Custody & Safekeeping Licensing

Overview

Custody licensing is the foundational regulatory gate for any firm seeking to hold digital assets on behalf of third parties. Unlike exchange or transfer licensing, custody authorization focuses specifically on the safekeeping of private cryptographic keys, the segregation of client assets from the custodian's own property, and the operational resilience of the custodian's infrastructure. Because custody failure can result in total, irreversible loss of client assets -- as demonstrated by the FTX, Celsius, and Quadriga CX collapses -- regulators worldwide have treated custody licensing with particular seriousness.

The five Tier 1 jurisdictions profiled here represent the primary licensing destinations for institutional-grade crypto custodians. Each has adopted a distinct regulatory model: the EU offers a unified passport through MiCA; the United States provides multiple federal and state pathways with no single regime; the United Kingdom is transitioning from basic AML registration to full FSMA authorization; the UAE operates four parallel regulators with dedicated custody licenses; and Singapore regulates custody through its Payment Services Act framework. These differences create significant strategic implications for firms choosing where to establish their custody operations.

The comparison below synthesizes practical licensing data -- actual timelines, real costs, staffing requirements, banking access difficulty, and regulatory direction -- drawn from the enriched country files in this repository. All data is current as of June 2026.

Deep Dive: For comprehensive custody regulation analysis, see Institutional Crypto Custody Regulations. This page focuses on the licensing comparison layer.

Licensing Model Taxonomy

Jurisdictions have adopted six distinct licensing models for institutional crypto custody. Each reflects different regulatory philosophies and market development stages. For the full taxonomy with jurisdiction-by-jurisdiction mapping across 17 surveyed jurisdictions, see Custody Licensing Frameworks.

Model A -- Bank-Only Custody

Only entities holding a full banking license may provide crypto custody. No standalone crypto custody license exists. This model leverages existing prudential infrastructure but restricts market entry to incumbent financial institutions. South Korea's VAUPA/SFIA framework is the primary example, where real-name bank account requirements effectively limit custody to five partner banks.

Model B -- Dedicated Crypto Custody License

A purpose-built license category specifically for crypto custody, distinct from general banking or financial services licenses. Allows crypto-native firms to enter the market without obtaining a full banking license while subjecting them to tailored prudential requirements. The UAE's VARA Custody Services License and Germany's pre-MiCA Kryptoverwahrgeschaft (87 licensed firms within five years) are leading examples.

Model C -- Trust Company Model

Custody authorized under existing trust company legislation, leveraging fiduciary law for asset segregation and client protection. The US state trust charter model (NYDFS, South Dakota) has proven flexible, enabling both crypto-native firms and traditional institutions. Canada's CIRO four-tier custodian framework (February 2026) was developed directly in response to the Quadriga CX failure.

Model D -- Comprehensive CASP/PSA Framework

A multi-service licensing regime covering custody as one of several regulated crypto-asset services, often with passporting or cross-border recognition mechanisms. The EU's MiCA and Singapore's PSA are the primary examples. MiCA's EU-wide passport is the single most significant structural advantage of this model.

Model E -- Bespoke/Special Purpose License

Purpose-built legal structures creating new categories of regulated entities specifically for digital asset activities. Wyoming's SPDI charter (full-reserve, no lending) and Switzerland's tiered approach (FinTech license, DLT facility, proposed crypto institution) provide the most calibrated examples.

Model F -- No Specific Regime / General Financial License

No dedicated crypto custody license exists. Firms operate under AML registration only or general financial services regulation. The UK's current regime and Australia's pre-reform posture fall here. The UK is actively transitioning to Model D (full FSMA authorization by October 2027).

Jurisdiction Comparison Table

The table below draws on exact data from the enriched Tier 1 jurisdiction files. Where a jurisdiction offers multiple pathways, the primary institutional custody pathway is shown.

