Crypto licence requirements by country: India, UAE, EU, US

Crypto licence requirements by country in 2026 turn on four different tests, and the label on your product decides none of them. India registers any provider of five notified VDA activities with FIU-IND, wherever it is based. Dubai licenses eight activities through VARA, with custody in its own legal entity. The EU requires CASP authorisation for ten listed services, and since 1 July 2026 no transitional cover remains for unauthorised firms, non-EU firms included. The US asks one question under FinCEN’s money-transmission test: do you accept and transmit value? India has no crypto licence, only FIU-IND registration; the CLARITY Act is not law as at 6 October 2026; and on our reading a merchant selling its own goods is outside all four tests, though the UAE limits which tokens it may take.

Service Need this handled rather than explained? See the Web3 practice, or book a 30-minute call with the author.

Ten activities, four regimes

An “out” cell carries the condition that keeps it out. The US column covers FinCEN’s federal test only, as at 6 October 2026, re-checked against the bill’s official status record after the Senate failed to invoke cloture on H.R.3633 on 15 September 2026.

Schedule A · Crypto licence or registration matrix by activity: ten activities against four regimes, as at 12 September 2026, with a merchant-acceptance row added 6 October 2026
Activity	India (FIU-IND, PMLA)	UAE (VARA, Dubai outside the DIFC)	EU (MiCA)	US (FinCEN, federal test only)
Exchanging crypto for fiat	Activity (i); register first	Exchange Services	Service (c), exchange for funds; Class 2, EUR 125,000	Exchanger, generally a money transmitter; MSB registration within 180 days
Exchanging one crypto-asset for another	Activity (ii)	Exchange Services	Service (d); Class 2	Exchanger, broking or dealing from own reserves
Running an order-matching trading platform	Activities (i) and (ii) when done for others in business	Exchange Services; no proprietary trading	Service (b), trading platform; Class 3, EUR 150,000	Out only as a forum where parties settle outside it; in where it buys from the seller and sells to the buyer
Custody, hosted wallets, key control	Activity (iv), safekeeping or administration of VDAs or instruments enabling control	Custody Services; distinct legal entity, standalone licence	Service (a), including control of means of access such as private keys; Class 2; not outsourceable to a non-CASP	Hosted wallet providers are account-based money transmitters
Transferring crypto-assets for clients	Activity (iii); Travel Rule data before or at transfer, never post-facto	Transfer and Settlement Services	Service (j); Class 1, EUR 50,000	The definition itself
Broking, order execution and routing	Not a named head; tested under (i) to (iv)	Broker-Dealer Services	Services (e) execution and (g) reception and transmission; Class 1	In where value is accepted and transmitted; out only as a pure forum
Advice and portfolio management	Not a named head; managing client assets is tested under (iv)	Advisory Services; Management and Investment Services	Services (h) advice and (i) portfolio management; Class 1	Outside the definition where no value is accepted and transmitted; securities law is separate
Lending and borrowing	Not a named head; (iii) and (iv) apply if it takes transfer or control of VDAs	Lending and Borrowing Services	Not among the ten Article 3(1)(16) services; custody or transfer alongside it is	Same test
Issuance, placing and market making	Activity (v); issuance, underwriting and market-making services; ICOs “strongly discouraged”	VA Issuance Category 1	Service (f), placing; Class 1	Administrators generally qualify
Non-custodial wallet software and DeFi interfaces	Where one wallet is hosted, the onus sits on the hosting RE; unhosted-wallet transfers draw enhanced due diligence; a smart contract does not relieve its controlling parties	Custody reading risk where the provider holds even one key in the client flow	Out only where fully decentralised with no intermediary; in where persons perform, provide or control it, even in part	Out only where no total independent control and no hosted wallets; a DApp developer is in if it deploys the DApp to transmit value; the Blockchain Regulatory Certainty Act provisions in H.R.3633 are not enacted
Merchant accepting crypto as payment for its own goods or services	Outside the five heads where the merchant takes VDAs only for its own sales, not for or on behalf of another person; a processor that exchanges or transfers VDAs for merchants is inside (i) to (iii)	No VARA activity for taking payment for your own sales; CBUAE Payment Token Services Regulation Article 2(7) limits a UAE merchant to a dirham payment token from a licensed issuer, and a processor that receives, holds or transfers tokens for merchants performs Payment Token Custody and Transfer	Not a CASP where the merchant takes crypto-assets only for its own sales and has no clients (Article 3(1)(15)); a processor that transfers or exchanges for merchants provides service (j), (c) or (d), and related payment services need PSD2 authorisation (Article 70(4))	A seller that only takes CVC for its own sales does not transmit value for others, and the exemptions cover funds moved only as an integral part of a sale; a CVC payment processor is a money transmitter and generally cannot use the payment processor exemption

