Which US crypto licences you need: FinCEN, states, NYDFS

There is no US crypto licence. A crypto business meets three layers, each tested on what it does, not on what it calls itself. Federal: FinCEN registration as a money services business, Form 107 within 180 days of starting, owed by anyone who accepts and transmits value and does business wholly or in substantial part in the United States, wherever the company sits; it is a registration, never a licence. State: a money transmitter licence in each licensing state whose residents you serve, through NMLS where the state uses it. New York: the BitLicense or a limited purpose trust company charter, on top of both. Beside them sit the SEC and CFTC line for securities and derivatives, and the GENIUS Act for payment stablecoin issuers, in force by 18 January 2027 at the latest.

FinCEN and New York need none of this if your software never takes value or keys, if you hold only for your own account, or if you sell your own goods for crypto; the states answer under their own statutes, verify each. Selling coins from your own inventory, kiosks included, is an exchanger: FinCEN registration and, in New York, a BitLicense, with the states tested one by one. An Indian or UAE company obtains them in this order: the outbound leg at home, the US entity, the EIN and bank account, the BSA programme, Form 107, the states, then New York. Every position below is as at 7 November 2026.

Service Need this handled rather than explained? See the crypto AML programme, or book a 30-minute call with the author.

This page covers the US only

The four-regime comparison, with the FinCEN test applied activity by activity, is on crypto licence requirements by country; the UAE answer is on crypto licence in Dubai and the UAE; the EU answer is on crypto licence in Europe; the UK and EU payments answer is on stablecoin payments licence in the UK and EU. This page takes the US whole: the three layers, when none applies, and the order for a foreign-founded entrant.

Three layers, not one licence

“Yes” means the layer applies on the activity alone; “depends” carries the condition. Where another page owns the reasoning, the cell links it.

Schedule A · US crypto licence requirements by activity, as at 7 November 2026
Activity	FinCEN registration	State money transmitter licence	New York (23 NYCRR 200)	SEC, CFTC or GENIUS line
Fiat-to-crypto exchange	Yes. An exchanger is a money transmitter, brokering or dealing from its own reserves (FIN-2019-G001, 9 May 2019). Form 107 within 180 days; renew every two years.	Yes, in each licensing state you serve, through NMLS where the state uses it.	BitLicense: buying and selling, exchange services. Or a trust charter.	Outside unless a listed asset is a security; a person regulated by the SEC or CFTC is not an MSB.
Crypto-to-crypto exchange	Yes. The exchanger rule covers CVC for CVC.	Depends: only where the statute reaches virtual currency; verify each.	BitLicense: exchange services.	SEC and CFTC staff, 2 September 2025: current law does not prohibit registered exchanges from facilitating trading of certain spot crypto products.
Hosted wallet or custody	Yes. Hosted wallet providers are account-based money transmitters (section 4.2.1; custody licensing page).	Depends on whether the statute reaches holding virtual currency for others; verify.	BitLicense: custody or control for others. A trust company adds fiduciary powers.	Security tokens raise custody questions owned by the token legal opinion pages.
Payment processing or stablecoin on and off ramp	Yes, generally; the processor exclusion is narrow (by-country page, processor row).	Yes in most licensing states.	BitLicense: receiving for transmission or transmitting.	From 18 July 2028 a digital asset service provider may not offer or sell a payment stablecoin to US persons unless a permitted issuer issued it, subject to the Act’s exceptions (GENIUS section 3(b)(1)).
Kiosk or ATM	Yes. The owner-operator is a money transmitter both ways (section 4.3); own inventory does not take it out.	Yes in most licensing states; kiosk rules vary, verify each.	BitLicense: buying and selling as a customer business.	None unless the asset is a security.
Payment stablecoin issuance	Depends. Under GENIUS a permitted issuer becomes a BSA financial institution; the FinCEN and OFAC rule was proposed 10 April 2026 and no final rule was found on 7 November 2026.	State qualified issuer route, or the state transmitter statute.	BitLicense: controlling, administering or issuing; or a trust charter (Circle Internet Trust Company, LLC, July 2026 in the NYDFS table).	Only a permitted payment stablecoin issuer formed in the US may issue once the Act is in effect (sections 2(23), 3(a)); where to issue a stablecoin.
Software-only or non-custodial wallet	No, where it never accepts and transmits value: software for a transmitter is excluded and building a DApp is not transmission (31 CFR 1010.100(ff)(5)(ii)(A); FIN-2019-G001 section 5.2.2; custody licensing page).	Generally outside; verify each definition.	Exempt: software development as a purely technical service.	None unless it distributes a token offering.
Token sale or broker	Depends on whether value is accepted and transmitted for others.	Depends; holding or moving customer value is in.	BitLicense: controlling, administering or issuing a virtual currency.	Howey, owned by is my token a security; Regulation Crypto Assets is a proposal, comments closed 20 October 2026.

