Kitobni o'qish: «Where and how to register a crypto company»

Where and how to register a crypto company

Crypto company registration, activity classification,

and licensing in Web3

Andrei Voronin

About this book

A crypto company does not start with a country. It starts with a clear answer to one question: what will the company actually do every day? For example, will it exchange crypto for money, hold the crypto of its clients, run a trading platform, or issue its own token?

This book is a practical guide for founders of crypto projects, for their lawyers, and for their investors. It explains, step by step and in plain language, three connected decisions. First, the type of activity decides which license the company needs. Second, the license decides in which country the company should register. Third, at each stage, a regulator, a bank, an exchange, and a tax authority check the company, and the book explains what each of them looks at.

The book covers the licensing rules of Kazakhstan, Uzbekistan, the European Union, the United Arab Emirates, the United States, Russia, and Tajikistan. It also explains the legal status of tokens, legal ways to raise money, listing a token on an exchange, the duties of a company after it receives a license, taxes, the protection of personal data, the team and the brand, DAOs, tokenized real-world assets, sanctions and banking risks, disputes, and control over the company. A DAO, or decentralized autonomous organization, is a project in which token holders vote on decisions.

Each chapter starts with a short answer, explains each step in simple words, and ends with a checklist.

Contents

Part I. Start

Chapter 1. Where and how to register a crypto company

Chapter 2. Structure and substance of a crypto company: what the regulator checks

Chapter 3. Banking for a crypto company: why banks say no, and how to open an account

Part II. Token and money

Chapter 4. Security token or utility token: legal status of your crypto token

Chapter 5. How to raise money for a crypto project legally: SAFT and token sales

Chapter 6. Crypto token listing on an exchange: legal requirements

Part III. Compliance

Chapter 7. AML and KYC for crypto companies: compliance requirements after licensing

Chapter 8. Crypto company taxes: a complete guide for founders

Chapter 9. GDPR for a crypto platform: user data protection

Chapter 10. Crypto advertising laws: what you can promote and what you cannot

Part IV. Team and special models

Chapter 11. Crypto team and brand: hiring, token pay, trademarks, and domain ownership

Chapter 12. DAO legal status: who is liable if there is no legal entity

Chapter 13. RWA tokenization licenses and risks: who is liable if the asset falls or disappears

Part V. Risks and strategy

Chapter 14. Sanctions and banking risk for CIS founders: correspondent banking and account closure

Chapter 15. Crypto company redomiciliation: how to change jurisdiction without killing the token

Chapter 16. Crypto license revocation and regulator review: what a founder should do

Chapter 17. Crypto company bankruptcy and client assets: segregation, wind-down, and license sale

Chapter 18. Common crypto founder mistakes: real cases, a self-check list, and how to read this book

Part VI. Document, dispute and control

Chapter 19. Smart contract legal enforceability: code, offer, and court

Chapter 20. Crypto terms of use for retail clients: withdrawal rights, complaints, and unfair clauses

Chapter 21. Crypto dispute resolution and enforcement: governing law, courts, arbitration, and on-chain assets

Chapter 22. Crypto company outsourcing: KYC vendor, cloud, custodian, and market maker risk

Chapter 23. Crypto white paper disclosure after launch: updates, liability, and misleading statements

Chapter 24. Crypto company change of control and qualifying holdings

Supplement

Chapter 25. Crypto licensing laws: Kazakhstan, Uzbekistan, MiCA, Dubai VARA, and UAE CMA rules

Chapter 26. Crypto license checklist before you file: activity, jurisdiction, white paper, and charter

After the chapters

Conclusion. Where and how to register a crypto company

About the author

Copyright and legal notice

Introduction

This book is for founders of crypto projects, for their lawyers, and for their investors. It helps them decide where and how to register a crypto company, and how to keep the company legal after the launch.

The book explains the legal side of a crypto business in the same order in which a founder usually meets it. First comes the choice of the type of activity, the license, and the country. Then come the token and the money. After that come the daily legal duties of the company, the team, special business models, and risks. The book ends with documents, disputes, and control over the company.

How is the book organized?

The book has six parts and a supplement.

Part I. Start explains where and how to register a crypto company. It also explains what a regulator checks when it asks for “substance,” meaning real people, a real office, and real management in the country, and how to open a bank account.

Part II. Token and money explains the legal status of a token, legal ways to raise money for a project, and listing a token on an exchange.

Part III. Compliance explains the duties of a company after it receives a license. These duties include AML and KYC, meaning the rules against money laundering and the checks of who the clients are, as well as taxes, the protection of personal data, and the rules on advertising.

Part IV. Team and special models explains hiring and the brand, the legal status of a DAO, and the tokenization of real-world assets, such as buildings or gold.

Part V. Risks and strategy explains sanctions and banking risks, moving a company to another country, a review or a withdrawal of a license, the bankruptcy of a company, and the typical mistakes of founders.

Part VI. Document, dispute and control explains smart contracts, the terms of use for retail clients, disputes, outsourcing, the white paper after launch, and changes in the owners of a company.

The supplement lists the main laws of the countries covered in the book, and the final checks that a company should make before it files an application for a license.

How is each chapter built?

Each chapter starts with a short answer to its main question. The sections of the chapter are written as the questions that a founder usually asks.

Where it helps, a chapter gives one of three things: a hypothetical example, a real case from a court or a regulator, or a step-by-step plan. A hypothetical example is always marked as hypothetical or as a composite example, and it does not describe a real company. A real case always names the court or the regulator and the date.

Each chapter ends with a checklist. The book has no tables and no lists of links, so that it reads the same way on paper and in audio.

How current is the information?

The information in this book is current as of October 2026. Laws, the rules of regulators, and the required amounts of capital change often. Before you rely on any figure, date, or rule from this book, take three steps. First, check the official text of the law. Second, check the website of the regulator on the date of your decision. Third, talk to a local lawyer in the country where the product will work.

Where should I start?

If you are choosing a country for a new company, start with Chapter 1. Before you file an application for a license, go through the checks in Chapter 26.

If your company already has a license, start with Part III, which explains the daily duties of a licensed company.

If you want to see what usually goes wrong, read Chapter 18. That chapter also explains how to use this book.

This book is not legal, tax, or financial advice. The full legal notice is at the end of the book.

Part I. Start

Chapter 1. Where and how to register a crypto company

The short answer. Before a founder chooses a country for a crypto company, the founder needs to decide exactly what the business will do. The type of business activity decides which license the company needs. The type of license then decides which countries are realistic for the company. The country comes last, not first. This chapter explains these three steps one by one, describes the rules in each country, and ends with a comparison of the countries, a step-by-step plan, and a list of documents for a license application.

Why should I choose the business activity before the country?

Registering a crypto company does not start with choosing a country. It starts with one simple question: what will the business actually do? The answer to this question decides what type of license the company needs. The type of license then decides which countries are realistic options for the company.

Some founders reverse this order. They choose a country first because registration there looks cheap or because “everyone registers there.” Later, these founders have to change their business model to fit rules that were never written for that model. Fixing the business model in this way almost always costs more than the money the founders saved at the start.

Which types of crypto business need different licenses?

There are five common types of crypto business: an exchange, a broker, a custody provider, a platform that turns real-world assets into tokens, and a legal wrapper for a decentralized organization. These are five different activities. In almost every country, one license does not cover all five activities.

An exchange brings buyers and sellers together and runs a place where they trade. An exchange needs the most capital, and regulators check exchanges most closely, because an exchange handles the largest amount of other people’s money.

A broker carries out client orders to buy or sell, either in the broker’s own name or in the client’s name. For a broker, the regulator mainly checks how the broker handles client money before a trade is complete.

A custody provider, often called simply “custody,” holds client crypto assets in its own wallets. Custody almost always needs a separate permit with stricter rules. The reason is simple: if a custody provider is hacked or goes bankrupt, the money that is lost belongs to the clients, not to the company.

A real-world asset platform, usually shortened to RWA, turns a physical asset into a digital token. The asset can be real estate, a debt, or goods in a warehouse. An RWA platform works under two sets of rules at the same time: the rules for crypto, and the ordinary property law that applies to the real asset behind the token.

A decentralized autonomous organization, or DAO, is a group that makes decisions through votes recorded on a blockchain. In its pure form, a DAO is not a legal entity at all. For this reason, founders create a separate legal wrapper around the DAO, usually a foundation in one of the few countries that recognize this kind of structure.

A legal wrapper for a DAO is an ordinary legal entity that the members of the DAO create. The wrapper lets the DAO sign contracts, open a bank account, pay taxes, and protect its members from personal liability. Without a wrapper, a court in some countries may treat all members of the DAO as partners in a general partnership. In that case, each member can be personally responsible for the debts of the DAO. Founders most often use one of three wrappers: a foundation company in the Cayman Islands, a DAO limited liability company in the US state of Wyoming, or a DAO limited liability company in the Marshall Islands. Each wrapper has its own rules on members, voting, and taxes, so choosing a wrapper is a separate legal task. Chapter 12 compares these wrappers in detail.

A real-world asset token can also fall under securities law, not only under crypto rules. Suppose the token gives its holder a right to income from the asset, for example rent from a building or interest on a loan. In that case, many regulators treat the token as a security or as another financial instrument. Then the company needs a securities license or a license for digital financial assets, not only a crypto license. Chapter 13 explains the licenses and risks of real-world asset tokens.

