How to get a crypto licence in Asia, a 2026 playbook

Getting an APAC crypto licence in 2026 is no longer about choosing the friendliest jurisdiction; every active regime now has substance, capital and AML expectations that rule out shell-company structures. The work is in matching the right regime to the business model, then running a clean application that the regulator can approve without remand.

This guide sets out the actual sequence we run, eight steps, in the order they become rate-limiting. We do not cover marketing, fundraising or token economics; we cover the regulatory file and the people who will look at it.

Types of crypto licences in Asia, pick the activity before the country

"Crypto licence" is an umbrella term. Every APAC regulator scopes the licence to a specific activity, and the capital, audit and conduct rules step up accordingly. Before shortlisting jurisdictions, be clear on which activity you are licensing:

• Exchange licence, matching client orders on a venue you operate (Singapore MAS DPT, Hong Kong SFC VATP, Japan CAESP, Korea FSC VASP, Thailand SEC Digital Asset Exchange).
• Broker / dealer licence, routing client orders against third-party liquidity on an agency basis (Thailand SEC Digital Asset Broker, Korea brokerage, Labuan money broker with digital-asset endorsement).
• Custody licence, safekeeping of client virtual assets on a fiduciary or regulated basis (Hong Kong SFC / TCSP Trust, Japan custody from 2023, Singapore MAS DPT with custody permission).
• OTC licence, principal-basis trading outside a venue (Hong Kong CSO consultation, Korea OTC desk registration, Japan Type I Funds/FIEA routes).
• Stablecoin issuer licence, issuing fiat-referenced payment stablecoins (Hong Kong HKMA Stablecoin Ordinance 1 Aug 2025, Singapore MAS SCS framework, Japan Electronic Payment Instruments from 2023).

A firm running exchange, custody and stablecoin issuance from the same entity will usually need three authorisations, not one. Scoping the activity first prevents the most common remand, filing for the wrong licence category.

Cost and timeline at a glance

End-to-end timelines span 3 to 24 months, paid-up capital ranges from no statutory minimum to USD 400 million, and government application fees sit between USD 5,000 and USD 80,000. Three broad tiers:

• Fast and budget (3–8 months, USD 80k–200k all-in). Labuan, Uzbekistan, Kazakhstan AIFC, New Zealand, India FIU-IND VDASP.
• Mid-tier (6–12 months, USD 150k–300k all-in). Malaysia SC DAX, Thailand SEC broker/dealer, Philippines BSP VASP, Indonesia OJK.
• Institutional (12–24 months, USD 300k–900k all-in). Singapore MAS MPI, Hong Kong SFC VATP, Japan CAESP, Korea FSC VASP, Australia AUSTRAC + ACL.

Detailed figures with source citations sit on the cost guide, cheapest-licence guide and fastest-licence guide. The headline warning: total cost is almost never the government fee plus the capital, it is dominated by year-1 AML staffing, external assessor fees and insurance premiums, none of which shrink with a cheaper licence.

Step 1. Shortlist three jurisdictions

Open the 15-jurisdiction comparison and shortlist three by client base, banking access and tax residency of founders. Singapore and Hong Kong dominate institutional shortlists; Labuan and Uzbekistan dominate cost-led shortlists; India and New Zealand dominate speed-led shortlists.

The shortlist is judged on three things: where the customers are (or will be), where the banking partners are, and where the founders can credibly hold residency. Adding a fourth criterion at this stage usually means you have not done the first three properly.

Step 2. Pick the regime within the country

Most APAC countries have multiple licence categories. Singapore has SPI vs MPI vs DTSP; Thailand has six SEC categories; Japan has CAESP, EPISP, ECISB and the upcoming FIEA migration; Hong Kong has VATP, HKMA Stablecoin and the upcoming SFC VA Dealer / Custodian regime. The regime within the country is shaped by:

• Whether you hold client assets (custody triggers higher capital and a separate licence in some regimes).
• Whether you list security tokens (triggers SFO Type 1+7 in HK, FIEA in Japan from FY2027).
• Whether you serve only foreign clients (triggers FSMA Part 9 DTSP in Singapore, discretionary licence).
• Whether you offer earn / lend / yield products (prohibited under SEC Thailand from 30 August 2023).