License Type and Regulator

Capital and Cost

Timeline and Staffing

Market Access and Approval

Arbitrage Analysis

Cheapest Path to Custody Authorization

Singapore offers the lowest capital and setup costs among the five jurisdictions. The base capital requirement is SGD 250,000 (~USD 185,000), with total Year 1 costs of approximately SGD 450,000-700,000 (~USD 330K-515K) including the SGD 200,000 security deposit, legal opinions, auditor attestation, and compliance framework development. The MAS application fee is just SGD 1,500 for an MPI license.

However, MAS's extremely selective approval process (~22% historical approval rate, with MAS Director Dawn Chew publicly stating that "most crypto organisations seeking a license in Singapore have not succeeded") means the probability-adjusted cost is significantly higher than the headline figure. Firms should budget for the possibility of a rejected application.

The EU (MiCA) is the next most affordable pathway, with EUR 125,000 minimum own funds and total Year 1 costs of EUR 250,000-600,000 depending on the member state chosen. NCA government fees range from EUR 1,500 to EUR 10,000+. Lithuania and Cyprus offer the lowest total cost environments. Compliance costs have risen approximately 6x under MiCA compared to pre-MiCA national regimes (from approximately EUR 10,000 to EUR 60,000+ for basic compliance alone), disproportionately affecting smaller firms.

The United Kingdom current MLR registration costs an average of GBP 287,500 but confers only AML/CTF supervision -- not prudential regulation, conduct regulation, or FSCS protection. The future FSMA authorization (from October 2027) will add approximately GBP 165,000 in implementation costs per custody firm per FCA estimates.

The UAE (VARA) requires AED 4,000,000 (~USD 1.09M) in locked capital alone, with total Year 1 costs of AED 6.5M-8M (~USD 1.8M-2.2M). ADGM is cheaper for non-public-fund custody (USD 250,000 capital), bringing total Year 1 costs to USD 800,000-1.5M.

The United States is by far the most expensive pathway. OCC national trust bank setup costs are estimated at USD 5M-20M+ (Anchorage reported spending "tens of millions" building compliance infrastructure). Even the Wyoming SPDI requires a practical minimum of USD 10M in capital plus USD 1M-3M in legal and compliance setup. The least expensive US pathway -- the New York BitLicense at USD 150K-500K -- does not confer fiduciary custody or qualified custodian status.

Fastest Path to Market

EU (MiCA) via Lithuania or Cyprus NCAs offers the fastest actual authorization at approximately 90-120 days (3-4 months). The Netherlands issued its first MiCA licenses on the very first eligible day (30 December 2024). Firms with prior national authorization (e.g., existing German KWG license or French PSAN registration) can access simplified fast-track processes reducing timelines to 3-4 months. New entrants without regulatory history face the longest timelines (9-12 months). ESMA has warned that last-minute applications filed close to the 1 July 2026 deadline should expect heightened regulatory scrutiny.

The United States OCC pathway demonstrated rapid conditional approval (3-4 months for the December 2025 batch of five approvals). However, conditional approval is not operational approval -- firms must still satisfy pre-opening conditions on capital, governance, risk controls, and policies before commencing business. As of June 2026, only Anchorage Digital Bank has progressed from conditional approval to fully operational status, despite nine firms now holding OCC conditional approvals.

ADGM FSRA offers realistic 4-8 month timelines, with In-Principle Approval achievable in 6-10 weeks from complete submission. Singapore MAS review takes 3-12 months, with the full end-to-end process spanning approximately 12 months.

VARA (12-18 months) and NYDFS (12-24 months) are the slowest pathways among the five jurisdictions.

