How to Get a Crypto Exchange License: State-by-State Requirements

By Chanté Eliaszadeh | Updated June 2026

If you’re launching a cryptocurrency exchange---whether a centralized trading platform, swap interface, or marketplace---you face one of the most complex regulatory landscapes in fintech. The conventional wisdom says you need money transmitter licenses in all 49 states, federal MSB registration, and potentially a BitLicense if you want New York customers. That advice is correct, but incomplete.

What founders often don’t realize is that crypto exchanges face additional scrutiny beyond standard money transmitter requirements. State regulators scrutinize your custody practices, order book mechanics, trading pair offerings, and reserve management with intensity typically reserved for banks. Building a national licensing footprint is a six- to seven-figure undertaking that unfolds over twelve to eighteen months, with substantial ongoing compliance costs every year after.

This guide breaks down what crypto exchange operators need to know about licensing in 2026, including state-specific exchange requirements, custody obligations, strategic state selection frameworks, and alternatives to direct licensing that successful exchanges use to reduce costs and accelerate time to market. The 2025—2026 federal developments---the GENIUS Act and the pending market-structure legislation---change the picture at the margins, and this guide places them precisely.

What Makes Exchange Licensing Different from General MTL?

Crypto exchanges operate as money transmitters under state law, but face heightened regulatory expectations because they combine multiple high-risk activities: custody of customer assets, facilitation of trading, conversion between crypto and fiat, and market-making functions.¹

Core Activities That Trigger Exchange Licensing

Custodial Trading Platforms:

• Holding customer cryptocurrency or fiat during trading
• Operating order books matching buyers and sellers
• Facilitating crypto-to-crypto or crypto-to-fiat exchanges
• Maintaining customer account balances
• Processing deposits and withdrawals

Market Making and Liquidity Provision:

• Providing liquidity from house accounts
• Setting bid-ask spreads
• Operating trading pairs and determining listings
• Executing trades on behalf of customers

Custody and Safeguarding:

• Controlling private keys for customer cryptocurrency
• Maintaining hot wallets for operational liquidity
• Storing majority of customer assets in cold storage
• Implementing multi-signature security controls
• Segregating customer assets from company assets

What Doesn’t Require Exchange Licensing (Usually)

Non-Custodial Swap Protocols:

• Wallet-to-wallet exchange interfaces
• Smart contract protocols facilitating direct swaps
• Liquidity pool protocols without custody
• Peer-to-peer matching without intermediation

The critical distinction: If you take custody of customer funds at any point---even temporarily during a trade---you’re operating as a money transmitter and likely need state licenses. If users trade directly from their own wallets without you controlling private keys, you may avoid licensing requirements in most states (but should still obtain legal analysis).²

Important caveat: Even truly non-custodial protocols face regulatory scrutiny. The SEC and CFTC have pursued enforcement actions touching DeFi protocols, and some states are expanding money transmitter definitions to potentially capture non-custodial intermediaries. Do not assume non-custodial status provides complete regulatory immunity.

Federal Baseline: FinCEN MSB Registration

Before addressing state licenses, every crypto exchange must register as a Money Services Business (MSB) with FinCEN, regardless of custody model or business structure.³

FinCEN Registration Requirements

Registration Process:

• File FinCEN Form 107 (MSB Registration) electronically
• Registration must be completed within 180 days of commencing operations
• Renewal required every two years
• No filing fee (but significant compliance costs)

Mandatory AML Program Components:

• Written Anti-Money Laundering (AML) program tailored to exchange operations
• Designated AML Compliance Officer (must be identified)
• Independent AML program testing (annual or biennial)
• Ongoing AML training for all employees
• Risk-based Customer Identification Program (CIP)
• Enhanced due diligence for high-risk customers
• Ongoing transaction monitoring for suspicious activity
• Suspicious Activity Report (SAR) filing when thresholds met
• Travel Rule compliance for transactions over $3,000

Exchange-Specific AML Considerations:

• Blockchain transaction monitoring and wallet screening
• OFAC sanctions screening for wallet addresses
• Enhanced due diligence for privacy coins and mixers
• Geographic risk assessment (high-risk jurisdictions)
• Layering and structuring detection
• Integration with blockchain analytics tools (Chainalysis, Elliptic, TRM Labs)

Cost: Zero registration fee, but expect a meaningful investment to build a compliant AML/BSA program with exchange-specific controls, plus continuing annual spend on blockchain analytics tools and ongoing monitoring.

Timeline: Immediate registration required. Operating an unregistered money transmitting business carries real teeth: a civil penalty of $5,000 per day under 31 U.S.C. § 5330, plus criminal exposure of up to five years’ imprisonment under 18 U.S.C. § 1960. The enforcement record is the clearest warning. FinCEN and the CFTC together assessed $100 million against BitMEX in 2021, and in February 2025 OKX pleaded guilty to operating an unlicensed money transmitting business and resolved the matter for approximately $505 million ($84.4 million in fines and $420.3 million in forfeiture).⁴

State Money Transmitter Licenses: The 49-State Framework

Crypto exchanges must obtain money transmitter licenses in every state where they offer services to residents. Currently, 49 states require licenses---Montana being the lone exception, though federal FinCEN registration still applies there.