Sources: FinCEN MSB registration page, read 7 November 2026; 31 CFR 1010.100(ff) and 1022.380, eCFR current as of 4 November 2026; FIN-2019-G001 (9 May 2019); NYDFS, Virtual Currency Businesses, read 7 November 2026; Public Law 119-27; Federal Register docket FINCEN-2026-0100; SEC File S7-2026-27. State cells are our reading of how each activity is tested, not a fifty-state survey.

Layer one: FinCEN registration, which is not a licence

FinCEN’s page says it in one sentence: with few exceptions, each money services business must register with the Department of the Treasury. The word licence does not appear. Money transmission means accepting currency, funds or other value that substitutes for currency from one person and transmitting it to another location or person by any means, with no dollar threshold; the USD 1,000 per person per day threshold belongs to the other MSB categories. The exclusions are narrow and include network access for a transmitter, a payment processor settling through a clearance system by agreement with the seller, and funds moved only integral to your own sale of goods or services (31 CFR 1010.100(ff)(5)(ii)(A) to (F)). Each MSB registers whether or not any state licenses it.

Form 107 is filed within 180 days after the MSB is established and renewed every two years, by 31 December. Re-registration within 180 days follows a change of ownership or control that requires re-registration under state law, a transfer of more than 10 percent of voting power or equity, or a more than 50 percent increase in agents. The registration form and its supporting documentation stay at a US location for five years. Failure to register carries a civil penalty of up to USD 5,000 per violation, each day a separate violation, and up to five years’ imprisonment, per FinCEN’s page read 7 November 2026.

For a company founded abroad, the definition reaches a person wherever located doing business wholly or in substantial part within the United States; a US office counts but is not required, and FIN-2019-G001 applies the rules equally to a foreign-located CVC transmitter with no US presence. A foreign-located MSB names a US-resident agent to accept service of legal process and a US address where records are kept. The guidance, issued 9 May 2019, creates no new requirements and remains the operative test. Its application to exchangers, hosted wallets, processors, merchants, DApps and multisig providers is on the by-country page; the recordkeeping that follows registration is on the crypto travel rule compared.

Layer two: state money transmitter licences

Each state licenses money transmission under its own statute, owed where the customer sits. The states that use NMLS take applications through it; NYDFS names NMLS as its route. The CSBS Money Transmission Modernization Act is the model, and its virtual currency articles are optional.

The CSBS update of August 2026 marks Maine (effective 9 August 2024), Minnesota and North Dakota (1 August 2023) as adopting the MTMA with the virtual currency title; most other enactments carry no such note. It lists 2025 enactments in Colorado (17 July 2025), Mississippi (1 July 2025), Nebraska (1 October 2025), Massachusetts (1 January 2026) and Virginia (1 July 2026). Its 2026 entries are Louisiana HB 1230 (effective 1 July 2026), Oklahoma HB 3521 (1 November 2026), Alaska SB 86 and HB 99 (1 July 2027) and Delaware SB 18, a full MTMA bill with the virtual currency title whose status the update does not date. The update prints no aggregate count, and we print none.

A state without the title tests a crypto business under its general definition of money, so the answer is statute by statute. Montana is commonly cited as the one state with no money transmitter licence; its regulator’s page could not be read on 7 November 2026, so verify with the Montana Division of Banking and Financial Institutions before relying on it. Home state first, then the states where customers are, with New York as its own layer or geofenced out until granted.

Layer three: New York

23 NYCRR Part 200 took effect on 24 June 2015. A BitLicense is needed for virtual currency business activity involving New York State or New York residents, so an out-of-state firm serving New Yorkers is caught. Five activities are licensable: receiving virtual currency for transmission or transmitting it; storing, holding or maintaining custody or control of it for others; buying and selling it as a customer business; exchange services as a customer business; and controlling, administering or issuing a virtual currency. Applications go through NMLS, and FinCEN registration does not affect whether one is needed.