Most Prestigious / Institutional-Grade

The US OCC National Trust Bank charter carries the highest institutional credibility globally. It places the custodian within the federal banking system, supervised by the same regulator responsible for JPMorgan Chase and Bank of New York Mellon. The December 2025 batch of conditional approvals -- Ripple, Circle (First National Digital Currency Bank), BitGo, Fidelity Digital Assets, and Paxos -- followed by Bridge/Stripe, Protego, and Crypto.com (Feb 2026) and Coinbase (2 April 2026) represents a who's who of institutional digital asset firms. For major institutional allocators (pension funds, sovereign wealth funds, endowments), an OCC charter signals the highest available level of regulatory rigor. The tradeoff is cost and complexity: USD 5M-20M+ setup, extensive ongoing OCC examination requirements, and semiannual assessment fees.

The EU MiCA CASP authorization carries the second-highest institutional weight, particularly for European institutional investors. MiCA's combination of comprehensive prudential requirements, conduct regulation, DORA operational resilience obligations, and ESMA oversight creates a robust regulatory envelope. The passport mechanism further enhances institutional credibility by demonstrating EU-wide authorization.

The UK FCA FSMA authorization (from October 2027) is expected to carry significant institutional credibility given the UK's established financial regulatory reputation and the proposed MIFIDPRU-style prudential framework. However, this regime does not yet exist as a functioning system.

Best Passporting / Market Access

The EU (MiCA) passport is unmatched globally. A single CASP authorization grants access to all 27 EU member states plus EEA countries (Norway, Iceland, Liechtenstein) -- a market of approximately 450 million people -- via a simple notification process taking approximately 15 calendar days. No physical presence is required in host member states for cross-border services. The passport covers the specific crypto-asset services for which the CASP is authorized (a custody-only CASP cannot passport exchange services). For the full passport mechanism, see

EU Custody Regulations.

No other Tier 1 jurisdiction offers formal custody license passporting:

• United States: No passporting. Multi-entity structures required. BitGo operates with a South Dakota trust charter (converting to OCC) in the US and German regulatory authorization in Europe. Coinbase maintains separate regulated entities in the US, UK, Germany, Ireland, Japan, and Singapore.
• United Kingdom: No EU passporting post-Brexit. UK-Gibraltar passport available only until December 2026. The overseas persons exclusion permits overseas firms to serve UK institutional clients without UK authorization, but not retail consumers.
• UAE: Limited intra-UAE coordination via VARA-federal mutual recognition (originating as the SCA-VARA arrangement of August 2025; the SCA was replaced in full by the Capital Market Authority (CMA) on 1 January 2026 under Federal Decree-Laws No. 32 and No. 33 of 2025, and the CMA assumed the arrangement as legal successor), but this does not extend to ADGM or DIFC free zones, and no GCC-wide passporting exists. How VARA-CMA mutual recognition operates under the heavier new federal regime (CMA Decision No. 4/R.M/2026, effective 13 February 2026) is not yet verified.
• Singapore: No ASEAN financial services passporting. Each ASEAN jurisdiction requires separate licensing. MAS has explicitly stated it will "generally not issue" DTSP licenses for firms serving only overseas customers.

Banking Access Summary

Banking access remains a critical operational bottleneck across all five jurisdictions. The ability to maintain bank accounts, access payment rails, and settle fiat transactions is operationally essential for custody operations -- particularly under regimes like MiCA that require client fiat funds to be placed with a credit institution by the next business day. Conditions are diverging significantly across jurisdictions.

For detailed banking access analysis per jurisdiction:

• US Banking Access
• Singapore Banking Access
• UAE Banking Access
• EU Banking Access
• UK Banking Access

Regulatory Direction

The five Tier 1 jurisdictions are moving in markedly different directions as of June 2026. Understanding these trajectories is essential for firms making multi-year licensing investment decisions.

United States -- Decisive Loosening

All five federal financial regulators (OCC, SEC, CFTC, Fed, FDIC) are moving in a permissive direction simultaneously -- an unprecedented alignment. The OCC has conditionally approved nine crypto national trust bank charters between December 2025 and April 2026 (more than the prior decade combined), and its national bank chartering final rule (Bulletin 2026-4, amending 12 CFR 5.20) took effect 1 April 2026 to affirm national trust banks' authority to engage in non-fiduciary custody and safekeeping. The SEC is modernizing the Custody Rule, with an NPRM expected April 2026. The Fed approved its first crypto bank master account (Kraken, March 2026) and proposed "skinny master accounts" for fintechs. The CFTC launched a Digital Asset Collateral Pilot Program and plans technical rulemaking for August 2026.

