CEX Legal Structuring: The Entity Behind the Exchange, in 2026

Nobody gets licensed by accident

Every centralised exchange eventually has the same conversation with a bank, an auditor, or a regulator: "who exactly are we dealing with?" A wallet address doesn't answer that question. A licensed legal entity does.

That's the part that gets skipped when people talk about "launching an exchange" — as if the hard part is the matching engine. The hard part, in 2026, is the licence sitting behind it, and the entity that holds it.

In what follows: the state of exchange licensing across the jurisdictions Otonomos clients actually use, what a licence costs and how long it takes where that's knowable, and why the licensed entity is rarely the only entity a serious exchange needs.

The licence and the entity are two different projects

Worth separating early, because the two get conflated constantly: forming a company takes days. Getting that company licensed as a Virtual Asset Service Provider — VASP outside the EU, CASP inside it — is a separate regulatory approval process, often running months, that sits on top of the entity.

Otonomos's job is the first part and everything that keeps it alive afterwards: incorporation, registered office, director and beneficial-owner KYC, the ongoing filings a regulator expects to see from a going concern. The licence application itself — the part where a regulator scrutinises your AML programme, your custody architecture and your management's fitness — is specialist regulatory work, usually run with local counsel who does nothing else. Anyone who tells you otherwise is selling you something.

The jurisdictions, honestly

The EU — one licence, 27 markets, and a deadline that already passed

MiCA replaced the old member-state-by-member-state VASP patchwork with a single Crypto-Asset Service Provider (CASP) authorisation. Get licensed in one EU state and you can passport into all 27 — genuinely the closest thing crypto has to a single market.

The catch is timing: the MiCA transitional period ended 1 July 2026. Exchanges that were trading on old national VASP registrations under grandfathering arrangements needed full CASP authorisation in place by then or stop serving EU customers. If you're reading this after that date and still relying on a legacy registration, that's not a compliance gap — it's a shutdown risk.

Budget €50,000–150,000 in licensing costs depending on service class, and 6–8 months in an efficient member state with a well-prepared application. Neither is a rounding error, but the passport is real.

BVI — registration is live, the exchange-specific rulebook is still catching up

The BVI's Virtual Assets Service Providers Act came into force in 2022, and it casts a wide net: a "virtual assets exchange" under the Act is any trading platform that takes custody, control or possession of money or virtual assets at any point — which covers most exchanges by design, custodial or not in name.

Registering with the BVI Financial Services Commission is mandatory for any business providing this as a profession from or in the BVI, and the applicant must be a BVI-incorporated company. Skip it and the exposure isn't theoretical: fines up to US$100,000, and up to five years' imprisonment for directors or senior officers who let it happen.

What's still developing is the granular, exchange-specific side of the rulebook — the detailed prudential and conduct regulations that will eventually sit underneath the Act. That's a live jurisdiction, not a finished one; worth confirming current requirements before you build a launch timeline around it.

Cayman Islands — the same reputational premium, with a liquidity bar

Cayman's VASP framework carries the same institutional weight that makes it the default for Web3 governance layers generally (see our Web3 Foundation comparison) — and it comes with a number attached. A Full VASP Licence applicant has to demonstrate six to twelve months of operating expenses, sitting in an actual corporate bank account, not projected on a spreadsheet.

That's a genuine funding-stage filter: it favours exchanges that have already raised, over ones hoping the licence will help them raise.

Hong Kong — the fastest-growing licensed cohort in the region

We covered this in detail in Hong Kong's 2026 comeback: the SFC's Virtual Asset Trading Platform (VATP) regime has gone from 13 licensed platforms to 47 in the space of about two years, with the regulator visibly tightening guidance as the cohort grows rather than loosening it. HSBC and a Standard Chartered/Animoca joint venture are both now in that licensed group — not exactly a signal that this is a light-touch regime for newcomers, but it is a functioning one with a real approval pipeline, which several of its regional peers still can't claim.

UAE — the most expensive ticket, bought for regional credibility

VARA's licence remains among the priciest to obtain, with capital requirements reaching AED 1,500,000 (roughly US$408,000 at the AED's dollar peg) for exchange and custody services. Dubai runs a full rulebook rather than a light registration regime, and the price tag reflects that. What it buys is standing with Gulf-region banks and institutional counterparties that a cheaper registration elsewhere doesn't.

