Crypto licence requirements by country in 2026: India, the UAE, the EU and the US, ten activities compared
Crypto licence requirements by country in 2026 turn on four different tests. India registers any provider of five notified VDA activities with FIU-IND, wherever it is based. Dubai licenses eight activities through VARA, with custody in its own legal entity. The EU requires CASP authorisation for ten listed services, and since 1 July 2026 no transitional cover remains for unauthorised firms, non-EU firms included. The US asks one question under FinCEN’s money-transmission test: do you accept and transmit value? The label on your product decides none of it.
Ten activities, four regimes
An “out” cell carries the condition that keeps it out. The US column covers FinCEN’s federal test only, as at 16 September 2026, the day after the Senate failed to invoke cloture on H.R.3633.
| Activity | India (FIU-IND, PMLA) | UAE (VARA, Dubai outside the DIFC) | EU (MiCA) | US (FinCEN, federal test only) |
|---|---|---|---|---|
| Exchanging crypto for fiat | Activity (i); register first | Exchange Services | Service (c), exchange for funds; Class 2, EUR 125,000 | Exchanger, generally a money transmitter; MSB registration within 180 days |
| Exchanging one crypto-asset for another | Activity (ii) | Exchange Services | Service (d); Class 2 | Exchanger, broking or dealing from own reserves |
| Running an order-matching trading platform | Activities (i) and (ii) when done for others in business | Exchange Services; no proprietary trading | Service (b), trading platform; Class 3, EUR 150,000 | Out only as a forum where parties settle outside it; in where it buys from the seller and sells to the buyer |
| Custody, hosted wallets, key control | Activity (iv), safekeeping or administration of VDAs or instruments enabling control | Custody Services; distinct legal entity, standalone licence | Service (a), including control of means of access such as private keys; Class 2; not outsourceable to a non-CASP | Hosted wallet providers are account-based money transmitters |
| Transferring crypto-assets for clients | Activity (iii); Travel Rule data before or at transfer, never post-facto | Transfer and Settlement Services | Service (j); Class 1, EUR 50,000 | The definition itself |
| Broking, order execution and routing | Not a named head; tested under (i) to (iv) | Broker-Dealer Services | Services (e) execution and (g) reception and transmission; Class 1 | In where value is accepted and transmitted; out only as a pure forum |
| Advice and portfolio management | Not a named head; managing client assets is tested under (iv) | Advisory Services; Management and Investment Services | Services (h) advice and (i) portfolio management; Class 1 | Outside the definition where no value is accepted and transmitted; securities law is separate |
| Lending and borrowing | Not a named head; (iii) and (iv) apply if it takes transfer or control of VDAs | Lending and Borrowing Services | Not among the ten Article 3(1)(16) services; custody or transfer alongside it is | Same test |
| Issuance, placing and market making | Activity (v); issuance, underwriting and market-making services; ICOs “strongly discouraged” | VA Issuance Category 1 | Service (f), placing; Class 1 | Administrators generally qualify |
| Non-custodial wallet software and DeFi interfaces | Where one wallet is hosted, the onus sits on the hosting RE; unhosted-wallet transfers draw enhanced due diligence; a smart contract does not relieve its controlling parties | Custody reading risk where the provider holds even one key in the client flow | Out only where fully decentralised with no intermediary; in where persons perform, provide or control it, even in part | Out only where no total independent control and no hosted wallets; a DApp developer is in if it deploys the DApp to transmit value; the Blockchain Regulatory Certainty Act provisions in H.R.3633 are not enacted |
Sources: S.O. 1072(E) of 7 March 2023 and the FIU-IND guidelines of 8 January 2026; VARA’s licensed-activities page; MiCA Articles 3, 59, 61 and 143, Recital 22 and Annex IV; ESMA statements of 17 April and 23 June 2026; FIN-2019-G001; the Senate substitute of 22 July 2026. Where India has no named head, the cell states how the activity is tested against the five heads; that is our reading, not FIU-IND text.
The one-sentence answer for each market
India. FIU-IND registration is a mandatory AML pre-requisite for any provider of a notified VDA activity, wherever it is registered: a reporting-entity registration under the PMLA, not a licence or product approval. The perimeter is the notification of 7 March 2023, which adopts the income-tax definition of a virtual digital asset by reference.