General MTL Requirements for Exchanges

Application Components:

• Comprehensive business plan and financial projections
• Three years of audited financial statements (or projections if new)
• Detailed description of exchange operations and technology
• AML/BSA policies and procedures
• Cybersecurity program and incident response plan
• Disaster recovery and business continuity plans
• Background investigations for all control persons (10%+ ownership)
• FBI fingerprint cards for executives and owners
• Net worth and liquidity demonstrations
• Surety bonds or equivalent securities

Financial Requirements (State-Specific, and Volume-Scaled):

• Application fees: roughly $100 to $10,000 per state
• Minimum net worth: roughly $25,000 in the smallest states to roughly $500,000 in the largest
• Surety bonds: roughly $25,000 to $2,000,000 or more per state, scaled to transaction volume
• Annual fees: roughly $500 to $3,000 per state
• Permissible investments: limits on how customer funds can be invested
• Reserve requirements: some states require 100% reserves for customer liabilities

These figures are illustrative, not quotes. State fees, bond amounts, and net-worth thresholds change frequently and scale with transaction volume. Treat any specific figure---here or anywhere else---as a starting point to verify, not a number to rely on. Confirm the current requirement directly with each state regulator and through the Nationwide Multistate Licensing System (NMLS) before you budget or file. Figures current as of June 2026.

Timeline: Processing time varies widely by state.

• Faster, crypto-receptive states (roughly 4—8 months): Texas, Georgia, Florida
• Most states (roughly 6—12 months)
• Slowest states (roughly 9—18+ months): New York, California, New Jersey

A Few Reliable State Anchors

Specific dollar figures move, but a handful of structural facts are stable enough to plan around:

• New York requires a BitLicense in addition to a New York money transmitter license---the most demanding combination in the country.
• Texas has historically been faster and more crypto-receptive than most states, with a minimum surety bond of $300,000.
• California’s Digital Financial Assets Law (DFAL) takes effect July 1, 2026, adding a dedicated digital-asset licensing regime on top of the existing money transmitter framework.
• Montana is the one state with no money transmitter license at all---though FinCEN registration still applies.

What Multi-State Licensing Actually Costs

There is no honest single number, because the real figure depends on how many states you enter, your transaction volume, your credit profile (which drives surety-bond premiums), and how much of the compliance work you build in-house versus outsource. The useful framing is directional: licensing a meaningful footprint is a six- to seven-figure undertaking, and full 49-state coverage runs well into seven figures in year one once application fees, surety bonds, net-worth funding, legal and consulting work, and compliance build-out are all counted. Ongoing compliance is a substantial annual cost on top of that.

Rather than anchoring on a fixed estimate, build a current, regulator-confirmed budget: pull the present fee and bond schedule for each target state from its regulator and NMLS, get a surety-bond quote against your actual credit and projected volume, and price the legal and compliance work for your specific business model. The numbers move; the method does not.

The MTMA: The Standardization Trend Reshaping Multi-State Licensing

The single most important structural development in multi-state money transmission is the Money Transmission Modernization Act (MTMA)---a model law developed through the Conference of State Bank Supervisors (CSBS) to harmonize money transmitter requirements across states. As of 2026, the CSBS reports that 31 states have enacted the MTMA in whole or in part, with more considering adoption.

For a crypto exchange pursuing a national footprint, the MTMA is the dominant trend to understand because it standardizes the things that used to differ state by state:

• Common definitions of money transmission, including the treatment of virtual currency.
• Uniform net-worth requirements scaled to transaction volume rather than set ad hoc per state.
• Harmonized permissible-investment rules governing how customer funds may be held.
• Streamlined multistate coordination through NMLS and shared examination standards.

The practical effect is that the patchwork is slowly becoming a grid. As more states adopt the MTMA, a single, well-built application package travels further, and the cost of each marginal state falls. The state count is fast-moving, so confirm the current adoption status for your target states before you rely on uniformity that a given state may not yet have enacted.

New York BitLicense: The Most Complex Exchange License

New York’s BitLicense represents the most stringent and expensive cryptocurrency licensing regime in the United States. Any exchange serving New York residents generally must obtain a BitLicense and a New York money transmitter license, or partner with a licensed entity.⁵

Two licenses, not one. A common and costly misunderstanding is that the BitLicense is the whole New York story. It is not. A crypto firm serving New York residents typically needs both:

• A BitLicense under 23 NYCRR Part 200 (virtual-currency business activity), with a $5,000 application fee; and
• A New York money transmitter license under Banking Law Article 13-B, which carries its own requirements, including a surety bond commonly in the range of $500,000.

BitLicense Application Requirements

Virtual Currency Business Activities Covered:

• Receiving virtual currency for transmission or transmitting virtual currency
• Storing, holding, or maintaining custody or control of virtual currency on behalf of others
• Buying and selling virtual currency as a customer business
• Performing exchange services as a customer business
• Controlling, administering, or issuing a virtual currency

Application Components (Comprehensive):

• Business plan and operational descriptions
• Three years of historical financial statements (if existing) or projections
• Capital and liquidity analysis
• Cybersecurity policy and program
• AML/BSA program with enhanced monitoring
• Business continuity and disaster recovery plan
• Description of all products and services
• Advertising and marketing materials
• Custody and safeguarding procedures
• Reserves and permissible investment policies
• Transaction monitoring and suspicious activity protocols
• Consumer disclosure policies
• Privacy and information security policies

Financial Requirements:

• New York does not impose a fixed minimum-capital formula. Instead, the Superintendent sets a discretionary, risk-based capital requirement determined by business model, transaction volume, and risk profile
• Many applicants demonstrate $1—5 million in capital in practice
• For the companion money transmitter license, expect 100% permissible-investment backing of outstanding customer obligations and a surety bond commonly around $500,000
• At least one director must be a local New York resident

Custody and Safeguarding Requirements (Critical for Exchanges):

• Segregation of customer assets from company assets
• Maintenance of reserves equal to 100% of customer liabilities
• Quarterly attestations by independent CPAs
• Multi-signature controls and cold storage protocols
• Incident response and breach notification procedures
• Insurance or bond coverage for losses

Costs:

• Application fee: $5,000 (plus separate money-transmitter-license costs)
• Investigation fees: often additional
• Legal fees for application: substantial, reflecting the depth of the submission
• Ongoing compliance: a meaningful recurring annual cost

Timeline: Roughly 12—24 months from application submission to license approval (improved from the multi-year timelines of the BitLicense’s early years).

