Crypto partner licence checks before signing

Procurement should request the draft agreement, account-opening terms and a service description before searching. Obtain:

• The contracting company’s full legal name, incorporation country, company number and registered address.
• Trading names, former names and the group relationship, supported by corporate records.
• Each regulatory reference: the FCA firm reference number, EU legal entity identifier and national reference, VARA reference, or Singapore Unique Entity Number and MAS directory entry.
• Website domains, regional website paths, app publisher, support addresses and the proposed payment recipient.
• The identity and role of each company providing custody, trading, execution, transfers or another part of the service.

Separate the incorporation number from the regulatory reference. A corporate extract helps establish identity; it does not establish permission for a regulated service. Record the provider’s claimed legal basis alongside the exact entity and activity. The relevant UK, EU and Dubai rules attach requirements to the person conducting the activity. MAS’s licensing guidance likewise requires the service provider to establish its licence or exemption. (Money Laundering Regulations 2017, regulations 8 and 56; MiCA, Article 59(1); VARA, Virtual Assets and Related Activities Regulations 2023 (VARA Regulations), III.A.1; MAS PS-G01, paragraph 2.1.)

Ask the provider to explain any different company named in the website footer, privacy notice, invoice or custody terms. Different entities can have legitimate roles, but the explanation must identify who owes each obligation and who performs the service. A privacy contact or software supplier need not be the regulated provider. Legal should test the actual conduct before requiring a change of contracting entity.

Freeze the scope in writing: services, assets, operating locations, customer countries and customer categories. Also state whether the business will use its own treasury assets or handle assets for others. A permission assessment for one arrangement should not be reused for a materially different service.

Compliance should navigate from the regulator’s own website. Search the exact legal name and regulatory identifier, then check trading names and former names. Save the individual record and relevant notices, rather than a search-results screenshot alone.

Licentium’s register pages can help locate names. The evidence supporting the decision should come from the regulator, including any permission document or clarification needed to interpret its public record.

UK FCA records

Use the FCA Financial Services Register for the detailed regulatory and historical record. Record the firm reference number, legal and trading names, status, relevant business categories, restrictions, requirements and contact details. Check the Warning List separately. The FCA crypto register provides the starting context for this registration category. (FCA, How to check a firm or individual is authorised, “If you want to check a firm’s historical record” and “Firm information and contact details”.)

For cryptoasset exchange and custodian wallet businesses within the UK scope, the current registration obligation arises under the Money Laundering Regulations. Registration does not itself establish permission for every investment, payment or other regulated service. Where an activity falls outside Financial Ombudsman Service jurisdiction or Financial Services Compensation Scheme protection, regulation 60A requires the cryptoasset business to explain the relevant absence before the relationship or transaction starts. Obtain that disclosure; do not infer coverage from a register entry. (Money Laundering Regulations 2017, regulations 8, 14A, 56 and 60A; FSMA 2000, section 19.)

A pending application is not registration. For a contract continuing into the new regime, obtain a separate authorisation and continuity plan. The application period runs from 30 September 2026 to 28 February 2027; full commencement is 25 October 2027. Existing registration does not convert automatically. Any proposed saving or run-off route needs its conditions checked against the provider and contract. (SI 2026/102, regulations 1 and 52–57; FCA direction under regulation 52, 20 February 2026, paragraph 2.)

EU MiCA records

Open ESMA’s MiCA register and select the crypto-asset service provider data. Match the legal name and LEI. Read all matching rows, including the home authority, legal basis, authorised or notified services, countries, relevant dates, withdrawal information, websites and comments. Clarify any blank field needed to establish the proposed service’s legal basis or scope. The MiCA registers help distinguish CASP records from issuer and white-paper records. (MiCA, Article 109(5); ESMA, Interim MiCA Register and accompanying field descriptions.)

An entry can remain after withdrawal, including withdrawal affecting only one service. Check the end dates and underlying decision before relying on a returned result. (MiCA, Articles 64(4) and 109(7).)

Reconcile ESMA’s entry with the home national regulator’s record and the permission or notification evidence. For a French provider, use the AMF’s list of crypto-asset service providers and its individual entry. A provider from another Member State requires that state’s competent authority. ESMA aggregates national information; it does not grant CASP authorisations. Its published data can lag a national decision. Resolve an inconsistency with the responsible authority before treating either record as conclusive. (MiCA, Articles 63 and 109(1), (5) and (7).)

An eligible financial institution can use Article 60 for the services that provision permits, subject to its notification requirements. Ask which route applies and obtain evidence that its conditions and timing were met. Article 60(8) prohibits commencement while the notification remains incomplete. A bank or investment-firm label alone does not establish the subsidiary’s status. At 29 October 2026, an old national crypto registration cannot support continued business through MiCA’s expired grandfathering period. A pending CASP application does not extend it. (MiCA, Articles 59–60 and 143(3).)