One more point matters before we look at specific countries. The same token or the same platform can fall under more than one type of activity at the same time. For example, an exchange that also holds client assets is in fact two businesses: an exchange and a custody provider. Most regulators require the company to have a license for both parts, not just for one part.

A common mistake at this stage is to apply for a license that covers only the “easier” part of the business and to hope that the rest will sort itself out later. This mistake happens often. It usually ends in one of two ways: the regulator refuses the license application, or the regulator orders the company to stop part of its business after the launch.

When does a crypto business not need a license?

Not every crypto product needs a license. The main question is whether the company ever controls other people’s money or crypto assets. A company that only writes and sells software, and never holds, moves, or exchanges client assets, often falls outside the licensing rules. Two examples show where the line usually runs.

The first example is a non-custodial wallet. In a non-custodial wallet, only the user holds the private keys. Private keys are the secret codes that control the crypto in a wallet. The company that made the wallet cannot move the user’s funds. The European Union’s Markets in Crypto-Assets Regulation, known as MiCA, says in its introductory part that the regulation does not cover companies that only provide hardware or software for non-custodial wallets. In the United States, the Financial Crimes Enforcement Network, known as FinCEN, said in its 2019 guidance that a company that provides unhosted wallet software, where the user alone controls the funds, is not a money transmitter for that activity.

The second example is a fully decentralized service. MiCA says that crypto services provided in a fully decentralized way, without any intermediary, do not fall under the regulation. The word “fully” is important. A regulator may decide that a service is not fully decentralized if the company runs the website for the service, holds administrator keys that can change or stop the smart contract, or earns fees from the service. In that case, the regulator treats the company as an intermediary. This exception is narrow, and a lawyer should check it for each specific product.

Hypothetical example. A team builds a mobile wallet app. The private keys stay only on the user’s phone, and the team never sees the keys. In this version of the app, the team usually does not need a crypto license under MiCA. Then the team adds a “Buy crypto with a card” button, and the card payments go through the team’s own company account. From that moment, the team’s company takes client money and exchanges it for crypto. This is exchange activity, and exchange activity needs a license.

Which countries do founders usually compare?

The rest of this chapter looks at specific countries. It starts with the countries that founders from Russian-speaking countries usually consider first: Kazakhstan, Uzbekistan, the European Union, and the United Arab Emirates. Then it covers the United States, Russia, and Tajikistan.

Kazakhstan: which regulator licenses what?

In Kazakhstan, the main law is the Law of the Republic of Kazakhstan number 193 of February 6, 2023, “On digital assets in the Republic of Kazakhstan.” This law took effect on April 1, 2023, and has been amended since then. A new set of rules under this law took effect on May 1, 2026.

Many people think that Kazakhstan has two sets of crypto rules. In fact, Kazakhstan has three. Each set has its own regulator and its own requirements.

The first regulator is the National Bank of Kazakhstan. The National Bank licenses operators that exchange crypto. The National Bank also keeps a register of trading platforms for what the law calls “unsecured digital assets,” which means ordinary cryptocurrencies such as bitcoin. Since May 1, 2026, a company files its application for an exchange operator license, or for registration as a trading platform operator or a digital financial asset platform operator, directly with the National Bank. The National Bank publishes the requirements on its website.

The second regulator is the Agency for Regulation and Development of the Financial Market, usually shortened to ARDFM. ARDFM regulates digital financial assets. Digital financial assets mainly include tokenized claims, tokenized bonds, and similar instruments. Stablecoins are the one exception. Under the law, stablecoins backed by money also count as digital financial assets, but the National Bank supervises stablecoins, not ARDFM.

The third system is the Astana International Financial Centre, known as the AIFC. The AIFC is a separate area inside Kazakhstan with its own legal system based on common law. The AIFC has its own regulator, the Astana Financial Services Authority, known as AFSA, and its own full set of licenses. These licenses have nothing to do with the National Bank or with ARDFM.

Common law is a legal system based on English law. In a common law system, court decisions matter as much as written statutes. Inside the AIFC, disputes go to the AIFC Court, and the rules are written in English. Many foreign founders find this system more familiar than the national law of Kazakhstan. However, an AIFC license covers only activity under the AIFC rules. Activity in the rest of Kazakhstan falls under the national rules.

How much capital do I need in Kazakhstan?

Two kinds of capital are easy to confuse. Share capital is the money that the owners put into the company when they register it. The amount of share capital appears in the founding documents of the company. Regulatory capital is the money that a licensed company must keep available at all times, so that the company can cover losses and pay clients back if something goes wrong. The regulator sets the amount of regulatory capital, and the company must prove to the regulator that it actually has this money. A company can register with a small share capital. However, the company cannot get a crypto license until it shows the regulatory capital that the license requires.

In the AIFC, the amount of capital depends on the specific license. Public overviews give a capital requirement starting at about 200,000 US dollars, or twelve months of operating expenses, for a license to run a digital asset trading facility. For custody and dealing, public overviews give a requirement starting at about 250,000 US dollars. These figures are only a rough guide. The exact amount depends on the combination of activities that the company applies for, so check the current amount in the AFSA rules before you rely on it.

For the national system, the minimum capital is set in the rules of the National Bank, not in the law. One public overview gives 50 million tenge for a crypto exchanger and 100 million tenge for a digital financial asset platform. Use these amounts only as a starting point, and check them on the website of the National Bank.

There is also an easier way to start in the AIFC: the FinTech Lab, the regulatory sandbox of the AIFC. A regulatory sandbox is a special program in which a regulator lets a young company test its product with real clients for a limited time, under lighter rules and close supervision. The company does not get a full license. Instead, it gets a temporary permission. AFSA sets the limits on the number of clients and on the volume of transactions separately in the permission of each company, so there is no single standard limit. To enter the sandbox, a company must show AFSA that it has enough money and a planned base capital that covers at least twelve months of operating expenses. When the test period ends, the company must either move to a full license or stop operating.

The sandbox suits a team that wants to prove that its product works before it spends money on a full license. The sandbox does not suit a business plan that needs many clients or large volumes from the first month.

Both for a full AIFC license and for the sandbox, AFSA expects the company to have a real presence in Kazakhstan: real people and a real office. AFSA reviews the candidates for key positions in the company. The company may not start serving clients until AFSA approves the internal rules and compliance manuals of the company.

Why is a bank account a separate problem in Kazakhstan?

In Kazakhstan, there is another difficulty that founders often underestimate: the bank account. An AFSA license, or even a letter of preliminary approval from AFSA, lets the company start talks with a bank. However, neither document guarantees that the bank will open an account.

Second-tier banks in Kazakhstan are cautious with crypto businesses. “Second-tier banks” is the official name in Kazakhstan for ordinary commercial banks. The National Bank is the first tier: it is the central bank, and it regulates the other banks. Commercial banks that serve companies and people are the second tier. These banks worry about their own reputation and about their financial monitoring duties. Financial monitoring is the legal duty of a bank to check its clients and to report suspicious transactions to the state. A crypto client adds work and risk to this duty, so many banks refuse crypto clients. Even with a complete set of documents, opening an account can take weeks, and sometimes the bank refuses without giving a reason.

Hypothetical example. A company receives its license and feels relieved. Then the company spends the next six months trying to set up its banking and payments. It applies to a second bank, a third bank, and a fourth bank, or it uses payment intermediaries. This is why the company should work on the bank account at the same time as the license application, not after the license.

Chapter 3 explains why banks refuse crypto companies and how to prepare for the bank. Chapter 2 explains what the regulator checks when it asks whether the company has “substance,” meaning real people, a real office, and real work in the country.

Uzbekistan: what does the regulator check?

In Uzbekistan, the licensing body is the National Agency of Perspective Projects, known as NAPP. The rules in Uzbekistan are noticeably stricter than in Kazakhstan. NAPP describes itself as the state body responsible for regulation, licensing, and permits in the field of crypto-asset turnover.

The main licensing document is the Regulation on the procedure for licensing service providers in crypto-asset turnover. NAPP approved this regulation by Order number 32 of July 14, 2022, and the Ministry of Justice registered it on August 15, 2022, under number 3380. The regulation names each type of provider separately, for example a crypto exchange, a mining pool, a crypto depository, and a crypto shop. Each type of provider needs its own license.

Public descriptions of the licensing rules since 2021 say that the electronic trading system of a crypto exchange must run on servers located inside Uzbekistan. The same descriptions say that the exchange must store transaction data, client identification data, and business correspondence for five years. Before you file, check that these requirements are still in force in the current version of the rules.

Preparing a license application in Uzbekistan takes considerable time. The company needs to prepare the application package, register the legal entity, set aside and confirm the required capital, host the platform on local servers, and write internal anti-money-laundering documents. This chapter does not give a minimum capital figure for Uzbekistan on purpose. Public sources give different figures depending on the type of license and on the date of the source. A wrong number is worse than no number, so confirm the current figure directly with NAPP before you file.

NAPP also uses its power to stop licensed companies. The public register of licenses on the NAPP website shows licenses that NAPP suspended for six months and licenses that NAPP revoked or annulled between 2024 and 2026. In September 2026, NAPP annulled one license because the company did not apply in time to resume it. For a founder, this means that a license in Uzbekistan is not the end of the work. The licensed company must keep meeting the rules every month. Otherwise, the company can lose the right to operate.

European Union: what is MiCA and how does a CASP license work?

In the European Union, the transition period under MiCA fully ended on July 1, 2026. Before that date, some companies worked under old national rules for VASPs. VASP stands for virtual asset service provider. These old national rules no longer apply. Now the only way to provide crypto services in the European Union is to get CASP status under MiCA. CASP stands for crypto-asset service provider. MiCA stands for Markets in Crypto-Assets, the European Union regulation on crypto-asset markets.

