Licensing and conduct rules for crypto-asset service providers

Crypto regimes carry different names in different countries, but they are built from the same parts: a trigger that says who needs a license, tests for the people who run the firm, capital, rules for client assets, conduct rules and operational resilience. A professional who knows these building blocks can read any new regime quickly, spot its gaps and compare it with the others a firm already lives under.

The global reference points

Three sets of international standards shape crypto-asset service provider (CASP) regimes:

• FATF Recommendation 15 requires countries to license or register virtual asset service providers for anti-money-laundering purposes. It sets the floor and is covered in the lesson FATF standards and the Travel Rule.
• The IOSCO Policy Recommendations for Crypto and Digital Asset Markets, published as a final report on 16 November 2023, set 18 recommendations for securities regulators. They follow the principle "same activity, same risk, same regulatory outcome" and cover six areas: conflicts from vertical integration, market abuse and fraud, cross-border cooperation, custody and client assets, operational and technological risk, and retail distribution. IOSCO added nine policy recommendations for decentralized finance (DeFi) in December 2023.
• The Financial Stability Board (FSB) high-level recommendations for crypto-asset activities and markets (July 2023) ask authorities for comprehensive regulation, supervision and cross-border cooperation in proportion to the financial stability risks involved.

Both bodies reviewed implementation in October 2025. IOSCO found "significant progress" among its members but said more work was needed as business models evolve. The FSB described implementation as uneven and inconsistent, with gaps that allow regulatory arbitrage. Expect shared building blocks and different details.

Authorization triggers: activity, not label

Every regime starts by listing regulated activities. A firm needs authorization if it carries on one of them as a business for clients in the jurisdiction. Typical activities:

• operating a trading platform that matches buyers and sellers;
• exchanging crypto-assets for fiat or other crypto-assets, as principal (dealing) or as agent (brokerage);
• executing or receiving and transmitting client orders;
• custody and administration of crypto-assets on behalf of clients;
• transfer services;
• portfolio management, advice, and placing or underwriting token offerings;
• staking on behalf of clients and crypto lending, where the regime covers them;
• issuing stablecoins, which is usually a separate license (see Stablecoin regulation: global principles).

The test is functional, as in FATF's VASP definition: what the firm does matters, not its marketing. One platform can need several permissions. An exchange that also holds client keys, lends client assets and runs a staking program may trigger four activities. Common exclusions cover dealing only on one's own account, pure software or infrastructure providers (node operators, wallet software publishers) and intra-group services. For example, the EU's MiCA regulation lists each crypto-asset service that needs authorization, while in the United States the same activity can trigger state money transmitter licenses or federal securities or commodities rules depending on the asset.

Fit and proper, governance and capital

Fit and proper tests apply to directors, senior managers and significant shareholders: honesty and integrity, competence and experience, financial soundness, and no relevant criminal or regulatory record. Supervisors also check the source of the owners' funds and must be told of later changes in control.

Governance rules require a board able to challenge management, independent control functions (risk, compliance, internal audit), a named anti-money-laundering officer and real local substance. A license held by a "brass plate" office while decisions are made elsewhere is a frequent reason for refusal.

Capital and prudential safeguards make sure a firm can absorb losses and wind down in an orderly way. A common design is "the higher of" a fixed minimum that depends on the activity and a share of annual fixed overheads. In a hypothetical regime with a floor of 150,000 and a requirement of one quarter of fixed overheads, a firm with fixed overheads of 8,000,000 a year must hold 2,000,000, because the overheads-based figure is higher. Some regimes accept insurance for part of the amount, and many also require liquid assets and a tested wind-down plan.

Client assets: segregation and custody

Most of the large losses in crypto came from firms that used client assets as their own. IOSCO's client asset recommendations set the expected outcomes.

Omnibus wallets are allowed in most regimes if the internal ledger is accurate and reconciled. How custody works technically is covered in the lessons Custody models and the legal side of holding assets and Counterparty risk and proof of reserves.

Conflicts, disclosure and fair treatment

Crypto firms often combine functions that are kept apart in traditional finance: exchange, broker, market maker, custodian, lender and even token issuer. IOSCO's recommendations ask for governance that manages these conflicts and, where they cannot be mitigated, legal separation and separate registration. They also require disclosure of each role the firm plays, fair order handling with restrictions on front running, public standards for admitting and removing tokens, and management of conflicts around tokens the firm issued or holds, which may mean not listing them.

Fair treatment rules focus on retail clients: appropriateness or suitability checks before complex or risky products, fair and clear marketing (including through social media and paid influencers), disclosure of all fees and of conflicts, and risk warnings in plain language.

Complaints handling completes the picture: a documented procedure, acknowledgment and response deadlines, records of every complaint, analysis of root causes and, where one exists, access to an external dispute-resolution body.

Outsourcing and operational resilience

A firm can outsource tasks but not responsibility. Supervisors expect due diligence on providers, contracts that give the firm and the supervisor access and audit rights, exit plans and attention to concentration risk, since many firms rely on the same cloud, custody-technology, identity-verification and blockchain-analytics providers. IOSCO's recommendation on operational and technological risk asks for cyber and system resilience, at least an annual review, and plain-language disclosure of material operational and technological risks. Regimes increasingly add incident reporting deadlines and resilience testing. Key backup and recovery are covered in the lesson Assurance, resilience and insurance.

Cross-border services: passporting and reverse solicitation

Passporting lets a firm authorized in one country serve clients in other countries that share harmonized rules, usually after a notification rather than a new application. The EU is the main example. Without a passport, a firm needs a local license, a licensed local subsidiary or a partner, or an exemption.

Reverse solicitation is the narrow exception for a client who approaches a foreign firm on their own exclusive initiative. It is lost as soon as the firm solicits clients in that country: local-language websites, targeted ads, sponsorships, influencer campaigns or offers of new products to clients who first came on their own. It covers only the service the client asked for.

More countries now license foreign firms that serve their residents, typically anchoring the duty to activity such as targeted marketing or the use of domestic payment rails.

Firms back their market choices with controls: residency checks at onboarding, geolocation and IP blocking, and offboarding of clients in countries the firm does not serve.

Exam focus: the three global references (FATF R.15 for AML licensing, IOSCO's 2023 recommendations on conduct and client assets, the FSB's 2023 recommendations on financial stability) and what the October 2025 implementation reviews found; authorization triggered by activity carried on as a business, not by labels; fit and proper and governance tests; "higher of" capital designs and wind-down plans; the client asset controls IOSCO expects (segregation, consent for any use, reconciliation, independent assurance, disclosure); conflicts from vertical integration and IOSCO's remedies; retail fair treatment and complaints handling; outsourcing responsibility and operational resilience; passporting, the limits of reverse solicitation and offshore licensing.