The pattern serious operators actually follow

Most exchanges that survive contact with real regulators end up holding two licences, not one: a primary licence somewhere with genuine credibility — MiCA CASP or VARA are the two most cited — plus a lighter offshore registration for everything outside that primary market. It's the same "stack, not one entity" logic that governs how we'd structure a dApp: one layer buys trust with the counterparties who matter most, a second layer keeps global operations running without forcing every user through the expensive jurisdiction's onboarding.

What actually needs separating

A licensed exchange is rarely one company doing everything. The pattern that holds up under scrutiny:

The Operating Co is the licensed entity — it holds the VASP/CASP registration, signs the user agreements, and is the counterparty regulators and banks actually deal with. This is the one that needs to sit in whichever jurisdiction's licence you're pursuing.

An IP Co, often in a separate jurisdiction, holds the trademarks, the software and the brand — insulating the technology and the name from whatever happens at the regulatory coalface.

If there's an exchange token, a Foundation — typically BVI or Cayman, for the same reasons covered in our dApp structuring guide — holds the treasury and governs the token, kept legally and financially separate from the licensed operating entity.

The Honest Comparison

Jurisdiction	Licence	Est. cost	Timeline	Standout trade-off
EU (any member state)	CASP (MiCA)	€50,000–150,000	6–8 months	27-market passport, but the transitional grace period is over
BVI	VASP registration	Registration + ongoing entity costs	Varies — exchange-specific rules still developing	Broad, live requirement; granular rulebook still forming
Cayman Islands	Full VASP Licence	Entity costs + 6–12 months opex on deposit	Months, funding-dependent	Reputational premium, real liquidity bar
Hong Kong	SFC VATP	Application + entity costs	Established pipeline; 47 platforms licensed to date	Tightening guidance as the regime matures
UAE (VARA)	VASP licence	Up to AED 1,500,000 (~US$408k) capital	Full rulebook process	Most expensive; buys Gulf-region credibility

How Otonomos Helps

Whichever licence you're pursuing, the entity work underneath it looks similar: incorporation in the right jurisdiction, a registered office and agent, director and UBO KYC, and the ongoing filings that keep the entity in good standing while your licence application — or your licensed operations — proceed. Otonomos runs the BVI, Cayman, Hong Kong and UAE entities behind this guide from one dashboard, with Nominee Directors available where privacy is the point.

We don't file your VASP or CASP application — that's specialist regulatory counsel's job, and we'll say so plainly rather than pretend otherwise. What we do is make sure the entity your licence depends on is formed correctly, KYC'd properly, and never lapses on a filing while your application is live.

Talk to us about the entity behind your exchange — no law firm retainer required, and you can pay in crypto.

FAQs

Do I need a licence to run a crypto exchange in 2026?
In every jurisdiction covered here, yes, if you take custody of user funds or assets at any point — which most exchanges do. The BVI's definition of "virtual assets exchange" is explicitly written to catch this. Running unlicensed isn't a grey area; in the BVI specifically it carries fines up to US$100,000 and potential imprisonment for responsible directors.

Which jurisdiction gives the broadest market access?
The EU's MiCA CASP authorisation, by a wide margin — one licence, passportable across all 27 member states. The trade-off is a genuine authorisation process (€50,000–150,000, 6–8 months), not a quick registration.

Can Otonomos get my exchange licensed?
We structure and maintain the entity your licence application depends on — incorporation, registered office, KYC, ongoing filings. The licence application itself is specialist regulatory work we'd point you toward local counsel for, not something to attempt without them.

Why do serious exchanges hold more than one licence?
Because a single "prestige" licence — MiCA or VARA are the two most common — rarely covers every market an exchange wants to serve. Pairing it with a lighter offshore registration is the pattern most operators that survive scrutiny converge on.

What's the cheapest way to get a licensed entity off the ground?
BVI's VASP registration sits on top of one of Otonomos's fastest, least expensive entity types — but "cheapest" only makes sense once the exchange-specific side of BVI's rulebook, still developing as of 2026, is confirmed against your actual business model.