The main advantage of MiCA is that a license from one EU country lets the company work in the other EU countries too. This system is called passporting. Passporting works through a notice, not through a new license. The company with a CASP license tells its home regulator in which other EU countries it wants to offer services. The home regulator sends this information to the regulators of those countries. After that, the company can serve clients in those countries without a separate license in each country.

However, a passport does not mean that every EU country works in the same way. Different EU countries apply MiCA at different speeds. Poland is an example. The Polish parliament passed a national law to apply MiCA three times, and the president of Poland vetoed the law three times: on December 1, 2025, and twice more in 2026, the last time on June 11, 2026. On September 4, 2026, the lower house of the Polish parliament tried to override the third veto, but the vote failed. In that vote, 241 deputies voted in favor and 198 voted against, while 266 votes were needed.

As a result, Poland still has no authority designated to supervise crypto companies under MiCA. The Polish Financial Supervision Authority, known as the KNF, says that it cannot process applications for a CASP license from Polish companies. A company that has a CASP license from another EU country can still serve clients in Poland through a passport. A company that is based in Poland, however, has no way to get a CASP license in Poland itself. For this reason, check the status of MiCA separately in each target country, and especially in the country where you plan to register the company. Do not rely only on the general status of MiCA in the European Union.

How long does a MiCA license take? MiCA sets deadlines for the work of the regulator. The national regulator has 25 working days to check whether the application is complete. After the application is complete, the regulator has 40 working days to assess the application and make a decision. The regulator can pause this period to ask the company for more information. These deadlines cover only the work of the regulator. Before the company even files, it usually spends several months writing the application, hiring people, and building its compliance system.

How much capital does MiCA require?

MiCA sets the capital requirements directly in the regulation. There are three classes, and the class depends on the type of activity.

The first class requires 50,000 euros. It covers executing orders for clients, placing crypto assets, transferring crypto assets for clients, receiving and transmitting orders, giving advice on crypto assets, and managing crypto-asset portfolios.

The second class requires 125,000 euros. It covers everything in the first class, plus holding and administering crypto assets for clients, known as custody, and exchanging crypto assets for money or for other crypto assets.

The third class requires 150,000 euros. It covers everything in the second class, plus running a trading platform for crypto assets.

Check these figures on the date you file.

These fixed amounts are only the minimum. MiCA says that the company must hold the higher of two amounts: the fixed minimum for its class, or one quarter of its fixed overhead costs for the previous year. Fixed overhead costs are the costs that the company pays no matter how much business it does, such as salaries, rent, and software. A new company that has no previous year uses the overhead costs that it planned in its business plan. As a result, a company with a large team can need much more than 150,000 euros, even if it provides only the services of the first class.

MiCA also sets rules on where the company and its managers must be. The company must have a registered office in an EU country where it provides at least part of its services. The company must be effectively managed from the European Union. At least one director must live in the European Union. A virtual office does not meet these rules.

United Arab Emirates: which regulator covers which territory?

The United Arab Emirates, like Kazakhstan, has several regulators for crypto. However, the UAE divides its regulators by territory and by type of zone, not by type of asset.

VARA, the Virtual Assets Regulatory Authority, was created by Dubai Law number 4 of 2022. VARA covers the whole emirate of Dubai, including its free zones, except the Dubai International Financial Centre.

ADGM FSRA, the Financial Services Regulatory Authority of the Abu Dhabi Global Market, covers the Abu Dhabi Global Market, a financial free zone in Abu Dhabi.

DIFC DFSA, the Dubai Financial Services Authority of the Dubai International Financial Centre, covers the Dubai International Financial Centre, a separate financial free zone inside Dubai.

The federal Capital Market Authority, or CMA, covers the rest of the country outside the financial free zones. The CMA rules for virtual-asset service providers are set in CMA Decision number 4 R.M. of 2026.

The name CMA is new. Before January 1, 2026, the federal regulator was called the Securities and Commodities Authority, or SCA. The SCA was renamed the CMA under Federal Decree-Laws number 32 and number 33 of 2025, which took effect on January 1, 2026. If a document or a consultant still calls the federal regulator “SCA,” that information is out of date and should be checked again.

A financial free zone in the UAE, such as the Abu Dhabi Global Market or the Dubai International Financial Centre, is a territory with its own laws, its own regulator, and its own courts for business matters. A company licensed in one financial free zone cannot automatically serve clients in the rest of Dubai or in another zone. For this reason, a founder must first decide where the clients and the team will be, and only then choose the regulator.

How much capital does VARA require?

VARA sets the paid-up capital for each type of activity in its Company Rulebook. Paid-up capital is the money that the owners have actually paid into the company. The amounts in the next paragraphs are in UAE dirhams, the currency of the United Arab Emirates.

For advisory services, the minimum is 100,000 dirhams.

For broker-dealer services, meaning executing trades for clients, the minimum is the higher of 600,000 dirhams or 25 percent of the fixed annual overhead costs of the company.

For custody services, the minimum is the higher of 600,000 dirhams or 25 percent of the fixed annual overhead costs.

For lending and borrowing services, for management and investment services, and for transfer and settlement services, the minimum is the higher of 500,000 dirhams or 25 percent of the fixed annual overhead costs.

For exchange services, the minimum is the higher of 1,500,000 dirhams or 25 percent of the fixed annual overhead costs.

If a company also holds a VARA custody license, or has another approval from VARA, two minimums are lower. For broker-dealer services, the minimum is the higher of 400,000 dirhams or 15 percent of overhead costs. For exchange services, the minimum is the higher of 800,000 dirhams or 15 percent of overhead costs.

These amounts add up. If a company combines several activities, the company must hold the required paid-up capital for each activity separately. The company calculates the requirement for each activity from the fixed overhead costs of that activity only. The company must divide its overhead costs between its activities so that it counts every cost once. The company must also reconcile its paid-up capital every month. Check both the amounts and the exchange rate on the date you file.

United States: is there a federal crypto license?

In the United States, there is still no single federal law that clearly sets the legal status of crypto assets or divides authority between regulators. Today, the main tool is the Howey test. The Howey test comes from the 1946 US Supreme Court decision in SEC versus W. J. Howey Company. The test asks whether an asset is an investment contract, in other words a security. Courts and the Securities and Exchange Commission, known as the SEC, use this test to decide whether a specific token falls under securities law. If a token is a security under the Howey test, the project must either register the token sale with the SEC or use a legal exemption from registration. Chapter 4 explains the four parts of the Howey test and how to apply them to a specific token.

Congress has tried to pass a broad law on the crypto market. The bill is called the CLARITY Act. The House of Representatives passed the CLARITY Act in July 2025 by 294 votes to 134. On September 15, 2026, the bill failed a procedural vote in the Senate by 49 votes to 50. The bill needed 60 votes to move forward, and since then it has not moved forward in the Senate. As a result, it is still unclear which regulator has authority over what: the SEC or the Commodity Futures Trading Commission, known as the CFTC. A founder should not plan a US launch on the assumption that a federal law will pass soon.

One federal crypto law does exist, but only for stablecoins. The GENIUS Act became law on July 18, 2025. It sets federal rules for companies that issue payment stablecoins, meaning tokens that are designed to keep a fixed value against the US dollar. The GENIUS Act covers only stablecoin issuers. It does not decide the legal status of other tokens, and it does not license exchanges.

There is also one federal step that most crypto businesses cannot skip. A company that exchanges crypto for money, or transfers crypto for clients, is usually a money services business, or MSB, under federal rules. An MSB must register with FinCEN, the federal agency that fights money laundering, and must run an anti-money-laundering program. FinCEN registration is not a license, and FinCEN does not review the business model in depth. Still, operating without FinCEN registration is a violation of federal law.

Beyond the federal level, most US states require a separate money transmitter license, or MTL. A company needs an MTL in a state if it holds or converts funds for clients in that state. Each state sets its own capital and bonding requirements. Bonding means a surety bond, a financial guarantee that a licensed company buys from an insurance company. If the licensed company loses client money or breaks the rules, the state can take money from the bond to pay the clients. There is no single federal amount. The company must check the amounts and conditions in each state where it plans to work.

New York has an additional license for virtual currency businesses, known as the BitLicense. The New York State Department of Financial Services issues the BitLicense. A company that wants clients in New York must check the BitLicense rules in addition to the money transmitter rules.

Many founders believe that registering a company in Delaware solves everything. A Delaware registration covers only corporate law: how the company is structured, who the shareholders are, and how meetings are held. A Delaware registration does not answer whether a token passes the Howey test. It also does not give the company a money transmitter license in the states where its clients actually live.

Russia: what does the new law allow?

In Russia, the Federal Law “On Digital Currency and Digital Rights” was signed on August 4, 2026. Its main provisions took effect on September 1, 2026. This is the first Russian law that fully regulates the circulation of cryptocurrency. It is a federal law adopted by parliament, and the Bank of Russia regulates the market under this law. Russia also has a separate law on digital financial assets, which has been in force since 2021.

Under the new law, only companies included in a special register may carry out crypto exchange activity. A company in the register must have equity of at least 15 million rubles and must join a self-regulatory organization of the financial market. A self-regulatory organization is an association of market participants. It sets standards for its members and checks that the members follow them, under the supervision of the Bank of Russia.

