Crypto Exchange License in the USA: BitLicense, FinCEN MSB and State Requirements

There is no single crypto exchange license in the USA. Operating a US crypto exchange legally means clearing three distinct layers: federal FinCEN MSB registration under the Bank Secrecy Act, a per-state Money Transmitter License in nearly every state plus DC, and special state regimes led by New York's BitLicense, with a securities and derivatives overlay from the SEC and CFTC sitting on top.

That single fact reshapes every budget, timeline and compliance plan a founder builds. A team that assumes one federal authorization exists, the way it might in Switzerland, Singapore or Japan, will misprice the project by an order of magnitude and miss the state filings that actually gate market entry. This guide maps each layer, names the regulator behind it, cites the controlling federal regulation or state rule, and explains the trigger that pulls your platform into scope. Where the only available figures come from older market estimates rather than primary law, we say so plainly, because on a fast-moving regulatory topic transparency about sourcing is itself a trust signal.

By Magnus Müller · Reviewed by Magnus Müller · Last updated: 2026-06-14

Is there a single crypto exchange license in the USA?

No. The United States has no single, nationwide crypto exchange license. Instead, a crypto exchange clears three layers: federal FinCEN MSB registration (31 CFR 1022.380), a per-state Money Transmitter License in roughly 49 states plus DC, and special state regimes such as New York's BitLicense (23 NYCRR Part 200), with an SEC and CFTC overlay.

The load-bearing reason is dual sovereignty. The US federal government regulates anti-money-laundering through the Treasury's Financial Crimes Enforcement Network, while each of the fifty states (and the District of Columbia) separately licenses the act of transmitting money to its own residents. A federal MSB registration does not grant the right to do business in any particular state, and a state license does not satisfy the federal AML registration. They are cumulative, not alternatives. On top of that, two market regulators, the Securities and Exchange Commission and the Commodity Futures Trading Commission, can attach depending on what your platform actually trades. For a broader view across the whole country, including activities beyond running an exchange, see our US crypto licensing overview.

The three-layer model at a glance

The cleanest way to think about US crypto exchange authorization is as a stack, where each layer is triggered by a different activity:

• Layer 1, Federal, FinCEN MSB registration. Triggered the moment you accept and transmit value that substitutes for currency. Mandatory nationwide, filed via BSA E-Filing within 180 days, renewed every two years.
• Layer 2, State, Money Transmitter Licenses. Triggered by serving the residents of a given state. Roughly 49 states plus DC require it, mostly through the NMLS platform, increasingly standardized by the CSBS Money Transmission Modernization Act.
• Layer 3, State special regimes. Triggered by virtual currency business activity in specific states, most prominently New York's BitLicense under 23 NYCRR Part 200, with California's bespoke regime phasing in.
• Overlay, SEC and CFTC. Triggered by what you trade: securities (SEC, via the Howey test) or commodity derivatives (CFTC).

This stack model is reinforced by Infographic 1 below. Each layer adds its own application, its own regulator, and its own ongoing obligations.

Which regulators govern a US crypto exchange?

A US crypto exchange answers to several authorities at once. Understanding which one owns which question is half the battle:

Two further authorities apply as compliance overlays rather than licensing layers: the Office of Foreign Assets Control (OFAC) for sanctions screening, and the Internal Revenue Service (IRS) for taxation. Infographic 2 maps these regulators across the federal, state and overlay tiers.

Layer 1, Federal: FinCEN MSB registration

The federal layer is the one rule that applies to every US crypto exchange without exception. The Financial Crimes Enforcement Network, a bureau of the US Treasury, administers the Bank Secrecy Act, and under it a crypto exchange is classified as a money transmitter, a type of money services business (MSB). FinCEN consolidated how this applies to crypto in guidance FIN-2019-G001, issued on May 9, 2019, which confirmed that convertible virtual currency exchangers and administrators are money transmitters.

Why a crypto exchange is a "money transmitter"

A money transmitter is defined under 31 CFR 1010.100(ff). Money transmission services means the acceptance of currency, funds, or other value that substitutes for currency from one person, and the transmission of that value to another location or person by any means. A crypto exchange accepts and moves value that substitutes for currency, so it falls squarely inside this definition.

The same regulation lists exclusions, and they matter for borderline business models. Excluded from "money transmitter" status are providers of delivery, communication or network-access services used by a transmitter; payment processors facilitating the purchase of goods or services; operators of a clearance-and-settlement system acting solely between BSA-regulated institutions; physical currency transporters; and acceptance or transmission of value that is integral to the sale of goods or the provision of services. FIN-2019-G001 also addresses peer-to-peer exchangers, hosted and unhosted wallet providers, crypto kiosks, mining and ICOs, so a model that looks adjacent to "running an exchange" still needs its own classification analysis.

