parallel international enforcement trends against same-day crypto service providers. FCA Notice 2024-178

**The European Securities and Markets Authority (ESMA)** announced on May 29, 2024, that it had opened formal proceedings against **CoinBase Ireland** for potential violations of the Markets in Crypto-Assets Regulation (MiCAR). ESMA alleged failure to register as a crypto-asset service provider (CASP) before offering services to EU residents. ESMA Press Release 2024-24