Crypto exchange regulation in 2026 is fragmented by jurisdiction: the EU requires a CASP authorisation under MiCA (mandatory bloc-wide since 1 July 2026, via national regulators reporting to ESMA); the UK runs a separate FCA regime, currently an AML/CTF registration transitioning to full FSMA authorisation (applications open 30 September 2026, mandatory from 25 October 2027); Singapore requires a Major Payment Institution/Digital Payment Token licence under the Payment Services Act, supervised by MAS; the UAE (Dubai) requires a VARA licence plus federal SCA oversight elsewhere in the country; Australia requires AUSTRAC registration as a digital currency exchange, with ASIC reforms to crypto asset regulation ongoing; and the US splits oversight between the SEC, CFTC and state-level money-transmitter licensing, with no single federal crypto exchange licence yet. Always verify any exchange's current status on the named regulator's own register before depositing funds. This is information, not financial advice.
European Union — MiCA and the CASP authorisation
The EU regulates crypto exchanges under the Markets in Crypto-Assets Regulation (MiCA), which requires any firm offering crypto-asset services to EU clients to hold a Crypto-Asset Service Provider (CASP) authorisation from a national competent authority — for example Luxembourg's CSSF, Ireland's Central Bank, Malta's MFSA or Austria's FMA. MiCA's transitional period, during which firms could keep operating under earlier national registrations, ended EU-wide on 1 July 2026 with no extension, so any exchange serving EU clients without a CASP authorisation is now operating in breach of EU law.
For a UK/EU retail user, a CASP authorisation matters because it is what makes an exchange legally allowed to onboard EU clients and to passport that authorisation across the whole bloc from a single national licence. To verify a specific exchange, check the national regulator that granted its authorisation (CSSF, Central Bank of Ireland, MFSA and FMA each publish their own supervised-entity lists) and cross-reference against ESMA's consolidated MiCA register, which aggregates authorisations reported by national regulators.
United Kingdom — FCA, and the shift from AML registration to full authorisation
The UK runs its own regime, separate from MiCA post-Brexit. Since 2020, crypto exchanges serving UK customers have needed to register with the FCA under the Money Laundering Regulations — a lighter AML/CTF registration, not a full financial-services authorisation. That is changing: the FCA finalised rules for a full FSMA authorisation regime for cryptoassets in June 2026, comparable in weight to authorisation for a bank or investment firm. Applications open 30 September 2026 and close 28 February 2027, with the mandatory regime starting 25 October 2027.
For now, the practical check for a UK user is simple: search the exchange's name on the FCA's public register. A live AML registration means the firm has passed anti-money-laundering vetting; it does not yet mean full FSMA-grade consumer protections apply, since those only become mandatory once the new regime lands in October 2027.
Singapore — MAS and the Payment Services Act
Singapore regulates crypto exchanges through the Monetary Authority of Singapore (MAS) under the Payment Services Act 2019. Firms offering digital payment token (DPT) services to Singapore customers need a Major Payment Institution licence covering the DPT service class, and MAS has separately published guidelines restricting how licensed DPT providers can promote their services to the general public, reflecting a retail-caution stance rather than a promotional one.
MAS also maintains a newer, related regime for Digital Token Service Providers under the Financial Services and Markets Act 2022, aimed at firms based in Singapore but serving customers only overseas — a category that previously sat in a licensing gap. To verify a specific exchange's Singapore status, search MAS's own Financial Institutions Directory rather than a third-party summary, since license classes and provider names are updated there directly.
UAE / Dubai — VARA plus federal SCA oversight
The United Arab Emirates has a two-track structure. In the Emirate of Dubai (excluding the DIFC financial free zone), crypto exchanges must be licensed by the Virtual Assets Regulatory Authority (VARA), which since 2022 has governed activities including exchange services, broker-dealer services, custody and lending across eight defined licence categories. Firms operating in DIFC fall under the Dubai Financial Services Authority instead, and activity elsewhere in the UAE falls to the federal Securities and Commodities Authority (SCA).
This overlapping structure means the right question for a user is not just "is this exchange licensed in the UAE" but "licensed by which UAE authority, and for which emirate or free zone." VARA publishes its own public register of licensed entities and licence categories, which is the primary source to check for any Dubai-facing exchange.
Australia — AUSTRAC registration and incoming ASIC reform
Australia has required digital currency exchange (DCE) providers to register with AUSTRAC, the country's financial intelligence and AML/CTF regulator, since 2018. AUSTRAC registration is an anti-money-laundering compliance requirement rather than a full financial-services licence, and DCE registrations must be renewed every three years; AUSTRAC can refuse, suspend or cancel a registration where it assesses unacceptable money-laundering or terrorism-financing risk.
