Global Crypto Regulations for Centralized Exchanges: EU, USA, Asia, Latin America & UAE Guide

MiCA (Markets in Crypto-Assets Regulation)

MiCA introduces a unified licensing framework for all crypto-asset service providers (CASPs) across EU member states. For centralized exchanges, compliance is mandatory. Operating without required authorization may result in enforcement action, including fines, restrictions, or orders to cease activities.

CASP definition. Under MiCA, CASPs include providers offering custody, operation of trading platforms, crypto-to-fiat or crypto-to-crypto exchange, order execution, transfer services, advice, and portfolio management. Most centralized exchanges fall within this perimeter through trading, custody, transfer, and exchange services.

Mandatory authorization. All CASPs must obtain authorization from their national competent authority. From 30 December 2024, new CASPs generally cannot provide services in the EU without authorization. Existing providers may rely on national transitional arrangements, where available, but only until the applicable national deadline and no later than 1 July 2026.

Organizational requirements. CASPs must maintain proper governance structures, clear roles and responsibilities, risk management systems, internal control procedures, and business continuity arrangements. Strong IT systems and cybersecurity measures are mandatory, especially where exchanges provide custody or operate trading infrastructure.

Technical standards and cybersecurity. ESMA and EBA are developing detailed technical standards for CASPs covering ICT systems, resilience, and cybersecurity. CEXs should proactively align their infrastructure with these standards. Tools like independent security audits and bug bounty programs help identify vulnerabilities and demonstrate regulatory readiness.

Member state variation. MiCA applies uniformly, but transitional arrangements differed by member state, and CASPs had to track country-specific authorization timelines in addition to EU-level requirements. CEXs should verify any jurisdiction-specific transitional arrangements and authorization status with local counsel or the relevant national competent authority.

DORA (Digital Operational Resilience Act)

DORA applies directly to CASPs as financial entities under EU law and has been applicable since 17 January 2025. It establishes binding obligations for ICT risk management, incident reporting, resilience testing, and third-party ICT risk.

ICT risk management. CEXs must establish a comprehensive framework covering governance, prevention, detection, response, recovery, and continuous improvement. This includes business continuity planning, secure access and change management, continuous monitoring, and regular resilience testing.

Incident reporting. Major ICT-related incidents, including cyberattacks, system outages, and data breaches, must be reported to competent authorities through staged reporting: an initial notification, intermediate updates where required, and a final report. In serious cases, affected clients may also need to be informed.

Resilience testing. Regular ICT resilience testing is mandatory, including vulnerability assessments. Certain CASPs identified by competent authorities under DORA may be required to conduct threat-led penetration testing (TLPT). Entities in scope are generally required to perform TLPT at least once every three years, subject to supervisory assessment.

Third-party ICT risk. CEXs must actively manage dependencies on cloud services, payment infrastructure, and other external ICT providers. Contractual safeguards, exit strategies, and limits on single-provider concentration are required. Critical ICT providers fall under EU-level oversight.

EU AML Package

The EU AML framework applies to CASPs through existing AML/CFT rules, the recast Funds Transfer Regulation, and the new AML package. However, the new directly applicable AML Regulation is being phased in and will generally apply from 10 July 2027. CEXs should therefore distinguish between current AML obligations and upcoming single-rulebook obligations.

Customer due diligence (CDD). CEXs must verify customer identity, check beneficial ownership, understand the purpose of the business relationship, and conduct ongoing transaction monitoring. Higher-risk cases require enhanced due diligence.

Transaction monitoring and reporting. CEXs must monitor for unusual or suspicious activity and report suspicious transactions to the relevant FIU. Where required by applicable law or FIU instruction, they may need to refrain from executing or completing a suspicious transaction. They must also avoid tipping off the customer.

Internal controls. Exchanges must establish AML/CFT policies and procedures, provide regular staff training, and ensure independent audit mechanisms. Senior management is responsible for approving and overseeing these controls.

Record keeping. Customer due diligence data, transaction records, and AML documentation must be retained for at least five years, with possible extension to ten years if required by competent authorities.

Who Regulates Crypto in the U.S.

The SEC regulates digital assets that qualify as securities and has historically focused on investor protection, disclosure, and registration obligations. However, after years of enforcement-led regulation, the SEC’s 2025 dismissal of several major crypto cases signaled a shift toward clearer rulemaking and legislative coordination.

The CFTC regulates crypto derivatives and has enforcement authority related to fraud and manipulation involving commodities. Bitcoin and Ethereum are treated as digital commodities in current CFTC regulatory materials.

FinCEN enforces AML/KYC obligations under the Bank Secrecy Act. Many centralized exchanges operating in or serving the U.S. must register as money services businesses when they provide money transmission or convertible virtual currency services.

State regulators—most notably New York's Department of Financial Services (NYDFS) impose additional licensing requirements such as the BitLicense, which carries capital reserve, cybersecurity, and consumer protection obligations.

Legal Status of CEXs

Many centralized exchanges are regulated as money services businesses under the Bank Secrecy Act where they provide money transmission or convertible virtual currency services. This requires FinCEN registration, AML/KYC programs, record keeping, and suspicious activity reporting. Depending on the services offered, exchanges may also face SEC, CFTC, and state-level requirements, including money-transmitter licensing and New York’s BitLicense.