Dubai VARA records

Open VARA’s Public Register and the individual provider record. Read the licence type before the activity list or status label. Capture the reference, licensed activities, issue date, current status, website, address and licence conditions, including permitted investor classes. The VARA register provides a reader route into this market’s records. (VARA Public Register; Market Conduct Rulebook, IV.A.1 and V.A.1.)

An In-Principle Approval can appear in the register with activity descriptions. VARA expressly prohibits an IPA holder from starting operations, conducting virtual-asset activities or serving clients before receiving its full VASP licence. Hold activation and asset transfers until the required operating authority and conditions are evidenced. (VARA Public Register, introductory notice.)

Where a group company claims Sponsored VASP status, obtain VARA’s approval of the sponsor and VARA’s approval of the specific relationship. Check the sponsored entity’s own authorisation number, activities, restrictions and validity. The approved route has distinct conditions and disclosure requirements. Common ownership and a commercial agreement alone do not establish it. (VARA Compliance and Risk Management Rulebook, VII.B.1, VII.D.1–3 and VII.E.1–3.)

Singapore MAS records

Search MAS’s Financial Institutions Directory by legal name and filter for Digital Payment Token Service. Open the entity’s details and check the listed activity, licence type or status, address and available contact information. An entry for another payment service is insufficient. The MAS DPT register provides an additional route for identifying the relevant company. (MAS, Financial Institutions Directory; PS-G01, paragraphs 2.1–2.3 and Table 1.)

Obtain the licence and conditions where the directory leaves the proposed scope unclear. If the provider relies on an exemption, require its precise basis and supporting evidence. MAS maintains separate lists for temporary exemptions and entities whose exemptions have ended. Its 2024 transitional route can preserve a qualifying exemption while an application is assessed, subject to the required steps. Those entities are not licensed for the expanded-scope services merely because they appear on that list. An application or in-principle approval alone cannot establish a current licence or exemption. (MAS, Payments, “Directories and Listing”; Entities that have notified MAS pursuant to the Transitional Regulations 2024, introductory paragraphs.)

Legal and the operational team should map what the provider will actually do. Identify who accepts orders, exchanges assets, controls private keys, approves withdrawals and initiates transfers. Classify those functions under each relevant regime. Use the resulting service descriptions in the contract and account configuration.

A UK exchange-provider definition includes arranging crypto exchanges. Under MiCA, exchange, custody, order execution and transfer services are distinct categories. VARA’s Schedule 1 also distinguishes activities. MAS’s DPT category encompasses several functions, including transfers and custody. Matching a label across jurisdictions without checking its definition can miss a required permission. (Money Laundering Regulations 2017, regulation 14A; MiCA, Article 3(1)(16)–(26); VARA Regulations, Schedule 1; MAS PS-G01, Table 1, Activity F.)

If the proposed product includes tokenised securities, derivatives, lending or payment services, obtain a separate perimeter assessment where the crypto permission does not resolve that activity. MiCA excludes financial instruments from its scope. MAS also distinguishes DPT services from activities governed by securities legislation. Remove an unsupported product from the service schedule until the correct permission or applicable exclusion is established. (MiCA, Article 2(4)(a); MAS, MAS Clarifies Regulatory Regime for Digital Token Service Providers, 6 June 2025, paragraph 3 and footnote.)

Check both operating and customer countries

Record where the service is performed and where it is offered. A Dubai or Singapore permission does not establish the legal basis for providing the same service to an EU customer. For an EU provider serving another Member State, check the Article 65 notification. Service can begin upon receipt of the home authority’s communication under Article 65(3). Alternatively, it can begin at the latest on the fifteenth calendar day after submission of the required information. The underlying Article 59 entitlement remains necessary. A list of intended markets in a sales presentation is insufficient evidence that the procedure was completed. (MiCA, Articles 59(7) and 65(1)–(4).)

A third-country firm relying on an EU customer’s exclusive initiative needs a separate Article 61 assessment. Solicitation by the firm, an entity acting on its behalf or a closely linked entity can defeat that route. A contractual declaration cannot reverse the actual acquisition history. Legal should review the relevant advertising, introductions and contact records before accepting the claimed exception. (MiCA, Article 61; ESMA Guidelines on reverse solicitation under MiCA, paragraphs 22–28.)

For the UK, distinguish the current MLR test for business carried on in the UK from the financial-promotion rules. An overseas provider’s communications can engage section 21 when capable of having an effect in the UK. Confirm the lawful communication route and applicable conditions separately from the provider’s registration status. A corporate customer’s description as professional does not establish an exemption. (Money Laundering Regulations 2017, regulation 8; FSMA 2000, section 21(1)–(3); FCA, Cryptoasset firms marketing to UK consumers, “Communication routes”.)

