From Singapore MPI to Labuan Money-Broking, with the SFC VATP, JFSA CAESP, KoFIU VASP, SC DAX, SEC Thailand and BSP VASP in between. We map the right route to your business model, capital, client base, banking realities.
A crypto exchange licence is a regulator-issued authorisation that lets a company operate a venue for the trading of virtual assets, spot order books, fiat on/off-ramps, custody of customer balances and, in some regimes, derivatives and security tokens. In APAC the label differs by jurisdiction: Singapore calls it a Major Payment Institution (MPI) licence for Digital Payment Token services, Hong Kong issues a Virtual Asset Trading Platform (VATP) licence under SFO Types 1 and 7, Japan grants a Crypto Asset Exchange Service Provider (CAESP) registration, Korea runs Virtual Asset Service Provider (VASP) registration with KoFIU, Malaysia splits Digital Asset Exchange (DAX) operators from DACS custodians, Thailand licenses Digital Asset Exchanges under the SEC, and the Philippines is moving from BSP-registered VASPs to SEC-licensed Crypto-Asset Service Providers from 5 July 2025. The licence is what unlocks banking, compliant customer onboarding and the legal ability to solicit residents of the jurisdiction.
A crypto exchange in APAC is gated by three separate things: a regulator's authorisation, a banking partner that will hold customer fiat, and FATF Travel Rule compliance. The licence unlocks the first, materially helps the second, and is a precondition for the third. Operating without licensure where one is required is now an enforcement target across most of the region, see for example Indonesia's POJK 27/2024 enforcement, Uzbekistan's NAPP inspections of foreign CASPs, and Singapore's FSMA Part 9 cessation requirement. FATF's own virtual-asset guidance is the framework every APAC regulator now implements locally.
The eight active exchange routes by minimum paid-up capital and timeline. Click through to the country page for full detail.
| Country | Regulator · Licence | Min capital | Timeline | Best for |
|---|---|---|---|---|
| Singapore | MAS · MPI (DPT) | SGD 250,000 | 9–18 months | Payment-token exchanges, stablecoin pair listings |
| Hong Kong | SFC · VATP (Type 1+7) | HKD 5,000,000 | 9–18 months | Institutional exchanges, security-token venues |
| Japan | JFSA · CAESP | JPY 10,000,000 | 15–24 months | Domestic Japanese clients, corporate-treasury alignment |
| South Korea | FSC / KoFIU · VASP | No statutory min* | 12–30 months | KRW-facing operators (with real-name bank) |
| Malaysia | SC · DAX (RMO) | MYR 5,000,000 | 9–18 months | Domestic Malaysian market, capital-markets-anchored |
| Thailand | SEC · Digital Asset Exchange | THB 50,000,000 | 8–14 months | SEA retail, 5-year personal-tax exemption advantage |
| Philippines | SEC CASP (BSP frozen) | PHP 100,000,000 | 9–18+ months | SEC-track operators, CASP rules from 5 Jul 2025 |
| Labuan | Labuan FSA · Money-Broking | MYR 500,000 | 5–10 months | Offshore profile, 3% LBATA tax |
* Korea has no statutory minimum but KoFIU and banks expect KRW 2–3 billion in operating capital.
A crypto exchange licence is one of several related authorisations. Understanding the taxonomy matters because regulators in APAC deliberately separate them, and the wrong choice caps your product roadmap. The five recognised licence families are:
Most real exchanges in APAC end up holding at least two of these, typically exchange plus custody, or exchange plus broker. We scope the combination at the jurisdiction-selection stage so the application file is coherent from day one.
Regardless of which APAC regulator you target, the licensing workflow follows six stages. Timelines below reflect the regime variance already shown in the comparison table (5–10 months at Labuan, up to 30 months at KoFIU Korea).
A crypto exchange licence is not a one-time grant. Every APAC regime imposes ongoing obligations that are audited, and non-compliance is the most common route to licence variation, suspension or revocation. The recurring obligations across MAS, SFC, JFSA, KoFIU, SC Malaysia, SEC Thailand, BSP and Labuan FSA include:
We run a multi-year retainer covering all of the above, co-signed with the country lead who handled the original application so there is no handover risk.
Labuan at MYR 500,000 paid-up. Singapore SPI at SGD 100,000 is also low-cost but only covers smaller payment-token volumes. India and New Zealand have no statutory minimum but the operating-cost floor is set by AML programme and audit obligations.
