BITZ0

ステーブルコインに対する英国の完全なルールブックがついに整備されました。法定通貨連動型トークンを発行、カストディ、または決済ルーティングする場合、今後12〜18か月は「構築（ビルド）」のための期間です。
この記事では、発行に関して何が変わるのか、カストディがどのように評価されるのか、そして決済事業者が、チェックアウトやアプリにステーブルコインを組み込む際に、新たなガードレールに引っかからないよう何を行う必要があるのかを分解して解説します。
私たちは紙に書かれた内容に従い、生きたタイムラインを示し、英国のチームをつまずかせるものを明確にしていきます。
英国ではデュアルトラックのステーブルコイン規制体制が始動します。FCAは、詳細な健全性および行為（コンダクト）のルールのもとで、ほとんどの法定通貨（フィアット）連動型発行者とカストディ業者を認可します。一方で、イングランド銀行は、システミック（重大）なスターリング・トークンに対して追加の制約を課す形で関与します。許可されたバッファを前提とする厳格な1対1の裏付け、より厳しいカストディ管理、そして、決済事業者とウォレットをおなじみの監督下に置く決済の導線が求められる見込みです。

実質借入コストは、ほとんど20年近く多くの投資家が織り込む必要のなかった水準まで戻ってきています。国債デスク、暗号資産のトレジャリー、あるいは成長寄りのポートフォリオの近くに身を置いているなら、その体感があります。割引率はより重く、計算が容赦なく効いてきます。
今回のひねりはこうです。AIは株のバリュエーション・マルチプルを動かすだけではありません。債務の供給を押し動かしているのです。データセンター、電力契約、チップ、そしてファイバーを調達するために資金を急ぐ企業が、債券の波を売り出しています。その新しい発行分のペーパーはどこかで吸収されなければならず、長期の実質金利がすでに景気循環の高値近辺にある金利市場と衝突しています。

バミューダは暗号資産のカストディを「後回し」にしません。これは免許制の活動であり、細部に踏み込むルールブックがあります。具体的には、顧客資産の分別方法、鍵の保管方法、誰が何に触れられるか、そして何か問題が起きた場合にどうするのか、という点です。
あなたがファンドマネージャー、保険会社、ファミリーオフィス、またはバミューダのライセンスを受けたデジタル資産ビジネスを計画しているスタートアップなら、これはあなたが評価されるための「基準（ガードレール）」です。そしてクライアントとしてなら、これはあなたのコインと、他人のトラブルの間に立つものです。

日本の取引所から海外の取引所へ暗号を送る場合、どのような送金で、送信者と受取人の情報を付ける必要がありますか？それが、2026年の日本のトラベルルールの核心です。
以下は、金融庁の2026年8月の改正で、対象に含まれるもの／含まれないもの、そして何が変わったのかを、明確で実務的に整理した読み物です。要点はこうです。受取先の取引所がどこに所在しているか、そして移動させる資産の種類は何かに注目してください。
2026年8月3日から、日本のVASPsは、旅行取引（トラベルルール）に相当する規制がある外国VASPsの管轄に対して暗号資産または電子決済手段（ステーブルコイン）を送る際、送信人および受益者のデータを送信することが義務付けられます。金融庁は、その対象国リストを63の管轄まで拡大し、国境を越えたVASP間（VASP-to-VASP）移転において相互主義のアプローチを採用することを確認しました。国内の利用者フローやセルフホスト型ウォレットは扱いが異なり、主に国境を越えた通知というより、より広範なAML（マネロン・テロ資金供与防止）ルールによって処理されます。