Crypto exchanges may keep operating without registration until July 1, 2027. After that date, crypto transactions must go through registered companies. This means that, at the time this chapter was written, Russia is still in a transition period.

The Russian rules are noticeably stricter than the rules in Kazakhstan or Uzbekistan. Using crypto to pay for goods and services inside Russia remains banned, and advertising crypto as a way to pay is also banned. The law allows a few exceptions, such as payments under foreign trade contracts, the use of mined cryptocurrency, and settlements with securities, other digital currencies, or digital rights.

The law divides investors into two groups. Non-qualified investors, meaning ordinary retail investors, may buy only the most liquid cryptocurrencies. They may buy only through a registered intermediary, only after they pass a test, and only up to 300,000 rubles per year with one intermediary. Qualified investors may buy any cryptocurrency. The Bank of Russia decides which cryptocurrencies count as the most liquid. For this reason, check the final list of allowed assets shortly before launch.

Tajikistan: can a crypto company get a license?

In Tajikistan, there is currently no legal way to get a crypto license. In December 2025, the National Bank of Tajikistan stated that trading in virtual assets is not regulated by law and is not a licensed activity. The National Bank also stated that no crypto exchange is officially registered in the country, and that all financial transactions in the country must be in somoni, the national currency.

Of all the countries in this chapter, Tajikistan is the only one where a founder cannot choose a license, because there is no license to choose. Until Tajikistan adopts a special law, any crypto business there works outside the law. Such a business has no protection from a regulator and no legal way to work with local banks as a crypto company. For a founder, this means that Tajikistan is not a realistic main country for an operating crypto company at this time. Tajikistan may become worth watching if it adopts proper rules in the future. However, a business plan should not depend on that.

How do the countries compare?

The following paragraphs compare the main points for each country. Every figure in these paragraphs can change, so check each figure on the website of the regulator on the date you file.

Kazakhstan, national system. The National Bank of Kazakhstan licenses exchange operators and platforms and supervises stablecoins, and ARDFM regulates the other digital financial assets. The minimum capital is set in the rules of the National Bank, and one overview gives 50 million tenge for an exchanger. For the requirements on people and the office, check the rules of the National Bank. The main practical risk is the bank account.

Kazakhstan, AIFC. AFSA licenses crypto activity in the AIFC. The minimum capital depends on the license, and overviews give from about 200,000 US dollars for a trading facility. The company needs real people and a real office in Kazakhstan. The main practical risk is the bank account.

Uzbekistan. NAPP licenses crypto activity in Uzbekistan. The minimum capital depends on the type of license, so confirm the amount with NAPP. The servers of the platform must be inside Uzbekistan. The main practical risk is the suspension or the loss of the license.

The European Union. The national regulator of the chosen EU country licenses crypto activity under MiCA. The minimum capital is 50,000, 125,000, or 150,000 euros, depending on the class of services, or one quarter of the fixed overhead costs if that amount is higher. The company needs a registered office and management in the European Union and at least one director who lives in the European Union. The main practical risk is that EU countries apply MiCA unevenly, as the example of Poland shows.

Dubai, except the Dubai International Financial Centre. VARA licenses crypto activity in Dubai. The minimum capital is from 100,000 dirhams for advice to 1,500,000 dirhams for an exchange, for each activity, and the amounts for several activities add up. The company needs a real team in Dubai. The main practical risk is the cost of the local team.

The United States. At the federal level, the SEC and the CFTC share authority without a clear split, and FinCEN registers money services businesses. Each state issues its own money transmitter license and sets its own capital requirements, and the requirements for people also depend on the state. The main practical risks are the absence of a federal law on the crypto market and licensing state by state.

Russia. The Bank of Russia keeps the register of operators. An operator needs equity of at least 15 million rubles and membership in a self-regulatory organization. The main practical risks are the ban on crypto payments and the limits for investors.

Tajikistan. Tajikistan has no licensing system for crypto activity, so there are no requirements for capital or people, and there is no legal way to operate a crypto business.

Why does minimum capital decide whether I can enter the market?

Founders often skip the topic of minimum capital in the first meeting with a lawyer, because it sounds like a technical detail. In fact, minimum capital decides whether the company can enter the market at all. In every country in this chapter, the regulator sets the amount based on the specific activity. The higher the risk to client money, the higher the capital requirement. Holding client assets and running a full trading platform carry the highest risk. The difference between the lowest and the highest requirement in one country can be large. In Dubai, the minimum for advisory services is 100,000 dirhams, and the minimum for running an exchange is 1,500,000 dirhams, which is fifteen times more.

The practical lesson is simple. A founder cannot estimate a licensing budget from one number, such as “how much does a license in country X cost.” The founder must calculate the budget for the specific set of activities that the company plans to carry out, not for the country in general.

Capital is not the only cost. A licensing budget usually includes four more items. The first item is the application fees and the annual fees of the regulator. The second item is the salaries of the staff that the regulator requires, such as a compliance officer and a money laundering reporting officer, known as an MLRO, who reports suspicious transactions to the authorities. The third item is legal and consulting work on the application. The fourth item is technology, such as software that monitors transactions, and security audits.

Each regulator publishes its own list of fees, so check the fees on the website of the regulator.

Why does the reputation of the country matter for banks?

The reputation of the country is closely linked to capital, and general overviews rarely mention it. The Financial Action Task Force, known as FATF, is an international body that sets standards against money laundering. FATF keeps two lists of countries with weak anti-money-laundering rules. The “grey list” includes countries under increased monitoring. The “black list” includes countries that require stronger counter-measures.

A license from a country on either list is still legally valid in that country. However, banks and payment providers around the world consider the reputation of the country when they decide whether to open an account or process payments for a company. As a result, a license that is fully valid under local law may still not give the company access to international banking. A bank in another country can simply refuse and cite its own risk policy, without further explanation.

For this reason, check the current FATF status of a country before you choose it for registration, not after. FATF updates both lists after its plenary meetings, which usually take place three times a year, in February, June, and October. Check the list on the FATF website in the month when you choose the country, and do not rely on an old article.

What does it cost to choose the wrong country?

The cost of choosing the wrong country is real, and it usually comes from several problems at once, not from one problem. A founder who chooses a “cheap” country to save money at the start usually faces three connected consequences.

The first consequence concerns the money of the company. The bank account either does not open at all, or the account that does open does not work with the currency that the business needs. The company then has no legal place to hold client money.

The second consequence concerns the token. The country may not recognize the type of digital asset that the company needs, or it may require a separate and more expensive permit to issue the token. If the company finds this out only after the product launches, fixing the problem costs far more than choosing the right country from the start would have cost.

The third consequence concerns the courts. In a dispute with a client, a partner, or the regulator, a contract signed by a company with a doubtful or incomplete license can turn out to be unenforceable. This often happens in exactly the part of the contract where the company needs protection most.

None of these three problems appears in the first month of operation. Usually six months to a year and a half pass before the money saved on the country turns into one large cost that is several times higher than the original saving. For this reason, a founder should not choose a country only by the entry price. The founder should look at the full picture: what the business model needs, how much capital the full set of planned activities requires, what banking is really available, and what reputation the country has internationally.

How do I choose a country, step by step?

Step one. Describe the business in one paragraph. Write down what the company does with client money and client crypto: whether the company holds it, exchanges it, transfers it, or never touches it.

Step two. Turn this description into a list of activities. Use the list of activities of the regulator itself, for example the list of crypto services in MiCA or the list of activities in the VARA rules. One business often covers two or three activities.

Step three. Check whether an exception applies. If the company never controls client assets, ask a lawyer whether the product falls outside the licensing rules.

Step four. Make a short list of three or four countries. Choose countries where your clients are, where your team can live and work, and where one license or a set of licenses covers all your activities.

Step five. Check the FATF status of each country on the short list. Remove the countries that banks in your target markets are likely to refuse.

Step six. Talk to banks before you file. Ask two or three banks or payment institutions whether they would open an account for your business model in each country on the short list.

Step seven. Calculate the full budget for each country on the short list. Include capital, fees, staff salaries, legal work, and technology.

Step eight. Choose the country and file the application. Do this only after steps one to seven. Chapter 25 lists the main law for each country in this chapter, and Chapter 26 gives the final checks before you file.

Which documents does a license application usually need?

Each regulator sets its own list of documents. The next paragraphs describe a typical package of ten documents, not a final list for any one country.

The first document is the set of founding documents of the company, together with a chart of the group structure. The chart shows every owner, up to the individuals who finally own the company.

The second document is a business plan with financial projections for at least three years.

The third document is proof of capital, such as a bank statement or a letter from an auditor.

The fourth group of documents is the “fit and proper” documents for each director, each owner, and each key manager: CVs, police certificates, references, and proof of the source of their funds. “Fit and proper” is the test that regulators apply to the people who run a licensed company. The regulator checks whether each person is honest, competent for the role, and financially sound.

The fifth document is the policy against money laundering and terrorist financing, known as the AML and CFT policy. This policy includes the rules for identifying clients, known as KYC, which stands for “know your customer.”

The sixth document is a risk assessment of the business.

The seventh group of documents is the policies on the custody of client assets, on IT security, and on the protection of client data.

The eighth group of documents is the client agreements and the terms of service.

The ninth document is proof of a real office, such as a lease agreement. A virtual address is not enough.

The tenth group of documents is the contracts with key service providers, such as a provider of transaction monitoring and an auditor.

A note from practice. Regulators most often return applications because the business plan describes one business and the policies describe another business. To avoid this problem, write the business plan first. Then write each policy around the activities in the business plan.