Exempt: merchants and consumers using virtual currency solely to buy or sell goods or services, consumers holding solely for investment, and software development as a purely technical service. The alternative is a limited purpose trust company charter, which can exercise fiduciary powers; a BitLicensee cannot. On 7 November 2026 the NYDFS table listed 39 virtual currency entities, four dated 2026: Zap Solutions (February), Mastercard Transaction Services (US) LLC (May), GalaxyOne Prime NY LLC (May) and Circle Internet Trust Company, LLC (July). A conditional licence framework was floated in a 2020 industry letter; verify its current terms with NYDFS before planning around it.

When you need none of them

Two questions follow the map: do I need any of this if I am software-only, non-custodial or without US customers, and what do I keep to prove it. One row runs the other way. A seller dealing from its own inventory, kiosk operators included, is an exchanger under FIN-2019-G001; “we only sell our own coins” is not a federal exemption, and we will not sign an opinion that says it is.

Schedule B · When a crypto business needs none of the three US layers, as at 7 November 2026
Your position	FinCEN	State and New York	What to document	Owning page
Software only, no key share, no fee on transfers	Outside: software or network access for a transmitter is excluded; building a DApp is not transmission.	Generally outside; New York exempts purely technical software.	Architecture note: no value accepted, no key held; terms that charge for software.	Self-custody controls checklist
Non-custodial wallet or DApp	Depends on who can move value alone; the test is on the custody licensing page.	Follows the custody definitions; New York custody activity where there is control for others.	Key-control map: who can move value alone.	Custody licensing; MPC and smart-contract wallets
No US customers and no US business	Outside on the facts; the definition reaches a person wherever located doing business wholly or substantially in the US. If it reaches you, register and name a US-resident agent for service.	Outside where no resident is served; NYDFS reaches out-of-state firms serving New Yorkers.	Geofencing logs, customer-residence records, a dated US-business analysis.	This page; by-country page
Own-account investor or treasury	Outside: using CVC solely on your own behalf is neither acceptance nor transmission.	Outside; New York exempts holding solely for investment.	Board resolution; ledger with no client flows.	This page
Merchant accepting crypto for its own goods or services	Outside: funds moved only integral to your own sale are excluded.	Outside; New York exempts merchants using virtual currency solely for their own sales.	Invoices; no transfers for third parties.	By-country page, merchant row
Seller from own inventory, including a kiosk or ATM	Not exempt: an exchanger dealing from its own reserves and a kiosk owner-operator are money transmitters.	Not exempt in New York (buying and selling as a customer business); other states vary, verify.	Form 107, BSA programme, state applications, kiosk locations.	This page; crypto AML programme

Sources: 31 CFR 1010.100(ff)(5)(ii) and 1022.380(a)(2); FIN-2019-G001 sections 3, 4.2.1, 4.2.2, 4.3, 4.4, 5.2.2 and 5.3; NYDFS FAQ, read 7 November 2026. The document column is our practice, not regulator text.

SEC, CFTC and GENIUS beside the three layers

Securities and derivatives law runs beside the three layers, not inside them. A person registered with, and functionally regulated or examined by, the SEC or the CFTC is not an MSB under 31 CFR 1010.100(ff)(8)(ii), so a registered broker-dealer or designated contract market leaves the FinCEN layer by that route; on 2 September 2025 SEC and CFTC staff said jointly that current law does not prohibit registered exchanges from trading certain spot crypto products. Whether a token is a security is owned by is my token a security and the token legal opinion hub. Regulation Crypto Assets (File S7-2026-27, issued 18 August 2026) is a proposal whose comments closed 20 October 2026; our view is in our SEC comment letter.

The GENIUS Act applies to issuers: a permitted payment stablecoin issuer must be formed in the United States (section 2(23)), and once the Act is in effect only a permitted issuer may issue (section 3(a)). Its digital asset service provider definition excludes protocols, self-custodial software interfaces and validators. Which entities qualify as a permitted issuer, and the reserve rules, are on where to issue a stablecoin; what belongs here is the dated status.