Alternative: A New York limited-purpose trust company charter (even more complex, but provides custody and fiduciary authority).

BitLicense Strategic Considerations

When BitLicense is Worth the Cost:

• New York has one of the largest concentrations of crypto users and institutional capital
• BitLicense signals credibility to institutional investors and customers
• Some institutional clients require BitLicense as a procurement criterion
• International recognition (some jurisdictions treat BitLicense as a meaningful credential)

When to Exclude New York Instead:

• Early-stage exchanges with limited capital
• Companies targeting retail users primarily in other states
• Businesses that can achieve product-market fit without NY access
• Startups needing rapid time to market (can add NY later)

Geofencing New York:

• Technically straightforward: IP blocking, address verification, terms-of-service restrictions
• Legally permissible and widely practiced
• Must be robust and well-documented (NYDFS pursues unlicensed operations aggressively)
• Can revisit New York expansion once the company scales

California DFAL: New Custody Requirements for Exchanges

California’s Digital Financial Assets Law (DFAL) takes effect July 1, 2026, creating a new licensing regime specifically for digital asset businesses, including exchanges.⁶

DFAL Key Requirements for Exchanges

Covered Activities:

• Exchange services (crypto-to-crypto, crypto-to-fiat)
• Custody and storage of digital financial assets
• Stablecoin issuance and transmission

Application Process:

• Applications submitted through the NMLS system
• License required before commencing California operations
• Transitional provisions for existing money transmitter licensees

Financial and Operational Requirements:

• Capital and liquidity sufficient to meet obligations to California residents
• Surety bond or trust account (amounts set by regulation)
• Proof of reserves through CPA examination or agreed-upon procedures
• Quarterly financial reporting
• Annual independent audits

Custody and Security:

• Cybersecurity framework addressing digital asset-specific risks
• Multi-signature controls for wallets
• Cold storage protocols for majority of customer assets
• Hot wallet limits for operational liquidity
• Incident response and breach notification
• Insurance or bond coverage for custody losses

Recordkeeping:

• Five-year retention for all transactions and customer records
• Real-time reconciliation of on-chain assets and customer liabilities
• Detailed transaction histories for regulatory examination

Penalties for Non-Compliance:

• Up to $100,000 per day for unlicensed activity, and up to $20,000 per day for a licensee’s violation (among the highest in the U.S.)
• Cease-and-desist orders
• Restitution to customers
• Potential criminal referrals for knowing violations

Timeline: The DFPI began accepting applications ahead of the July 1, 2026 effective date. Existing California money transmitter licensees may qualify for transitional treatment.

Strategic Consideration: California’s DFAL is one of the most comprehensive state digital-asset frameworks. Early compliance positions an exchange favorably for institutional customers and national expansion.

State Examination Priorities for Crypto Exchanges

Understanding what state examiners scrutinize helps exchanges prepare stronger applications and maintain ongoing compliance.

Top Examination Focus Areas

1. Custody and Safeguarding (Highest Priority)

State examiners focus intensely on how exchanges protect customer assets:

• Segregation: Are customer assets segregated from company assets both on-chain and in accounting records?
• Reserves: Does the exchange maintain 100% reserves equal to customer liabilities?
• Hot vs. Cold Storage: What percentage of assets are in hot wallets vs. cold storage?
• Multi-Signature Controls: Are private keys distributed across multiple signatories?
• Disaster Recovery: Can the exchange reconstitute wallets if infrastructure fails?
• Insurance: Does the exchange maintain crime insurance or bonds covering custody losses?

Red flags that trigger enforcement:

• Commingling customer and company assets
• Under-reserved positions (liabilities exceed assets)
• Excessive hot wallet balances creating theft risk
• Inadequate multi-signature protections
• No proof-of-reserves verification process

2. BSA/AML Program Effectiveness

Exchanges receive heightened AML scrutiny because they facilitate high-volume transactions:

• Transaction Monitoring: Real-time monitoring for structuring, layering, and suspicious patterns
• Blockchain Analytics: Integration with Chainalysis, Elliptic, or TRM Labs for wallet screening
• OFAC Compliance: Screening against sanctions lists before allowing withdrawals
• Travel Rule Compliance: Capturing and transmitting originator/beneficiary information for transactions over $3,000
• SAR Filing: Timely filing of Suspicious Activity Reports with appropriate detail
• High-Risk Customers: Enhanced due diligence for PEPs, high-risk jurisdictions, large transactions
• Privacy Coins: Policies on whether to support privacy-enhanced cryptocurrencies (Monero, Zcash)

3. Financial Condition and Reserve Management

State examiners verify that exchanges can meet customer withdrawal demands:

• Permissible Investments: Customer funds must be invested only in permitted securities (typically U.S. Treasuries, money market funds, FDIC-insured deposits)
• Liquidity Ratios: Sufficient liquid assets to meet withdrawal requests
• Capital Adequacy: Minimum net worth and ongoing capital requirements
• Stress Testing: Demonstrated ability to withstand market volatility and customer withdrawals

4. Cybersecurity and Incident Response

Given high-profile exchange hacks, cybersecurity receives extensive examination:

