How to start a crypto business: license compliance guide

What you will accomplish in this crypto business guide

If you want to know how to start a crypto business in 2026, start with the license perimeter before you build the product. This guide helps you identify the regulated activity, choose the right crypto business license path, prepare AML/KYC controls, and launch with reporting, tax, custody, and security systems already working.

Disclaimer: This guide is for education only and is not legal, tax, or financial advice. License requirements change by jurisdiction, business model, asset type, customer location, and custody role. Ask qualified counsel to review your exact facts before you spend money on filings or launch.

The contrarian point is simple: forming an LLC or launching a token is not step one. The first step is deciding what regulated activity you will perform. A founder who builds a non-custodial analytics tool has a different risk profile from a founder who holds customer fiat, routes orders, or issues a yield-bearing token.

This article uses the license-first build order, an original operating framework with six checkpoints: activity, jurisdiction, entity, controls, evidence, and live reporting. Use it as a worksheet before you buy software, open banking relationships, or publish marketing copy.

The dated trigger for this guide is the 2026 compliance cycle. MiCA became applicable for crypto-asset service providers from 30 December 2024 (ESMA, December 2024), FATF still anchors the Travel Rule around a $1,000 / €1,000 threshold in many jurisdictions (FATF, November 2023), and U.S. suspicious activity reports are generally due within 30 calendar days after detection (FinCEN, 2024).

Who this guide is for

This guide is written for builders, not traders. It is useful if you plan to operate an exchange, wallet, payment processor, token project, crypto ATM network, OTC desk, DeFi interface, custody product, staking service, or crypto data business.

If you are pre-incorporation, use the early sections as a go/no-go filter. If you have already launched, use the later sections to identify control gaps before a regulator, bank, payment provider, or investor finds them for you.

What this guide is not

This is not a trading guide. It will not tell you how to buy Bitcoin, predict altcoin prices, trade derivatives, or calculate daily trading income. It focuses on the second scenario: operating a crypto company for other users.

Caitlin Long, founder and chief executive officer of Custodia Bank, has repeatedly warned that crypto firms cannot treat banking, reserves, and compliance as cosmetic issues. That lesson applies to startups too. Compliance is the operating model, not a launch-week task.

What you will need before you start

Before you touch a license application, open a bank account, or write code, collect the documents that regulators and banking partners will request. It is also the right moment to hire a crypto lawyer before applying for licenses, because entity, custody, and jurisdiction choices are hard to unwind later.

Founder checklist

Work through this list before you submit anything. Missing one item can pause an application for weeks.

• Government ID for every founder: use passports where possible and keep scans current.
• Proof of address: collect a utility bill, tax letter, or bank statement dated within 90 days.
• Beneficial ownership chart: show every direct and indirect owner, including anyone at or above 25 percent, which remains a common due diligence threshold under FATF guidance (FATF, November 2023).
• Cap table: include equity, SAFEs, options, token warrants, and any side letters.
• Source-of-funds file: keep bank statements, investor wires, payroll records, or sale documents showing where startup capital came from.
• Jurisdiction plan: list countries and states you will serve, block, or delay.
• Business model memo: describe the assets you support, what customer funds touch, and how you earn revenue.
• Key employee CVs: include compliance, security, engineering, finance, and operations leads.
• Technical architecture: document wallet design, custody provider, key management, cloud systems, and third-party integrations.
• Compliance budget: plan for small registrations, major licenses, legal work, vendors, insurance, and staff before product spend.

Pro tip: document decisions early

Regulators do not only ask what you built. They ask why you chose one jurisdiction, custody model, token design, onboarding process, or marketing approach over another.

Create a one-page decision memo for each major choice. The memo should state the options you considered, the legal reason for the choice, the person who approved it, and the review date. This small file often becomes useful evidence during bank onboarding or a license review.

Step 1: Define your crypto business model

Start by answering one question: what does your business do with customer funds, assets, orders, data, or expectations of profit? That answer determines the license stack more than the company form does.

Your action item is to write a flow-of-funds map. Show where fiat enters, where crypto enters, who controls private keys, who routes orders, who sets fees, and where settlement happens.

Common crypto business types and their regulatory footprint

Not every crypto business carries the same compliance weight. Use this table as your first filter before speaking with counsel.