The critical risk is political durability. Nearly all changes were made through sub-legislative mechanisms -- interpretive letters, no-action letters, executive orders, staff guidance -- rather than durable legislation. The GENIUS Act (stablecoin legislation) and pending market structure bills are the only statutory anchors. A future change in administration could reverse much of this framework, as the 2022-2024 restrictive period demonstrated in the opposite direction. See

US Regulatory Direction.

European Union -- Systematic Tightening and Enforcement

MiCA is fully in force, with the 1 July 2026 deadline ending all transitional/grandfathering periods. Enforcement is aggressive: over EUR 540 million in penalties issued since MiCA enforcement began, 230+ audits conducted in H1 2025, and two CASPs fined EUR 12M and EUR 8M respectively for Travel Rule violations. The EU Anti-Money Laundering Authority (AMLA) will begin direct supervision of high-risk CASPs from 2027 under Regulation (EU) 2024/1620. ESMA's July 2025 peer review of Malta identified authorization quality concerns, establishing a supervisory baseline that is expected to drive more rigorous authorization across all member states.

DeFi regulation (60%+ of EU DeFi protocols have opted for partial MiCA compliance voluntarily), NFT-specific classifications, and staking treatment are all under active consideration for future MiCA amendments. See

EU Regulatory Direction.

United Kingdom -- Deliberate Transition to Full Regulation

The UK is undergoing the most significant change in its crypto regulatory approach since 2020, transitioning from AML-only registration to full FSMA authorization:

There is no automatic grandfathering from MLR registration to FSMA authorization -- all firms must apply anew. The FCA has signaled a more accommodative stance recently (processing times down from 17 to 5 months, approval rates rising from under 15% to approximately 45%), and the government pushed back on bank de-risking in January 2026. However, the UK remains 2-3 years behind the EU in establishing a comprehensive custody regime. See

UK Regulatory Direction.

UAE -- Strategic Maturation

The UAE is simultaneously tightening standards and expanding its regulatory infrastructure under the Dubai Economic Agenda D33. Key 2025-2026 developments: VARA Rulebook 2.0 (effective June 2025) imposed aggressive 30-day compliance transitions for existing licensees; the CBUAE Federal Decree-Law No. 6 (effective September 2025) brought all virtual asset activity under central bank authority with fines up to AED 1 billion (~USD 272M) for unlicensed operations; ADGM FSRA shifted to a notification-based process for accepted virtual assets and reduced capital requirements for lower-risk custody (USD 250,000 BCR for non-public fund custody).

A major 2026 structural change is the replacement of the Securities and Commodities Authority (SCA) by the independent Capital Market Authority (CMA) on 1 January 2026 (under Federal Decree-Laws No. 32 and No. 33 of 2025), followed by CMA Decision No. 4/R.M/2026 (effective 13 February 2026), which replaced the prior SCA federal VASP regime in full with an activity-based model of eight licensed virtual-asset activities -- including a dedicated federal Custody Services license (defined as safeguarding and administering client virtual assets via control of cryptographic keys or distributed-ledger registration). The federal custody license carries a minimum paid-up capital of AED 4,000,000 plus a 6-month operating-expense buffer for the Safe Custody of Virtual Assets activity; the AED 3,000,000 figure that earlier summaries cited is the discretionary Portfolio-Management activity, not custody -- the two were never in conflict (a cross-mapping error in the source-domain files). The license also requires mandatory structural separation between exchange and custody activities, a total privacy-token ban, and a one-year transition window to 13 February 2027. This federal layer operates alongside (not replacing) VARA, ADGM/FSRA, and DIFC/DFSA, which continue under their own rulebooks.