• Security Assessments: Regular penetration testing and vulnerability scanning
• Access Controls: Multi-factor authentication, role-based access, least-privilege principles
• Incident Response Plan: Written plan with breach notification procedures
• Third-Party Risk Management: Due diligence on vendors, APIs, and service providers
• Disaster Recovery: Tested backup and recovery procedures

5. Consumer Protection and Disclosures

Exchanges must provide clear, accurate disclosures to customers:

• Fee Disclosures: Clear explanation of trading fees, spread markups, withdrawal fees
• Risk Disclosures: Warnings about cryptocurrency volatility and loss potential
• Terms of Service: Clear explanation of custody model, liability limitations, dispute resolution
• Stablecoin Reserves: If offering stablecoins, disclosure of backing and reserve composition
• Trading Pair Listings: Criteria for listing and delisting cryptocurrencies

Strategic State Selection: Which States to Target First

Not all exchanges need 49-state coverage from day one. Strategic state selection reduces costs and accelerates time to market.

Tier 1: Must-Have States (Consider These First)

California, Texas, Florida

• Largest crypto adoption rates
• Major metro centers with high user concentration
• A combined addressable market on the order of 85+ million people

Illinois, New York (If You Can Afford It)

• Financial centers with institutional presence
• New York requires both a BitLicense and a state money transmitter license
• Illinois has comparatively reasonable requirements under the MTMA

Strategic Note: Licensing in the top five states provides access to roughly 40%+ of the U.S. population and crypto users. The remaining 44 states represent the rest of the population at much lower per-capita cost. Build the budget for each from current regulator-confirmed figures.

Tier 2: High-Value Secondary States

Washington, Pennsylvania, Georgia, Massachusetts, Colorado

• Tech hubs and financial centers
• Moderate licensing costs and timelines
• Georgia and Colorado often process comparatively quickly

Strategic Approach: License Tier 1 states first, launch to customers there, validate product-market fit, then expand to Tier 2.

Together, Tier 1 + Tier 2 is about ten states covering roughly half the U.S. population.

Tier 3: Consider Based on Customer Data

Arizona, North Carolina, Virginia, Maryland, Oregon, Connecticut

• Mid-sized markets with varying costs
• License based on actual customer-acquisition data
• May be worthwhile if specific marketing initiatives target these states

States to Potentially Exclude

Small-Population States with High Relative Costs:

• Vermont, Wyoming, Alaska, Hawaii, Rhode Island
• Combined population under 5 million
• Individual licensing processes add cost out of proportion to the addressable market
• Geofencing Strategy: Block these states initially, add later if customer demand justifies cost

High-Cost, Complex States (If Undercapitalized):

• New Jersey (expensive process, high net-worth requirement)
• Connecticut (stringent for a limited market)
• States with unique requirements adding disproportionate compliance burden

Geofencing Implementation

Technical Controls:

• IP address blocking (primary method)
• GPS location verification (mobile apps)
• Address verification during KYC process
• VPN detection and blocking
• Periodic re-verification of user location

Legal Requirements:

• Clear terms-of-service restrictions by state
• Prohibited-jurisdiction disclosures during registration
• Attestations that users are not residents of excluded states
• Monitoring for VPN circumvention attempts

Enforcement Risk: State regulators rarely pursue out-of-state exchanges that effectively geofence their state. Primary enforcement targets are exchanges that knowingly serve state residents without licenses or implement ineffective geofencing.

Alternatives to Direct Licensing: Partner Bank and White-Label Models

Many exchanges never obtain direct money transmitter licenses early on. Instead, they use partner-bank models or white-label solutions that provide regulatory coverage.

Partner Bank Model: Licensing Without Licensing

How It Works:

• Exchange partners with a chartered bank holding money transmitter licenses in the required states
• Bank acts as principal money transmitter for regulatory purposes
• Exchange operates as a service provider or agent under the bank’s licenses
• Bank provides regulatory umbrella, compliance oversight, and examination preparation

Benefits:

• Faster time to market than building direct licensing state by state
• Reduced upfront costs: application fees and surety bonds are largely carried by the bank
• Compliance expertise: the bank provides experienced compliance personnel
• Regulatory relationships: the bank has established relationships with state regulators
• Lower net-worth burden: the startup need not independently meet every state’s net-worth threshold

Costs:

• Revenue share on transaction revenue (varies with volume and risk)
• Implementation and onboarding fees
• Ongoing compliance support (often bundled into the revenue share)
• Examination costs (shared or absorbed by the bank)

Trade-offs:

• Reduced margins: the revenue share decreases profitability
• Less control: the bank may hold veto power over products, features, and listings
• Dependency risk: the bank’s regulatory issues become your issues
• Customer perception: some customers prefer direct licensing as a credibility signal
• Exit costs: transitioning to direct licensing later requires re-onboarding customers

When Partner Bank Makes Sense:

• Pre-revenue or early-revenue exchanges needing fast market entry
• Startups that cannot independently meet minimum net-worth requirements
• Teams without deep in-house regulatory expertise
• Exchanges prioritizing speed to market over near-term margin
• Companies with a clear plan to transition to direct licensing as they scale

Choosing a Partner Bank: Several chartered banks operate banking-as-a-service and partner programs for crypto and fintech companies, but the field has proven volatile---the 2024 collapse of one prominent banking-as-a-service arrangement froze customer funds across multiple fintech programs and is a cautionary tale. Do not select a partner bank on reputation or name alone. Independently vet each candidate’s current regulatory standing, financial condition, enforcement history, and operational track record, and confirm that its program is in good standing today---not as of some prior year. A partner bank’s failure or regulatory action can shut your exchange down overnight, so this diligence is foundational, not a formality.

