Crypto and fintech licensing: VARA license, MiCA

Regimes ask about the same things in their own words: a company the regulator can see; people it approves; capital and client money; controls written to its depth. The licence sits on top of a company, so registration and a bank account come first.

What the choice depends on

• What the product does: custody, exchange, lending, transfers, advice and issuance are separate regulated activities, and some products cross several at once.
• Where your clients live, because a regime can catch you through the client wherever your address is.
• Where you incorporate: the regulator follows the address, and one country can hold several regimes with different perimeters.
• What the regime costs in capital, in people who must sit in the country, and in the regulator's time.

A company inside the perimeter

• A company incorporated where your regulator has authority: the address decides it, not where the team sits.
• An office and presence matching the activity: the regulator looks at where decisions are taken.
• A shareholding chart to the ultimate owners, with identity documents and source of funds.
• A regulatory business plan: the product, the client base, how money and assets move, and a model.

People the regulator approves

• Senior management assessed individually, with evidence of the experience claimed.
• A compliance officer and a money laundering reporting officer, whose seniority and residency the regime sets.
• A board that can show it understands what it supervises.
• Whether any of these roles may be outsourced — one of the real differences between regimes.

Capital and client money

• Paid-up capital: how much depends on the set of activities — one regime adds the requirement up per activity, another takes one floor for the whole class.
• Client assets segregated from the firm's own, under a custody arrangement the regulator accepts.
• Whether custody may be delegated at all: a regime can require the entity holding the assets to be authorised itself, which rules out a group company abroad.

Controls the file rests on

• AML and sanctions policies with named owners, and the client-facing document set that matches them.
• Technology, custody and cyber-security described to the depth the rulebook asks for, keys and access included.
• A whitepaper where a token is issued, reviewed separately from the licence application.
• A wind-down plan: regulators ask how the firm stops before letting it start.

Where your clients are

• Residents of the EU pull you into MiCA wherever the company is incorporated and wherever the team sits.
• Marketing can be a permission of its own, separate from the licence: a regime may let you market without one and still bar you from onboarding local clients.
• Onboarding by country needs a control you can enforce and evidence; a sign-up checkbox is not one.
• The client's own exclusive initiative is construed narrowly: ESMA says contractual terms or disclaimers cannot override the facts.

Where a licence is needed

Dubai — VARA

Eight types of virtual asset activity in or from Dubai, licensed one type at a time. The perimeter follows the address, and the Dubai International Financial Centre (DIFC) is outside it.

European Union — MiCA

Crypto-asset services for clients in the EU, authorised by the competent authority of one member state, which has 40 working days to decide on a complete application. The transitional period ended on 1 July 2026, so there is nothing left to wait out.

Hong Kong — SFC

Four categories of licensed intermediary: trading platforms, fund management, dealing and advising, and the distribution of virtual asset products. The regulator states the principle as same business, same risks, same rules.

Sources: the perimeter and the activity types are the VARA FAQ; the end of the MiCA transitional period is the ESMA statement of 17 April 2026, and the 40 working days to decide are Article 63 of the Regulation in the ESMA rulebook; the narrow reading of a client's own exclusive initiative is the ESMA guidelines on reverse solicitation. Hong Kong: the SFC on virtual assets.