VARA’s jurisdiction covers Dubai outside the DIFC. A claim involving the DIFC or another UAE jurisdiction needs the relevant regulator checked separately. A VARA provider operating abroad must also comply with applicable foreign requirements. Its licence does not resolve every payment-token or other separately regulated activity. (Dubai Law No. 4 of 2022, Article 3; VARA Regulations, III.A.4 and IV.A.4.)

For Singapore, check the home-country position even where customers are overseas. MAS states that, from 30 June 2025, providers within its overseas-only digital-token regime require a licence and must cease the regulated activity without one. MAS generally will not issue these licences. Providers already serving Singapore customers under the existing regimes require a different assessment. A foreign licence cannot settle which Singapore route applies. (MAS, MAS Clarifies Regulatory Regime for Digital Token Service Providers, 6 June 2025, paragraphs 2–5.)

Check the actual customer category

An external business customer remains a client under MiCA. The narrow exclusion for exclusively intragroup services does not extend to external procurement merely because the supplier belongs to a group. (MiCA, Articles 2(2)(a) and 3(1)(39).)

An incorporated business is not automatically an institutional, qualified or accredited investor. Obtain the classification evidence and any required consent. VARA licence conditions can restrict the permitted investor classes. MAS’s consumer-protection guidelines define retail customers and the accredited-investor opt-in process; an ordinary corporate treasury customer can remain within the retail definition. (VARA Market Conduct Rulebook, IV.A.1–4; MAS PS-G03, paragraphs 2.1.1–2.1.2.)

That classification can change the product decision. MAS’s guidelines state expectations against lending or staking retail customers’ assets and against specified retail credit, leverage and derivatives arrangements. These are supervisory expectations; they must be distinguished from statutory prohibitions and licence conditions. Require the provider to explain how the proposed service complies, and disable an incompatible feature before activation. (MAS PS-G03, paragraphs 1.3, 3.7 and 4.4.)

Procurement should compare the agreement, onboarding screens, regional domain, app and payment instructions with the verified entity record. Call back through independently verified official contact details. A copied firm reference number can belong to the genuine business while the email address or payment recipient belongs to an impersonator. (FCA, Clone firms and individuals, “How clone firms work” and “Avoid clone firms”.)

Ask the provider to substantiate a domain change or missing website entry. Preserve the explanation and confirmation obtained through the genuine firm’s contact channel. A missing domain field is unresolved evidence; an exact name match does not authenticate the person communicating with the buyer.

Where a licensed group company is presented as the provider but another company performs a material service, legal should examine that allocation. Change both the contract and delivery arrangements if the wrong entity is responsible. An authorised EU custodian outsourcing custody must use a provider authorised under Article 59 and inform clients. An affiliate’s technology agreement cannot displace that requirement. (MiCA, Articles 73 and 75(9).)

Check the FCA Warning List, ESMA’s non-compliant-entity register, the relevant national warnings, VARA enforcement notices and MAS’s Investor Alert List. Match the legal entity and domain, read the allegation or operative decision, and distinguish a clone warning from action against the genuine firm. MAS’s Investor Alert List is non-exhaustive and states that it no longer publishes identifiers of entities impersonating regulated institutions. An absence there cannot clear a suspected clone. (MiCA, Article 110; FCA Warning List; VARA, Unlicensed VASPs; MAS Investor Alert List.)

Read restrictions by activity and effective date. A withdrawn application differs from a withdrawn licence; a fine does not necessarily revoke permission. For a VARA suspension, the end of its stated period does not automatically establish permission to resume. Obtain the required VARA approval unless the notice expressly provides for automatic resumption. (VARA Regulations, IV.B.2.)

Create a record for each entity, service and territory combination. Record the legal name and identifier, group role, exact activity, customer category, destination and legal basis. Add the status, restrictions, official source, relevant permission dates, retrieval date and saved evidence. Keep the source’s update date separate from the date the reviewer checked it. A website update date is not a licence-grant date.

For every discrepancy, state the required follow-up, its owner and the condition that closes it. The decision should take one of these forms:

• Proceed for the specified services and markets once the required permission or exemption, conditions and entity allocation are evidenced.
• Correct the agreement, onboarding journey or service configuration, then recheck the changed arrangement before activation.
• Hold the affected activity while a missing condition, conflicting record, claimed exemption or unclear restriction is resolved with the provider or regulator.
• Decline the proposed route where impersonation is established, the checked rule prohibits the activity, or the provider cannot substantiate the necessary legal basis. Identify the activity or counterparty that must change.

As procurement controls, refresh the official checks before signing and activation. Reopen the assessment when the entity, domain, activity, country, customer category, custodian or regulatory status changes. Legal should propose contract terms requiring notice of relevant changes, evidence on request and rights to suspend or exit affected services. Those negotiated protections supplement the applicable duties; they cannot supply a missing permission.

The decision record should also assign any further custody, financial, cybersecurity or sanctions diligence revealed by the review. Permission evidence supports the defined regulatory conclusion. Asset-control arrangements, contractual recovery rights and operational resilience require their own evidence before the business accepts those exposures.