Crypto OTC Licensing: Market‑maker & OTC Desk Licences Across EU, UAE, Singapore and the US

Crypto OTC licensing is now a threshold operational question for any firm running an over‑the‑counter desk or providing crypto market maker licensing services across the EU, UAE, Singapore and the United States. This landing page delivers a practical, conversion‑focused playbook, not a theoretical overview, for businesses that need to launch, expand or regularise bilateral trading and liquidity provision across borders. It sets out who needs authorisation, how to classify your activity, the documents to prepare, indicative costs and timelines, and the anti‑money‑laundering controls regulators now expect. Every jurisdictional statement is grounded in primary regulator sources so you can act with confidence.

Introduction, what this page covers and who should read it

This guide is written for founders, general counsel, compliance leads and operations teams responsible for crypto OTC licensing decisions. It covers the four regimes that dominate cross‑border liquidity flows, the EU under the Markets in Crypto‑Assets Regulation (MiCA), the UAE (Dubai’s VARA and Abu Dhabi’s ADGM), Singapore under the Payment Services Act supervised by the MAS, and the United States’ layered federal‑and‑state system. If you provide agency or proprietary liquidity, run a bilateral OTC desk, or intend to passport services regionally, this page maps the requirements you must satisfy.

Why market makers & OTC desks are different to exchanges

Exchanges operate a multilateral, order‑matched venue. Market makers and OTC desks instead quote and trade bilaterally, often in large, negotiated tickets, either as principal (proprietary risk) or agent. That distinction matters for crypto OTC licensing because regulators assess the exact activity: dealing on own account, arranging deals, custody of client assets and settlement all trigger different authorisation categories. A desk that appears “smaller” than an exchange can attract equal or heavier scrutiny because bilateral high‑value trades carry elevated money‑laundering and counterparty risk.

2025–26 regulatory inflection points

• MiCA enforcement: The EU regime is now operational, with national authorities and ESMA issuing supervisory guidance on CASP authorisation and conduct.
• VARA and ADGM operationalisation: Both UAE regulators have moved from framework‑building to active licensing and supervision of virtual asset service providers.
• MAS tightening: Singapore has raised its fit‑and‑proper and technology‑risk expectations for licensees under the Payment Services Act.
• US AML focus: FinCEN, the SEC and the CFTC continue an enforcement‑led posture, with state money‑transmitter obligations layered on federal BSA duties.

Executive summary, key takeaways & recommended immediate actions

Across all four regimes, crypto OTC licensing turns on precise activity classification and a demonstrable AML/CTF programme. In the EU, most OTC and market‑making activity falls within MiCA’s crypto‑asset service provider (CASP) authorisation. In the UAE, firms choose between VARA (Dubai) and ADGM (Abu Dhabi) depending on model and location. Singapore requires a Payment Services Act licence supervised by the MAS. The United States has no single federal OTC licence, instead expect FinCEN registration, state money‑transmitter licences, and potential securities or commodities considerations.

Recommended immediate actions: map your exact activities against each regulator’s definitions; build a risk‑based AML programme with enhanced due diligence for high‑value counterparties; appoint qualified compliance and AML officers; document your custody and technology controls; and prepare a jurisdiction‑by‑jurisdiction application dossier. Firms that begin classification and AML design early materially shorten approval timelines.

Quick jurisdictional snapshot, at‑a‑glance rules for market‑making & OTC desks

The following snapshot summarises the practical position in each regime. It is designed for rapid decision‑making; the detailed process, requirements and AML sections below expand on each point. Use the anchor sections to compare requirements before committing to a licensing route.

EU (MiCA), MiCA market maker licence and CASP authorisation

Under MiCA, providing crypto‑asset services, including operating a trading platform, exchanging crypto‑assets for funds or other crypto‑assets, executing orders, dealing on own account and providing custody, requires authorisation as a CASP. A bilateral OTC desk buying and selling as principal, and a market maker providing continuous two‑way quotes, will typically be captured because these amount to “exchange” and “dealing on own account” services under the MiCA Regulation. Applicants must demonstrate governance, prudential safeguards, conflict management, AML controls aligned with EU anti‑money‑laundering law, and orderly conduct rules. Supervisory expectations, including best‑execution and market‑abuse considerations, are elaborated in ESMA’s MiCA guidance and Q&As. A key operational advantage is the ability to passport a CASP authorisation across Member States once granted.

