Cross-Border Crypto Services: Licensing and AML Considerations for Global Operations

Running a global crypto business used to mean finding the loosest regulations and hoping no one noticed. Those days are over. As of mid-2026, regulators worldwide have closed the loopholes that allowed Virtual Asset Service Providers (VASPs) to operate in the shadows. If you offer exchange, custody, or transfer services to clients outside your home jurisdiction, you are triggering licensing and Anti-Money Laundering (AML) obligations in multiple countries simultaneously.

The landscape has shifted from 'wild west' experimentation to strict financial supervision. The Financial Action Task Force (FATF) updated its standards in June 2025, highlighting that only 29% of jurisdictions are fully compliant with Recommendation 15. This means if you think you are safe because you are licensed in a small island nation, you might still be facing enforcement actions from major economies like the EU, US, or Singapore. To survive and scale, you need to treat compliance not as an afterthought, but as the core architecture of your business.

The Global Standard: FATF Recommendation 15

Everything starts with the Financial Action Task Force (FATF), which is the global money laundering and terrorist financing standard-setter. In June 2019, they amended Recommendation 15 to explicitly cover virtual assets. This was the turning point. It mandated that VASPs must be licensed or registered and subject to effective AML/CFT supervision in the jurisdiction where they are created.

The definition of a VASP is broad. It includes anyone who, as a business:

• Exchanges virtual assets for fiat currency (like USD or EUR).
• Exchanges one virtual asset for another.
• Transfers virtual assets.
• Safeguards or administers virtual assets (custody).
• Participates in the issuance or sale of a virtual asset.

If you do any of these, you are in the crosshairs. The FATF’s sixth targeted update in June 2025 criticized 'global VASPs' that try to arbitrage weak jurisdictions by locating in countries without licensing regimes while serving clients worldwide via the internet. The message is clear: physical location matters less than where your customers are and where your servers route data.

The Travel Rule: Your Biggest Operational Hurdle

You cannot talk about cross-border crypto without discussing the Travel Rule. Originally designed for wire transfers, this rule was extended to virtual currency transfers valued at 1,000 USD/EUR or more in June 2019. It requires both the originating and beneficiary VASPs to obtain, hold, and transmit key originator and beneficiary identifiers along the payment chain.

What does this look like in practice? When a user sends Bitcoin worth $1,500 from Exchange A to Exchange B, Exchange A must attach the sender’s name, account number, and physical address to the transaction. Exchange B must capture this data and make it available to authorities upon request. This sounds simple, but technically, it is a nightmare. You need robust infrastructure to securely attach this metadata to blockchain transactions, especially when dealing with unhosted wallets or non-compliant foreign exchanges.

Industry feedback suggests that setting up these messaging channels-using protocols like IVMS101 or proprietary APIs-can take 6 to 12 months. Ongoing maintenance costs often amount to low single-digit percentages of operating expenses. If you ignore this, you risk being cut off from compliant counterparties.

European Union: The Power of MiCA Passporting

If you want to serve Europe, you need to understand Markets in Crypto-Assets Regulation (MiCA), which is the EU's comprehensive framework for crypto-assets and service providers. Part II of MiCA, governing Crypto-Asset Service Providers (CASPs), began applying on December 30, 2024. This is the gold standard for regulatory clarity.

MiCA offers a 'passporting' mechanism. Once you are authorized as a CASP in one EU member state, you can provide services throughout the entire EU by simply notifying your home supervisor. You don’t need to reapply for licenses in France, Germany, or Italy. However, there are strings attached:

1. You must meet strict prudential requirements, including initial capital (e.g., €150,000 for certain activities).
2. You must demonstrate adequate AML systems and governance structures.
3. You must notify your home authority of the types of services, the list of EU states where you will operate, and the start date.

Crucially, third-country firms (non-EU companies) cannot directly passport into the EU. You must establish an EU legal entity and secure CASP authorization. During the transitional period ending December 2024, national 'grandfathered' regimes did not confer EU passport rights. So, if you were relying on old Malta or Cyprus licenses, you needed to upgrade to full CASP status to keep your cross-border operations alive.

United States: The Extraterritorial Reach of FinCEN

The US approach is different. It relies on the Bank Secrecy Act (BSA) and treats convertible virtual currency businesses as Money Transmitters under the Money Services Business (MSB) rules. FinCEN’s guidance from March 2013 and May 2019 makes it clear: if you accept and transmit value that substitutes for currency, you are an MSB.