Step 3. Pre-consultation with the regulator

The application clock starts here, not at filing. A formal or informal pre-consultation with the regulator (and, in Japan, with JVCEA before JFSA) gives you the dossier shape the regulator expects. Skipping pre-consultation produces remand cycles that can add 3–6 months to the end-to-end timeline.

Pre-consultation is also where the regulator tells you what they will and will not accept on substance, governance, custody architecture and capital structure. Take notes; the regulator's verbal feedback is the brief for the file you will submit.

Step 4. Incorporate the entity and seat the directors

Local incorporation under the country's prescribed vehicle: Singapore Pte Ltd, HK Limited, Japan KK, Korea Co., Ltd., Indonesia PT-PMA, Vietnam JSC inside the IFC, AIFC Private Company in Astana, and so on. See company formation for the full list. If timing is critical, see ready-made companies.

Seat the directors and key officers per the regime. Singapore-resident director, Hong Kong-resident RO, KZ-resident SEO/CO/MLRO, Japan-resident representative director, Korea-resident CISO and AMLO. Each appointment carries fit-and-proper review.

Step 5. Capital deposit and bank certification

Deposit and certify the regulator's required paid-up capital. Specific figures by regime are on the country pages; common pitfalls:

• Borrowed or pledged funds disqualified. Uzbekistan NAPP rule, mirrored elsewhere.
• Bank certification of the deposit, required for Uzbekistan, common practice for Indonesia OJK fit-and-proper.
• Capital must remain unimpaired by losses. Labuan FSA, MAS MPI security deposit.
• Plan for capital uplifts. Malaysia SC PCP 3/2025 proposes MYR 5M → MYR 15M during 2026.

Step 6. AML programme, technology framework, custody architecture

Build the AML/CFT programme to the regulator's specific framework. MAS Notice PSN02, AMLO Schedule 2, AML/CTF Act Part 6A, PMLA Rules 2005, NAPP AML rules. Integrate Travel Rule at the regime threshold (SGD 1,500 / JPY 100,000 / KRW 1M / etc.). See AML/KYC programme.

Build the technology framework to MAS Notice PSN05 / SFC's VATP Guidelines / equivalent. Cold/hot wallet split (≥98% cold under HK, ≥95% under Japan, ≥80% under Korea VAUPA). Insurance covering hot-storage VAs (50% under HK). Proof-of-reserves cadence aligned with regulator expectations.

Step 7. File and run the regulator dialogue

Submit the application via the prescribed portal. MAS via the FI Connect, SFC WINGS, OJK ITSK, AUSTRAC enrol portal, FIU-IND FINgate 2.0, Labuan FSA business division. Expect 2–3 rounds of clarification questions over 4–12 months. Respond same-week, in the format the regulator prefers, track every change against the original submission.

For VATP and CAESP applications, an external assessor runs in parallel. Treat that workstream as part of the file, not as a side project.

Step 8. Approval, banking, post-licensing

On approval, three things happen in parallel: the regulator publishes the licence on its register, the corporate banking partner activates production accounts, and the post-licensing compliance regime starts. Renewal is typically annual; AML audit annual or biennial; on-site supervisory inspections at the regulator's discretion. We retain most clients on a multi-year retainer for that work; see AML/KYC programme.

Common reasons applications are rejected or remanded

Regulators rarely issue an outright rejection, they issue requests for further information that, if unanswered or mishandled, convert into a withdrawal. Six failure modes account for most of what we see:

1. Beneficial-ownership chart that does not reconcile to the AML risk assessment. The UBO pack says one thing, the ERA says another, the fit-and-proper questionnaire says a third. SFC, MAS and JFSA all flag this in the first round.
2. Directors or key officers with prior enforcement history that was not disclosed up front. Every APAC regulator runs an international sanctions and enforcement check; self-disclosure is treated as a fit-and-proper factor in itself.
3. Capital sourced from borrowed or pledged funds. The NAPP rule in Uzbekistan is explicit; the principle is mirrored across the region. Bank certification of the deposit is now standard for Indonesia OJK fit-and-proper and Japan CAESP.
4. AML programme copied from another regime. The Travel Rule threshold in Singapore is SGD 1,500; in Japan JPY 100,000; in Korea KRW 1 million. Pasting a MAS PSN02 programme into an AUSTRAC enrolment is the single most common shortcut that triggers a full remand.
5. Custody architecture that does not meet the cold-wallet ratio. Hong Kong requires ≥98% cold, Japan ≥95%, Korea ≥80% under VAUPA. Regulators ask for signed proof-of-reserves procedures, not only a policy PDF.
6. No banking partner identified by approval-in-principle. Korea, Philippines, Indonesia and Vietnam all require an operating account before final licence issuance. Treat corporate banking as a parallel workstream from Step 4, not something to arrange after approval.