UAE, VARA OTC licence UAE vs ADGM crypto licence

The UAE offers two distinct routes. In Dubai, the Virtual Assets Regulatory Authority (VARA) licenses Virtual Asset Service Providers by activity category, broker‑dealer, exchange, custody, lending and management, with detailed rulebooks and operational‑readiness requirements. A desk conducting principal trading or brokerage will apply for the relevant VARA activity licence. In Abu Dhabi, the ADGM Financial Services Regulatory Authority (FSRA) regulates virtual assets within its financial services framework, requiring a Financial Services Permission with local substance, capital and cyber/custody standards. Which route to pursue depends on your commercial location, counterparties and whether you value ADGM’s common‑law financial‑centre framework or VARA’s activity‑specific virtual‑asset regime.

Singapore (MAS), MAS VASP licence Singapore under the Payment Services Act

In Singapore, businesses dealing in or facilitating the exchange of digital payment tokens generally require a licence under the Payment Services Act, supervised by the Monetary Authority of Singapore (MAS). An OTC desk buying and selling tokens, or a market maker providing liquidity to Singapore customers, falls within “digital payment token service”. Applicants must satisfy fit‑and‑proper tests, appoint a resident compliance officer, implement robust AML/KYC and technology‑risk controls, and meet base capital and security requirements. The MAS has tightened expectations around governance, custody segregation and consumer protection, and reviews applications rigorously, so early, complete filings matter.

United States, us otc crypto regulation, federal vs state

The United States has no single federal OTC crypto licence. At the federal level, a desk that exchanges or transmits value is typically a “money services business” and must register with FinCEN, maintaining a Bank Secrecy Act AML programme. Separately, most states require money‑transmitter licences, each with its own fees, bonding and net‑worth tests. Depending on the assets traded, activity may also fall within the jurisdiction of the SEC (securities) or the CFTC (commodities and derivatives). This layered structure makes us otc crypto regulation the most operationally complex of the four regimes covered here.

Process, How to obtain a crypto OTC or market‑maker licence

While the specifics differ by regulator, the crypto OTC licensing lifecycle follows a consistent arc across jurisdictions: define your activity, classify it, build governance and compliance infrastructure, evidence technology and custody controls, then package and submit a jurisdiction‑specific application. Common documentation includes a business plan, group structure chart, financial projections, AML/CTF policies, a compliance manual, custody and cyber‑security architecture, and fit‑and‑proper declarations for owners and senior managers. The steps below apply the crypto market maker licensing lifecycle in practical order.

1. Pre‑engagement, business model & activity mapping: Document precisely how the desk operates: centralised versus bilateral OTC, principal versus agency market‑making, whether you custody client assets, and settlement mechanics. Deliverables include an activity map, customer‑journey flowcharts and a preliminary risk register. This single step determines which regulator and which licence category applies.
2. Regulatory classification: Test your activity against each regime, MiCA crypto‑asset service definitions and asset classes; the MAS “digital payment token service” tests; and the US securities/commodities analyses under the SEC and CFTC. Classification errors are the most common cause of delay, so obtain a written classification rationale before filing.
3. Governance & fitness: Establish a board and senior‑management structure with demonstrable competence, appoint a dedicated AML/CTF compliance officer (resident where required), and document a compliance framework, reporting lines and a conflicts‑of‑interest policy. Regulators expect real decision‑making substance, not nominee arrangements.
4. Technology & custody: Define your custody model (self‑custody, sub‑custodian or hybrid), wallet and key‑management security, segregation of client assets, and, increasingly expected, proof of reserves and independent security assurance. Prepare architecture diagrams, penetration‑test summaries and business‑continuity plans.
5. AML/KYC program design: Build a documented, risk‑based programme covering customer due diligence, enhanced due diligence for OTC counterparties, sanctions screening, transaction monitoring and suspicious‑activity reporting. For OTC desks, the treatment of large bilateral trades and source‑of‑funds/source‑of‑wealth evidence is decisive.
6. Operational policies: Prepare best‑execution and quoting policies, client onboarding agreements, terms of business, recordkeeping standards and regulatory reporting procedures. Market makers should address quote obligations, inventory and market‑abuse controls.
7. Application submission: Package the dossier to the specific regulator’s forms, pay applicable fees and respond to the standard information requests. Common rejection reasons include incomplete AML documentation, weak governance substance, unclear custody arrangements and inconsistent financial projections.
8. Post‑licence obligations: After authorisation, maintain ongoing reporting, capital adequacy, independent audits, periodic AML testing and proactive supervisory engagement. Treat the licence as the start of an ongoing compliance relationship, not the finish line.