SEC Enforcement: From Landmark Cases to Policy Shift

The SEC’s 2023 lawsuits against Coinbase and Binance became defining examples of the U.S. enforcement-led approach to crypto exchanges. Both cases centered on whether exchanges should have registered under U.S. securities laws. However, the regulatory picture changed in 2025: the Coinbase case moved toward dismissal, and the SEC dismissed its Binance civil enforcement action with prejudice.

The Coinbase case alleged that the exchange operated as an unregistered securities platform by listing tokens the SEC viewed as investment contracts. The Binance lawsuit included broader allegations, including offering U.S. users access to prohibited products and other compliance failures. These cases shaped CEX compliance strategies even though they no longer represent the same active litigation risk.

The consequences were far-reaching: exchanges tightened token listing policies, restricted U.S. services, separated U.S. entities from global operations, and invested more heavily in legal classification frameworks. Even after the 2025 shift in SEC enforcement posture, token classification remains a central compliance issue.

Legislative Outlook: Stablecoins and Market Structure

U.S. legislative attention has shifted toward market-structure and stablecoin frameworks. The GENIUS Act created a federal framework for payment stablecoins. At the time of publication, the Digital Asset Market Clarity Act remains a major market-structure legislative initiative aimed at clarifying SEC and CFTC jurisdiction over digital assets. For CEXs, these developments matter because they could affect token listing decisions, stablecoin support, custody obligations, and federal registration pathways.

Key Compliance Requirements for U.S. CEXs

• Register with FinCEN as an MSB.
• Implement robust AML/KYC programs aligned with Bank Secrecy Act requirements.
• Maintain detailed audit trails and suspicious activity reporting.
• Establish internal token classification procedures to mitigate SEC/CFTC risk.
• Obtain state licenses where required—New York's BitLicense is among the most comprehensive state-level crypto licensing regimes.
• Consider proof-of-reserves, custody attestations, and transparent user disclosures as market-trust and risk-management practices, where required or commercially expected.

Singapore

Singapore operates one of the clearest and most progressive regulatory frameworks for CEXs, anchored in the Payment Services Act (PSA) and Financial Services and Markets Act (FSMA). From 30 June 2025, Singapore-based Digital Token Service Providers conducting digital token services outside Singapore became subject to licensing requirements unless exempt. MAS has indicated that such licenses will be granted only in limited circumstances.

Key obligations include obtaining the appropriate MAS license depending on the business model, maintaining AML/CFT controls including Travel Rule compliance, segregating customer assets where required, complying with MAS technology risk expectations, and providing transparent disclosures on fees, risks, and token-related services.

Japan

Japan maintains one of the most mature CEX regulatory frameworks globally under the Payment Services Act (PSA) and Financial Instruments and Exchange Act (FIEA). All crypto-asset exchange service providers (CAESPs) must register with the Financial Services Agency (FSA).

Key obligations include FSA registration, AML/CFT programs, financial and organizational eligibility requirements, segregation of customer assets, custody controls, cybersecurity measures, and clear user agreements. Non-compliance can result in administrative orders, fines, license suspension, or criminal liability.

Hong Kong

Hong Kong has rapidly established itself as a major jurisdiction for virtual-asset trading, combining innovation with strong investor protection. Licensing is anchored in the Securities and Futures Ordinance (SFO) and Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), supplemented by the SFC’s Guidelines for Virtual Asset Trading Platform Operators, effective from 1 June 2023.

On 18 December 2024, the SFC granted licenses to four deemed-to-be-licensed VATP applicants under a swift licensing process based on risk-based on-site inspections. Following a circular dated 16 January 2025, the SFC extended this streamlined licensing approach to all new VATP applicants, consolidating the assessment into a single external review instead of the earlier two-phase process. Key obligations include SFC licensing, KYC/AML and CTF controls, client asset segregation, custody controls, and restrictions on marketing by unlicensed platforms to Hong Kong investors.

South Korea

South Korea's framework is grounded in the Act on the Protection of Virtual Asset Users (enacted July 2023, effective July 2024), overseen by the Financial Services Commission (FSC) and Financial Supervisory Service (FSS).

Key obligations include VASP registration, segregation of user assets from company assets, safeguarding of customer deposits through banks, cold-wallet controls, insurance or reserve requirements, market surveillance for abnormal transactions, and suspicious activity reporting. South Korea is also developing broader Phase 2 digital asset legislation expected to address stablecoins, market structure, and systemic risk, among other issues.

India

India's approach is cautious and still evolving. No dedicated comprehensive crypto law exists—key frameworks include the Finance Act 2022 (introducing 30% taxation on virtual digital assets and 1% TDS on transfers) and the Prevention of Money Laundering Act (PMLA) as amended to cover VDA service providers.

Key obligations include registration as a reporting entity with FIU-IND where applicable, KYC/AML compliance under the PMLA, a 30% tax rate on income from the transfer of VDAs under Section 115BBH, 1% TDS on qualifying transfers, and transparency around custody, lending, staking, and use of customer assets. Significant regulatory evolution remains possible as India balances innovation, capital controls, investor protection, and systemic risk concerns.