If you are choosing a country now, start with step one of the plan in this chapter: write one paragraph about what your company will do with client money and client crypto. Do not sign a registration contract with a consultant until this paragraph and the list of activities are ready.

Chapter 2. Structure and substance of a crypto company: what the regulator checks

The short answer. A regulator does not license a set of papers. A regulator licenses a real organization: real people, a real office, real money, and a management structure that makes sense. Regulators call this “substance.” This chapter explains how to choose the structure of the company or the group, what exactly the regulator checks under the word “substance,” when a nominee director is legal and when it is not, why insurance matters, how the visa of the director can delay the launch, and why the founder must keep personal money separate from the money of the company.

What does “substance” mean, and why does the regulator check it?

When a regulator reviews a license application, it does not look mainly at the name of the company or at the incorporation papers. The regulator looks for a real organization behind those papers: people, a physical place, money, and a management structure that makes sense. In licensing practice, this is what the word “substance” means. The full term is “economic substance.” It means proof that the company actually works in the country where it is registered, not only on paper.

A company that exists only on paper almost never passes this check. This chapter explains what substance is made of, how a company can prove it legally, and where the signs of a fake structure begin. A fake structure creates legal risk not only for the company, but also for the specific people behind it.

Should I build one company or a holding structure?

The first question comes even before substance: what kind of structure to build. There are two main options. The first option is a single company. The second option is a holding company with licensed subsidiaries in different countries.

A single company makes sense when the business works in one country only and has no plans to expand in the next year or two. A single company means less accounting work, one audit, and one regulator. A bank or an investor can also understand a single company easily.

The problem starts when the company wants to work in more than one country. Almost no single license covers the whole world. Even passporting under MiCA, the European Union regulation on crypto-asset markets, works only inside the European Union. Passporting is the system that lets a company licensed in one EU country serve clients in other EU countries. In the same way, Kazakhstan has two separate licensing systems. The Astana International Financial Centre in Kazakhstan, known as the AIFC, has its own regulator, AFSA. A license from AFSA has nothing to do with a license from the National Bank of Kazakhstan for activity outside the AIFC. Chapter 1 explains these regulators in detail.

For this reason, companies that plan to work in several regions usually build a holding structure. In a holding structure, a parent company sits at the top. Under the parent company, there is a separate licensed subsidiary in each target country. This structure solves the problem of needing several licenses. However, it creates a new problem. Each subsidiary keeps its own accounts and goes through its own audit. Tax authorities also pay separate attention to payments between the parent company and its subsidiaries, and so does the licensing regulator.

The choice between a single company and a holding structure is a choice between two trade-offs. A single company is simple, but it works in one country. A holding structure is complex, but it works in many countries. There is no correct answer until the founder knows the actual plans of the company.

Does an offshore holding company need its own substance?

A parent company in an offshore jurisdiction has substance rules of its own. The British Virgin Islands have the Economic Substance Act of 2018 for companies and limited partnerships. The Cayman Islands have the International Tax Cooperation Act on economic substance. Both laws were introduced to meet the international standards of the OECD, the Organisation for Economic Co-operation and Development.

These laws apply to companies that carry out “relevant activities.” The list of relevant activities includes banking, distribution and service centers, fund management, headquarters, holding, insurance, intellectual property, and shipping. A company that carries out a relevant activity must show adequate substance in the jurisdiction. This means enough employees there, adequate premises there, adequate spending there, and core income-generating activities there. In most cases, the company must also be managed and directed from the jurisdiction.

A pure equity holding company is a company that only holds shares in other companies. A pure equity holding company faces a reduced test. The requirement to be managed and directed from the jurisdiction does not apply to it.

A company that breaks these rules pays a fine. In the British Virgin Islands, the minimum fine is 5,000 US dollars for a first offense and 10,000 US dollars for a second offense. In the Cayman Islands, the fine is 10,000 Cayman Islands dollars, about 12,200 US dollars, for a first failure, and 100,000 Cayman Islands dollars, about 122,000 US dollars, for a later failure. If the company keeps breaking the rules, the registry can strike the company off the register. Check the current amounts in the law of each jurisdiction before you rely on them.

What does the regulator check under the word “substance”?

The regulator checks five specific things. The next five paragraphs describe them one by one.

The first thing is an office. The office must be a real place where people can find the staff at work during business hours. A mailing address or a virtual office does not count. The office must have an active lease agreement. The company must not sign the lease agreement later and date it earlier to make it look older.

The second thing is a local director. The local director must be more than a name in the company register. This person actually takes part in running the company and can answer the questions of the regulator in real detail. As a rule, the local director lives in the country of registration or near it.

The third thing is staff. The company must have a minimum number of employees who work for this company specifically. People who split their time between ten other companies do not count.

The fourth thing is the lease agreement. Regulators often ask for the lease agreement as a separate document. The lease agreement is one of the simplest ways to tell a real company from a fake one.

The fifth thing is key roles approved by the regulator. Most regulators require the company to fill certain roles with named people whom the regulator approves. The most common roles are a senior executive officer, a finance officer, a compliance officer, and a money laundering reporting officer, known as an MLRO. The MLRO is the person who reports suspicious transactions to the authorities. Each of these people goes through a “fit and proper” check. In a fit and proper check, the regulator checks whether the person is honest, competent for the role, and financially sound.

Two examples show how this works in practice.

In the AIFC in Kazakhstan, a full license application must include information on all Approved Individuals. It must also include separate applications for Approved Individual status for the Senior Executive Officer, the Finance Officer, the Compliance Officer, the MLRO, and the Director. AFSA reviews each of these people. As Chapter 1 explains, AFSA also expects the company to have a real presence in Kazakhstan: real people and a real office.

In Dubai, VARA, the Virtual Assets Regulatory Authority, requires each licensed company to appoint two Responsible Individuals of sufficient seniority. Each Responsible Individual must be a full-time employee of the company. Each must be a fit and proper person. Each must live in the UAE or hold a UAE passport. VARA must approve both people during the licensing process. The company must make sure that both people meet these rules at all times. The company must check this every year and keep a record of each check. Before the company replaces a Responsible Individual, it must ask VARA for approval.

These checks are not a formality. The regulator approves a specific person, not a name on a form. If a Responsible Individual or an Approved Individual cannot clearly explain what the company actually does, the regulator has a reason to refuse the application, even if every other document in the package is in order.

In the European Union, MiCA sets its own rules on where the company and its managers must be. Chapter 1 lists these rules: the company must have a registered office in an EU country, the company must be effectively managed from the European Union, and at least one director must live in the European Union.

Can a company outsource part of its work and still have substance?

A company can hire contractors for some functions, for example a provider of identity checks or a cloud provider. However, outsourcing does not move the legal duty away from the company. The regulator still holds the licensed company responsible for the work of its contractors. The key roles described in this chapter, such as the compliance officer and the MLRO, must remain real people inside the company who answer for the work. Chapter 22 explains the risks of outsourcing in detail.

Is a nominee director legal?

Nominee directors are usually the point where legitimate practice ends and what a regulator or a court later treats as a fiction begins.

A nominee director is a person who holds the position of director on paper but does not actually take part in running the company. A nominee director is not automatically illegal. There are legitimate uses for a nominee director. For example, a nominee director can be a temporary solution while the real managing partner is still getting a visa and residency. A nominee director can also meet a local-director requirement during a transition period.

A nominee director becomes a problem when the company uses the nominee director not as a temporary practical solution, but for one of three purposes. The first purpose is to hide the real beneficial owner. The second purpose is to avoid personal liability. The third purpose is to prepare a doubtful transaction that the nominee director knows nothing about and cannot explain.

The beneficial owner is the individual who finally owns or controls the company. A nominee director does not hide the beneficial owner for long. Banks and regulators require the company to disclose its beneficial owners, and the bank sees the same people that the regulator sees. Chapter 14 and Chapter 24 explain how banks and regulators check the owners of a company.

The company is not the only party that pays for this practice. The nominee director who takes on this role carries a real risk of personal liability, and in some countries criminal liability. The risk is highest if the company later goes bankrupt or becomes linked to a chain of suspicious asset transfers. The person who signed the documents remains responsible as the signer, even if someone else made the actual decisions.

For the beneficial owner, the bigger risk lies elsewhere. Regulators that run fit and proper checks increasingly insist on meeting the actual person listed as director. If that person cannot answer basic questions about the business, the regulator may refuse the license, and a refusal is not even the worst outcome. The situation is much worse when the truth comes out after the regulator has already granted the license, during an inspection. Then the question is no longer only whether the regulator will revoke the license. The question becomes the personal liability of everyone who stood behind the structure.

What insurance does a crypto company need?

Two types of insurance need to be kept apart. The first type is general professional liability insurance. The second type is custody insurance. Custody insurance is a narrower policy that covers the client assets that a company actually holds.

Insurance under MiCA. Under MiCA, a crypto-asset service provider must hold prudential safeguards. Prudential safeguards are a financial cushion that protects clients if something goes wrong. MiCA allows three ways to hold this cushion. The first way is the own funds of the company. The second way is an insurance policy that covers the territory of the European Union, or a comparable guarantee. The third way is a combination of own funds and insurance. Chapter 1 explains the minimum amounts. So under MiCA, insurance is one of the ways to meet the requirement, not a separate extra requirement.

If the company chooses an insurance policy, MiCA sets five strict conditions for the policy.

First, the company must publish the policy on its website.

Second, the first term of the policy must be at least one year.