Sources: S.O. 1072(E) of 7 March 2023 and the FIU-IND guidelines of 8 January 2026; VARA’s licensed-activities page; MiCA Articles 3, 59, 61 and 143, Recital 22 and Annex IV; ESMA statements of 17 April and 23 June 2026; FIN-2019-G001; the Senate substitute of 22 July 2026. Merchant row, read 6 October 2026: CBUAE Payment Token Services Regulation (C 2/2024, rulebook effective from 31 August 2024) Articles 1, 2(7) and 40; MiCA Articles 3(1)(15), 3(1)(16) and 70(4); FIN-2019-G001 sections 2 and 4.6. Where India has no named head, the cell states how the activity is tested against the five heads; that is our reading, not FIU-IND text. The “outside” positions in the merchant row are also our reading; the UAE token limit and the US processor position are regulator text.

The one-sentence answer for each market

India. FIU-IND registration is a mandatory AML pre-requisite for any provider of a notified VDA activity, wherever it is registered: a reporting-entity registration under the PMLA, not a licence or product approval. The perimeter is the notification of 7 March 2023, which adopts the income-tax definition of a virtual digital asset by reference.

UAE. A VARA licence is an activity licence held by a Dubai legal entity; several activities may sit under one licence, except custody, which needs its own entity and standalone licence. VARA covers Dubai outside the DIFC; ADGM, in Abu Dhabi, and the DIFC run their own regimes. Whether a DMCC or IFZA licence is a crypto licence, and what each VARA permission allows, is on crypto licence in Dubai and the UAE. Fees, capital and timelines are in VARA licence cost, capital and timeline; the free-zone choice is in DMCC vs ADGM vs IFZA.

EU. Under Article 59 a person may not provide crypto-asset services in the Union unless authorised as a CASP or, under Article 60, already regulated as a credit institution, investment firm or one of the other listed entities; for a crypto-native business that means CASP authorisation. Since 1 July 2026 a non-EU CASP cannot provide MiCA services to EU clients or solicit them, business-to-business included, outside the narrow Article 61 carve-out. Authorisation means an EU entity with effective management in the Union and an EU-resident director, passported from one member state. Where the MiCA authorisation programme is engaged: Infinilex quarterbacks, EU local counsel files. Choosing between the EU and Dubai is covered in MiCA vs VARA.

US, as at 6 October 2026. FinCEN’s federal AML test governs this column; state money-transmitter licensing and securities and commodities law sit outside it. Accepting value that substitutes for currency from one person and transmitting it to another is money transmission, and a money transmitter registers as an MSB within 180 days. On 15 September 2026 the Senate failed to invoke cloture on the motion to proceed to H.R.3633, so nothing in it is enacted and FinCEN’s 2019 guidance remains the operative federal position. The bill’s official status record, re-checked on 6 October 2026, shows no later action.

There is no VASP licence in India, only FIU-IND registration

India issues no crypto or VASP licence. A business that performs any of the five notified activities for or on behalf of another person in the course of business registers with FIU-IND as a reporting entity under the PMLA; FIU-IND’s guidelines make that registration a mandatory pre-requisite. FIU-IND keeps its list of registered providers private, the Ministry of Finance told the Lok Sabha on 30 March 2026, because a public list “may create the impression that registered entities are licensed, approved, or endorsed by the government”. How many are registered, and who, is in the FIU-IND registered VASP list.

So asking what a VASP licence costs in India gets no licence-fee answer: there is no licence to price. The work sits in the AML/CFT/CPF programme a reporting entity must run. That means written policies and procedures with an independent annual review, a Principal Officer who reports to the board, and a board-approved client acceptance framework. The steps are in FIU-IND registration in India and the documents in the FIU-IND registration checklist.

