Crypto regulation: how licensing grew and where it leads

Crypto regulation has a shorter history than it feels. Thirteen years separate the first ruling that treated crypto companies as regulated businesses from the registers we count today. The direction has been steady and the mechanism has barely changed: a regulator borrows an existing rulebook, then writes a bespoke one, then a register appears, then the register gets shorter.

It started by borrowing an older rulebook

In March 2013 the US Treasury's financial crimes unit published guidance saying that anyone exchanging or administering virtual currency counts as a money services business. Nothing new was created. An existing category opened its doors, and companies that had been operating outside any framework woke up inside one.

New York went further in 2015 with the BitLicense, the first permission written for crypto alone. It did two things at once: it made operating legal and it made operating expensive, and a number of smaller firms left the state rather than apply. That pattern repeats in the regimes that follow.

Japan made it statutory in April 2017, amending its Payment Services Act to create a legal category for crypto assets and a registration regime for exchanges. For the first time a national parliament, rather than a regulator's interpretation, defined what these companies were.

The global layer arrived in 2019, when the Financial Action Task Force defined the virtual asset service provider and told its members to license or register them. After that, a country without a regime was the exception.

Estonia showed what a register can do

Estonia issued licences freely and ended 2019 with 1,234 licensed crypto firms. By September 2020 there were 353. The regulator had tightened requirements and revoked in bulk, and 71% of the register disappeared inside nine months.

Nothing illegal happened to most of those companies. They failed a paperwork threshold that did not exist when they applied.

What the registers hold now

Our licences section tracks six regimes and 789 permissions between them. MiCA accounts for 361 across 30 markets, about 17 new authorisations a month since it began applying to service providers at the end of 2024. South Africa's FSCA holds 310, Dubai's VARA 57, Kazakhstan 36 and CySEC 25.

South Africa is the only one of the six publishing a full funnel: 533 applications, 310 approved, 17 refused and 124 withdrawn once the regulator started asking questions. The approval rate is 58.2%. The 23.3% who withdrew are the number that never appears in approval statistics.

The cost of a licence decides who applies

Kazakhstan charges about $289 outside its financial centre and $98,000 inside it, a 339-fold spread in one country. CySEC asks €10,000 to apply and between €50,000 and €150,000 of capital depending on the class of service. Dubai charges up to roughly $27,200 to apply and up to $54,500 a year in supervision, plus more for each additional activity.

Australia's deadline closed this month with 45 applications from an estimated 400 platforms, so eleven per cent applied. Hong Kong, after years of regulated activity, has 15 permissions in total.

The pessimistic case for the next ten years

What follows is our reading rather than anyone's forecast, and it comes out of the numbers above.

Licensing is a filter that selects for balance sheets. Capital floors, annual supervision fees and compliance staffing favour companies that already have all three, which means banks, brokers and the largest exchanges. A register that grows by 17 a month across a bloc of 450 million people defines a short list.

Expect consolidation. The licensed set stays small, acquisitions replace applications, and the cost of compliance becomes the moat it already is in banking. Quiet exits come with it: 124 withdrawals in one country show that firms leave before a refusal is recorded, and those departures never reach a statistic anyone reports.

The long tail moves rather than disappears. Activity that cannot carry a $98,000 permit goes to a self-custody wallet, to permissionless venues and to jurisdictions that have not yet written a regime. Regulation reduces the number of licensed intermediaries without reducing demand.

The risk also changes shape. A user's danger today is that an exchange fails. In ten years the likelier complaint is that the licensed options are few, their terms resemble each other, and leaving them is harder than it was. Estonia's register went from 1,234 to 353 by administrative decision.

What to do with this

Read the regime before the country. A jurisdiction's tax rate tells you what you keep; the licence tells you whether you can operate at all, and the two are set by different authorities on different timetables.

Our licences section keeps the capital requirements, the fee tables and the statutory deadlines for six regimes. Fee tables change without announcements, which is why every figure there carries the date it was checked.

Informational material, not legal or investment advice. The ten-year reading is our own and follows from the figures above; every register number carries the date it was checked.