As of the 2026 planning cycle, the stablecoin row deserves special attention. In the U.S., federal stablecoin legislation has been debated through bills listed on Congress.gov (2025), while the EU already applies MiCA rules to asset-referenced tokens and e-money tokens.

Warning: non-custodial does not always mean unregulated

The sentence "we do not touch customer funds" is not a complete legal analysis. Hester Peirce, commissioner at the U.S. Securities and Exchange Commission, has often argued that crypto rules need clearer lines, which is exactly why founders should not rely on labels alone.

If you control an upgradeable smart contract, collect protocol fees, curate token access, route swaps, or market the product as a way to earn returns, regulators may view you as more than a neutral software publisher. Read our guide to custodial vs non-custodial crypto rules before assuming your architecture removes licensing risk.

Decision point: where does the customer money go?

Use the control-flow compliance check. Mark every place where your company receives, holds, moves, prices, routes, restricts, or influences customer assets.

1. Fiat control: do you receive, hold, convert, or transmit customer dollars, euros, pounds, or other fiat?
2. Private key control: do you or a vendor you control hold keys for users?
3. Order control: do you match, route, execute, or broker buy and sell orders?
4. Investment expectation: do users give money expecting profit from your managerial or technical efforts?

If the answer is yes to any of these, pause product work and complete a license analysis first.

Step 2: Choose jurisdictions and identify your crypto business license

A crypto business license is the authorization, registration, or regulatory approval required to provide crypto services such as custody, exchange, brokerage, payments, token issuance, or transfers. The exact license depends on your business model, customer location, custody role, and jurisdiction.

Do not ask only where to incorporate. Ask where your customers are, where marketing is visible, where fiat flows, where custody occurs, and where managers make decisions.

U.S.: FinCEN, state licensing, SEC, and CFTC

In the U.S., there is no single federal crypto license. Many exchanges, payment processors, and hosted wallet providers start with FinCEN MSB registration through BSA E-Filing. The federal registration filing itself is generally no-fee, but it does not replace state licensing or AML obligations (FinCEN BSA E-Filing, January 2026).

If you use the BSA E-Filing portal, select the MSB registration form, enter the legal entity name exactly as it appears in formation records, confirm the business address, add the responsible person, and save the confirmation receipt. Put that receipt in your evidence folder before you contact banks.

Most states have separate money transmitter license requirements. A national retail launch can take 12 to 36 months and can require legal work, surety bonds, background checks, audited financials, and renewal filings. If your token, staking product, or pooled yield product could be a security, read how securities law applies to crypto before you finalize token design.

EU: MiCA and CASP authorization

MiCA is now the central EU rulebook for crypto-asset service providers. It covers custody, exchange, trading platforms, transfer services, advice, portfolio management, and several issuer obligations.

MiCA became applicable for crypto-asset service providers on 30 December 2024 (ESMA, December 2024). CASP initial capital requirements start at €50,000 for lower-risk service classes (ESMA, 2024) and rise for higher-risk activities such as custody or trading platform operation.

UK, UAE, Singapore, and other hubs

The UK has an FCA cryptoasset AML registration regime and financial promotion rules. The UAE has separate regimes in Dubai and financial free zones. Singapore uses a payment services licensing model through MAS. Each path can be credible, but only if it matches your customers, banking plan, and activity.

Marketing into a country can create obligations even if the company is incorporated elsewhere. Geo-blocking, language choices, app store availability, and paid ads are legal decisions as much as product decisions. If you are considering frontier markets, review crypto regulation in Africa to see how uneven local rules can be.

License-perimeter worksheet

Create a row for every product feature. Add the customer location, asset type, custody role, fiat flow, order function, revenue model, regulator, license status, and launch decision.

The rule is strict: if a feature maps to a regulated activity and no license or exemption is ready, do not ship that feature publicly.

Step 3: Register the company and set up governance

After you map the license perimeter, form the entity that will apply for licenses, sign vendor contracts, open accounts, and face regulators. An LLC or corporation is a legal shell. It is not a crypto business license.

Choose the right legal structure

Check current beneficial ownership reporting rules before filing. FinCEN began beneficial ownership information reporting under the Corporate Transparency Act on 1 January 2024 (FinCEN, 2024), but later court orders and rule changes affected who must file. Use the current FinCEN page, not an old blog post.