Sources: S.O. 1072(E) of 7 March 2023; FIU-IND AML and CFT guidelines for reporting entities providing VDA services, updated as on 8 January 2026, paragraphs 2.1(a), 3.3(j), 3.4.3 and 3.5 (the 10 March 2023 edition numbered these topics differently); Lok Sabha Unstarred Question 5805, answered 30 March 2026, answers (a), (c) and (f). Read 6 October 2026.

Accepting crypto as payment for your own sales

A merchant that takes crypto for its own goods or services acts for itself, not for clients, so on our reading it falls outside India’s five heads, MiCA’s ten services and FinCEN’s federal test. The processor it uses is usually inside. FinCEN treats CVC payment processors as money transmitters that generally cannot meet the payment processor exemption, because they do not settle through systems that admit only BSA-regulated financial institutions. Under MiCA a firm that transfers or exchanges crypto-assets for merchants provides a crypto-asset service, and payment services it offers alongside need PSD2 authorisation. In India a processor that exchanges or transfers VDAs for merchants is inside the notified activities.

The UAE is where the rule reaches the merchant itself. Article 2(7) of the Central Bank’s Payment Token Services Regulation says no merchant or other person in the UAE selling goods or services in the course of business may accept a virtual asset towards payment unless it is a dirham payment token from a licensed issuer, or a foreign payment token from a registered issuer used to buy virtual assets. For a Dubai e-commerce business that means no VARA licence for taking payment for its own sales, on our reading, but a limit on which tokens it may take. Article 40 kept Article 2 out of force for one calendar year after commencement and lets the Central Bank extend that period, so confirm the position on the day you switch crypto payments on. A provider that receives, holds or transfers payment tokens for you performs Payment Token Custody and Transfer, which needs a Central Bank licence or registration; the dirham token route is covered in stablecoin issuance.

Custody and wallets: control, not labels

FinCEN’s test is the narrowest: a provider that only creates unhosted wallets requiring a second authorisation key is not a money transmitter because it never accepts and transmits value; hosting wallets, booking value in its own accounts or holding total independent control makes it one, whatever it calls itself. MiCA is broader: custody means safekeeping or controlling crypto-assets or the means of access to them, including private keys, so clearing FinCEN’s unilateral-control test does not clear MiCA’s controlling-means-of-access test. India’s head (iv) reaches instruments enabling control over VDAs. VARA runs custody through its own entity, and holding even one key in a client flow risks a custodial reading. The capital, segregation, cold-storage and insurance terms each custody licence then imposes are compared in crypto custodian licence terms compared, and the key-arrangement question in MPC and smart-contract wallets.

The architecture vocabulary here draws on the joint article with Reah, where Reah contributed the product perspective and Infinilex the legal analysis; neither article assesses any platform’s architecture, including Reah’s, and no cell is co-signed by a vendor. Operating controls are in the self-custody controls checklist. Travel-rule thresholds and the self-hosted wallet duty in all four markets are in the crypto travel rule compared.

The EU perimeter after 1 July 2026

Article 143(3) let firms operating lawfully under national law before 30 December 2024 continue until 1 July 2026 at the latest, or until their authorisation was granted or refused, and member states could shorten that period. ESMA’s 17 April 2026 statement said any entity serving EU clients without a MiCA licence after 1 July 2026 would be in breach of EU law, and its 23 June 2026 statement set out an orderly exit for unauthorised firms. Reverse solicitation is narrow: Article 61 applies only where the EU client acts at its own exclusive initiative, and any promotion in the Union by or for the firm defeats it notwithstanding any contractual disclaimer. Member states differ in capacity and experience, so member-state selection is a real choice; Where the service moves or holds an e-money token such as USDC for clients, a PSD2 payment institution or EMI authorisation sits on top of CASP authorisation since 2 March 2026: stablecoin payments licence in the UK and EU. the MiCA CASP readiness checklist is the pre-application pass. Who is already authorised, by home state, is on the MiCA CASP register by member state, and the Dubai equivalent is the VARA register explained.