Third, the insurer may cancel the policy only with at least 90 days’ notice.

Fourth, the insurer must be authorized under EU law or national law, and the insurer must be a third party, not a company of the same group as the crypto company.

Fifth, the policy must cover specific risks, including the loss of documents, misleading statements, breaches of legal duties and of confidentiality, failure to manage conflicts of interest, losses from business disruption or system failures, and gross negligence in safeguarding client assets where this applies to the business model.

Insurance where the law does not require it. In countries where the law does not formally require insurance, the situation is not really simpler. Banks and institutional partners still expect to see insurance before they open an account or sign an agreement. In these countries, the expectation comes from the partner instead of the regulator. On paper, the company can ignore it. In practice, serious partners will not work with the company without insurance.

Custody insurance. Custody insurance deserves separate attention, because it covers the most expensive risk in this industry: a hack or a loss that affects wallets with the assets of clients, not the own funds of the company. The amount of the policy must match the actual amount of client funds under custody. A minimum amount chosen only to meet a formal rule is not enough. When a claim happens, enough coverage means a loss that the company can survive. Too little coverage can mean the end of the company.

Why can the visa of the director delay the launch?

Founders rarely think early about one more part of substance: the visa and residency status of the founder, or of the person who acts as the local director. In a number of countries, the regulator wants more than a company with a local address. The regulator wants a real person with the legal right to live and work in that country. Depending on the country, this means a work visa, a residence permit, or citizenship. For example, VARA in Dubai requires each Responsible Individual to live in the UAE or hold a UAE passport.

Getting a visa is a separate process. The visa process runs at the same time as the company registration and the license application, not after them. The visa process often takes longer than the founder expects, especially if the founder focuses more on the product and the token model than on immigration law.

Hypothetical example. The legal entity is ready. The bank account is almost open. The license package is complete. But the work permit of the director is still not ready, and this one ordinary detail delays the launch of the company by months.

If the founder does not plan to move to the country, a more sensible path is to find a local director who already has the right residency status. This path is better than trying to solve the immigration question, the corporate question, and the licensing question at the same time through one person.

How does the structure affect the bank, investors, and taxes?

The structure that a company chooses at the start affects much more than the licensing process. The same choice decides three things that founders usually think about separately.

The bank. A bank has its own policy for assessing risk. Suppose the parent company is registered in a country with a doubtful reputation. Then the risk level of the whole group goes up, even if the operating subsidiary sits in a country with a clean reputation and has a clean license. Chapter 3 explains how banks assess crypto companies.

Investors. Institutional funds often have internal rules about which structures they may invest through. A holding company registered in the wrong country can shut out a whole category of investors before the conversation about the terms of the deal even starts.

Taxes. The countries of the parent company and of the operating subsidiaries decide whether double taxation applies, whether tax treaties are available, and how the tax authorities treat payments between the companies of the group. Tax authorities also look at where the company actually makes its decisions. Suppose the directors of an offshore holding company in fact make all decisions from another country. Then the tax authorities of that other country may ask whether the company should pay tax there. Chapter 8 explains the taxes of a crypto company.

In short, a decision about the structure that the founder makes in the first month of the project keeps affecting the company for years after the registration is finished.

Why must personal money and company money stay separate?

The last mistake, and probably the most common one in practice, is mixing the personal assets of the founder with the assets of the company. At first, the mixing looks harmless. The founder pays a personal expense from the company account, because “it’s basically my company anyway.” The founder keeps some of the crypto of the company in a personal wallet for convenience. The founder does not keep separate books, because separate books feel like something that can wait.

Legally, this mixing leads directly to the loss of the separation between the company and the person behind it. Different legal systems call this by different names. In the United States and the United Kingdom, courts call it “piercing the corporate veil.” In serious cases, a court can ignore the separate legal status of the company and make the owner personally liable for the debts of the company. In Russia, the Federal Law “On Insolvency and Bankruptcy” allows a court in a bankruptcy case to make the persons who control the company personally liable for its debts. This is called subsidiary liability.

Once the line between the founder and the company disappears in practice, not only on paper, the personal assets of the founder can be used to pay the debts of the company. The obligations of the company become the personal problem of one individual, not the problem of a company with limited liability.

The founder usually realizes this when it is too late to fix: during an audit, or during a dispute with a client or a partner. At that moment, someone asks whose money this actually was: the money of the company or the money of the founder. Suddenly the answer is not obvious even to the founder, because nobody kept records that could settle the question.

Substance checklist before you file

Use this checklist of ten points before you file a license application. Each regulator sets its own exact rules, so check the rules of your regulator on the date you file.

The company has a real office with an active lease agreement signed on the real date.

The local director lives in the country or near it and can explain the business in detail.

The company has its own staff, not people shared with many other companies.

The key roles are filled with named people: a senior executive officer, a compliance officer, an MLRO, and any other roles that the regulator requires.

Each key person has the documents for the fit and proper check.

Each person who must live in the country has a valid visa or residence permit, or has already applied for it.

If the parent company is in the British Virgin Islands or the Cayman Islands, the parent company meets the economic substance law of that jurisdiction.

The company knows who its beneficial owners are and can disclose them to the bank and to the regulator.

The company has the insurance that the regulator or its partners require, and the custody policy matches the real amount of client assets.

The founder keeps personal money and company money in separate accounts and separate wallets, and the company keeps its own books.

If you are preparing an application now, start with this checklist and mark each line “done” or “not done.” Do not file the application while any line about people, the office, or the visa of the director is still marked “not done.”

Chapter 3. Banking for a crypto company: why banks say no, and how to open an account

The short answer. A bank usually refuses a crypto company not because something is wrong with the license of the company, but because the bank is protecting itself. A license does not decide the question. The bank looks at how money will actually move through the account and at how well the company checks its own clients. This chapter explains why banks refuse crypto companies, how a bank, an electronic money institution, and a crypto payment provider differ, what documents a bank asks for, why a company needs more than one account, and what to do when a bank freezes an account.

Why does a bank refuse a crypto company that has a license?

A bank does not refuse a crypto company because something is wrong with the license of the company. The bank refuses the company because the bank is protecting itself. Founders almost never understand this difference at the start. For this reason, a refusal from a bank feels like a personal failure. In fact, a refusal is a standard and predictable reaction of the financial system to a whole category of business. It is not a judgment on one specific company.

Bankers have a name for this practice: de-risking. De-risking means that a bank cuts off a whole category of clients because of their industry, instead of reviewing each client individually. The Financial Action Task Force, known as FATF, is the international body that sets the standards against money laundering. FATF has said many times that de-risking is a problem. FATF describes de-risking as banks ending or limiting relationships with clients “to avoid, rather than manage, risk.” According to FATF, its standards require a case-by-case, risk-based approach. Cutting off whole classes of clients without a serious assessment of the risk of each client is not in line with the FATF standards. FATF returned to this topic in its 2021 report on the unintended consequences of its standards and in its 2023 targeted update on virtual assets.

Banks still practice de-risking because each bank is itself under supervision. If the regulator of a bank decides that the anti-money-laundering controls of the bank are weak, the bank faces fines and can even lose its own license. For the bank, it is simpler to turn away a hundred legitimate clients than to miss one illegitimate client. Many banks choose exactly this logic.

There is one more reason. Every bank works with correspondent banks. Correspondent banks are other banks through which international transfers actually move. A correspondent bank can set its own condition: either the bank reduces its number of high-risk clients, or the bank loses its ability to make international payments through that correspondent bank. In this situation, the bank is not really making a decision against one client. The bank is protecting its whole payment system, and the crypto company simply gets caught in a decision that has nothing to do with the company itself. Chapter 14 explains correspondent banking and sanctions risk in detail.

How does a bank decide which transactions look risky?

Banks mostly do not work with hard limits, such as “a transfer above this amount is blocked automatically.” Banks use a risk-based approach. Under a risk-based approach, the bank does not assess one single transaction. The bank assesses a combination of factors and, most importantly, any change from the usual behavior of the client.

For example, one large deposit with a clear origin and supporting documents can pass without trouble. At the same time, ten small transfers from different individuals over a short period can look riskier, even if the total amount is smaller. This is why a license alone does not settle the question. The bank is not looking at the permit to operate. The bank is looking at how money actually moves through the account, day by day.

Should I use a bank, an EMI, or a crypto payment provider?

A bank account, an account at an electronic money institution, and a crypto payment provider are three different tools. The company should choose between them based on what it actually needs. The company should not choose a bank only out of habit or because “a normal bank is what everyone uses.”

A traditional bank. A bank account gives the most status and the fullest range of banking services. In the European Union, bank deposits are protected by a deposit guarantee scheme up to 100,000 euros under EU Directive number 49 of 2014 on deposit guarantee schemes. Outside the European Union, the amount of protection depends on the law of each country. A bank also gives access to SWIFT, the international network that banks use to send payments to each other. However, banks usually take the longest to review an application, even when the set of documents is complete. Banks are also the most likely to refuse a company that has no physical presence in the country or whose beneficial owners have no local connections.

An EMI. EMI stands for electronic money institution. An EMI is a company licensed to issue electronic money and to process payments without a banking license. In the European Union, EMIs work under EU Directive number 110 of 2009 on electronic money. If an EMI also provides payment services, it follows EU Directive number 2366 of 2015 on payment services, known as PSD2. EMIs have historically been more willing to take clients from higher-risk sectors, such as crypto, online gambling, and financial technology. EMIs were built from the start around a more flexible compliance model. Opening an account at an EMI is usually much faster than opening an account at a bank.

