Meet Dr. Marcus Hartmann
Dr. Marcus Hartmann has spent over two decades at the intersection of financial law and emerging technology. Based in Zug — Switzerland's Crypto Valley — he has guided startups, trading platforms, and institutional investors through the full spectrum of VASP licensing: from FINMA FinTech notifications to MiCA CASP applications and offshore structuring across 60+ jurisdictions.
He joined CryptoLicenses.net as Senior Licensing Advisor after a decade leading the fintech practice of a Swiss-regulated law firm, where he managed regulatory mandates in the UAE, Singapore, Liechtenstein, and the Cayman Islands.
- A crypto broker is an intermediary that executes cryptocurrency trades on behalf of clients — distinct from an exchange that matches buyers and sellers directly
- Brokers holding client funds or providing investment advice require a VASP or CASP license in most jurisdictions
- Capital requirements range from €50,000 to €150,000 depending on jurisdiction and license scope
- Best jurisdictions for 2026: Estonia (VASP), Gibraltar (DLT), Cyprus (CySEC CASP), Seychelles (offshore), and EU MiCA (CASP with 27-country passporting)
- Timeline ranges from 1 month (offshore) to 12 months (full MiCA CASP), with costs from €5,000 to €150,000+
- MiCA CASP authorization is now the gold standard for EU brokers — passporting eliminates the need for separate national licenses
What is a Crypto Broker?
A crypto broker is a regulated financial intermediary that buys and sells cryptocurrency assets on behalf of clients, typically at a quoted price or a spread above market rates. Unlike a crypto exchange — which operates an order book matching buyers and sellers directly — a broker acts as a principal counterparty, sourcing liquidity from exchanges, OTC desks, or market makers and filling client orders itself.
Broker vs. Exchange vs. OTC Desk
The regulatory distinction matters significantly. An exchange provides a platform where clients trade with each other; the exchange earns fees. A broker executes trades for clients and earns a spread or commission. An OTC desk handles large block trades directly, typically for institutional clients or high-net-worth individuals, often with customized pricing and settlement terms.
In practice, the lines can blur. A platform that quotes prices for immediate execution (like a buy/sell service rather than an order book) is typically classified as a broker. If your platform holds client assets between trades, routes client orders to external venues, or provides portfolio management services using crypto, you are almost certainly operating as a broker rather than a pure exchange.
How Crypto Brokers Operate
Most retail crypto brokers source liquidity from one or more upstream venues — major exchanges, prime brokers, or aggregators — and offer clients a simplified interface with fixed or semi-fixed pricing. They may custody client assets themselves or use a licensed third-party custodian. Revenue comes from the bid-ask spread, transaction fees, or both. Some brokers also offer margin or leverage, which triggers additional regulatory requirements in most jurisdictions.
Do You Need a License?
The trigger for licensing depends on what your business actually does. In 2026, the regulatory frameworks across the EU, UK, UAE, and most major markets explicitly cover broker-type activities. If any of the following apply to your model, licensing is not optional — it is a legal requirement.
Offshore is not a solution for EU/UK clients: Operating through a Seychelles or Marshall Islands entity while serving EU or UK clients remains illegal under those clients' home jurisdiction rules. Geo-blocking is required if you are not licensed to serve those markets.
"The most common mistake I see crypto brokers make in 2026 is choosing their jurisdiction before they have clearly defined their business model. A broker planning to serve retail EU clients with a simple buy/sell interface has completely different licensing needs than one offering margin products to institutional clients across MENA and Asia. Get the business model documentation right first — the jurisdiction choice follows naturally from that."