Schedule C · Federal status as at 7 November 2026
Instrument	Status on 7 November 2026	Source
GENIUS Act	Enacted 18 July 2025 as Public Law 119-27.	GovInfo enrolled text
OCC final rule	Bulletin 2026-50 of 21 October 2026, creating 12 CFR 15; effective 18 January 2027; BSA, AML and OFAC left to a separate rulemaking with Treasury.	OCC Bulletin 2026-50
FinCEN and OFAC AML rule for permitted issuers	Proposed 10 April 2026 (FR Doc. 2026-06963), comments closed 9 June 2026; no final rule found.	Federal Register docket FINCEN-2026-0100, read 7 November 2026
GENIUS effective date	The earlier of 18 months after enactment, 18 January 2027, or 120 days after the regulators’ final rules.	Public Law 119-27, section 20
CLARITY Act (H.R. 3633)	Not law. Cloture failed 49 to 50 on 15 September 2026, a motion to reconsider is pending and no further vote had been reported by 7 November 2026, per the Senate record as reported. Status block on the by-country page.	Trackers, October 2026; congress.gov unreadable on the day
FIN-2019-G001	Issued 9 May 2019; consolidates rules since 2011, creates none; the operative federal test.	FinCEN, re-read 7 November 2026

The order for an Indian or UAE company entering the US

Vendor pages list the US steps as if the company already sat in the US. For an Indian or UAE founder the first step is at home, and the BSA programme comes before the registration that announces it, because banks and FinCEN both ask for it.

Schedule D · Order of operations for an Indian or UAE company obtaining US crypto registrations and licences
Step	What it is	Who acts	Depends on
1. Outbound leg at home	India: FEMA and ODI, and the choice between a Delaware flip and a US subsidiary, including the Stripe Atlas and FEMA trap. UAE: a parent-level resolution and the parent’s own UAE licence position.	The parent and its AD bank	What the US entity will do and who will own it
2. US entity and registered agent	Delaware or another state; LLC or C-corp. The registered agent is also the natural US agent for service if the parent abroad, not the US entity, is the transmitter that registers (step 5).	Founders; registered agent	Step 1
3. EIN and US bank account	EIN without an SSN, then the account. Banks onboarding a crypto business usually want the BSA programme drafted, so step 4 runs alongside.	Responsible party; the bank	Step 2
4. BSA and AML programme, compliance officer	Written programme, named officer, training and independent review, before Form 107: the crypto AML programme.	Compliance officer; Infinilex	Steps 2 and 3
5. FinCEN Form 107	Within 180 days of establishment. If the US entity is the transmitter it registers in its own name; if the parent abroad transmits to US customers, the parent registers as a foreign-located MSB and names the US-resident agent and records address, for which the registered agent is the natural choice. Renew every two years by 31 December; refile within 180 days of a change of ownership or control that requires re-registration under state law, a transfer of more than 10 percent of voting power or equity, or a more than 50 percent increase in agents.	Owner or controlling person	Step 4
6. NMLS account and state applications	Home state first, then each licensing state whose residents you serve, through NMLS where used.	Company; state regulators	Steps 4 and 5; the customer map
7. New York, if New York customers	BitLicense or limited purpose trust company charter through NMLS, or a geofence until granted.	Company; NYDFS	Step 6
8. SEC and CFTC perimeter check	For any token you list, distribute or hold and any derivative you offer: is it a security or a derivative, and does SEC or CFTC registration apply, which also takes the person outside the FinCEN definition. Owned by the token legal opinion hub and our SEC comment letter.	Company; Infinilex	Step 2 and the product
9. GENIUS route, only if issuing a payment stablecoin	A permitted payment stablecoin issuer must be formed in the United States; the eligibility routes are on where to issue a stablecoin, the dated status in Schedule C.	Company; the federal or state regulator	Step 2 and the product
10. The ongoing calendar	Biennial renewal, re-registration triggers, state reports, registration records kept five years at a US location, and the filings every foreign-owned US company owes: the US compliance calendar.	Compliance officer; Infinilex	Steps 5 to 9

Two shortcuts fail. Form 107 before the programme announces a transmitter with no controls, and the first bank or examiner to ask finds none. A state application before the home state, or before the FEMA leg is clean, names an owner who could not lawfully have funded it.