Document checklists differ by jurisdiction. The following short lists indicate the core additional items each regulator expects:

• EU (MiCA): CASP application forms, prudential/own‑funds evidence, conflict‑of‑interest and complaints policies, ICT and market‑abuse controls, and AML documentation aligned to EU anti‑money‑laundering law.
• UAE (VARA / ADGM): Activity‑specific rulebook compliance evidence, local office and director substance, cyber and custody standards, and capital confirmations (particularly for ADGM Financial Services Permissions).
• Singapore (MAS): Payment Services Act application, resident compliance officer details, base‑capital and security deposit evidence, technology‑risk‑management documentation and AML/CFT policies.
• United States: FinCEN MSB registration, BSA AML programme, state‑by‑state money‑transmitter applications with surety bonds and net‑worth evidence, plus any SEC/CFTC analyses.

Comparative requirements, costs & timelines

The comparison table below summarises indicative licensing requirements, cost drivers and typical timelines for crypto OTC licensing across the four regimes. Costs and timelines vary materially with activity scope, custody complexity and the novelty of the assets traded, treat these as planning benchmarks, not fixed quotes.

Comparison table, crypto OTC licensing requirements, costs and timelines

Read the table as a directional guide. Timelines lengthen where the regulator perceives elevated enforcement risk, where the traded assets are novel or potentially securities, or where custody arrangements are complex and require additional assurance. In the US, the state‑by‑state nature of money‑transmitter licensing means a national footprint can take considerably longer than a single filing. In the EU, the passporting benefit can offset a longer initial authorisation by removing the need to re‑licence in each Member State.

Key requirements & eligibility

Corporate & board requirements

Regulators expect a properly constituted corporate entity with a clear ownership chart, a competent board and defined governance. VARA and ADGM require local substance, office presence and, in ADGM, appropriately located management. The MAS requires a resident compliance officer, and MiCA requires that at least part of the management be effectively based in the authorising Member State. Nominee or shell structures are a red flag across all regimes.

Capital and financial resource tests

Capital expectations scale with activity. Under MiCA, own‑funds requirements depend on the category of crypto‑asset services provided. ADGM applies base‑capital requirements linked to permitted activities. Singapore sets base capital and security‑deposit requirements under the Payment Services Act. In the US, states impose net‑worth and surety‑bond conditions that vary widely. Firms should model capital across every jurisdiction in which they intend to operate.

Fit & proper tests for beneficial owners and senior managers

All four regimes apply fit‑and‑proper assessments to controllers, beneficial owners and senior managers, examining integrity, competence and financial soundness. Expect enhanced scrutiny of criminal, regulatory and insolvency history. Prepare detailed personal questionnaires, references and background‑check documentation in advance to avoid delay.

Local presence vs remote servicing

Regulators increasingly distinguish between servicing local customers and merely operating from abroad. VARA and ADGM require genuine local presence; the MAS expects a local nexus and resident officers; MiCA requires an authorised establishment within the EU. Remote‑only servicing of a jurisdiction’s residents without local authorisation is a principal enforcement trigger.

Technology & custody standards

Custody and technology controls are central to crypto OTC licensing. Regulators expect segregation of client assets, robust key management, resilient infrastructure, independent security testing and, increasingly, proof‑of‑reserves attestations. Document your custody model, whether self‑custody or via a qualified sub‑custodian, and evidence disaster‑recovery and business‑continuity capability.

AML, KYC & sanctions compliance for OTC desks and market makers

A credible anti‑money‑laundering programme is the single most important element of crypto OTC licensing. OTC desks handle large, bilateral, often high‑value trades, making them attractive to bad actors, so regulators expect controls calibrated to that risk. The requirements below draw on international standards and the specific expectations of each regime.

Core AML obligations

The baseline is a risk‑based programme meeting the FATF Guidance for a Risk‑Based Approach to Virtual Assets and VASPs. In the US, this means a BSA AML programme, customer identification, recordkeeping and suspicious‑activity reporting under FinCEN rules, including the “travel rule”. Under MiCA and EU anti‑money‑laundering law, CASPs must apply customer due diligence and transaction monitoring; in Singapore, the MAS imposes equivalent CDD, screening and STR obligations on licensees.

OTC‑specific AML considerations

Because OTC trades are large and negotiated, robust identity verification and beneficial‑ownership analysis for high‑value counterparties are essential. Enhanced due diligence should trigger on ticket size, jurisdictional risk, politically exposed persons and unusual settlement patterns. Source‑of‑funds and source‑of‑wealth evidence should be obtained and documented before settlement, not after.

Sanctions screening and transaction monitoring

Desks must screen counterparties and wallet addresses against applicable sanctions and watch lists, at onboarding and on an ongoing basis. Blockchain analytics for wallet‑risk scoring, screening cadence appropriate to risk, and clear escalation procedures for potential matches are expected. Maintain records evidencing every screening decision.

Practical controls

Operational controls that regulators look for include segregated escrow or settlement arrangements, trade‑surveillance and market‑abuse monitoring for market makers, structured staff training on typologies, and independent audits of the AML programme. Independent testing demonstrates that controls work in practice, not just on paper.