Caitlin Long, founder and chief executive officer of Custodia Bank, has argued that entity design and custody structure affect banking access for years. That is why you should not choose a structure solely because formation is cheap.

Set up founder, investor, and control records

Prepare a cap table, operating agreement or shareholder agreement, board consents, officer appointments, investor documents, source-of-funds evidence, and conflict-of-interest policy. Store them in one controlled folder with version dates.

Your compliance officer or outside counsel should be able to answer these questions in one sitting: who owns the company, who controls the company, who can move customer assets, who approves new listings, and who signs suspicious activity reports.

Warning: do not open accounts under a vague business purpose

Common mistake: founders describe the business as software consulting to avoid bank friction, then begin processing crypto transactions. A bank review can close the account or freeze funds when activity does not match the declared purpose.

Be specific during onboarding. Name the crypto activity, disclose whether you hold customer assets, attach the license or application status, and provide your AML policy summary. A bank that declines you early is less damaging than one that exits after launch.

Step 4: Build AML/KYC, sanctions, and wallet-risk controls

Your next job is to build the control stack that sits between your business and your first user. Regulators expect written procedures, trained staff, audit logs, and escalation decisions, not only vendor subscriptions.

Design your customer onboarding flow

For individuals, collect government ID, a liveness check, proof of address where required, sanctions screening, and a risk score. For business customers, run KYB: formation documents, ownership chart, director checks, source of funds, and business purpose.

Apply enhanced due diligence to higher-risk customers. Triggers can include politically exposed person status, high-risk jurisdictions, privacy coins, unusual source of wealth, or volume that does not match the customer profile.

Screen wallets and transactions

Screen deposits before crediting them. Look for exposure to sanctioned addresses, mixers, darknet markets, ransomware wallets, hacked funds, high-risk bridges, and rapid layering patterns. For technical details, read how blockchain surveillance and wallet screening work.

Set written thresholds. For example, you might automatically pause a deposit with recent sanctioned-address exposure, require manual review for mixer exposure within a set number of hops, and block withdrawals until the case is closed.

Implement Travel Rule workflows

The FATF Travel Rule requires originator and beneficiary information to accompany qualifying transfers. Many jurisdictions use a threshold around $1,000 / €1,000 (FATF, November 2023), although local law can be stricter.

Your process must handle three cases: transfers to another virtual asset service provider, transfers from another provider, and transfers to or from an unhosted wallet. Document what data you collect, how you transmit it, when you reject a transfer, and who approves exceptions.

Crypto compliance checklist

1. Risk assessment: document products, customers, geographies, assets, delivery channels, and transaction types.
2. KYC: verify individual identity, address where required, sanctions status, and risk score.
3. KYB: verify business formation, ownership, directors, source of funds, and operating purpose.
4. Sanctions screening: screen customers, counterparties, and wallets against OFAC, UN, EU, and local lists at onboarding and during the relationship.
5. Wallet screening: check deposits and withdrawals for illicit exposure before funds are credited or released.
6. Transaction monitoring: create rules for volume, velocity, structuring, geography, asset type, and counterparty risk.
7. Travel Rule: collect and transmit originator and beneficiary data for covered transfers.
8. SAR and escalation process: name reviewers, approvers, filing staff, and deadlines.
9. Recordkeeping: store KYC, transactions, alerts, Travel Rule data, and filings for the required period.
10. Staff training: train relevant employees at hiring and at least annually, with attendance records.

Pro tip: write the procedure before buying tools.
Software does not equal compliance. Before you buy analytics or KYC tools, write the case management flow, define false-positive handling, assign owners, and specify who can override a block. The examiner will want the human decision log, not only a dashboard export.

Brian Armstrong, co-founder and chief executive officer of Coinbase, has often described compliance and regulation as central constraints for mainstream crypto adoption. For founders, the practical lesson is to budget for compliance staff and tooling before marketing spend.

Step 5: Prepare applications, policies, and evidence

Now assemble the application package. Treat every policy as both a regulator-facing document and an operating manual your team can follow.