India FIU-IND (3–5 months) and New Zealand FSP plus AML/CFT (3–5 months). Labuan at 5–10 months is the next tier. Among the more substantive regimes, Thailand SEC Digital Asset Exchange at 8–14 months is the quickest.
No. Each regime is national. The Asia-Pacific region has no equivalent of the EU MiCA passport. Multi-jurisdiction operations require parallel licensing, with structures that align operating models per jurisdiction.
Banking is the practical bottleneck in several markets. Korea (real-name accounts with one of four partner banks), Philippines (banking de-risking), Indonesia (PT-PMA with Indonesian commercial banks). We engage banking partners in parallel with the regulatory file.
Often yes, custody is a separate authorisation in HK (SFC Type 1 sub-category), MY (DACS), JP (CAESP custody subset). In Singapore, custody is bundled into the MPI authorisation. See custody licence.
Scoped fixed-fee for application preparation plus a monthly retainer post-licence. We do not run hourly billing for licensing engagements. Indicative fee ranges are scoped at the 30-minute consultation.
Exchange runs a multilateral order book, broker fills client orders as principal or agent, OTC executes bilateral trades for institutional flow, and custody holds client assets. Hong Kong SFC splits them via Type 1 dealing plus a Type 1 custody sub-category; Japan separates CAESP trading from CAESP custody; Malaysia separates DAX (exchange) from DACS (custody); Singapore PS Act bundles most of them inside one MPI authorisation. See broker licence, OTC licence and custody licence.
MAS and the SFC require documented matching logic, pre-trade risk controls, market-surveillance capability and wallet-key governance at application stage. JFSA CAESP file includes cold-wallet segregation (95%+ cold-storage norm), system-risk management and incident reporting. Thailand SEC requires ISO 27001-equivalent information-security controls. Labuan and India FIU-IND focus more on AML tech than matching-engine mechanics.
Hong Kong VATP retail-eligible tokens require a large-cap, liquid profile and SFC no-objection; Singapore MPI keeps listing inside the licensee's governance with MAS retail-restriction guidance; Japan JVCEA pre-screens tokens before JFSA sign-off (the slowest listing pipeline in APAC); Thailand SEC maintains an approved-token list; Korea real-name exchanges operate under DAXA self-regulatory listing rules; Labuan and India let the operator govern listings with AML scrutiny.
Singapore (with a clean MAS file), Hong Kong (with SFC VATP no-objection), Labuan (through Labuan-licensed banks) and AIFC (via Eurasian / second-tier banks inside the AIFC perimeter) are the most workable. Korea is hardest, only the four real-name banks will open won accounts for KoFIU VASPs. Indonesia, Philippines and Vietnam require on-shore accounts with domestic banks that apply internal de-risking rules.
Nearly all APAC regimes require a local operating entity: Singapore Pte Ltd, Hong Kong limited company, Japan KK, Korea chusik hoesa, Indonesia PT-PMA, Philippines domestic corporation, India private limited, AIFC participant and NAPP Uzbek LLC. Branches of a foreign licence holder are not recognised as substitute authorisations. See company formation for the entity step.
A resident Chief Compliance Officer plus an MLRO are standard across MAS, SFC, JFSA, KoFIU, SC Malaysia, SEC Thailand, BSP and OJK files. SFC and MAS additionally expect a dedicated information-security officer (CISO) and an independent risk function for larger order-book operators. Labuan, New Zealand and India FIU-IND accept combined compliance/MLRO roles at smaller scale.
Singapore MAS applies the Travel Rule from SGD 1,500 (roughly USD 1,100); Hong Kong applies it to all VA transfers without a de minimis; Japan applies it from JPY 100,000; Korea applies it from KRW 1,000,000. Australia AUSTRAC, New Zealand, Philippines BSP and Indonesia all apply Travel Rule to VASPs; thresholds and message-standard choices (IVMS 101) differ. Multi-jurisdiction exchanges usually implement the lowest threshold as the operational baseline.
Singapore, Hong Kong, Japan, Korea, Malaysia, Thailand, Philippines, Indonesia and Australia all require genuine on-shore office space and resident senior officers. Labuan requires a Labuan operating office and a Labuan-resident director. AIFC mandates an Astana presence inside the AIFC perimeter. NAPP Uzbekistan requires a Tashkent office. India and New Zealand accept lighter substance but still require a registered address and resident officers.
A 30-minute scoping call with the country lead for your target regime. Written summary of approach, indicative fees and timeline.