White-Label Exchange Solutions

How It Works:

• A third-party provider offers pre-built exchange software with built-in compliance features
• The provider may include banking relationships and licensing coverage
• The exchange brands and customizes the platform
• The provider handles technical infrastructure and regulatory updates

Benefits:

• Fastest time to market: launch in a matter of months
• Lower development cost: no need to build an exchange from scratch
• Built-in compliance: KYC/AML integrations, blockchain analytics, reporting tools
• Regulatory expertise: providers stay current with changing requirements
• Banking integrations: existing relationships with crypto-friendly banks

Costs:

• Setup and customization fees
• Recurring platform fees
• Transaction-based fees on trading volume
• Additional fees where the provider supplies a regulatory umbrella

Strategic Consideration: White-label solutions work well for exchanges focused on specific niches (regional markets, specific asset classes, institutional clients) where custom-built technology isn’t the differentiator. They are less suitable where proprietary technology is the core value proposition.

Order Book vs. Swap vs. DeFi Interfaces: Different Licensing Implications

The type of exchange you operate significantly impacts licensing requirements.

Order Book Exchanges (Full Licensing Required)

Model: Central limit order book matching buyers and sellers with the exchange as intermediary.

Licensing: Full state money transmitter licenses required in all states.

• Exchange takes custody during trades
• Maintains customer account balances
• Facilitates price discovery and matching
• Processes deposits and withdrawals

Examples: Coinbase, Kraken, and Gemini operate broad multi-state licensing footprints.

Regulatory Intensity: Highest---exchanges receive regular examinations and ongoing supervision.

Swap/Instant Exchange (Streamlined MTL Possible)

Model: Fixed-price swaps without order books; the exchange quotes prices and executes immediately.

Licensing: Money transmitter licenses are generally required, though applications may be simpler.

• Still involves custody during swap execution
• No order book or trading pairs
• Single-step transactions
• May have lower transaction volumes

Examples: Instant-exchange services range from non-custodial swap interfaces to custodial instant-exchange operators.

Regulatory Intensity: Moderate---a simpler business model may receive less intensive examination.

DeFi Interfaces (Potentially No Licensing, But Complex)

Model: A user interface to decentralized protocols where users trade directly from their own wallets.

Licensing: Unclear and evolving.

• No custody of customer funds
• Smart contracts execute trades automatically
• The interface provider doesn’t control funds
• May still implicate securities broker-dealer registration depending on the services offered

Examples: Front-end interfaces to protocols such as Uniswap, and platforms transitioning toward fuller decentralization.

Regulatory Intensity: Uncertain---the SEC and CFTC have at times pursued enforcement touching DeFi protocols despite their non-custodial nature, even as the agencies’ broader 2026 posture has shifted toward clarifying federal treatment rather than litigating it.⁷

Critical Warning: Do not assume a DeFi interface exempts you from licensing. Obtain thorough legal analysis. Regulators may apply money transmitter, securities-dealer, or derivatives requirements even to non-custodial arrangements in certain circumstances.

Real-World Examples: How Major Exchanges Structured Licensing

Understanding how established exchanges approached licensing provides practical insight. These are matters of public record, not descriptions of firm representation.

Coinbase: Broad Direct Licensing

Strategy: Comprehensive direct licensing across states from an early stage.

Approach:

• Money transmitter licenses across a broad multi-state footprint
• New York BitLicense obtained (among earlier recipients)
• State trust company charters in multiple states for custody services
• Federal MSB registration with FinCEN

Why This Approach:

• Well-capitalized, with an institutional customer focus requiring broad coverage
• Public-markets ambitions necessitated full regulatory compliance
• Built a large in-house compliance function

Key Insight: Coinbase used direct licensing as a competitive moat and credibility signal to institutional customers.

Kraken: Phased, Strategic State Expansion

Strategy: A phased approach targeting highest-value states first.

Approach:

• Money transmitter licenses across many states, expanded over time
• Geofencing for states not yet licensed
• Obtained a Wyoming Special Purpose Depository Institution (SPDI) charter

Key Insight: Kraken prioritized product development and market traction before broad coverage, adding states as the business case justified the cost.

Gemini: Compliance as a Differentiator

Strategy: Obtained the BitLicense early and used regulatory standing as a brand pillar.

Approach:

• New York BitLicense (among earlier recipients)
• Broad U.S. licensing coverage
• Positioned regulatory compliance as a core differentiator

Key Insight: Gemini treated regulatory compliance as a product differentiator rather than a cost center, justifying a higher licensing investment.

The Partner Bank Alternative: How Smaller Exchanges Avoid Direct Licensing

Many growing exchanges use partner-bank models to access markets without bearing direct licensing costs up front.

Typical Structure:

1. The exchange builds trading technology and user experience
2. The partner bank holds money transmitter licenses across the required states
3. The bank provides:
   • Regulatory coverage (the exchange operates as the bank’s agent)
   • BSA/AML compliance oversight
   • State examination preparation
   • Customer fund custody (segregated accounts)
4. The exchange focuses on product, marketing, and user acquisition

Revenue-Share Economics:

• Volume-based tiers: the revenue-share percentage typically falls as monthly volume rises
• Break-even: direct licensing tends to win on economics once monthly volume is high enough to amortize the upfront cost
• Transition strategy: many exchanges use a partner bank for the first year or two, then move to direct licensing when volume justifies the investment

The arithmetic is straightforward: a partner bank trades a low upfront cost for an ongoing revenue share, while direct licensing trades a high upfront cost for lower marginal cost once licensed. The crossover point is a function of your volume and margin---model it on your own numbers rather than a generic example.