UAE. A VARA licence is an activity licence held by a Dubai legal entity; several activities may sit under one licence, except custody, which needs its own entity and standalone licence. VARA covers Dubai outside the DIFC; ADGM, in Abu Dhabi, and the DIFC run their own regimes. Fees, capital and timelines are in VARA licence cost, capital and timeline; the free-zone choice is in DMCC vs ADGM vs IFZA.
EU. Under Article 59 a person may not provide crypto-asset services in the Union unless authorised as a CASP or, under Article 60, already regulated as a credit institution, investment firm or one of the other listed entities; for a crypto-native business that means CASP authorisation. Since 1 July 2026 a non-EU CASP cannot provide MiCA services to EU clients or solicit them, business-to-business included, outside the narrow Article 61 carve-out. Authorisation means an EU entity with effective management in the Union and an EU-resident director, passported from one member state. Where the MiCA authorisation programme is engaged: Infinilex quarterbacks, EU local counsel files. Choosing between the EU and Dubai is covered in MiCA vs VARA.
US, as at 16 September 2026. FinCEN’s federal AML test governs this column; state money-transmitter licensing and securities and commodities law sit outside it. Accepting value that substitutes for currency from one person and transmitting it to another is money transmission, and a money transmitter registers as an MSB within 180 days. On 15 September 2026 the Senate failed to invoke cloture on the motion to proceed to H.R.3633, so nothing in it is enacted and FinCEN’s 2019 guidance remains the operative federal position.
Custody and wallets: control, not labels
FinCEN’s test is the narrowest: a provider that only creates unhosted wallets requiring a second authorisation key is not a money transmitter because it never accepts and transmits value; hosting wallets, booking value in its own accounts or holding total independent control makes it one, whatever it calls itself. MiCA is broader: custody means safekeeping or controlling crypto-assets or the means of access to them, including private keys, so clearing FinCEN’s unilateral-control test does not clear MiCA’s controlling-means-of-access test. India’s head (iv) reaches instruments enabling control over VDAs. VARA runs custody through its own entity, and holding even one key in a client flow risks a custodial reading.
The architecture vocabulary here draws on the joint article with Reah, where Reah contributed the product perspective and Infinilex the legal analysis; neither article assesses any platform’s architecture, including Reah’s, and no cell is co-signed by a vendor. Operating controls are in the self-custody controls checklist.
The EU perimeter after 1 July 2026
Article 143(3) let firms operating lawfully under national law before 30 December 2024 continue until 1 July 2026 at the latest, or until their authorisation was granted or refused, and member states could shorten that period. ESMA’s 17 April 2026 statement said any entity serving EU clients without a MiCA licence after 1 July 2026 would be in breach of EU law, and its 23 June 2026 statement set out an orderly exit for unauthorised firms. Reverse solicitation is narrow: Article 61 applies only where the EU client acts at its own exclusive initiative, and any promotion in the Union by or for the firm defeats it notwithstanding any contractual disclaimer. Member states differ in capacity and experience, so member-state selection is a real choice; the MiCA CASP readiness checklist is the pre-application pass.
The US column: FinCEN money transmission and the CLARITY Act, as at 16 September 2026
Everything in the US column rests on FIN-2019-G001, which by its own words established no new regulatory expectations; FinCEN interprets the exemptions strictly. The pending change is the Digital Asset Market Clarity Act. H.R.3633 passed the House on 17 July 2025, the Senate Banking Committee advanced it 15 to 9 on 14 May 2026, and on 22 July 2026 Senator Lummis released an updated text merging the Banking and Agriculture Committee products. Its Blockchain Regulatory Certainty Act provisions would provide that a non-controlling developer or provider is not treated as a money transmitting business under 31 U.S.C. 5330 or 18 U.S.C. 1960 solely for publishing software, supplying tools for a customer’s own custody, or providing infrastructure support; non-controlling means having neither the legal right nor the unilateral and independent ability to control, initiate or effectuate transactions in users’ assets without a third party’s approval or direction. On 15 September 2026 the Senate vote to invoke cloture on the motion to proceed failed, short of the 60 votes required, so none of this is law. If a version is enacted later, the wallet and DeFi-interface cells would move; this page does not predict whether the bill returns and will be re-checked if it does.
Seven questions before you pick a jurisdiction
- Which of the ten activities do you perform? List them by function, not product name.
- Can any single party, including your platform, move a client’s assets alone? This decides the custody row in every market.
- Where are your users? India and the EU reach offshore providers serving their residents.
