A digital asset service provider licence is permission from a financial regulator to run a crypto business for clients: holding their assets, running a trading venue, exchanging, executing orders or advising. No jurisdiction issues a licence under that exact name. The term is the market's shorthand for what the Financial Action Task Force calls a virtual asset service provider, and each of the UAE, the UK, the EU and the US turns it into a different permission, with a different regulator and a different test for who needs one.
This guide compares the four side by side. It is a map for choosing where to apply or whom to trust, not legal advice, and it is dated 8 November 2026. Regulation moves, so each row points to the regulator's own page. We organise Proof of Talk Abu Dhabi, an invitation-only summit where many of these firms meet regulators, and we say where that touches the guide.
What the licence is, and the test behind it
The FATF's virtual asset guidance defines a provider by activity: exchanging virtual assets for money or for other virtual assets, transferring them, safekeeping or administering them, and taking part in or providing financial services for an issuer's offer. A firm needs a licence because of what it does for customers, not because of what it calls itself. The same three questions decide it almost everywhere: what activity, for which clients, from which place.
The four regimes at a glance
- UAE: no single licence. A licence or permission from the regulator of the area where the firm is based: VARA in Dubai outside DIFC, the ADGM FSRA, or the DFSA in DIFC, with federal rules above. In force.
- UK: registration with the FCA for anti-money-laundering supervision now, and full FSMA authorisation for crypto activities from 25 October 2027. Registration is in force; the authorisation regime is not yet.
- EU: CASP authorisation under MiCA from a national competent authority, passportable across member states. In force, and the transition has ended.
- US: no single federal licence. A stack of FinCEN registration, state licences, and SEC or CFTC registration where the activity is a securities or derivatives one. In force, piecemeal.
UAE: four perimeters, and a licence does not travel
A firm that says it is "licensed in the UAE" has told you little. In Dubai outside the financial centre, the Virtual Assets Regulatory Authority lists the licensed activities. In Abu Dhabi, the ADGM Financial Services Regulatory Authority's guidance on virtual asset activities sets out which activities need a Financial Services Permission. DIFC has its own regulator, the DFSA, and the federal Central Bank and capital market rules sit above all of them. A licence from one perimeter does not carry into another. Our UAE regulation map takes each body in turn with the dated status of its rules.
UK: registered today, authorised from October 2027
A UK cryptoasset business today holds a registration with the FCA under the Money Laundering Regulations. That is anti-money-laundering supervision only: it gives no client-asset protection and no compensation cover. The new regime is law but not yet in operation: the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 create new regulated activities that commence on 25 October 2027, and the FCA's policy statements on the cryptoasset regime set the final rules and the application gateway dates. Check that page for the current gateway window before you plan around it. Our jurisdiction-by-jurisdiction reference keeps the UK, US and EU positions marked as in force, drafted or consulted on.
EU: one authorisation, ten services, a passport
The EU is the clearest case. Regulation (EU) 2023/1114, MiCA, requires a crypto-asset service provider to be authorised by a national competent authority for any of ten listed services, and the authorisation names which ones. The transitional cover ended everywhere by 1 July 2026, and ESMA's statement on the end of the transitional periods confirms that serving EU clients without one is now a breach. Capital classes, fit-and-proper tests and the limits of the passport are in our MiCA CASP authorisation guide.
US: a stack, not a licence
There is no federal licence for a crypto firm as such. Most start with registration as a money services business with FinCEN, add state money-transmission licences, and in New York the Department of Financial Services' virtual currency business licence. If a token is a security, trading it brings in the SEC's rules, as clarified in its March 2026 interpretation with the CFTC. Stablecoin issuance waits on the GENIUS Act taking effect, and nobody can hold a permitted issuer status yet. State licensing applies on top of whatever the federal agencies do.
Not the same thing: a market data licence
The other "licence" in this field is a contract, not a permission. A service provider licence comes from a regulator and lets a firm carry on an activity. A market data licence comes from a data vendor or exchange and lets a firm use, display or redistribute prices in its products. The first is granted by law and can be withdrawn by a supervisor. The second is granted by contract and can be audited by the vendor. A firm with a full regulatory licence still needs the data rights for every client report and product it builds, and the reverse is also true. Our guide to digital asset market data licensing covers that second question.
A short way to choose
- Serving EU clients: you need a CASP authorisation, applied for in one member state.
- Serving UK clients: register for anti-money-laundering supervision now, and plan for the October 2027 authorisation regime.
- Serving US clients: map each activity to a federal registration and each state you serve to its licence.
- Based in or selling into the UAE: first identify the perimeter, then apply to that regulator.
The people who run these regimes, and the firms that hold the licences, are the audience for the Abu Dhabi edition on 3 to 4 December 2026 at the Louvre Abu Dhabi, capped at 2,000 and by application only. If you work on a licence application, request access to Proof of Talk Abu Dhabi.
How this guide was made
The Proof of Talk editorial team wrote it on 8 November 2026. The positions for the UAE, UK, EU and US come from our dated regulation posts linked above, each checked against the regulator's own pages when it was published, and the links in this guide go to those pages. The US federal and state licensing summary is general and was not re-verified against each state. We are not lawyers: confirm a specific application with counsel in the jurisdiction concerned.