The Short Answer
Getting licensed runs in four moves: choose the jurisdiction that matches your market, set up the local entity and prepare the file, submit and answer the regulator's questions, then operate under oversight once approved. There is no universal crypto license: each jurisdiction runs its own rulebook, and the differences shape the whole business. The VASP compliance hub collects the related guides.
That point deserves the emphasis. Applicants often search for "the crypto license" as if it were one certificate. In reality a license from one regulator opens some markets and not others, carries its own capital and staffing demands, and binds you to that regulator's questioning style. Choosing where to apply shapes everything else.
The pages below walk that decision honestly: what to weigh, what the EU's single market changes, how to evaluate the Lithuanian CASP route, and what the application file actually contains.
Pick Your Jurisdiction First
Three considerations decide the jurisdiction: which customers you can lawfully serve, how the regulator's reputation travels, and what operating under its oversight costs in money and effort. The EU added a fourth that changed the math: under MiCA, one CASP authorization passporting across member states. Weigh all four before paperwork, because switching later means starting over.
Market fit comes first, because a license that does not cover your customers is decoration. If your users are mostly in the EU, an EU authorization is the direct route. If they cluster in a region with local rulebooks, a local license, or a stack of them, is the honest answer.
Regulatory reputation is second. Authorization from a supervisor with a credible track record reads better to banking partners, institutional customers, and other regulators. A cheap rulebook with a weak reputation can cost more in rejected banking relationships than it saves in fees.
Operating weight is third. Every rulebook carries ongoing duties: local staffing, reporting cycles, exams, renewal work. The license is not a one time purchase; it is a relationship with a supervisor, and the VASP AML guide describes the team’s ongoing duties.
The EU runs its own math. MiCA, the markets in crypto assets regulation, replaced a patchwork of national registrations with one CASP authorization that passports across member states. For many applicants that consolidation, one file, one supervisor, one market of twenty seven countries, puts EU jurisdictions at the top of the shortlist. Outside the EU, each rulebook stands alone, and the comparison work is country by country.
The four weights side by side:
| Consideration | The question it answers | What it decides |
|---|---|---|
| Market reach | Where can you lawfully serve customers? | Which jurisdictions make the shortlist at all |
| Regulatory reputation | How does the supervisor's name travel? | Banking partners, institutional customers, other regulators |
| Operating weight | What does ongoing oversight cost in effort? | Staffing, reporting cycles, exam load after approval |
| EU passporting | Does one file open many markets? | Whether an EU CASP authorization changes the whole calculation |
For the related licensing and compliance guides, see the VASP compliance hub.
The Lithuania Path
Lithuania is one EU jurisdiction in which firms can assess a CASP authorisation route under MiCA. The decision depends on the services, market reach, governance and supervisory requirements, not on an assumed shortcut. The Bank of Lithuania’s CASP authorisation pages are the source for the local process.
Applicants must meet MiCA’s authorisation, governance and EU establishment requirements, its prudential requirements and applicable Lithuanian rules. Article 59 requires effective management in the EU and at least one director resident in the EU; it does not itself require every director to be a Lithuanian resident. Check current local requirements for responsible officers and the application file with the competent authority.
Two cautions keep expectations straight. Requirements, fees and procedures must be checked against current official information, not an older VASP registration guide. MiCA CASP authorisation is a distinct regulatory route; do not assume an old AML registration permits ongoing business under the current authorisation regime. Approval starts ongoing oversight rather than ending AML, conduct and reporting obligations.
For exchange founders specifically: what the market calls an exchange license is usually the exchange services category inside the broader CASP authorization. The category you apply for should match the services you actually run, trading for customers, custody, exchange of own funds for others, each named. Applying in the wrong category is a fixed cost paid twice.
What Applications Ask For
Whatever the jurisdiction, the file converges on five items: a business plan that survives questions, written AML and KYC policies, beneficial owner disclosure, proof of capital, and identified local responsible persons. Regulators are licensing a controlled business, not approving a website, and the file is the first oversight conversation.
The business plan carries more weight than newcomers expect. It should say who the customers are, which services run at launch and later, how the operation is staffed, and where the risks sit. Vague plans draw long question rounds; specific plans draw approval.
The AML and KYC policies are the heart of the file. The regulator wants to see customer due diligence that matches the FATF standards most jurisdictions copy: risk rating of customers, ongoing monitoring, thresholds, escalation, and reporting of suspicion. The plan needs to name tools and workflows, not only intentions, which is why the section below exists.
Beneficial ownership disclosure identifies the people behind the company. Capital evidence supports the applicable prudential requirements. Identify the directors and responsible officers required by local law, and verify their fitness, presence and residency conditions rather than assuming a universal local-director rule.
What the file should not contain: borrowed template policies. Examiners read enough applications to know the difference between a policy written for this business and one bought by it, and the difference shapes the question rounds that follow.
After the License: Your First Tool Decisions
The application asks how the business will monitor transactions, so tool and workflow decisions belong before or during the application. Three free checks a month after registering on BlockSec can help evaluate the interface and risk results. They are not a substitute for a monitoring plan matched to the business’s risks, expected volume, staffing and applicable requirements.
Free checks can support an initial product evaluation before selecting paid capacity. The application must independently explain the controls, people and operating workflow the business will actually use; an account with a handful of sample checks does not establish that those controls are sufficient.
On choosing tools in general, this page stays deliberately narrow, because tool selection against price has its own treatment: the small VASP selection and pricing guide in the AML family walks it end to end. What belongs here is only the sequence: the application names the monitoring approach, the team evaluates supporting tools, and production capacity is selected for the operating requirements. API integration requires Scale or Enterprise; there is no free API sandbox currently.
How monitoring actually runs, wiring checks into deposit and withdrawal flows, triaging alerts, keeping records an examiner accepts, is the transaction monitoring guide, the operational sequel to this page. The full map from definition to duties to daily work is in the VASP compliance hub.