— Dr. Marcus Hartmann, Senior Licensing Advisor
Best Jurisdictions for Crypto Broker License
The right jurisdiction depends on your target market, capital position, and how quickly you need to go live. Below is a comparison of the six most-used frameworks for crypto brokers in 2026, covering license type, minimum capital, timeline, and key considerations.
| Jurisdiction | License Type | Min. Capital | Timeline | Key Feature |
|---|---|---|---|---|
| 🇪🇪 Estonia | VASP (FIU) | €10,000–20,000 | 2–3 months | EU-based, cost-effective entry point |
| 🇬🇮 Gibraltar | DLT License (GFSC) | €50,000 | 6–9 months | Robust framework, English common law |
| 🇨🇾 Cyprus | CySEC CASP | €125,000 | 6–12 months | EU MiCA transition path, CySEC credibility |
| 🇪🇺 EU MiCA | CASP Authorization | €125,000 | 3–6 months | 27-country EU passport, highest credibility |
| 🇸🇨 Seychelles | Offshore FSA | ~€5,000 | 1–2 months | Fastest and cheapest, limited banking access |
| 🇦🇪 UAE (VARA) | VARA Broker License | $50,000+ | 6–12 months | MENA market access, premium credibility |
Which Jurisdiction is Right for You?
For EU-focused brokers, MiCA CASP authorization is the definitive long-term solution — one license covers all 27 member states, and the regulatory framework is now mature and well-understood. Cyprus CySEC offers a faster entry point with a clear MiCA transition pathway.
For brokers targeting global clients or wanting a faster launch, Estonia remains a viable EU-compliant option at significantly lower cost. Gibraltar is preferred by brokers who value a common-law environment with a strong regulatory reputation and no EU overhead.
Seychelles and similar offshore jurisdictions are suitable only for non-EU, non-UK client bases. They provide little credibility with institutional counterparties or banking partners and should be treated as a temporary or supplementary structure, not a primary license.
Crypto Broker Licensing Requirements
While specific requirements vary by jurisdiction, the following checklist covers what virtually every regulated broker license requires. Gaps in any of these areas will delay or derail your application.
- Incorporated legal entity in the target jurisdiction (Ltd, LLC, or local equivalent) with appropriate corporate structure
- Local director or equivalent substance in the jurisdiction — nominee-only structures are increasingly rejected by regulators
- Qualified AML Compliance Officer (MLRO) with demonstrable crypto or financial services experience, approved by the regulator
- Comprehensive AML/KYC program: written policies, procedures, risk appetite statement, and a transaction monitoring system
- Minimum capital requirement met and evidenced — paid-up share capital, not a loan or credit line
- IT infrastructure documentation: trading platform, order management, custody solution, and cybersecurity framework
- Professional indemnity insurance (required in Gibraltar, Cyprus, MiCA — amounts vary by jurisdiction)
- Detailed business plan covering target market, revenue model, risk management, governance, and 3-year financial projections
- KYC documentation for all directors, senior management, and ultimate beneficial owners (UBOs) — certified copies, source of wealth, clean criminal records
- Client agreements, terms of service, best execution policy, and conflicts of interest disclosure
Common rejection trigger: Generic or template AML documentation is the number-one cause of application rejection and delay across all jurisdictions. Regulators can identify off-the-shelf AML policies instantly. Your AML program must be specifically tailored to your business model, client base, and risk profile.
Not sure which licence fits your business? Get a free 30-minute consultation with our advisors. We'll review your model and recommend the right jurisdiction.
Get Free Consultation →Steps to Get Your Broker License
Getting a crypto broker license is a structured process. Rushing any step — particularly AML documentation and capital preparation — leads to delays. The following seven steps apply across all major jurisdictions, with jurisdiction-specific variations noted.
Before any incorporation or legal work, finalize the jurisdiction based on your target market, capital available, and desired timeline. If you plan to serve EU clients, MiCA CASP (via Cyprus, Lithuania, or another NCA) is the right long-term path. If you need speed and low cost, Estonia VASP or Seychelles FSA can bridge the gap while you build toward MiCA authorization.
Confirm that the chosen license actually covers your intended business activities — for example, if you plan to offer leverage or margin products, verify that the broker license in your chosen jurisdiction covers this, or whether a separate derivative dealer license is required.
Register the company in the target jurisdiction with the correct share structure, articles of association, and registered office. Appoint directors who meet the jurisdiction's "fit and proper" criteria — usually requiring relevant financial services experience, clean criminal records, and (for senior roles) regulator pre-approval.