Decision Framework: Build Your Licensing Stack vs. Partner vs. White-Label

Use this decision tree to determine the optimal licensing approach.

Step 1: Assess Financial Capacity

Can you fund a six- to seven-figure direct-licensing build over 12—18 months?

• YES → Continue to Step 2
• NO → Consider a partner-bank or white-label model

Step 2: Evaluate Technical Capabilities

Is proprietary exchange technology your core differentiator?

• YES → Build custom + obtain licenses (direct or partner bank)
• NO → Consider a white-label solution with licensing included

Step 3: Analyze Time Sensitivity

Do you need market access within a few months?

• YES → Partner bank or white-label are the realistic options
• NO → Direct licensing is feasible (a 12—18 month timeline is acceptable)

Step 4: Project Transaction Volume

Expected monthly transaction volume in 18 months:

• Low → Partner bank or white-label (direct licensing costs are hard to justify)
• Moderate → Partner bank with a transition plan to direct licensing
• High → Direct licensing (the economics clearly favor it)

Step 5: Assess Regulatory Expertise

Do you have an experienced compliance team in-house?

• YES → Direct licensing is manageable
• NO → A partner bank provides expertise (or plan to hire a CCO before licensing)

Recommended Strategies by Stage

Early stage:

• White-label or partner-bank model
• Focus on product-market fit, not regulatory infrastructure
• Strategic state selection if pursuing direct licensing (a handful of states)

Growth stage:

• Partner-bank model with a transition plan to direct licensing
• Or strategic state licensing across priority states
• Build the compliance team (hire a Chief Compliance Officer)

Scale stage:

• Broad direct licensing to maximize margin and control
• Transition away from the partner bank over 12—18 months
• Invest in proprietary compliance technology and automation

Your 90-Day Crypto Exchange Licensing Action Plan

Month 1: Research and Planning

Week 1—2: Business Model Clarity

• Define custody model (custodial vs. non-custodial)
• Determine trading mechanics (order book vs. swap vs. liquidity pool)
• Identify cryptocurrency offerings (major assets only vs. altcoins)
• Analyze geographic customer distribution (where are your users?)
• Project transaction volumes by state

Week 3—4: Licensing Strategy Decision

• Complete the decision framework (Steps 1—5 above)
• Model economics: direct licensing vs. partner bank vs. white-label
• Determine state-coverage strategy (broad vs. strategic selection vs. geofencing)
• Engage a licensing attorney for a preliminary consultation
• If considering a partner bank, request proposals from several candidates

Month 2: Documentation and Preparation

Week 5—6: Compliance Program Development

• Draft a comprehensive AML/BSA program tailored to exchange operations
• Integrate a blockchain-analytics provider (Chainalysis, Elliptic, TRM Labs)
• Develop a cybersecurity program addressing custody and wallet security
• Create disaster-recovery and business-continuity plans
• Document custody and safeguarding procedures (hot/cold wallet protocols)

Week 7—8: Application Preparation

• Compile financial statements and business plan
• Develop three-year financial projections with a state-by-state revenue breakdown
• Identify all control persons (10%+ ownership) and begin background checks
• Obtain FBI fingerprint cards for executives and owners
• Engage a surety-bond broker to pre-qualify for required bonds

Month 3: Execution

Week 9: Federal Registration

• File FinCEN MSB registration (FinCEN Form 107)---required before operations
• Enroll the company in NMLS (if pursuing direct state licensing)
• Execute the partner-bank agreement (if applicable)

Week 10—12: State Applications or Partner-Bank Onboarding

If Direct Licensing:

• Submit applications for Tier 1 priority states (California, Texas, Florida, Illinois, New York)
• Begin Form MU1/MU2/MU3 completion in NMLS
• Submit state-specific supplemental applications
• Respond to initial examiner questions (expect requests for additional information)

If Partner Bank:

• Complete partner-bank due diligence and compliance onboarding
• Integrate banking APIs and compliance tools
• Train the team on the bank’s compliance requirements and reporting
• Complete test transactions and user-acceptance testing

If White-Label:

• Finalize the white-label provider agreement
• Complete platform customization and branding
• Integrate KYC/AML and banking services
• Conduct a security audit of the white-label infrastructure

Week 12: Launch Preparation

• Implement geofencing for excluded states (if applicable)
• Finalize customer-facing disclosures (terms of service, privacy policy, risk warnings)
• Conduct internal compliance training for all employees
• Establish transaction monitoring and SAR filing procedures
• Set a launch date (a soft launch to limited users is recommended)

Critical Pre-Launch Requirement

Do not commence operations in any state before:

1. Obtaining the required money transmitter license in that state, OR
2. Executing a partner-bank agreement with coverage in that state, OR
3. Implementing effective geofencing to exclude that state

Penalties for unlicensed operations:

• Cease-and-desist orders
• Civil penalties (commonly $1,000—$100,000 per day depending on the state)
• Criminal charges (particularly for willful violations)
• Lasting difficulty obtaining licenses later (regulators share violation information)
• Reputational damage and loss of customer trust

Ongoing Compliance: What Happens After You Get Licensed

Obtaining licenses is only the beginning. Ongoing compliance requires continuous attention and investment.

