COUNTERPARTY CATALOGUE

Crypto Custody License Regimes Compared

Each regime below is scored on how clearly it mandates eight custody safeguards, from 0 (missing) to 3 (mandatory and explicit). The score is the share of the maximum. Open a regime for its assessment and the crypto custodians and digital asset providers verified to hold it.

Assessed regimes

Regime Jurisdiction Regulator Score Insurance Coverage Backup Key Storage Key Control Authority Operations & Auditing Bankruptcy Protection Asset Segregation Cold/Hot Wallet Rules AML/KYC Compliance
Dubai VARA VASP licence Dubai, United Arab Emirates Virtual Assets Regulatory Authority (VARA) 83% 2 3 3 2 3 3 1 3
EU MiCA CASP authorisation European Union National competent authority under ESMA 67% 0 2 3 3 3 3 0 2
New York BitLicense New York, United States New York State Department of Financial Services (NYDFS) 58% 2 2 3 2 0 2 0 3
US Special Purpose Broker-Dealer United States SEC and FINRA 50% 0 2 3 2 0 3 0 2
France DASP registration France Autorité des Marchés Financiers (AMF) 42% 2 0 2 2 0 1 0 3
Singapore Major Payment Institution licence Singapore Monetary Authority of Singapore (MAS) 33% 0 0 2 2 0 1 0 3
South Dakota public trust company charter South Dakota, United States South Dakota Division of Banking 33% 3 0 0 2 0 0 0 3
US national trust bank charter (OCC) United States Office of the Comptroller of the Currency (OCC) 25% 2 0 0 2 0 0 0 2
Hong Kong TCSP licence Hong Kong Companies Registry, Hong Kong 21% 0 0 0 2 0 0 0 3
Ireland VASP registration Ireland Central Bank of Ireland 21% 0 0 0 2 0 0 0 3
Spain VASP registration Spain Banco de España 8% 0 0 0 0 0 0 0 2

Detailed Column Explanations

Overall Score: Aggregate compliance score indicating how clearly each licensing regime defines regulatory requirements. This is not a risk assessment or compliance rating.
Insurance Coverage: Requirements for mandatory insurance policies or surety bonds that protect client funds against operational losses, theft, or security breaches.
Backup Key Storage: Legal obligations to create, maintain, and securely store backup copies or cryptographic shards of private signing keys for business continuity.
Key Control Authority: Regulations governing signing authority, including multi-signature requirements, restrictions on key outsourcing, and exclusive control provisions.
Operations & Auditing: Mandatory security audits, penetration testing requirements, operational assessments, and ongoing regulatory reporting obligations.
Bankruptcy Protection: Legal safeguards ensuring client cryptocurrency assets remain protected and recoverable if the licensed entity becomes insolvent.
Asset Segregation: Requirements to maintain clear separation between client digital assets, the firm's proprietary holdings, and assets belonging to different clients. Learn more about custodian standards.
Cold/Hot Wallet Rules: Specific mandates for cold storage percentages, hot wallet operational procedures, and security protocols for cryptocurrency storage infrastructure.
AML/KYC Compliance: Customer due diligence requirements, identity verification procedures, transaction monitoring obligations, and record-keeping for anti-money laundering compliance.

Frequently Asked Questions About Crypto Licenses

Which cryptocurrency license has the strongest regulatory requirements?

Based on our analysis, the UAE VARA license scores highest at 83%, followed by EU MiCA at 67%. These licenses provide the most comprehensive coverage across insurance, key management, asset segregation, and operational requirements. However, regulatory strength should be evaluated based on your specific business needs and risk profile.

What is the difference between crypto licenses in different jurisdictions?

Crypto licenses vary significantly across jurisdictions in their approach to key management, insurance requirements, asset segregation, and operational oversight. Some focus heavily on AML/KYC compliance (like Hong Kong TSCP), while others provide comprehensive custody protections (like EU MiCA and UAE VARA). The regulatory landscape reflects each jurisdiction's priorities for consumer protection and financial stability.

How do I choose the right cryptocurrency license for my business?

License selection depends on your business model, target markets, operational requirements, and risk tolerance. Consider factors like regulatory clarity, ongoing compliance costs, market access, and specific requirements for your services (custody, exchange, payment processing). Review the specific regulatory authorities listed in our comparison (such as AMF for France, MAS for Singapore, or VARA for UAE) and consult with qualified legal and regulatory experts familiar with each jurisdiction's requirements.

Which jurisdictions require mandatory insurance for crypto businesses?

South Dakota Custodian license has the strongest insurance requirements (score 3), while France DASP, NY BitLicense, UAE VARA, and National Bank (OCC) have moderate insurance requirements (score 2). Many other jurisdictions currently lack specific insurance mandates for cryptocurrency businesses, representing a potential regulatory gap.

Not yet assessed