The convergence trajectory is toward a unified national framework, with potential GCC-level coordination as a longer-term aspiration. Real-world asset tokenization is a major strategic focus, with UAE positioning for Islamic DeFi and tokenized Sukuk. See

UAE Regulatory Direction.

Singapore -- Selective Tightening

MAS has closed the offshore loophole (FSMA DTSP regime, effective 30 June 2025, with no transitional period) and imposed penalties of up to SGD 250,000 and/or imprisonment of up to 3 years for unlicensed DTSP operations (FSMA 2022 s.137(6)). The licensing posture remains deliberately selective -- MAS has stated it will "generally not issue" DTSP licenses for firms serving only overseas customers.

Project Guardian is expanding from pilots to operational playbooks across fixed income, funds, FX, and interoperability workstreams with 40+ institutions. MAS plans to pilot tokenised government bills settled with wholesale CBDC in 2026. A stablecoin regulatory framework is under development with draft legislation expected in 2026. The strategic direction is toward institutional-grade custody of tokenised assets as the primary growth vector, not retail crypto services. See

Singapore Regulatory Direction.

Cold Storage and Key Management Requirements

Custody-specific technical requirements vary significantly across the five jurisdictions. The following table summarizes the key operational security mandates that custody licensees must satisfy.

Japan (95% cold storage) and South Korea (80% cold storage) maintain even more prescriptive requirements than the Tier 1 jurisdictions profiled here. For the full comparative analysis across 17 jurisdictions, see Custody Licensing Frameworks.

Cost Comparison Summary

The following table normalizes Year 1 and ongoing costs to USD for direct comparison. All figures are estimates based on data from the enriched jurisdiction files.

Interpretation: When cost is normalized against market access, the EU MiCA pathway offers the best value. A single investment of EUR 250K-600K unlocks a 30-country market via passporting. By contrast, a USD 5M-20M OCC investment unlocks only the US market (though with the highest institutional credibility).

Notable Custody Licensees by Jurisdiction

The following table tracks major institutional custodians and their licensing status across the five Tier 1 jurisdictions. This illustrates the multi-jurisdiction licensing strategies that leading firms employ.

Copper Technologies' withdrawal from the UK (December 2024) is instructive: despite holding temporary FCA registration and having Barclays as a backer, the firm could not secure permanent registration and chose to obtain licenses in Switzerland and Abu Dhabi instead, illustrating the UK's challenging licensing environment.

Transition Timelines and Deadlines

For firms planning custody licensing, the following deadlines are critical:

Key Takeaways for Licensing Strategy

1. For EU market access: MiCA via a fast-track NCA (Lithuania, Cyprus, Netherlands) is the optimal path -- lowest cost, fastest timeline, and unmatched passport to 30 countries. Firms already holding national licenses should convert promptly before the July 2026 deadline.

2. For maximum institutional credibility: The US OCC national trust bank charter is the gold standard, but at USD 5M-20M+ setup cost and multi-year operational buildout. Suitable only for firms with deep institutional backing and long time horizons.

3. For cost efficiency: Singapore MPI license offers the lowest capital requirements (SGD 250,000) but the approval process is highly selective. EU MiCA is the best cost-efficiency option with the added benefit of passporting.

4. For speed: EU (Lithuania/Cyprus NCA) at 3-4 months, followed by ADGM FSRA at 4-8 months. VARA and NYDFS are the slowest (12-24 months).

5. For the Middle East/GCC: VARA is the primary institutional pathway, but ADGM offers lower capital for non-public fund custody and faster processing. Neither provides GCC-wide passporting.

6. For the UK: Wait for the FSMA regime (applications open September 2026). Current MLR registration confers limited regulatory value and no path to automatic grandfathering.