Sample AML checklist for an OTC desk / market‑maker

• Enterprise risk assessment: documented, board‑approved and reviewed at least annually.
• CDD and EDD procedures: tiered by risk, with clear EDD triggers for high‑value OTC counterparties.
• Beneficial ownership: verified for corporate counterparties and traced to natural persons.
• Sanctions and PEP screening: at onboarding and on an ongoing basis, with audit trails.
• Transaction monitoring: rules and thresholds tailored to bilateral, large‑ticket trades.
• Travel‑rule compliance: originator and beneficiary information captured where required.
• SAR/STR filing: defined internal reporting lines and regulator‑facing procedures.
• Recordkeeping: retained for the periods each regulator prescribes.
• Independent audit and training: periodic testing and role‑based staff training.

Together these controls form the backbone of crypto otc aml compliance and are scrutinised closely during every licensing review.

Timelines & practical milestones by jurisdiction

Typical application milestones

Most crypto OTC licensing applications follow the same milestone sequence: preparation and internal readiness; formal filing; a regulator question‑and‑answer phase; conditional or in‑principle approval subject to final conditions; and full authorisation once conditions are met. The regulator Q&A phase is where incomplete AML documentation and unclear classifications cause the greatest delay, so front‑load quality into the initial dossier.

Fast‑track and bridging strategies

Where available, use structural advantages to accelerate market access. In the EU, a MiCA CASP authorisation can be passported across Member States, avoiding repeat licensing. In the UAE, VARA and ADGM have offered phased or provisional approval pathways tied to operational readiness. In the US, prioritising key states and, where relevant, coordinated multistate licensing frameworks can compress an otherwise lengthy state‑by‑state timeline. Sequencing your rollout around these mechanisms materially reduces time to revenue.

Cross‑border operations & licensing strategy

When one licence might suffice vs when local registration is required

A single licence rarely covers global operations. The EU passport is the principal exception: an authorised CASP can serve the whole EEA. Elsewhere, the UAE, Singapore and the US, servicing local customers generally requires local authorisation. The determinative question is where your customers are located and where the service is deemed to be provided, not merely where your servers or staff sit.

Use of local entities, representative offices and delivery models

Firms commonly deploy local licensed entities in each core market, supported by group service arrangements. Delivery‑model choices, agency versus principal, custodial versus non‑custodial, roaming versus fixed desk, affect which authorisation is triggered and whether local substance is required. Structure the model deliberately, because regulators look through form to the economic substance of the activity.

Regulatory coordination and notification strategies

Where operations span jurisdictions, coordinate notifications and align policies to avoid duplication and inconsistency. A single, well‑documented group AML and governance framework, tailored locally where required, reduces the burden of multiple filings and demonstrates a coherent control environment to each supervisor.

Enforcement & regulatory risk map, what changed in 2025–26

MiCA enforcement guidance practical implications

With MiCA operational, national authorities and ESMA are actively supervising CASPs, focusing on conduct, custody safeguarding and AML integration. Firms should expect scrutiny of market‑making quoting practices and market‑abuse controls.

VARA/ADGM operational enforcement posture

Both UAE regulators have shifted to active supervision, testing local substance, custody standards and AML controls against their published rulebooks. Operational‑readiness evidence is examined closely at and after licensing.

MAS supervisory attention points

The MAS has heightened expectations on governance, custody segregation, technology‑risk management and consumer protection, reviewing applications and licensees rigorously.

US AML enforcement and state‑by‑state risk

FinCEN, the SEC and the CFTC maintain an enforcement‑led approach, and unlicensed money transmission across states remains a leading source of penalties. Robust BSA compliance and complete state licensing are the primary defences.

Conclusion, next steps and how to use this playbook

Use this crypto OTC licensing playbook to classify your activity, prepare your AML programme and sequence applications across the EU, UAE, Singapore and the US. Prioritise accurate classification, credible governance and documented controls, these determine both approval speed and long‑term supervisory standing.

Sources

• Regulation (EU) 2023/1114 (Markets in Crypto‑Assets, MiCA), EUR‑Lex
• ESMA, Markets in Crypto‑Assets Regulation (MiCA) guidance and Q&As
• Dubai Virtual Assets Regulatory Authority (VARA)
• Abu Dhabi Global Market (ADGM), FSRA guidance and policy
• Monetary Authority of Singapore (MAS), Payment Services Act
• FinCEN, Application of FinCEN’s Regulations to Certain Business Models
• FATF, Guidance for a Risk‑Based Approach to Virtual Assets and VASPs
• U.S. Securities and Exchange Commission (SEC), Crypto Assets
• U.S. Commodity Futures Trading Commission (CFTC), Digital Assets