Separately, the Australian Securities and Investments Commission (ASIC) has been working through broader crypto-asset regulatory reforms through 2025–2026, which are expected to bring more crypto products and platforms within mainstream financial-services licensing over time. As of mid-2026 this reform work is reportedly still underway rather than finalised, so AUSTRAC registration remains the primary baseline check for an Australian-facing exchange; verify the detail of any newer ASIC-specific licensing requirement directly with ASIC before treating it as settled.
United States — a split SEC/CFTC/state model, no single federal licence
The US has no single federal licence for crypto exchanges. Oversight is split: the Securities and Exchange Commission (SEC) asserts jurisdiction where tokens or products are deemed securities, the Commodity Futures Trading Commission (CFTC) has jurisdiction over crypto derivatives and, increasingly, aspects of spot-commodity markets, and individual states require money-transmitter licences (or, in New York, the specific BitLicense) for exchanges handling customer funds within that state.
For a US-facing exchange, this means genuine compliance is a patchwork rather than a single stamp of approval — a platform can hold state money-transmitter licences in most states while still facing open questions about SEC or CFTC jurisdiction over specific products it lists. Given how actively this landscape has been shifting, verify any US regulatory claim about a specific exchange directly against the relevant regulator's own enforcement or registration pages rather than relying on the exchange's own marketing.
Frequently asked questions
Is a crypto exchange regulated in one country automatically regulated everywhere?
No, generally not — with one partial exception. Inside the EU, a CASP authorisation from one member state can be passported to serve clients across the whole bloc under MiCA. Outside that, licences are jurisdiction-specific: an FCA UK registration does not cover the EU, a MAS Singapore licence does not cover the UAE, and so on. Always check the specific regulator relevant to your own country of residence.
What does MiCA authorisation actually require of an exchange?
MiCA requires a Crypto-Asset Service Provider (CASP) authorisation from a national regulator in an EU/EEA member state — covering governance, capital, safeguarding of client assets, and conduct requirements — before the firm can lawfully offer crypto services to EU clients. The transitional grace period for firms operating under older national rules ended EU-wide on 1 July 2026, so post that date, unauthorised EU-facing operation is a breach of EU law, not a grey area.
Why does the UK have a different regime from the EU if it used to follow EU rules?
The UK left the EU's regulatory orbit after Brexit and has built its own cryptoasset framework independently of MiCA. It currently runs a lighter FCA anti-money-laundering registration regime, which is being replaced by a full FSMA authorisation regime with applications opening 30 September 2026 and the mandatory regime starting 25 October 2027. An EU MiCA authorisation does not substitute for UK FCA status, and vice versa.
Which regulator should I check for an exchange operating in Dubai?
It depends on where in the UAE the entity is licensed. Most Dubai-facing crypto exchanges are licensed by VARA (the Virtual Assets Regulatory Authority) for mainland Dubai and most Dubai free zones, but firms based in the DIFC financial free zone fall under the Dubai Financial Services Authority instead, and activity elsewhere in the UAE falls under the federal Securities and Commodities Authority. Confirm which authority actually issued the licence before assuming VARA coverage.
Does AUSTRAC registration mean an exchange is fully regulated in Australia?
AUSTRAC registration only confirms AML/CTF (anti-money-laundering) compliance for a digital currency exchange provider — it is not a full financial-services licence in the way a banking or securities licence would be. ASIC has reportedly been developing broader crypto-asset regulatory reforms through 2025–2026 that may extend fuller financial-services-style licensing to some crypto platforms; verify directly with ASIC whether a specific product or platform falls under any newer requirement.
Is there a single US regulator for crypto exchanges, similar to the FCA or MAS?
No. The US splits oversight between the SEC (securities-classified tokens/products), the CFTC (derivatives and some spot-commodity oversight) and individual states, which require their own money-transmitter licences (New York's BitLicense being the best-known example). There is currently no single unified federal licence covering crypto exchange activity comparable to the FCA in the UK or MAS in Singapore.
Sources & further reading
- ESMA — Markets in Crypto-Assets Regulation (MiCA) overview and register
- CSSF (Luxembourg) — Crypto-Asset Service Providers (CASP)
- FCA — A new regime for cryptoasset regulation
- FCA — Registered Cryptoasset Firms (public register)
- MAS — Licensing for Payment Service Providers
- MAS — Financial Institutions Directory (verify a specific licence)
- VARA — Virtual Assets Regulatory Authority (Dubai), official site
- AUSTRAC — Digital currency exchange provider registration
An independent publisher mapping the regulation of cryptocurrency exchanges. Our editorial desk verifies every licence and availability claim against primary sources — the ESMA MiCA register, the FCA register, ASIC, MAS, VARA and each exchange's own terms — and never accepts payment for a better assessment or placement. We publish information only; nothing here is financial advice.