For MiCA CASP applications, the entity must have its registered office and effective place of management within the EU. Gibraltar requires a physical office; Cyprus CySEC requires genuine local substance, not just a registered address.
Draft a complete AML/KYC policy suite: AML policy, customer due diligence (CDD) procedures, enhanced due diligence (EDD) procedures for high-risk clients, transaction monitoring policy, record-keeping policy, sanctions screening procedure, and Travel Rule compliance procedure.
Appoint and train your MLRO (Money Laundering Reporting Officer). The MLRO must have demonstrable compliance experience — not just a job title. In Cyprus, Gibraltar, and most MiCA NCAs, the MLRO appointment must be approved by the regulator before the license is granted. Build this into your timeline: regulator review of MLRO candidates can take 4–8 weeks.
Ensure the required minimum capital is fully paid up and evidenced by bank statements showing clear source of funds. This is not a reserve — it must be genuinely available in the company account. Many applications stall because capital is not ready at the time of filing.
Simultaneously, open a corporate bank account or secure a crypto-friendly banking partner. For EU-based entities, this is often the hardest practical step — many traditional banks remain reluctant to bank crypto businesses, even licensed ones. Fintech-friendly banks and EMIs (electronic money institutions) are often the most practical solution. Start banking conversations before you file for the license, not after.
Compile all required documentation: completed application forms, corporate documents, KYC packages for all directors and UBOs, business plan, AML policy suite, financial projections, IT documentation, and client-facing agreements (terms, best execution policy, conflicts of interest disclosure).
For MiCA CASP applications, the business plan is typically 40–80 pages covering governance structure, risk management framework, technology architecture, and regulatory compliance program. Do not underestimate this — the quality and specificity of your business plan is a primary signal to the regulator of your operational readiness.
File the complete application with the relevant regulator. Most regulators acknowledge receipt within 5–10 business days and may issue a completeness check before formally starting the review clock. Respond to all information requests (RFIs) promptly and completely — partial responses typically reset the review clock.
Maintain close communication with your local legal representative throughout the review period. Do not make material changes to your ownership structure or business model without notifying the regulator. In Cyprus and Gibraltar, in-person meetings with regulators are standard practice during broker license reviews.
Once the license is granted, activate your compliance infrastructure before onboarding any clients. This means transaction monitoring systems are live, KYC workflows are operational, MLRO is in post and active, and your reporting schedule to the regulator is calendared.
Notify the regulator when you begin operations — many jurisdictions require formal notification of operational commencement. Ensure your website and client-facing materials include required disclosures: license number, regulator name, risk warnings, and complaints procedure. Operating without these disclosures is a compliance failure even with a valid license.
Capital Requirements by Jurisdiction
Capital requirements for crypto broker licenses vary significantly by jurisdiction and by the scope of activities covered. The following table shows minimum paid-up capital requirements as of 2026. Note that capital must remain in the entity — it is not an operating cost, though it is locked up during the license period.
| Jurisdiction | License | Min. Capital | Ongoing Capital Rule | Notes |
|---|---|---|---|---|
| 🇸🇨 Seychelles | FSA Offshore | ~€5,000 | None specified | Minimal credibility; offshore only |
| 🇪🇪 Estonia | VASP (FIU) | €10,000–20,000 | None specified | Low barrier; MiCA transition pending |
| 🇬🇮 Gibraltar | DLT License | €50,000 | Risk-based ongoing assessment | Additional operational capital expected |
| 🇦🇪 UAE (VARA) | VARA Broker | $50,000+ | Activity-dependent; can scale to $1M+ | Security deposit also required |
| 🇨🇾 Cyprus CySEC | CASP | €125,000 | Must maintain at all times | EU MiCA aligned; CIF also available |
| 🇪🇺 EU MiCA | CASP (Class 3) | €125,000 | Quarter-of-fixed-overhead rule applies | 27-country passport; gold standard |
Capital is not a cost: Minimum capital requirements represent funds that must be held in the entity — they are not consumed or paid to the regulator. However, they must be genuinely available and maintained throughout the license period. Dropping below minimum capital thresholds must be reported to the regulator immediately.