The 180-day registration deadline and 2-year renewal

The registration mechanics live in 31 CFR 1022.380, and they are precise:

1. Register with FinCEN. Each money services business must register, whether or not it is also licensed as an MSB by any state.
2. File via BSA E-Filing. The MSB registration form is submitted electronically through FinCEN's BSA E-Filing system.
3. Meet the 180-day deadline. Initial registration must be filed on or before the end of the 180-day period beginning the day after the business is established.
4. Renew every two years. Registration runs in two-calendar-year periods, and each subsequent period is a renewal period.
5. Re-register on key changes. Re-registration is required on a change of ownership or control, a transfer of more than 10% of voting power or equity, or a more than 50% increase in the number of agents during a registration period.

Agents that qualify as MSBs solely because they act as an agent are exempt; the principal carries the registration obligation. Processing the federal registration itself is typically a matter of weeks, which makes it the fastest layer to clear, though that speed is deceptive because the state layer is far slower.

The four-pillar AML program

Registration is only the entry ticket. Every MSB must develop, implement and maintain a written anti-money-laundering program commensurate with its risks, under 31 CFR 1022.210. The program rests on four pillars:

• Policies, procedures and internal controls designed to manage the platform's specific money-laundering and terrorist-financing risks.
• A designated compliance officer responsible for day-to-day program administration.
• Ongoing training and education for relevant personnel.
• Independent review of the program, conducted by someone other than the compliance officer.

On top of the four pillars come the broader Bank Secrecy Act obligations: filing Suspicious Activity Reports (SARs), Currency Transaction Reports (CTRs), keeping records, and applying the Travel Rule to qualifying transfers. These obligations form the backbone of the compliance program your platform will run every day after launch, and they connect directly to the wider AML and KYC requirements that govern any licensed crypto business.

Layer 2, State: Money Transmitter Licenses (MTLs)

If the federal layer is the entry ticket, the state layer is where most of the time, cost and friction actually live. Nearly every state plus the District of Columbia requires a money transmitter license to serve that state's residents, and there is no single multistate license that covers them all. Each state grants its own. That is why a serious US launch can mean assembling roughly 49 separate authorizations rather than one.

How NMLS and the per-state patchwork works

Most states process money-transmitter applications through the Nationwide Multistate Licensing System (NMLS), the same platform used for mortgage and other financial licensing. NMLS gives applicants a common front door, but it does not collapse the requirements into one license: each state still reviews, conditions and grants its own authorization, and you still hold a separate license per state.

This answers a question founders ask constantly. You generally do need a license in every state where you serve customers, not just the state where your company is incorporated. The practical sequencing question, which states to enter first and in what order, is a strategic decision rather than a regulatory one, and it usually tracks where your target users actually are.

The Money Transmission Modernization Act (MTMA)

The modern framework that is quietly reshaping this patchwork is the Conference of State Bank Supervisors' Money Transmission Modernization Act (MTMA), a model state law that standardizes the core requirements across states: net worth (capital), surety bond, and permissible-investments (liquidity) rules. According to CSBS, around 31 states have enacted the MTMA in full or in part, and the adopting states represent roughly 99% of reported money-transmission activity.

The adoption timeline shows how fast this is moving: Arizona in 2022; Arkansas, California, Georgia, Hawaii, Indiana and Iowa in 2023; Connecticut, Illinois, Kansas, Maine, Missouri, New Hampshire, North Dakota and Rhode Island in 2024; and Colorado, Massachusetts, Mississippi, Nebraska and Virginia in 2025. The direction of travel is toward harmonization, which over time should make multi-state expansion more predictable, though for now applicants still navigate genuine state-by-state variation. Most competitor guides omit the MTMA entirely, which is exactly why it belongs at the center of any current US analysis.

Typical per-state requirements

Under the MTMA and individual state laws, the recurring asks across states include:

• Minimum net worth (capital), scaled to the size of the operation.
• A surety bond, with the amount varying by state and by transmission volume.
• Permissible investments backing outstanding customer obligations (a liquidity buffer).
• Fingerprint and background checks on key individuals and beneficial owners.
• A business plan, an AML program, financials and audits.
• Periodic reporting and renewal on each state's cadence.