Annual Compliance Obligations

State Reporting Requirements:

• Quarterly call reports (transaction volumes, financial condition)
• Annual audited financial statements
• Annual renewal applications and fees
• Updates to business operations or ownership changes
• Notification of material events (cybersecurity incidents, regulatory actions, litigation)

Federal Reporting:

• FinCEN MSB registration renewal (every 2 years)
• Suspicious Activity Reports (SARs) as required
• Currency Transaction Reports (CTRs) for transactions over $10,000
• Travel Rule information retention and transmission
• OFAC sanctions screening and blocking

Examination Preparation:

• State examinations (cadence varies; more frequent for new licensees)
• Document-production requests (transaction samples, customer files, AML investigations)
• On-site examinations (examiners visit premises, interview staff, review systems)
• Follow-up on examination findings and corrective actions

Ongoing Costs: Continuing compliance is a substantial annual line item, spanning renewal fees, examination fees, compliance-staff salaries, external audits, blockchain-analytics tooling, and legal counsel. Size it from current figures for your footprint rather than a generic estimate.

Cryptocurrency Listing Reviews

State examiners scrutinize which cryptocurrencies exchanges list and the due diligence conducted:

Pre-Listing Analysis Required:

• Is the cryptocurrency a security under the Howey test? (If so, securities-dealer registration may be required)
• Does the cryptocurrency facilitate money laundering or sanctions evasion? (Privacy-coin scrutiny)
• What is the market capitalization and liquidity? (Low-cap tokens raise fraud concerns)
• Who controls the cryptocurrency? (Centralization concerns)
• What consumer protections exist? (Volatility and loss risks)

Ongoing Monitoring:

• Regular reviews of listed cryptocurrencies for delisting consideration
• Monitoring for rug pulls, exploits, or regulatory actions
• Updating risk assessments based on market developments

State Enforcement Reality: State regulators have penalized exchanges for listing what they viewed as unregistered securities, demonstrating that cryptocurrency selection carries direct regulatory implications.

Looking Ahead: The Federal Picture in 2026

State-by-state licensing remains the operative framework, but the federal landscape moved meaningfully in 2025—2026. Three developments matter for exchange operators, and it is important to state their effect precisely.

The GENIUS Act: Targeted Preemption for Stablecoin Issuers

The GENIUS Act, signed into law on July 18, 2025, is the first federal framework for payment stablecoins.⁸ For licensing purposes, the key feature is narrow and specific: the Act preempts state money-transmitter licensing for permitted payment stablecoin issuers---federal qualified issuers and insured-depository-institution subsidiaries operating under the federal regime.

Read that carefully, because the scope is easy to overstate:

• The preemption runs to stablecoin issuers that qualify under the federal framework---not to crypto exchanges generally.
• A crypto exchange that transmits value or custodies customer assets still needs state money transmitter licenses. The GENIUS Act does not exempt exchanges from the 49-state framework.
• The practical takeaway: if your business issues a permitted payment stablecoin, the federal path may relieve you of state MTL for that activity; if you run an exchange, plan for state licensing as before.

Market-Structure Legislation: Pending, Not Enacted

The broader effort to build a federal market-structure regime for digital assets advanced but has not become law. The CLARITY Act passed the U.S. House in July 2025 and, as of mid-2026, remained under Senate Banking and Agriculture Committee consideration. It is not enacted, and its eventual scope---particularly any preemption of state licensing for trading platforms---remains to be settled in the legislative process.

• The bill would establish a federal framework for digital-asset trading platforms, allocating oversight between the CFTC (digital commodities) and the SEC (digital-asset securities).
• It could reduce the state-licensing burden if a final federal registration regime preempts state requirements---but that is a forward-looking possibility, not a present rule.
• Plan against today’s law. Do not defer state licensing in anticipation of a bill that has not passed.

A Shifting Regulatory Posture

The SEC and CFTC have moved in 2026 toward clarifying the federal treatment of crypto and away from the enforcement-first posture that defined the prior period. That shift reduces some of the litigation uncertainty that hung over the industry, but it does not change the state-licensing obligations that exist today. The regulatory weather is improving; the requirement to be licensed where you operate has not gone away.

Strategic Consideration: Federal clarity is welcome, but state licensing remains required now. If federal legislation does pass, it would more likely grandfather existing state-licensed exchanges than require re-licensing---so building a compliant state footprint today is the conservative and correct course.

Frequently Asked Questions

Q: Do I need a license in every state to run a crypto exchange?

A: Nearly. Forty-nine states require a money transmitter license to offer crypto exchange services to their residents; Montana is the lone exception, and even there federal FinCEN registration still applies. On top of state licenses, every exchange must register as a Money Services Business with FinCEN, and New York requires a BitLicense in addition to its state money transmitter license.

Q: How much does it cost to get a crypto exchange license?

A: It is a six- to seven-figure undertaking, and full 49-state coverage runs well into seven figures in year one once application fees, surety bonds, net-worth funding, legal work, and compliance build-out are all counted. The figures change frequently and scale with transaction volume, so build a current, regulator-confirmed budget for your specific footprint rather than relying on a fixed number. Partner-bank and white-label alternatives trade a lower upfront cost for an ongoing revenue share or platform fee.

Q: Does the GENIUS Act mean exchanges no longer need state licenses?

A: No. The GENIUS Act (signed July 18, 2025) preempts state money-transmitter licensing only for permitted payment stablecoin issuers---federal qualified issuers and insured-depository-institution subsidiaries. It narrows state licensing for stablecoin issuers specifically. A crypto exchange that transmits value or custodies customer assets still needs state money transmitter licenses.

Q: What is a BitLicense, and is it the only New York requirement?

A: A BitLicense is New York’s virtual-currency business license under 23 NYCRR Part 200, administered by the New York Department of Financial Services, with a $5,000 application fee and demanding custody and cybersecurity requirements. It is generally not the only New York requirement: a crypto firm serving New York residents typically also needs a New York money transmitter license under Banking Law Article 13-B. Plan for both.

Q: How long does it take to get licensed?