Who signs the US leg

Infinilex counsel qualified in India, the UAE and the US sign opinions for those jurisdictions; for the EU and any other jurisdiction Infinilex scopes and coordinates the local counsel who sign. On a US entry a US-admitted Infinilex lawyer in the New York office signs the FinCEN and state analysis, and an advocate enrolled in India or Infinilex’s chartered accountant signs the FEMA and ODI leg at home. We will not sign that a seller from its own inventory is outside money transmission, because FIN-2019-G001 says the opposite; we will map the model to the exclusions that exist and to the bank-led or licensed routes where none does. The Web3 practice shows where the US leg sits beside VARA, FIU-IND and MiCA work.

Frequently asked questions

Is there a US crypto licence, and is FinCEN MSB registration one?

No single licence exists and no single regulator issues one. FinCEN takes a registration from each money services business, filed on Form 107 within 180 days of starting; its page never calls it a licence, and the regulation requires it whether or not a state licenses you. States license money transmission under their own statutes, through NMLS where they use it. New York adds the BitLicense under 23 NYCRR Part 200, in force since 24 June 2015, or a limited purpose trust company charter. Securities and derivatives sit with the SEC and the CFTC, payment stablecoin issuers with the GENIUS Act. Positions as at 7 November 2026.

What licences does a crypto exchange need in the USA?

FinCEN treats an exchanger as a money transmitter whether it brokers between customers or deals from its own reserves, so the exchange registers with FinCEN within 180 days of starting, renews every two years by 31 December and runs a BSA programme. It then needs a money transmitter licence in each licensing state whose residents it serves, and a BitLicense or trust charter if any of them live in New York. If it lists a security or trades derivatives, the SEC or CFTC line applies, and a person registered with and regulated by the SEC or the CFTC sits outside the FinCEN definition. A kiosk is the small version of the same answer: the owner-operator is a money transmitter.

What are the BitLicense requirements, and who is exempt?

A BitLicense is needed for virtual currency business activity involving New York State or New York residents: receiving virtual currency for transmission or transmitting it; custody or control for others; buying and selling as a customer business; exchange services as a customer business; and controlling, administering or issuing a virtual currency. Applications go through NMLS, and registration with FinCEN does not change the answer. Exempt: merchants and consumers who use virtual currency solely to buy or sell goods or services, consumers who hold solely for investment, and software development as a purely technical service. The alternative is a limited purpose trust company charter, which can exercise fiduciary powers. The NYDFS table listed 39 regulated entities on 7 November 2026.

Do I need a US crypto licence if my company is in India or Dubai and has no US office?

You may. The FinCEN definition reaches a person wherever located doing business wholly or in substantial part within the United States, and FinCEN's 2019 guidance applies the rules equally to a foreign-located transmitter with no US physical presence. If US customers are a substantial part of the business, you register, name a US-resident agent to accept service of legal process and give a US address where the records are kept. State licences follow where the customer sits, and NYDFS says a business outside New York serving New York residents needs a BitLicense. With no US customers and no US business, none of the three layers applies; keep the geofencing and customer records that prove it.

What licensing do you need to offer crypto services in the US and the EU?

Two maps. In the US: FinCEN registration for anyone who accepts and transmits value, a money transmitter licence in each licensing state you serve, the New York BitLicense or trust charter if New Yorkers are customers, the SEC and CFTC line for securities and derivatives, and the GENIUS Act for payment stablecoin issuers. In the EU: one authorisation as a crypto-asset service provider under MiCA (Regulation (EU) 2023/1114 of 31 May 2023, Article 59) in one member state, usable across the rest on a notification to the home authority (Article 65), with no transitional cover left since 1 July 2026 (ESMA statement of 23 June 2026); the EU map is on the Europe crypto licence page linked above. On the EU filing Infinilex quarterbacks, EU local counsel files. Infinilex counsel qualified in India, the UAE and the US sign opinions for those jurisdictions; for the EU and any other jurisdiction Infinilex scopes and coordinates the local counsel who sign.

Next step

Mapping your US entry?

Tell us what the product does, who can move customer value, where your customers sit and where the parent is. We will say which layers apply, which you can document your way out of, and the order to run the home leg and the US leg.

Book a 30-minute call The Web3 practice Not ready for a call? Email two lines

Thirty minutes with Prashant Sharma, the founder, who does the work himself. You leave with next steps either way. Email is read by the founder and answered within one working day.

Which US crypto licences you need: FinCEN registration, state money transmitter licences and the New York BitLicense