Beyond these six, the biggest qualitative trap is tone: applicants who argue with the regulator's comments instead of implementing them lose goodwill and end up in a longer remand cycle. The response to a clarification letter is a technical exercise, not a negotiation.

Frequently asked questions

How long does it take to get a crypto licence in Asia?

Between 3 and 24 months end-to-end. India FIU-IND VDASP registration and New Zealand FSP registration close in 3–6 months; Labuan FSA and Uzbekistan NAPP close in 4–8 months; Singapore MAS MPI, Hong Kong SFC VATP and Korea FSC VASP typically run 12–18 months; Japan JFSA CAESP is the longest at 15–24 months because of the JVCEA pre-review.

How much does a crypto licence cost in Asia?

Paid-up capital ranges from no statutory minimum (Labuan money broker) up to USD 400 million for the Vietnam IFC pilot. MAS MPI requires SGD 250,000; SFC VATP HKD 5 million; Japan CAESP JPY 10 million plus net assets; Korea KRW 3 billion net asset test. Government application fees sit between USD 5,000 and USD 80,000; professional fees typically run USD 80,000–350,000 depending on regime.

Which country is easiest to get a crypto licence in Asia?

By timeline and documentation burden: Labuan, Uzbekistan, New Zealand and India. None of these are "paper" licences, all require local substance, fit-and-proper directors and an audited AML programme, but they do not require the full external-assessor workstream that Singapore, Hong Kong and Japan impose. Read the cheapest-licence guide for the full trade-off.

What documents are required for a crypto licence application?

Core dossier: certificate of incorporation and constitution; beneficial-ownership chart with fit-and-proper forms for every UBO, director and key officer; business plan with three-year financial projections; AML/CFT programme including enterprise-wide risk assessment; technology and cyber framework; custody architecture and proof-of-reserves methodology; capital-deposit bank certification; insurance binder; outsourcing register; and board-approved policies on conflicts, complaints, incident reporting and business continuity. Legal opinions on specific structural questions are often needed for cross-border fact patterns.

What is the difference between an exchange, custody and broker licence?

An exchange licence authorises matching client orders on a venue you operate. A custody licence authorises safekeeping of client virtual assets on a fiduciary basis. A broker licence authorises executing client orders against third-party liquidity on an agency basis. Capital, conduct and audit requirements step up from broker to exchange to custody; most firms end up holding two of the three.

Can a foreign founder own a licensed crypto company in Asia?

Yes in most regimes, with local-officer substance. Singapore, Hong Kong, Japan, Labuan, Kazakhstan AIFC, New Zealand and Australia permit 100% foreign ownership. Indonesia requires at least one Indonesian-national commissioner and foreign-ownership caps through a PT-PMA. Vietnam IFC requires Vietnamese-resident representation. Korea requires a Korea-resident CISO and AMLO but does not cap foreign equity.

What happens if the regulator rejects the application?

True rejections are rare. What normally happens is a request for clarification, a withdrawal prompted by the regulator, or an approval-in-principle with conditions. In all three cases, resubmission is possible, but the prior file is on record. The practical rule is never to file until pre-consultation is closed and every identified issue is resolved in the dossier; the second application always faces a higher bar.

Do I need a crypto licence to serve clients in Asia from an offshore entity?

In most APAC jurisdictions, yes, the test is where the service is provided to or solicited from, not where the entity is incorporated. Singapore FSMA Part 9 DTSP captures firms serving only foreign clients from Singapore; Hong Kong SFO Schedule 5 captures active marketing into Hong Kong; Japan Payment Services Act and Korea VAUPA apply to any operator with a Japan- or Korea-facing interface. A ready-made offshore company is a sequencing tool, not a perimeter workaround.

Where to go next

Open the 15-jurisdiction comparison for the live capital and timeline figures, then read the country page for your shortlist. For cost analysis: crypto licence cost. For the speed/cost trade-off: cheapest licence and fastest licence. When ready: book a 30-minute scoping call with the country lead for your jurisdiction.