The US column: FinCEN money transmission and the CLARITY Act, as at 6 October 2026

Everything in the US column rests on FIN-2019-G001, which by its own words established no new regulatory expectations; FinCEN interprets the exemptions strictly. The pending change is the Digital Asset Market Clarity Act. H.R.3633 passed the House on 17 July 2025, the Senate Banking Committee advanced it 15 to 9 on 14 May 2026, and on 22 July 2026 Senator Lummis released an updated text merging the Banking and Agriculture Committee products. Its Blockchain Regulatory Certainty Act provisions would provide that a non-controlling developer or provider is not treated as a money transmitting business under 31 U.S.C. 5330 or 18 U.S.C. 1960 solely for publishing software, supplying tools for a customer’s own custody, or providing infrastructure support; non-controlling means having neither the legal right nor the unilateral and independent ability to control, initiate or effectuate transactions in users’ assets without a third party’s approval or direction. On 15 September 2026 the Senate vote to invoke cloture on the motion to proceed failed, short of the 60 votes required, so none of this is law. If a version is enacted later, the wallet and DeFi-interface cells would move; this page does not predict whether the bill returns and will be re-checked if it does.

The vote was 49 to 50 (Record Vote No. 234), and Senator Tillis then entered a motion to reconsider it. The bill’s official status record, re-checked on 6 October 2026, lists that motion as the latest action. FIN-2019-G001, re-read the same day, is unchanged. Securities law sits outside this column: the SEC proposed Regulation Crypto Assets in Release No. 33-11434 (File No. S7-2026-27); its comment period closed on 20 October 2026, and it is a proposal, not law. Our position on it is in our SEC comment letter on Regulation Crypto Assets.

Seven questions before you pick a jurisdiction

Which of the ten activities do you perform? List them by function, not product name.
Can any single party, including your platform, move a client’s assets alone? This decides the custody row in every market.
Where are your users? India and the EU reach offshore providers serving their residents.
Do you solicit anywhere you are not authorised? In the EU, promotion of any kind defeats reverse solicitation.
Which capital class and entity shape applies? MiCA classes 1 to 3; VARA’s standalone custody entity.
Which US position are you relying on, and on what date? Record the FinCEN test and the CLARITY Act status on the day you decide.
Obtain a jurisdiction-specific determination. The matrix narrows the question; it does not answer it for your facts. That means Infinilex counsel qualified in that jurisdiction sign each of the India, UAE and US legs: an advocate enrolled in India (or Infinilex’s chartered accountant where a statute names that professional) on the India leg, Infinilex counsel qualified for the relevant UAE regulator on the UAE leg and a US-admitted Infinilex lawyer on the US leg. On the MiCA filing Infinilex scopes the work and builds the fact record, and EU local counsel, named to you before they act, file.

Frequently asked questions

Which crypto activities need a licence in India, the UAE, the EU and the US?

Each regime keeps its own list. India notifies five VDA activities under the PMLA: fiat-to-crypto exchange, crypto-to-crypto exchange, transfer, safekeeping or administration, and financial services around an issuer's offer; providers register with FIU-IND. Dubai's VARA licenses eight activities, from advisory and broker-dealer through custody, exchange, lending, management and transfer to VA issuance. MiCA lists ten crypto-asset services in Article 3(1)(16). The US federal AML test asks one question: does the business accept and transmit value? State money-transmitter licensing and securities and commodities law are separate and not covered here.

Crypto exchange licence: India vs Dubai vs EU, what is the difference?

In India an exchange registers with FIU-IND as a reporting entity under the PMLA, an AML gate that reaches offshore exchanges serving Indian users. In Dubai an exchange needs a VARA Exchange Services licence held by a Dubai legal entity, and licensed VASPs may not trade their own or their group's portfolio. In the EU an exchange needs CASP authorisation from one member state: exchange for funds or other crypto-assets is Class 2 at EUR 125,000 minimum capital, and a trading platform is Class 3 at EUR 150,000 (Annex IV floors, as at September 2026).

Do you need a licence to run a DeFi interface or non-custodial wallet in the UAE, EU, India or US?