This speed comes at a cost. A deposit guarantee scheme does not protect money at an EMI the way it protects a bank deposit. Instead, safeguarding protects the money. Safeguarding means that the EMI must keep the money of its clients separate from its own money. Under the directive on electronic money, the EMI must safeguard the money it receives no later than five business days after it issues the electronic money. If the EMI fails, the money of its clients does not go into the general pool that the creditors of the EMI share.

Before a company keeps large amounts at an EMI, the company should understand exactly how safeguarding works at that specific EMI. Safeguarding is a different kind of protection from a bank deposit. How reliable safeguarding is depends on how the specific EMI arranges it. The law allows each EU country to decide which methods of safeguarding an EMI may use.

A crypto payment provider. Crypto payment providers are the third type of tool. They are built specifically to handle payments for crypto companies. They usually understand the industry and do not react badly to the word “crypto” in the description of a business. Crypto payment providers also have a weak point. A crypto payment provider still depends on its own banks or correspondent banks. If that connection breaks, the money of the clients at the provider can get stuck, just as money at an ordinary bank can get stuck. For this reason, the company should check the provider one level deeper: which banks the provider itself uses and how stable those relationships are.

Here is a short comparison of the three tools.

A bank gives a full range of services, status, and access to SWIFT. The weak points of a bank are a slow review of applications and frequent refusals for crypto companies. A deposit guarantee scheme protects the money in a bank account, in the European Union up to 100,000 euros.

An EMI opens an account faster and is more open to crypto companies. The weak point of an EMI is that it offers fewer services than a bank. Safeguarding protects the money at an EMI: the EMI keeps the money of its clients separate from its own money.

A crypto payment provider understands the crypto business. The weak point of a crypto payment provider is that it depends on its own banks. The protection of the money depends on the provider, so the company should check the banks of the provider and the structure of the provider.

Why does a licensed crypto company still need a bank?

A license does not remove the need for a bank. In the European Union, MiCA, the regulation on markets in crypto-assets, sets a clear rule in its Article 70. A crypto-asset service provider that holds client funds must deposit those funds with a credit institution or a central bank by the end of the business day after it receives them. A credit institution is a bank. The provider must also keep these funds in an account that is separate from the accounts with its own money. So a crypto company that holds client money in the European Union cannot work legally without an account at a bank or at a central bank.

The same article of MiCA, Article 70, also covers payment services. If a crypto-asset service provider offers payment services linked to its crypto services, the provider itself or the third party that provides these services must have a license under PSD2.

What documents does a bank ask a crypto company for?

A bank looks at three areas when it reviews an application from a crypto company. The next three paragraphs describe these areas one by one.

The first area is the source of funds. The source of funds means documented proof of where the money of the company and of its beneficial owners actually came from. The beneficial owner is the individual who finally owns or controls the company. A bank does not accept “we made it in crypto” as an answer. The bank wants contracts, tax returns, statements from exchanges, proof of asset sales, or other documents that show a specific chain of where the money came from. A general success story is not enough.

The second area is the business plan. The bank does not want a generic business plan written for investors. The bank wants a document that explains how the company actually makes money, who its clients are, what transaction volumes the company expects, and why the payments on the account will look the way they do.

The third area is the anti-money-laundering policies of the company. These policies are usually called AML policies. The bank checks not only the company itself, but also how the company checks its own clients, because part of the risk of these clients passes to the bank through the account. If a crypto company has no real process for checking its clients and monitoring transactions, the bank reasonably assumes that the bank itself will carry this risk. In that case, the bank will probably refuse the application before a thorough review. Chapter 7 explains the AML and KYC work of a crypto company in detail.

Checklist for a bank application. Before you apply to a bank, prepare six things.

First, prepare documents that prove the source of funds of the company and of each beneficial owner.

Second, prepare a chart of the group structure that shows every owner, up to the individuals who finally own the company.

Third, prepare a business plan with the expected clients, countries, and monthly transaction volumes.

Fourth, prepare the license of the company, or proof that the license application is in progress.

Fifth, prepare the AML policy, the procedure for identifying clients, and a description of how the company monitors transactions.

Sixth, prepare proof of a real office and of real staff, as Chapter 2 explains.

Why does a crypto company need more than one account?

Multi-banking means that a company opens accounts with more than one provider at the same time. Usually this is a mix of a bank and one or two EMIs, sometimes in different countries. Multi-banking is not a luxury and not excessive caution. It is a direct way to reduce risk.

The logic is simple. Suppose a company has a single account and the bank freezes it. The whole business stops at the same moment, together with the client money that the company needs, and the company has no other legal place to hold that money. Now suppose the company has several accounts that are not directly linked to each other. A freeze on one account does not stop the whole business. The company gets time to solve the problem with that specific bank while the other accounts keep working.

Multi-banking has a cost: extra administrative work. Every bank and every EMI has its own onboarding process, its own regular reporting, and its own contact person for compliance questions. This means that someone on the team must actually manage all of these accounts all the time, not only once when the company opens them.

Hypothetical example. A company keeps all its money at one EMI. The EMI receives a warning from its own bank and closes the accounts of all its crypto clients within a month. The company now has nowhere to receive client payments, and the business stops. A second company has an account at the same EMI, but it also has a bank account in another country. When the EMI closes its account, the second company moves its payments to the bank account and keeps working while it looks for a new EMI.

What should I do if the bank freezes my account?

A bank can freeze an account or place it on hold. A hold is a temporary block on some operations while the bank checks something. The company should prepare its plan for a hold in advance, not in a moment of panic. The plan has five parts, and the next five paragraphs describe them.

Part one of the plan. Answer the request of the bank quickly and in writing. Do not ignore the message and hope that the problem disappears. Banks give a specific deadline for an answer, and the bank does not read silence in favor of the client.

Part two of the plan. Do not move the money to another bank right after you receive the hold notice. The bank reads this behavior as an attempt to escape with risky funds. This behavior can turn a temporary hold into a full account closure. It can also lead the bank to send a suspicious transaction report to the financial intelligence unit. The financial intelligence unit is the state body that receives reports about suspicious transactions.

Part three of the plan. Keep the documents ready in advance. Prepare the documents that prove the source of funds, the business model, and the internal AML procedures before any request comes. Do not start collecting them only after the request arrives. How fast the company answers directly affects the outcome.

Part four of the plan. Know the escalation path inside the bank. Most banks have a separate internal channel for compliance disputes. The company should use this channel before the case goes to a financial ombudsman or to a court. A financial ombudsman is an independent body that reviews complaints of clients against financial institutions. Use the right channel on purpose, and do not write to general customer support at random.

Part five of the plan. Bring in a lawyer at once. Bring in a lawyer at the start of the hold, not as a last resort after the talks with the bank have stalled.

Here multi-banking matters again. A plan for a freeze works only if the company has another account to work from during the dispute. If the frozen account is the only account of the company, the plan cannot help much.

Why does the bank not explain its decision?

Founders often expect the bank to explain why it froze or closed an account. Often the bank cannot explain. In the European Union, the anti-money-laundering rules prohibit a bank and its staff from telling the client, or any other third person, that the bank has sent information about the client to the authorities. This rule is called the prohibition of tipping off. The rule comes from Article 39 of EU Directive number 849 of 2015 on the prevention of money laundering.

For this reason, a short answer from the bank, or no explanation at all, does not always mean that the bank is ignoring the client. Sometimes the bank is not allowed to say more. This is one more reason to prepare the documents in advance and to keep a second account.

Where should I start?

If your company is preparing to open a bank account now, start with two documents: proof of the source of funds of each beneficial owner and a realistic business plan. Then apply to a bank and to an EMI at the same time, not one after another. Do not keep all the money of the company and of its clients in one account.

Part II. Token and money

Chapter 4. Security token or utility token: legal status of your crypto token

The short answer. The legal status of a token does not depend on the code of the token. It depends on how the project sells the token, what the project promises the buyer, and who does the work after the sale. The same code can be a security, a means of payment, a key that gives access to a service, or none of these. The legal status of the token decides what license the project needs, to whom the project may sell the token, what the white paper must say, and which court will hear a dispute. This chapter explains how the United States, the European Union, and the United Kingdom classify tokens, what utility tokens, governance tokens, stablecoins, and NFTs are, how the other countries of this book name tokens, and why one token can have different legal statuses in different countries at the same time.

Why does the legal status of a token matter?

The legal status of a token is not a detail that the project can sort out later. The legal status is a fork in the road that decides almost everything that follows: what license the project needs, to whom the project can legally sell the token, what the white paper of the project must contain, and which court will hear a dispute if something goes wrong.

The exact same code behind a token can end up, legally, as a security, as a means of payment, as a simple digital key that gives access to a service, or as none of these. The difference almost never comes from the technology. The difference comes from three things: how the project sells the token, what return the project promises, and who does what after the sale.

How does the United States decide whether a token is a security?

In the United States, the main tool for deciding whether an asset is a security is the Howey test. The US Supreme Court created this test in 1946 in the case SEC versus W. J. Howey Company. The case was about the sale of plots in a citrus grove in Florida.

The Howey test has four parts. An asset is an investment contract, and therefore a security, if all four parts are present at the same time.

First, a person invests money.

Second, the money goes into a common enterprise, meaning a shared business.

Third, the person reasonably expects a profit.

Fourth, the profit comes from the efforts of other people, not from the efforts of the buyer.