Because state filings drive both the timeline and the bulk of professional cost, founders weighing the full investment should read our budget for an exchange license guide, which treats cost separately and in detail.

Layer 3, Special state regimes: NY BitLicense and beyond

A handful of states layer their own bespoke virtual-currency regime on top of, or in place of, the ordinary money-transmitter route. New York's BitLicense is the most consequential, and for many global exchanges it is the single hardest US authorization to obtain.

What the BitLicense covers (and who is exempt)

The BitLicense lives in 23 NYCRR Part 200. Section 200.3(a) is categorical: no person shall, without a license obtained from the superintendent, engage in any virtual currency business activity. Section 200.2(q) defines that activity to include:

• receiving virtual currency for transmission or transmitting virtual currency (other than nominal, non-financial transfers);
• storing, holding or maintaining custody or control of virtual currency on behalf of others;
• buying and selling virtual currency as a customer business;
• performing exchange services as a customer business;
• controlling, administering or issuing a virtual currency.

The rule also carves out exemptions: personal investing, merchants accepting crypto as payment, charitable donations, mining, private sales, software development, and financial advisory services. A genuine exchange will almost always fall inside the licensable categories rather than the exemptions.

BitLicense capital, surety bond and cybersecurity requirements

New York's substantive requirements are exacting. Capitalization under 23 NYCRR 200.8 is set case by case by the superintendent, based on the applicant's business model and risk profile. A surety bond or trust account for customer protection is required under 23 NYCRR 200.9, generally a USD 500,000 minimum, adjustable to the business model. On top of that sit a transaction-monitoring and filtering program under 23 NYCRR Part 504 and a dedicated cybersecurity program.

New York also charges an application fee and ongoing annual assessments. The DFS overview page does not state a specific dollar amount, and a commonly cited figure should be verified directly against the live application form before any number is relied upon (see Open questions). For a full walk-through of the filing itself, see our guide to the New York BitLicense application.

BitLicense vs the NY limited-purpose trust charter

New York offers an alternative path that materially changes what a company can do. A limited-purpose trust charter allows the holder to exercise fiduciary powers and to conduct money transmission without a separate money transmitter license. A BitLicensee, by contrast, cannot exercise fiduciary powers. For an exchange that also wants to act as a regulated custodian holding assets in trust, the charter route can be more powerful, though it is a heavier authorization to obtain. The right choice depends on whether your model needs fiduciary capacity at all.

Other special regimes (California DFAL)

California is the other state moving toward a bespoke regime, through the Department of Financial Protection and Innovation's Digital Financial Assets Law (DFAL). The exact effective date and scope were not confirmed from a primary source in this round of research, so we describe it cautiously: California's DFPI regime is phasing in, and any operator targeting California should verify the current effective date and licensing scope directly with the DFPI before relying on it. We will not assert a specific year here without that confirmation (see Open questions).

The SEC and CFTC overlay

The three licensing layers govern the act of moving money and serving customers. What you actually list for trading can pull in a second category of regulator entirely: the market authorities. This is an overlay, not a fourth licensing layer, but ignoring it can be fatal.

When the SEC gets involved (the Howey test)

The Securities and Exchange Commission gets involved when a traded token is an "investment contract," and therefore a security, under the Howey test. The test asks whether there is an investment of money in a common enterprise with a reasonable expectation of profit derived from the efforts of others. If a token meets it, securities law attaches, and a platform that trades crypto-securities may need to register as a national securities exchange, an alternative trading system (ATS), or a broker-dealer, sometimes more than one of these.

The SEC has published a staff "Framework for 'Investment Contract' Analysis of Digital Assets" applying Howey to tokens. The framework's existence and Howey basis are well established, though the live SEC page should be re-checked and quoted directly before relying on its precise wording (see Open questions).

When the CFTC gets involved (crypto as a commodity)

The Commodity Futures Trading Commission treats virtual currencies, including Bitcoin, as commodities under the Commodity Exchange Act. That gives the CFTC jurisdiction over crypto derivatives, meaning futures, swaps and options, and over fraud and manipulation in spot and cash crypto markets even where it does not directly license the venue.

A platform that offers crypto derivatives, as opposed to plain spot trading, may need to register in a derivatives capacity (for example as a designated contract market, a swap execution facility, or a futures commission merchant). The precise registration thresholds were not enumerated on the CFTC's digital-assets landing page in this research round, so we flag them as items to verify rather than assert (see Open questions).