It depends on control, not the label. FinCEN keeps a multi-signature provider outside money transmission only where it has no total independent control over value and hosts no wallets; a DApp developer is caught if it deploys the DApp to transmit value. MiCA reaches any service performed, provided or controlled by persons; only a fully decentralised service with no intermediary is outside. India's head (iv) covers instruments enabling control over VDAs, and a smart contract does not relieve its controlling parties. Under VARA's custody rulebook, holding even one key in the client flow risks a custodial reading.

Which countries regulate a crypto business that has no local office?

India and the EU both reach offshore providers serving their residents. FIU-IND's January 2026 guidelines say the obligations are activity-based and apply irrespective of physical presence in India, so any entity engaged in a notified activity must register. Under MiCA Article 59 a crypto-native business may not provide crypto-asset services in the Union without CASP authorisation (Article 60 lets entities already regulated as credit institutions, investment firms and the like provide them), and since 1 July 2026 ESMA says non-EU firms cannot serve or solicit EU clients, business-to-business included, outside the narrow Article 61 reverse-solicitation carve-out. VARA licenses a Dubai legal entity, so a Dubai presence is the entry condition. FinCEN's federal test turns on accepting and transmitting value, not on where the company sits.

Does one crypto licence cover India, the UAE, the EU and the US?

No. Each market runs its own test and the determination must be made separately wherever the service is offered. India's FIU-IND registration is an AML registration under the PMLA that reaches any provider of a notified activity, wherever it is based. A VARA licence is an activity licence held by a Dubai legal entity and covers Dubai outside the DIFC only. MiCA authorisation from one member state passports across the EU, but not beyond it. In the US, FinCEN's money-transmission test applies on the facts, regardless of the label. A licence in one market is evidence of substance in another, never a substitute.

Is there a VASP licence in India, and what does it cost?

There is no VASP or crypto licence in India. A business that performs any of the five notified VDA activities for or on behalf of another person registers with FIU-IND as a reporting entity under the PMLA, which is an anti-money-laundering registration, not a licence. FIU-IND does not publish its list of registered providers, the Ministry of Finance told the Lok Sabha on 30 March 2026, partly so that registration is not mistaken for a licence or government endorsement. With no licence there is no licence fee to price. The cost sits in the AML, KYC and reporting programme a reporting entity must run, including a Principal Officer who reports to the board and a board-approved client acceptance framework.

Do I need a licence to accept crypto payments in my Dubai e-commerce business?

Not a VARA licence, on our reading, because taking crypto as payment for your own goods is not one of VARA's eight licensed activities; the rule that binds the merchant is federal. Article 2(7) of the Central Bank's Payment Token Services Regulation says no merchant or other person in the UAE selling goods or services in the course of business may accept a virtual asset as payment unless it is a dirham payment token from a licensed issuer, or a foreign payment token from a registered issuer used to buy virtual assets. Read literally, that excludes bitcoin or a dollar stablecoin for goods. Article 40 kept Article 2 out of force for one calendar year after commencement and lets the Central Bank extend that period, so confirm the position before you switch crypto payments on. A provider that receives, holds or transfers payment tokens for you performs Payment Token Custody and Transfer, which needs a Central Bank licence or registration. The regulation treats ADGM and the DIFC as third countries, so a merchant there checks that zone's rules as well.

Is the CLARITY Act law yet?

No. H.R.3633, the Digital Asset Market Clarity Act, passed the House 294 to 134 on 17 July 2025. On 15 September 2026 the Senate voted 49 to 50 on cloture on the motion to proceed (Record Vote No. 234), short of the 60 votes required, and Senator Tillis then entered a motion to reconsider that vote. The bill's official status record shows no later action as at 6 October 2026. Until a version is enacted, FinCEN's 2019 guidance, FIN-2019-G001, remains the operative federal money-transmission position, and the bill's Blockchain Regulatory Certainty Act provisions for non-controlling developers have no effect.

Next step

Mapping which licence you need where?

Tell us the activities you perform, where your users are and who can move client assets. We will map the four perimeters against your facts before you commit to an entity or a regulator.

Book a 30-minute call The Web3 practice Not ready for a call? Email two lines

Thirty minutes with Prashant Sharma, the founder, who does the work himself. You leave with next steps either way. Email is read by the founder and answered within one working day.

Crypto licence requirements by country in 2026: India, the UAE, the EU and the US, ten activities compared