The US Securities and Exchange Commission, known as the SEC, applies this test to crypto assets without any special crypto law. The SEC simply applies an old framework created by a court to a new technology. This is why the same token can pass or fail the test depending on how the project actually sold it, not on what the token technically is. As Chapter 1 explains, at the time this chapter was written the United States still had no broad federal law on the crypto market.

Has the US position on tokens changed recently?

Yes. In 2025 and 2026, the SEC changed its approach to crypto in several steps.

The staff statements of 2025. In 2025, the staff of the SEC published several statements. In early 2025, the staff said that the offer and sale of meme coins do not fall under the Securities Act. A meme coin is a token that gets its value mainly from internet culture and community interest, not from a product or from the work of a team. Later in 2025, the staff published a statement on stablecoins and a statement that certain protocol staking activities are not securities offerings.

The speech of November 2025. On November 12, 2025, the Chairman of the SEC, Paul Atkins, gave a speech about a program called “Project Crypto.” In the speech, he described a possible token taxonomy, meaning a system of token categories.

The joint interpretation of March 2026. On March 17, 2026, the SEC and the Commodity Futures Trading Commission, known as the CFTC, issued a joint interpretation of how the federal securities laws apply to crypto assets. An interpretation is a document in which a regulator explains how it reads the law. The interpretation divides crypto assets into five categories.

The first category is digital commodities, also called network tokens, such as bitcoin and ether. A digital commodity is not a security when its value depends on how the network itself works, not on the management efforts of other people.

The second category is digital collectibles, such as NFTs and meme coins with limited functions. Digital collectibles are generally not securities. However, a collectible can become part of an investment contract if a project splits it into fractions or if its value depends on the management efforts of a team.

The third category is digital tools, meaning tokens that people use rather than hold as an investment, such as memberships, tickets, or credentials. Digital tools are not securities.

The fourth category is stablecoins, and their treatment depends on the facts. Payment stablecoins under the GENIUS Act are excluded from the definition of a security by the law itself. Chapter 1 explains the GENIUS Act. The interpretation does not decide the status of every other stablecoin.

The fifth category is tokenized securities. A tokenized security represents ownership of an instrument that already falls under the legal definition of a security, so a tokenized security remains a security.

An investment contract can end. The interpretation also explains that a token can stop being part of an investment contract. This happens when buyers can no longer reasonably see the promises of the issuer as attached to the token, for example because the issuer has completed the work that it promised, or has publicly abandoned it. After that moment, later trades in the token fall outside the securities laws. For this reason, the SEC encourages issuers to describe their planned work in detail: the timeline, the milestones, the resources needed, and a public announcement when the work is complete. The interpretation also says that validation and staking, wrapping of tokens, and certain airdrops generally do not involve an offer or sale of securities. An airdrop is a free distribution of tokens to many wallets.

The proposal of August 2026. On August 18, 2026, the SEC proposed new rules called “Regulation Crypto Assets.” The proposal would create special exemptions for raising money through investment contracts tied to crypto assets that are not securities themselves. A startup exemption would allow a project to raise up to 5 million US dollars once in a period of four years. A larger fundraising exemption would allow a project to raise up to 75 million US dollars in any 12-month period, in two tiers with different disclosure duties. The proposal would also create a safe harbor under which an investment contract ends when the issuer completes or permanently stops its essential management work and files a report with the SEC. Chapter 5 explains how to raise money for a crypto project.

What these documents mean for a project. The joint interpretation shows how the SEC and the CFTC read the law today. It is not a statute passed by Congress, and a court can still read the law differently. Regulation Crypto Assets is only a proposal at the time this chapter was written, not a final rule. A project should treat these documents as an important signal, but should not treat them as a guarantee. Check the current position of the SEC and the status of the proposal before you rely on them, because the thinking of US regulators on crypto has been changing faster in recent years than the industry has been able to follow.

How do the European Union and the United Kingdom classify tokens?

Other countries do not have a test with the same name, but they solve the same problem in a similar way.

The European Union. In the European Union, MiCA, the regulation on markets in crypto-assets, does not apply to crypto-assets that qualify as financial instruments. If a token meets the definition of a financial instrument under MiFID II, the EU directive on markets in financial instruments, the token falls outside MiCA and comes under ordinary securities law. On December 17, 2024, ESMA, the European Securities and Markets Authority, published guidelines on how to decide whether a crypto-asset is a financial instrument. The guidelines say that the decision depends on the rights that the token gives and on its economic substance, not on its name or on its technology. In borderline cases, the national financial regulator decides how to classify the token.

The United Kingdom. In the United Kingdom, two legal categories of UK financial law play a similar role: specified investments and collective investment schemes. The UK financial regulator applies these categories case by case.

The lesson is the same in all of these systems. A project cannot print any phrase on the description of a token that automatically takes the token out of securities law. The full set of facts around the actual sale decides the outcome.

When is a token really a utility token?

It is important to separate reality from wishful thinking early. Confusion around the term “utility token” costs projects more than almost any other mistake described in this chapter.

The idea behind a utility token is simple. If the token gives access to a product or a service, and not a share of the profit of the company, the token is not an investment contract and does not fall under securities law.

This idea works when three conditions are met.

First, the token is actually usable at the time of the sale.

Second, the project markets the token as a ticket to a specific function, not as something that will rise in value.

Third, the buyers are real users of the product, not speculators who bet that the efforts of the team will push the price up.

The idea stops working, and turns into wishful thinking, when the marketing of the project sells growth instead of function. Typical signs are promises such as “the token will go up because the team is building the ecosystem,” referral schemes, and messages that use limited supply as an investment argument instead of as a feature of the product. A regulator or a court looks at what the project actually promised the buyer, not at the word “utility” in the white paper.

The utility token under MiCA. MiCA has its own definition. Under MiCA, a utility token is a type of crypto-asset that is only intended to provide access to a good or a service supplied by its issuer. MiCA gives a utility token one practical advantage. Suppose the offer concerns a utility token that gives access to a good or a service that already exists or is already in operation. In that case, the project does not need to publish a crypto-asset white paper for that offer. If the good or the service does not exist yet, the offer to the public described in the white paper may last no longer than 12 months. Chapter 23 explains the white paper in detail.

How should a governance token be classified?

A governance token deserves separate attention, because it does not fit neatly into either of the two categories above. A governance token gives voting power over a protocol. A protocol is the set of smart contracts and rules on which a crypto service runs. The holders of governance tokens decide on upgrades, on the structure of fees, and on how the community treasury is spent.

On the one hand, a governance token is not a classic security like a share, because a vote is not the same as a right to dividends. On the other hand, a governance token is not a pure utility token in the narrow sense. The votes of the holders directly shape the future value of the protocol. Through the value of the protocol, the votes also shape what the holders expect the token to be worth.

The question of classification comes back to the same idea of “the efforts of other people.” Suppose that, in practice, a small team of developers makes the decisions, and voting is mostly a formality. Then a regulator will probably see the same signs of an investment contract as in an ordinary token. Now suppose that governance is truly distributed, and the holders make real decisions instead of simply approving the proposals of the founders. Then the case for treating the token as a utility token, or under the new US approach as a token outside the securities laws, gets stronger.

A law rarely draws this line directly. More often, a specific regulator draws the line in a specific case. A new project cannot get a guaranteed answer in advance. Chapter 12 explains the legal status of a DAO and who is liable for its decisions.

What are stablecoins under MiCA?

Payment tokens and electronic money tokens form a separate category. In the European Union, this category has precise legal names and its own stricter requirements under MiCA. MiCA distinguishes two types of these tokens.

An asset-referenced token, or ART. The value of an ART is tied to another value or right, or to a combination of them, for example to a basket of several currencies or commodities.

An electronic money token, or EMT. The value of an EMT is tied to a single official currency, for example to the euro or to the US dollar. An EMT works as electronic money.

The requirements for both types are noticeably stricter than the requirements for ordinary crypto-assets.

Who may issue them. An issuer of an ART needs a separate authorization under MiCA. Only a bank or an electronic money institution may issue an EMT. Both issuers must publish a detailed white paper, and both are under the supervision of a regulator.

The right of redemption. The holders of both types of tokens have a right of redemption at any time. A right of redemption is the right to return the token to the issuer and get value back. However, this right works differently for the two types. The holder of an EMT gets the money back at par value, meaning one euro for one euro token. The holder of an ART gets either money equal to the market value of the assets to which the token refers, or these assets themselves.

Reserves. The issuer of an EMT must safeguard the money that it receives for the tokens. At least 30 percent of this money must always be kept in separate accounts at banks. The issuer must invest the rest of the money in secure, low-risk, highly liquid instruments in the same currency as the token. The issuer of an ART must hold a reserve of assets that backs the token, under separate MiCA rules for this reserve.

Limits on use as a means of payment. MiCA also limits the use of ARTs as a means of exchange. The same limits apply to EMTs in a currency that is not the official currency of an EU country, for example an EMT tied to the US dollar. Suppose that, for such a token in one currency area, the average number of daily transactions is higher than 1 million and the average daily value is higher than 200 million euros. Then the issuer must stop issuing the token. Within 40 working days, the issuer must also give the regulator a plan to bring these numbers back below the limits.

These rules have real consequences. USDT, the largest dollar stablecoin by market value, did not receive authorization under MiCA. As a result, large exchanges stopped offering USDT to their clients in the European Economic Area. For example, the exchange Binance announced on March 3, 2025, that it would remove trading pairs with USDT for its users in the European Economic Area. This change took effect on March 31, 2025.