- Do you solicit anywhere you are not authorised? In the EU, promotion of any kind defeats reverse solicitation.
- Which capital class and entity shape applies? MiCA classes 1 to 3; VARA’s standalone custody entity.
- Which US position are you relying on, and on what date? Record the FinCEN test and the CLARITY Act status on the day you decide.
- Obtain a jurisdiction-specific determination. The matrix narrows the question; it does not answer it for your facts. That means an Indian advocate or chartered accountant on the India leg, ADGM- or DIFC-registered counsel on the UAE leg, EU local counsel on the MiCA filing and US securities counsel on the US leg, with Infinilex coordinating.
Frequently asked questions
Which crypto activities need a licence in India, the UAE, the EU and the US?
Each regime keeps its own list. India notifies five VDA activities under the PMLA: fiat-to-crypto exchange, crypto-to-crypto exchange, transfer, safekeeping or administration, and financial services around an issuer's offer; providers register with FIU-IND. Dubai's VARA licenses eight activities, from advisory and broker-dealer through custody, exchange, lending, management and transfer to VA issuance. MiCA lists ten crypto-asset services in Article 3(1)(16). The US federal AML test asks one question: does the business accept and transmit value? State money-transmitter licensing and securities and commodities law are separate and not covered here.
Crypto exchange licence: India vs Dubai vs EU, what is the difference?
In India an exchange registers with FIU-IND as a reporting entity under the PMLA, an AML gate that reaches offshore exchanges serving Indian users. In Dubai an exchange needs a VARA Exchange Services licence held by a Dubai legal entity, and licensed VASPs may not trade their own or their group's portfolio. In the EU an exchange needs CASP authorisation from one member state: exchange for funds or other crypto-assets is Class 2 at EUR 125,000 minimum capital, and a trading platform is Class 3 at EUR 150,000 (Annex IV floors, as at September 2026).
Do you need a licence to run a DeFi interface or non-custodial wallet in the UAE, EU, India or US?
It depends on control, not the label. FinCEN keeps a multi-signature provider outside money transmission only where it has no total independent control over value and hosts no wallets; a DApp developer is caught if it deploys the DApp to transmit value. MiCA reaches any service performed, provided or controlled by persons; only a fully decentralised service with no intermediary is outside. India's head (iv) covers instruments enabling control over VDAs, and a smart contract does not relieve its controlling parties. Under VARA's custody rulebook, holding even one key in the client flow risks a custodial reading.
Which countries regulate a crypto business that has no local office?
India and the EU both reach offshore providers serving their residents. FIU-IND's January 2026 guidelines say the obligations are activity-based and apply irrespective of physical presence in India, so any entity engaged in a notified activity must register. Under MiCA Article 59 a crypto-native business may not provide crypto-asset services in the Union without CASP authorisation (Article 60 lets entities already regulated as credit institutions, investment firms and the like provide them), and since 1 July 2026 ESMA says non-EU firms cannot serve or solicit EU clients, business-to-business included, outside the narrow Article 61 reverse-solicitation carve-out. VARA licenses a Dubai legal entity, so a Dubai presence is the entry condition. FinCEN's federal test turns on accepting and transmitting value, not on where the company sits.
Does one crypto licence cover India, the UAE, the EU and the US?
No. Each market runs its own test and the determination must be made separately wherever the service is offered. India's FIU-IND registration is an AML registration under the PMLA that reaches any provider of a notified activity, wherever it is based. A VARA licence is an activity licence held by a Dubai legal entity and covers Dubai outside the DIFC only. MiCA authorisation from one member state passports across the EU, but not beyond it. In the US, FinCEN's money-transmission test applies on the facts, regardless of the label. A licence in one market is evidence of substance in another, never a substitute.
Mapping which licence you need where?
Tell us the activities you perform, where your users are and who can move client assets. We will map the four perimeters against your facts before you commit to an entity or a regulator.
Further reading
VARA licensing · FIU-IND registration · MiCA authorisation · Non-custodial wallets and custody licensing, with Reah · VARA licence cost, capital and timeline · The self-custody compliance controls checklist
This article is general information for founders, not legal advice on your specific activities, entity or structure. The determination must be made separately in each market where a service is offered. Capital figures are stated as at 12 September 2026 and the status of H.R.3633 as at 16 September 2026; the US column will be re-checked if the bill returns. Have the position reviewed before you rely on any of the above.