Create the core policy pack

• AML/CFT policy: risk-based approach, monitoring rules, reporting workflow, and governance.
• Sanctions policy: list sources, screening frequency, wallet rules, and escalation steps.
• Business-wide risk assessment: product, customer, geography, asset, and delivery-channel risks.
• Information security policy: access control, encryption, logging, patching, and vendor review.
• Custody policy: key generation, storage, backup, recovery, segregation, and withdrawals.
• Incident response plan: internal contacts, customer notice, regulator notice, and law-enforcement escalation.
• Complaints policy: intake, deadlines, responsible staff, and board reporting.
• Conflicts policy: trading, listings, related-party activity, and employee holdings.
• Market abuse policy: surveillance, wash trading, manipulation, and suspicious order activity.

Each policy needs an owner, version number, approval date, next review date, and board sign-off. A template with no reference to your actual product is weak evidence.

Do not overlook crypto insurance for digital asset businesses. Insurers often ask for the same custody and security controls that regulators review.

Estimate fees, capital, and timelines

The table below gives planning ranges, not quotes. Use it to size a funding round and then confirm the numbers with counsel, vendors, and the regulator for your chosen jurisdiction.

EU CASP capital requirements start at €50,000 under MiCA service classes (ESMA, 2024). U.S. state money transmitter licensing can require separate surety bonds and renewals across many states, so the total cost can exceed the filing fee by a wide margin.

Avoid common application mistakes

Caitlin Long, founder and chief executive officer of Custodia Bank, has warned that vague custody descriptions create serious banking and regulatory risk. Your application should say exactly how assets are held, segregated, insured, reconciled, and returned.

1. Vague product descriptions: specify supported assets, order flow, settlement, fees, and customer types.
2. Missing owner information: collect IDs, source-of-funds evidence, background checks, and ownership percentages.
3. Weak risk assessment: tailor it to your assets, geography, transaction types, and customers.
4. Unsupported projections: match forecasted volume to staffing, tools, capital, and security capacity.
5. Unclear custody controls: state keyholders, multisig thresholds, custodian contracts, and recovery steps.
6. Marketing mismatch: align your website, app copy, pitch deck, terms, and regulatory application.

Run a consistency check before filing. Compare the application, policies, website, terms of service, pitch deck, and vendor contracts line by line.

Step 6: Launch with reporting, tax, custody, and security controls

License approval is not the finish line. It starts the live supervision period. Your systems must produce reports, protect assets, handle alerts, and support audits every day.

Maintain ongoing regulatory obligations

Create a regulatory calendar with renewal dates, report deadlines, audit windows, policy reviews, training dates, and material-change notice triggers. Many suspicious activity reports must be filed within 30 calendar days after detection (FinCEN, 2024).

Keep Travel Rule and customer records in structured storage. A common retention period is 5 years under FATF-aligned standards (FATF, 2023), although your local rule may be longer.

Protect customer assets

Build custody around segregation, limited access, daily reconciliation, and tested recovery. For a small exchange or custodian, a conservative internal policy often keeps only 2 to 5 percent of customer assets in hot wallets for operating liquidity (NIST custody considerations, 2024), with the rest in cold storage or qualified custody arrangements.

• Hot wallet cap: set a percentage cap and require sign-off to exceed it.
• Multisig policy: use at least 2-of-3 approval for cold withdrawals where your architecture supports it.
• Asset segregation: separate customer assets from treasury assets at wallet and ledger level.
• Daily reconciliation: compare blockchain balances, internal ledgers, customer liabilities, and bank balances.
• Emergency plan: test withdrawal freezes, key compromise response, insolvency procedures, and customer notices.
• Insurance review: reassess coverage, exclusions, and custody conditions every 12 months.

Coordinate tax and accounting early

Crypto tax is not one annual spreadsheet. Revenue, treasury trades, staking rewards, token grants, customer reporting, and cross-border payments each need records from day one.

U.S. digital asset broker reporting rules phase in for certain transactions beginning with sales on or after 1 January 2025 (IRS, 2024). If your business may be a broker, build tax data capture before launch rather than after the first reporting season.

Set up a crypto-native accounting system before customer transactions begin. Retrofitting cost basis across thousands of on-chain events is expensive and error-prone. To choose the right specialist, find a crypto tax accountant early in your build cycle.

Post-launch compliance is a live system. Build review cadence, reporting infrastructure, wallet governance, and tax records before customers send funds.