Technology Requirements
Technology documentation is a mandatory component of all serious crypto broker license applications. Regulators want to understand how your trading infrastructure operates, how client assets are protected, and how your systems detect and prevent market abuse and money laundering. Below are the four core technology areas every broker must address.
Order Management System (OMS)
Your OMS must be able to record all client orders with timestamps, routing decisions, execution venues, prices achieved, and any deviations from stated policy. Under MiCA and Gibraltar DLT requirements, you must be able to demonstrate — with data — that client orders were handled correctly and in clients' best interests. Off-the-shelf white-label trading platforms should be assessed for whether they produce sufficient audit trail data to satisfy regulatory requirements.
Best Execution Framework
MiCA CASP authorization and most EU-equivalent broker licenses require a documented best execution policy — a written commitment to execute client orders on terms most favorable to the client, considering price, speed, likelihood of execution, and cost. You must monitor and review best execution outcomes at least annually, and disclose your policy to clients. This requires aggregating execution quality data across all venues used.
Trade Reporting
Depending on jurisdiction, crypto brokers may be required to report trade data to regulators in near real-time or at defined intervals. MiCA introduces transaction reporting obligations for CASPs, aligned with MiFIR reporting concepts but adapted for crypto assets. Your systems must be capable of generating compliant reports in the required format — this should be tested before going live, not after your first regulatory review.
Custody Separation
All major broker license frameworks require the segregation of client assets from company assets. Client crypto holdings must be held in clearly identifiable client accounts or wallets, not commingled with the broker's own funds. This applies whether you custody assets in-house or through a third-party custodian. A written custody policy and demonstrated technical implementation of segregation are required documentation in most applications.
"MiCA has fundamentally changed the competitive calculus for EU crypto brokers. A single CASP authorization from CySEC or AMF now passports across all 27 member states — which means a broker that invests in proper MiCA authorization today has a structural advantage over competitors holding multiple national registrations. The ongoing compliance cost of MiCA is real, but it is offset by not having to maintain parallel compliance programs in each market."
— Dr. Marcus Hartmann, Senior Licensing Advisor
Ongoing Compliance After Licensing
A crypto broker license is not a one-time approval — it is an ongoing permission that depends on continuous compliance with regulatory obligations. Regulators are increasingly active in supervising licensed entities, and the industry is seeing a significant rise in post-licensing enforcement actions in 2026.
- Annual audited financial statements submitted to the regulator within the required filing period (typically 3–6 months after financial year-end)
- Ongoing capital monitoring — minimum capital adequacy must be maintained at all times and breaches reported within 24–72 hours depending on jurisdiction
- Independent AML audit by a qualified third party — annually in most jurisdictions, bi-annually in some. Results must be made available to the regulator on request
- Transaction monitoring: all transactions above threshold amounts screened against sanctions lists; suspicious transaction reports (STRs/SARs) filed with the FIU within the required timeframe
- Travel Rule compliance for all applicable virtual asset transfers — both outgoing and incoming, with counterparty VASP verification
- Regulatory notifications for material changes: changes in ownership (UBOs), key management changes, new business lines, new markets, technology infrastructure changes
- License renewal where applicable — Estonia VASP requires periodic renewal; MiCA CASP authorization is indefinite subject to ongoing compliance
- Annual review and update of AML/KYC policies to reflect regulatory changes — FATF guidance updates, new ESMA guidelines under MiCA, national FIU directives
MiCA-Specific Ongoing Obligations
For brokers holding a MiCA CASP authorization, additional ongoing requirements apply: client asset safeguarding quarterly reconciliation, conflicts of interest register maintenance, market abuse monitoring and reporting to the relevant NCA, complaint handling with mandatory reporting statistics, and annual review of the best execution policy with public disclosure of the results.
Build compliance costs into your financial projections from day one. For a mid-sized crypto broker operating under MiCA, realistic ongoing compliance costs — MLRO, external AML audit, legal advisory, regulatory reporting, and technology — typically run €50,000–€150,000 per year, excluding capital.