Recent Licensing Developments (since 2026-03-20)

The following licensing developments post-date the prior cut-off of this comparison and are reflected in the tables and analysis above. Each is reconciled against the refreshed crypto-custody source domain (all jurisdiction files refreshed 2026-06-04) and verified against a primary or highest-authority source.

Verification Notes

This comparison file is the license-map aggregator layer; its licensing facts are reconciled against the nine deep-research source domains, with crypto-custody as the authoritative source for custody licensing facts. All five Tier 1 source-jurisdiction files (EU, US, UK, UAE, Singapore) were refreshed 2026-06-04.

Corrections made during the 2026-06-04 refresh (Correction Protocol)

• US OCC conditional-approval count corrected from "8" to "9". The prior text stated eight OCC conditional approvals; the refreshed
  US source file and the OCC's own corporate decision confirm Coinbase received conditional approval on 2 April 2026, bringing the total to nine (Ripple, Circle/First National Digital Currency Bank, BitGo, Fidelity Digital Assets, Paxos in Dec 2025; Bridge/Stripe, Protego, Crypto.com in Feb 2026; Coinbase in Apr 2026). Source: OCC Corporate Decision #1370.
• EU CASP authorization count corrected from "~40+ as of Feb 2026" to current register figures. The refreshed
  EU source file reports 183 CASPs authorized across 20 EEA member states per the ESMA interim register (7 April 2026) and ~199 per third-party trackers (12 April 2026). The "~40+ as of Feb 2026" figure was a stale earlier snapshot. Source: ESMA — MiCA.
• Singapore unlicensed-DTSP penalty corrected from "SGD 200,000 or jail" to "SGD 250,000 and/or up to 3 years' imprisonment". The statutory maximum under FSMA 2022 s.137(6) is SGD 250,000 and/or 3 years; the refreshed
  Singapore source file corrected this same figure (the prior "SGD 200,000" was sourced to a now-dead Cointelegraph link). Source: FSMA 2022 (Singapore Statutes Online).
• UAE federal regulator updated from "SCA" to "CMA". The Securities and Commodities Authority (SCA) was replaced in full by the independent Capital Market Authority (CMA) on 1 January 2026, and CMA Decision No. 4/R.M/2026 (effective 13 February 2026) introduced a dedicated federal Custody Services license. References to the "SCA-VARA mutual recognition" arrangement were updated to reflect the CMA as legal successor. Source: Clyde & Co.

Cross-domain consistency note

• UAE federal custody capital figure resolved (gap-closure 2026-06-06). The CMA Decision No. 4/R.M/2026 federal Custody Services (Safe Custody of Virtual Assets) license requires AED 4,000,000 paid-up capital plus a 6-month operating-expense buffer. The previously-cited AED 3,000,000 figure is the discretionary Portfolio-Management activity, not custody -- the two were never in conflict; the apparent conflict was a cross-mapping error in the source-domain files. Updated here and in the
  UAE source file. Source: CMA prudential adequacy for virtual-asset firms. The VARA Custody Services license capital is also AED 4,000,000.

Self-reported / estimated figures (flagged)

• All Year 1 and ongoing cost figures in the Capital and Cost, Arbitrage Analysis, and Cost Comparison Summary sections are estimates derived from law-firm guides, licensing consultancies, and industry commentary, not official regulator fee schedules (except government application fees, which are from regulator schedules where cited). They should be treated as planning ranges, not quotations.
• Application timelines labelled "actual" are practitioner-reported observed timelines, distinct from statutory/nominal timelines; both are self-reported by the cited secondary sources unless tied to a specific dated approval.
• Approval/rejection rates (e.g., Singapore ~22%, UK ~12% historical/~45% recent) are derived from regulator parliamentary replies, register counts, and industry tracking; no regulator publishes a formal custody-license rejection rate.

For Full Details

• EU Custody Regulations
• US Custody Regulations
• UK Custody Regulations
• UAE Custody Regulations
• Singapore Custody Regulations
• Custody Licensing Frameworks (Full Taxonomy)