Crypto Wallet License: When a Wallet Provider Needs to Be Licensed in 2026
Few countries issue a license called a "wallet license." Regulators license control over other people's crypto. A wallet provider that can move or recover its users' assets provides custody. Custody makes it a virtual asset service provider (VASP) under the FATF standards, a crypto-asset service provider (CASP) under MiCA in the EU, and a money transmitter under FinCEN's rules in the United States. A provider of self-custody software whose users hold their own keys sits outside all three.
Architecture and product features decide which side of the line a wallet sits on, and a single release can move it across.
The Test Regulators Apply: Who Controls the Keys
All three frameworks ask the same question in different words: can the provider move the assets?
The FATF defines control as the ability to hold, trade, transfer, or spend a virtual asset. Its 2021 guidance adds that control does not have to be unilateral. A multi-signature arrangement, where a transaction needs several keys, does not take a provider out of scope if the provider has enough influence over the assets. Custodial wallet services fall within the VASP definition. Developers and sellers of self-custody software and hardware do not.
MiCA defines custody as safekeeping or controlling crypto-assets, or the means of access to them, such as private keys, on behalf of clients. Recital 83 places hardware and software providers of non-custodial wallets outside the regulation.
FinCEN's 2019 guidance uses four factors: who owns the value, where the value is stored, whether the owner interacts with the payment system directly, and whether the provider has total independent control over the value. A hosted wallet provider is a money transmitter. A provider of unhosted wallet software is not.
The wording differs, and shared-control designs feel the difference. FinCEN asks whether the provider has total independent control. The FATF asks whether it has control or influence at all, and MiCA covers control over the means of access without requiring that control to be exclusive. If your co-signing setup clears the US test, run a separate analysis before launching it in the EU.
Custodial, Non-Custodial, and Shared-Control Wallets
Classification depends on who can move the funds. The product's name and marketing make no difference.
| Wallet model | Who can move the funds | FATF / MiCA | FinCEN (US) |
|---|---|---|---|
| Custodial (hosted) | The provider, which holds the keys or keeps user balances in its own accounts | Custody: VASP or CASP authorization needed | Money transmitter: MSB registration plus state licenses |
| Non-custodial (self-custody) | Only the user, who holds the keys | Out of scope as a software or hardware provider | Not a money transmitter |
| Multi-signature or MPC, provider co-signs only | Neither party alone; the user initiates and the provider adds a signature | Depends on the provider's influence over the assets; needs case-by-case analysis | Not a money transmitter if the provider lacks total independent control |
| Multi-signature or MPC, provider can act alone | The provider, through enough key shares or a recovery path | Custody | Money transmitter |
A wallet marketed as "self-custody" can still give the company the ability to move funds, for example if the company can restore access without the user or holds a majority of key shares for convenience. Regulators classify the wallet by that ability.
Features That Turn a Non-Custodial Wallet Into a Licensed Business
A non-custodial wallet stays outside licensing only while its features keep the company out of the flow of funds. Five features bring it back in.
Key recovery held by the company. If the company can rebuild or rotate a user's key without that user, it controls the assets.
Freezing or blocking. Under the FATF test, the technical ability to stop a user's transfer gives the company influence over the assets, whatever the stated reason. Under FinCEN's test, it counts as control only if the company can also move the funds.
In-app swaps executed by the company. Exchanging one crypto-asset for another for users is a regulated service in its own right, separate from custody. The licensing duty sits with whoever contracts with the user and executes the trade: the wallet company or an integrated licensed partner.
Fiat on-ramps and off-ramps. Converting money into crypto and back is exchange for funds under MiCA and money transmission under FinCEN. The same rule decides who carries the license.
Balances held as ledger entries. If user balances live in the company's accounts rather than in addresses the user controls, the product is custodial, whatever the interface shows.
Each of these features changes the regulatory status of the whole product. Run the licensing analysis when the feature enters the roadmap, before it ships.