OFAC and IRS as compliance overlays

Two more federal authorities sit beside the licensing stack as compliance overlays. The Office of Foreign Assets Control requires sanctions screening of customers and counterparties, an obligation that runs continuously rather than at a licensing moment. The Internal Revenue Service governs taxation: the precise current treatment of digital assets and the related information-reporting rules were not re-confirmed from a primary source this round, so any specific tax claim should be verified against current IRS guidance before publishing (see Open questions). Neither agency issues an operating license, but both shape day-to-day operations.

How to license a crypto exchange in the USA: process and timeline

With the layers mapped, the practical question is sequence: what gets filed, in what order, and how long it realistically takes.

Step-by-step application sequence

A typical US-bound exchange follows this order:

1. Classify the business model and tokens. Decide whether you are federal-only, federal plus selected state MTLs, or federal plus state plus a BitLicense, and run a securities and derivatives review against the SEC and CFTC overlay.
2. Form a US legal entity (LLC or corporation) and appoint a compliance and AML officer.
3. Register the MSB with FinCEN via BSA E-Filing, within 180 days of establishment, and stand up the written four-pillar AML program.
4. Assemble documentation: corporate and ownership records, the AML and KYC program, a business plan, financials, and risk and IT-security policies.
5. File state MTL applications via NMLS, including surety bonds, net-worth proof, and background and fingerprint checks, state by state.
6. Apply for the NY BitLicense (and any other special state regime) if you intend to serve those states.
7. Build banking relationships and respond to regulator review, then launch on approval.

This sequencing, and the choice of which path to take, is exactly the kind of structuring decision a founder should pin down before spending on filings. The broader playbook sits in our pillar guide on how to start a licensed crypto exchange.

Indicative timeline and cost (and why we cite sources)

On timeline, only the federal layer has a clean primary-sourced number: FinCEN MSB registration must be filed within 180 days and processes in weeks. State money transmitter licensing is the slow part, commonly cited at 6 to 18 months per state, but that range comes from market experience rather than a single primary statute, so we present it as indicative rather than fact.

On cost, we deliberately do not publish hard dollar figures here. The dollar ranges that circulate for per-state MTLs and multi-state buildouts are not primary-sourced, and on a YMYL regulatory topic an unsourced number is worse than no number. We treat cost separately, with the same sourcing discipline, in the dedicated budget for an exchange license guide. The principle holds across our country pages: facts get cited, estimates get labelled.

Have questions about your specific situation? Book a free 15-minute discovery call with our licensed advisers, no commitment. Book a Call

Ongoing compliance after licensing

Licensing is the beginning, not the end. Every layer carries continuing obligations, and lapses can cost an exchange its authorization in any single state or at the federal level.

Federal and state renewals

Federal MSB registration must be renewed every two years, in line with the two-calendar-year period structure of 31 CFR 1022.380, and re-registration is triggered by qualifying ownership or agent changes during a period. Each state money transmitter license carries its own renewal cadence, reporting calendar and fee schedule, so a multi-state exchange manages many overlapping renewal clocks rather than one.

Reporting, audits and AML maintenance

The day-to-day compliance load is substantial. Across the federal layer, an exchange files Suspicious Activity Reports and Currency Transaction Reports, applies the Travel Rule, and keeps the four-pillar AML program live with ongoing training and independent review under 31 CFR 1022.210. In New York, the additional transaction-monitoring and filtering obligations under Part 504, plus the cybersecurity program, run continuously under 23 NYCRR Part 200. State examinations, periodic financial reporting and surety-bond maintenance round out the picture.

How Crypto Valley Partners helps US-bound exchanges

Crypto Valley Partners AG is based in Zug, the heart of Switzerland's Crypto Valley, and advises founders and operators on obtaining and maintaining crypto licenses across jurisdictions. The US is one of the most layered regimes we work with, and the value of advance structuring is highest precisely where the stack is deepest.

From our practice: the first decision that defines a US engagement is scope, federal-only versus federal plus a defined set of state MTLs versus federal plus state plus a New York BitLicense. Getting that scope right early, against the actual location of your target users and the actual tokens you intend to list, is what keeps a US launch from drifting into open-ended cost. We work alongside US counsel on the filings themselves and focus on the cross-border structuring, the jurisdiction-selection logic, and the compliance architecture that travels with you. Founders comparing the US against other major venues often look next at Japan's FSA registration as a contrast in regime design.

Our differentiation is breadth of jurisdiction coverage, primary-source regulatory depth, and Swiss credibility, not a price list. If you are weighing a US entry, the most useful next step is a focused conversation about your specific model.