China

China maintains a strict prohibition on centralized exchange operations following the country's 2021 prohibition measures on cryptocurrency trading and mining activities. CEX services, including fiat-crypto exchange, token trading platforms, and related payment/custody services, are treated as prohibited financial activities under China's regulatory framework. Financial institutions and payment channels are prohibited from supporting any virtual currency transactions. Offshore exchanges serving mainland Chinese residents can also be deemed illegal. China continues to prohibit centralized crypto exchange activities for mainland users while pursuing its own central bank digital currency initiatives.

Other Asian Markets

Thailand requires digital asset business licenses under the Digital Asset Business Decree, with SEC supervision and AML/KYC obligations. The Philippines regulates virtual asset service providers through the Bangko Sentral ng Pilipinas, with registration, AML/CFT, consumer protection, and operational risk requirements. Indonesia has been transitioning crypto oversight from Bappebti to the Financial Services Authority, OJK, while maintaining a national crypto exchange infrastructure and licensing requirements for approved platforms.

Argentina

CEXs operating in Argentina may fall within the scope of Proveedores de Servicios de Activos Virtuales (PSAV) under CNV Resolution No. 1058/2025, which sets the regulatory framework for Virtual Asset Service Providers (VASPs/PSAVs) under the National Securities Commission (CNV).

Covered activities: crypto-fiat and crypto-crypto exchange, transfers, custody, and financial services related to virtual asset offerings. Compliance requirements: KYC/AML policies, internal controls, information security, client asset segregation, wallet address reporting, and appointment of a compliance officer. Periodic compliance, internal control, and reporting obligations apply. Audit and assurance requirements depend on the applicable PSAV category and regulatory provisions.

Capital thresholds: Capital thresholds and supervisory fees depend on the applicable PSAV category and current CNV requirements.

Registration deadlines: The transitional registration deadlines under the 2025 framework have passed. New and continuing PSAVs must comply with applicable CNV registration and operating requirements.

Brazil

Brazil’s framework is built on Law No. 14,478/2022, which empowered the Central Bank of Brazil to regulate and supervise virtual asset service providers. In late 2025, the Central Bank issued a new regulatory package, including Resolutions 517, 519, 520, and 521, introducing mandatory licensing and more detailed operational, governance, prudential, and compliance requirements for VASPs.

Covered activities: crypto-fiat and crypto-crypto exchange, virtual asset transfers, custody and administration of virtual assets, and financial services related to issuance or sale of virtual assets. Securities-classified virtual assets remain under CVM (Securities Commission) supervision.

Compliance requirements include KYC/AML under Law No. 9,613/1998, internal controls and governance systems, suspicious transaction monitoring and reporting to COAF, client asset segregation, cybersecurity and risk management controls, Travel Rule-related obligations where applicable, and transparent reporting to regulators.

Timeline: Brazil’s detailed VASP regulatory framework was issued in late 2025, with key provisions effective from 2 February 2026. Existing providers should assess transition rules under the Central Bank’s resolutions and prepare for authorization, prudential, governance, AML, and reporting requirements.

Mexico

Mexico regulates its crypto sector under the Fintech Law (2018), with regulatory powers split among the CNBV, Banxico, and the Ministry of Finance (SHCP). The framework is conservative and compliance-driven.

Authorization: CEXs wishing to offer crypto-fiat conversion, custody, or payment-related services in Mexico may need authorization depending on their model. Under Circular 4/2019, regulated financial institutions and fintech entities face significant restrictions on public-facing virtual asset services. Unlicensed exchanges may still have AML registration and reporting duties under LFPIORPI, depending on activity and legal structure.

Compliance requirements: KYC/AML programs under LFPIORPI; transaction monitoring and suspicious activity reporting to the Unidad de Inteligencia Financiera (UIF); operational risk and market risk disclosures to users; CNBV cybersecurity and consumer-protection standards.

Deadlines: No fixed deadlines—Banxico authorizations are granted case-by-case, and most financial institutions remain restricted from public crypto services pending broader regulatory updates.

Other Latin American Markets

Chile enacted its Fintech Law (Law No. 21.521, 2023), bringing crypto platforms under the Financial Market Commission (CMF). Secondary CMF rules (2024) define registration, disclosure, and AML/KYC obligations.

Uruguay remains in regulatory development, with the Central Bank of Uruguay advancing proposals for VASP oversight, AML controls, and consumer protection. The regulatory framework remains under development.

Colombia has used regulatory sandbox initiatives for crypto exchanges and payment platforms, but a comprehensive permanent VASP framework remains less developed than in Brazil, Argentina, or Chile.

Peru and Panama have considered draft frameworks for VASP registration and AML controls, and regulatory developments remain ongoing.

Ecuador and Bolivia maintain cautious approaches to crypto assets. Crypto is not legal tender, and regulated financial institutions may face restrictions. Crypto activities remain subject to restrictions and evolving regulatory positions in both jurisdictions.