How Major Jurisdictions License Custodial Wallets
A custodial wallet needs a license where its users are. The main regimes compare as follows.
| Jurisdiction | Regime | What a custodial wallet needs | Capital |
|---|---|---|---|
| European Union | MiCA, home-state regulator | CASP authorization for custody and administration; transfers on behalf of clients are a separate service | EUR 125,000 (Class 2) |
| United States | FinCEN plus state law | MSB registration as a money transmitter, plus licensing in each state served; New York BitLicense; California DFAL license since July 1, 2026 | Set by each state |
| United Kingdom | MLRs now; FSMA from October 25, 2027 | FCA registration as a custodian wallet provider today; authorization for safeguarding cryptoassets under the new regime, gateway open until February 28, 2027 | Set by FCA rules |
| Canada | FINTRAC | MSB registration for dealing in virtual currencies, covering exchange and transfer services | Not fixed by FINTRAC |
| Georgia | National Bank of Georgia | VASP registration, including custodial wallet services | None for an LLC |
| Mauritius | FSC, VAITOS Act | Class O license for wallet services; Class R for custody | Class R: MUR 5,000,000 |
| El Salvador | BCR and CNAD | BSP registration for bitcoin custody; DASP registration for other digital assets | USD 2,000 |
Two practical points follow. First, licensing follows users: a Georgian or Mauritian license does not authorize serving EU or US residents. Second, the regimes count services differently. MiCA separates custody from transfers and from exchange, so a wallet that does all three applies for three services.
Each regional route has its own requirements: VASP registration in Georgia, the Mauritius VASP regime, BSP and DASP registration in El Salvador, and MSB registration in Canada. In the EU, the process runs through MiCA CASP authorization. In the UK, firms apply through the FCA crypto gateway.
What a Licensed Custodial Wallet Has to Run
A licensed custodial wallet carries four operating obligations.
Segregation and records. Under MiCA, a custodian keeps client assets separate from its own, maintains a register of positions for each client, and sends statements at least every quarter. It cannot use client assets for its own purposes.
Liability for loss. A MiCA custodian is liable for client assets lost through an incident attributable to it, such as a key compromise, up to their market value at the time of the loss.
Travel rule. Originator and beneficiary data travels with transfers. In the EU, for a transfer of more than EUR 1,000 to or from a self-hosted wallet, the custodian has to assess whether its own customer owns or controls that wallet.
AML program. Customer due diligence, transaction monitoring, sanctions screening, and suspicious activity reporting apply in every regime in the table.
These obligations drive the operating cost of a custodial wallet more than the license fee or the capital. They are the reason many product companies choose not to hold the license themselves.
Who Should Not Apply for a Wallet License
A license fits a business whose model is holding and moving users' crypto. Three profiles are better served by another route.
A non-custodial wallet developer. If users hold their keys, the company cannot recover or freeze assets, and swaps and ramps run through licensed partners that contract with the user, the company has nothing to license. Budget instead for a legal analysis of the architecture and a review step that keeps the roadmap inside it.
A fintech or neobank that wants to give its customers crypto wallets. Building and licensing a custody operation takes months and a dedicated team. In the EU, the faster route is a partnership with an authorized CASP. Equilex's CASP as a Service provides custody, wallets, exchange, and transfers under a partner's MiCA authorization, with implementation in about one to two months.
A wallet whose users are mostly in the United States. An offshore VASP license does not cover US residents. The US route is FinCEN registration plus state licensing, and the MSB registration in the USA page explains where a Montana structure fits.
FAQ
Does a non-custodial wallet need a license?
No, as long as the provider cannot move, freeze, or recover users' assets and does not itself provide exchange or transfer services. MiCA excludes non-custodial wallet providers, FinCEN does not treat unhosted wallet software as money transmission, and the FATF excludes software developers that do not provide VASP services.
Is an MPC wallet custodial?
It depends on who can produce a valid signature. If every transaction requires the user's key share and the provider cannot act or recover access alone, the wallet is non-custodial under FinCEN's test. EU treatment depends on whether the provider controls the means of access. If the provider can move funds without the user, it is custody everywhere.
Do I need a license to add a swap feature to my wallet?
Yes, if your company executes the swap for users: exchange is a regulated service separate from custody. If an integrated licensed partner contracts with the user and executes the trade, the partner carries the license. The contract structure and the flow of funds decide which case applies.
Does the travel rule apply to wallet providers?
It applies to custodial wallet providers as VASPs or CASPs. They send and receive originator and beneficiary data on transfers and, in the EU, assess whether self-hosted wallets belong to their customers for transfers above EUR 1,000. Non-custodial software providers are not obligated entities.
Which jurisdiction suits a custodial wallet business?
The one where its users are. A wallet serving EU residents needs MiCA authorization, and one serving US residents needs FinCEN registration and state licenses. A wallet serving users outside both can choose a regime such as Georgia, Mauritius, or El Salvador based on capital, substance, and the banking relationships it needs.
Equilex structures wallet businesses in the EU, the US, Canada, Georgia, Mauritius, El Salvador, Australia, Switzerland, and other jurisdictions, from the custody analysis to the application. Compare the routes for your user base on the crypto licensing options page.