Here is the kicker: these requirements apply equally to domestic and foreign-located CVC money transmitters doing business in whole or in substantial part within the United States. This gives the BSA regime extraterritorial reach. If your exchange serves US customers, even remotely, you likely need to register with FinCEN, implement an AML program, and file Suspicious Activity Reports (SARs) and Currency Transaction Reports (CTRs).

Failure to comply can result in civil and criminal enforcement, with penalties often in the tens of millions of dollars. Moreover, each US state may separately require money-transmitter licensing. This adds another layer of complexity beyond federal registration. Most global exchanges choose one of two paths: geofence US users completely or establish a US entity with a full-scale compliance department.

Singapore: Treating All Transfers as Cross-Border

Singapore is known for its pro-business stance, but its AML rules are tough. The Payment Services Act 2019 (PS Act), amended in April 2024, imposes strict obligations on Digital Payment Token (DPT) service providers. The Monetary Authority of Singapore (MAS) takes a unique stance: it treats all DPT transfers as cross-border in nature.

Why? Because decentralized networks make it difficult to determine transaction locations. MAS argues that treating every transfer as cross-border aligns with FATF standards and prevents regulatory arbitrage. This means licensees engaged in DPT services must comply with value-transfer requirements consistent with the travel rule for every transaction, regardless of value. This is stricter than the FATF’s $1,000 threshold. If you are incorporated in Singapore and provide DPT services anywhere in the world, you need a PS Act licence and must adhere to these rigorous AML/CFT requirements.

Dubai and Hong Kong: Physical Presence and Marketing Triggers

In Dubai, the Virtual Assets Regulatory Authority (VARA) enforces Law No. 4 of 2022. Any entity wishing to carry out regulated virtual-asset activities 'in or from' Dubai must obtain a VASP licence and maintain a physical presence in the Emirate. The licensing process is two-step: first, you submit an Initial Disclosure Questionnaire (IDQ) and get Approval to Incorporate (ATI); then, you finalize incorporation and submit full documentation for the VASP licence. This model ensures close supervisory engagement but can lengthen time-to-market.

Hong Kong uses a similar trigger based on marketing. The Securities and Futures Commission (SFC) requires any person operating a virtual-asset trading platform (VATP) in Hong Kong or actively marketing VATP services to Hong Kong investors to obtain a licence. Even if your exchange is located in London, if you run ads targeting Hong Kong residents, you are breaching the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) if unlicensed. This extraterritorial approach means you must layer SFC conditions with local AML rules and the regulations of your home jurisdiction.

Practical Steps for Implementation

So, how do you actually build this? Here is a practical sequence based on current best practices:

1. Jurisdiction Mapping: Identify where your clients reside and where services are deemed to be provided. Use FATF’s risk-assessment expectations as your anchor. Don't guess; map your user base by IP and KYC data.
2. Determine Licensing Obligations: Do you need a MiCA passport for Europe? An MSB registration for the US? A VARA licence for Dubai? Create a matrix of required licenses versus your target markets.
3. Build Technical Infrastructure: Invest in systems that can detect jurisdiction, screen client locations, and handle travel-rule messaging. This is not just software; it’s your compliance backbone.
4. Establish Local Entities Where Needed: For the EU, you need an EU entity. For the US, consider a subsidiary if you want to serve those customers. For Dubai, you need a physical office.
5. Implement AML Programs: Tailor your transaction monitoring scenarios to cross-border typologies. Ensure you have staff trained to file SARs and CTRs correctly.

Implementation timelines vary. Getting a CASP authorization in Malta can take several months. VARA’s two-step process also spans multiple months due to interviews and beneficial-ownership checks. Plan ahead. Don’t wait until you launch to start talking to regulators.

Future Outlook: Convergence and Fragmentation

Looking ahead to late 2026 and beyond, we see both convergence and fragmentation. On one hand, regimes like MiCA are harmonizing rules across large blocs. On the other, individual jurisdictions like Singapore and Hong Kong are tightening their own screws, often exceeding FATF minimums.

FATF’s June 2025 update warned that non-compliant states may face increased monitoring or inclusion on lists that discourage financial relationships. This pressure is driving new regimes. Analysts predict that over 2025-2027, regulators will increasingly coordinate on passports and mutual recognition but will insist that foreign VASPs serving domestic clients either establish local entities or accept full extraterritorial AML obligations.

The long-term viability of cross-border crypto services hinges on early investment. Firms that embed licensing and AML into their technical stacks from day one will thrive. Those that treat compliance as a checkbox will find themselves locked out of major markets. The era of regulatory arbitrage is ending. Welcome to the era of regulated finance.