A: It varies by state. Faster, crypto-receptive states such as Texas, Georgia, and Florida often process applications in roughly four to eight months; the slowest---New York, California, and New Jersey---can take nine to eighteen months or more. The New York BitLicense can take 12—24 months. Because applications are filed and reviewed state by state, building a broad footprint sequentially typically takes well over a year.

Q: Can I avoid licensing by only offering non-custodial trading?

A: Not necessarily. While non-custodial models may avoid some custody requirements, if you facilitate the transmission of value---even momentarily during atomic swaps---you likely need money transmitter licenses. DeFi interfaces claim to avoid licensing by being “just software,” but regulatory scrutiny persists, and the SEC and CFTC have pursued enforcement touching DeFi arrangements. The safest approach is to assume licensing is required unless you receive written regulatory guidance confirming an exemption.

Q: What happens if I operate an exchange without licenses?

A: The consequences are severe. At the state level: cease-and-desist orders, civil penalties (commonly $1,000—$100,000 per day depending on the state), and license denial for future applications. Federally, operating an unregistered money transmitting business carries a $5,000-per-day civil penalty under 31 U.S.C. § 5330 and criminal exposure of up to five years under 18 U.S.C. § 1960---and the enforcement record is real: OKX pleaded guilty in February 2025 to operating an unlicensed money transmitting business and resolved the matter for approximately $505 million. You generally cannot retroactively cure unlicensed operation; regulators scrutinize applications from companies with a violation history.

Need Help with Crypto Exchange Licensing?

Astraea Counsel advises cryptocurrency exchanges on licensing strategy, state-by-state compliance, BitLicense applications, and partner-bank alternatives. We help exchange operators navigate the complex regulatory landscape while managing costs and accelerating time to market.

We assist with:

• Strategic state selection and cost-benefit analysis
• Money transmitter license applications (direct licensing)
• New York BitLicense and companion money-transmitter-license applications
• California DFAL readiness for the July 1, 2026 effective date
• GENIUS Act analysis for stablecoin issuers
• Partner-bank selection and agreement negotiation
• AML/BSA program development for exchanges
• Custody and cybersecurity policy development
• Ongoing compliance program management
• State examination preparation and response
• Cryptocurrency listing reviews and securities analysis

Schedule a consultation to discuss your exchange licensing strategy.

Related Resources

• State-by-State Crypto Licensing Map: 2026 Requirements Guide---The comprehensive fifty-state-plus-DC licensing matrix this exchange guide builds on
• Money Transmitter Licensing: State-by-State Strategy for Crypto Startups---Comprehensive guide to money transmitter licensing fundamentals
• Qualified Crypto Custodians: Regulatory Requirements and Selection Guide---Federal and state custody-law framework for exchanges and issuers
• FinCEN’s CVC Kiosk Crackdown: What Crypto ATM Operators Need to Know---FinCEN enforcement priorities for crypto MSBs
• Regulatory Compliance Services---Comprehensive compliance guidance for digital asset businesses

---

Footnotes

1. Conference of State Bank Supervisors, “Money Transmitter Regulation / Money Services Businesses,” available at https://www.csbs.org/. ↩

2. Financial Crimes Enforcement Network (FinCEN), “Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies,” FIN-2019-G001 (May 9, 2019); see also FinCEN, “Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies,” FIN-2013-G001 (Mar. 18, 2013), available at https://www.fincen.gov/resources/statutes-regulations/guidance/application-fincens-regulations-persons-administering. ↩

3. 31 CFR § 1022.380 (Money Services Business registration); registration via FinCEN Form 107. ↩

4. Operating an unregistered money transmitting business carries a civil penalty of $5,000 per day under 31 U.S.C. § 5330 and criminal liability of up to five years under 18 U.S.C. § 1960. For enforcement anchors, see FinCEN, “FinCEN Assesses $100 Million Penalty Against BitMEX for Violations of the Bank Secrecy Act” (Aug. 10, 2021), available at https://www.fincen.gov/news/news-releases; and U.S. Department of Justice, U.S. Attorney’s Office, S.D.N.Y., “OKX Pleads Guilty to Operating an Unlicensed Money Transmitting Business” (Feb. 2025) (approximately $505 million total---an $84.4 million fine and $420.3 million forfeiture). ↩

5. New York Department of Financial Services, 23 NYCRR Part 200 (Virtual Currency Regulation); New York Banking Law Art. 13-B (money transmitter licensing), available at https://www.dfs.ny.gov/virtual_currency_businesses. ↩

6. California Financial Code Division 1.25, Digital Financial Assets Law (effective July 1, 2026); California Department of Financial Protection and Innovation, “Digital Financial Assets Law Frequently Asked Questions,” available at https://dfpi.ca.gov/regulated-industries/digital-financial-assets/digital-financial-assets-law-frequently-asked-questions/. ↩

7. On DeFi-related enforcement, see, e.g., CFTC v. Ooki DAO (N.D. Cal. 2023) (CFTC enforcement against a decentralized autonomous organization). Note that SEC v. Wahi (W.D. Wash. 2022) was an insider-trading matter concerning a former Coinbase employee, not a money-transmitter-licensing case, and is not authority for non-custodial licensing treatment. The SEC’s investigation of Uniswap Labs was reportedly closed without enforcement action in 2025. ↩

8. GENIUS Act, Pub. L. No. 119-27 (2025) (federal payment-stablecoin framework; preemption of state money-transmitter licensing for permitted payment stablecoin issuers), available at https://www.congress.gov/. On the market-structure legislation, see the CLARITY Act (passed the U.S. House July 2025; Senate Banking and Agriculture Committee consideration in 2026; not enacted as of June 2026). ↩