Dubai’s crypto marketing scene moved from "anything goes" to very structured, very quickly. If you’re planning a promo, a splashy brand campaign, or an influencer push that could touch the UAE, you’ve got to build around VARA’s rulebook.
This guide walks through what’s allowed, what’s not, and how to design ads and KOL posts that pass a VARA sniff test without killing your creative.
I’ll keep it practical — labels that need to be on screen, what a risk disclaimer actually looks like in a 9:16 video, and the moment where you should ask for a copy of the VASP licence instead of hoping for the best.
Point Details Only licensed VASPs can market Marketing in or targeting the UAE must be done by a VARA‑licensed VASP, or on their behalf with approval. Unlicensed entities can’t market into Dubai/UAE (VARA). Clear ad labels are mandatory Paid ads and sponsored posts must be clearly marked as “ad”, “advertisement”, “promoted” or “sponsored”, visible on all device types (VARA). Prominent risk warnings Disclaimers stating virtual assets may lose value (even to zero) and are highly volatile must be unmissable and persistent for the medium (VARA). Influencers are not journalists KOLs must disclose sponsorship on each post and confirm the VASP they promote is VARA‑licensed; profile bios alone don’t count (VARA). Substance over style Compliance lives in the fine print, timing, and placement — labels must be legible; disclaimers must stay on screen long enough to be read; claims must be fair and not misleading.
What counts as “marketing” in Dubai?
Short answer: a lot more than just banner ads. If you push a message that could influence someone in the UAE to buy, sell, hold, stake, lend, or otherwise engage with a virtual asset or a VA service, you should treat it as marketing under VARA’s regime.
Think paid social, sponsored creator content, programmatic display, out-of-home, advertorials, SEO landing pages with a clear call to action, email blasts, push notifications, affiliate promos, referral codes, and even in-app pop-ups. If it’s accessible in the UAE or aimed at UAE residents, assume VARA will care.
That doesn’t mean you can’t publish general news or analysis. But as soon as it becomes promotional — a call to action, a benefit claim, an offer — you’re in VARA territory.
Who can actually advertise crypto in Dubai?
This is the first gate most campaigns fail. VARA’s Marketing Regulations say marketing “in or targeting the UAE” has to be carried out by a VASP licensed by VARA, or on behalf of and approved by a VARA‑licensed VASP. In plain English: if you’re not licensed, you can’t market into Dubai. A licensed partner must front the campaign and sign off on it. See the rulebook here: VARA.
Two practical implications:
Global brands without a VARA licence should either hold back UAE‑facing creatives or work through a licensed local entity that fully approves the materials.
Media buyers and agencies need to verify licensing before they traffic anything with UAE geo or Arabic copy. Ask for the licence number and scope of permitted activities.
Pro tip: If the VASP you’re promoting is licensed for a narrower activity than your ad implies (say, custody only, but the creative hints at trading), fix the copy. The licence scope matters to the message.
How to label ads and sponsored posts so they pass review
VARA couldn’t be clearer on this one: if money changed hands, the content must say so in a way users can’t miss. The Guidance requires “ad,” “advertisement,” “promoted,” or “sponsored” — legible, prominent, and obvious on all devices. Source: VARA.
Where to put the label
Short-form video: on-screen text in the first frame and a persistent bug or overlay for at least the first 3–5 seconds. The caption alone is risky if the on-screen never shows the label.
Static images: top-left or top-right corner in a font size that remains readable on a phone in portrait. Don’t bury it under stickers.
Stories/Reels: on-screen label plus the platform’s paid partnership toggle if available. Use both.
Long-form copy (blogs, newsletters, advertorials): label near the headline and again before the first call to action.
Labels must survive reposts, duets, stitches, and cross-posting. If an influencer exports the video and uploads natively to another platform, the disclosure needs to be baked into the asset, not just the platform toggle.
Risk warnings that cannot be missed
VARA wants a prominent risk disclaimer that flags extreme volatility and the chance of total loss. In their words, disclaimers must be “unmissable” — legible, proportionate in size/position, and persistent enough for the medium. Reference: VARA.
What the disclaimer should say
Use plain language. For example: “Virtual assets are highly volatile. You may lose all the money you invest.” That’s the spirit VARA is after.
How to place it
Video: keep the disclaimer on-screen long enough to be read in full. On a 15-second spot, it probably needs to be there for most of the ad, not just a flash at the end.
Audio: read it aloud and put it on-screen as text. Podcasts should include it in the ad read and the show notes.
Outdoor: use a font size that’s readable from a typical viewing distance. If the copy is big and bold, the warning can’t be microtext.
Web: place it above the fold or adjacent to the CTA. Footer-only is weak.
Don’t rely on a single, tiny footer line. If someone can screenshot your ad and the warning isn’t visible, it’s probably not compliant.
Working with influencers and KOLs the right way
Influencers aren’t treated like journalists in VARA’s eyes. If a KOL is paid or otherwise incentivised, they must disclose that on every sponsored post, and they must confirm the VASP they’re promoting is licensed by VARA. A profile-level “#partner” note isn’t enough; each post needs its own clear disclosure. See the case study language in the Guidance: VARA.
What to include in the KOL brief
The exact disclosure wording and where it must appear on-screen and in the caption.
Confirmation of the VASP’s licence status and the specific service being highlighted.
The risk disclaimer text and display rules for each platform.
A list of prohibited phrases (see the next section) and examples of acceptable alternatives.
Approval process: brand review, legal review, and final sign-off by the licensed VASP.
Audit the final uploads, not just the drafts. If an influencer trims the first two seconds to hook viewers and cuts off the on-screen “Ad” label, you need them to re-upload. Screenshots help.
Words, claims, and tactics that get ads pulled
VARA’s marketing regime expects accuracy and balance. Overpromise and you’ll have a problem. Here’s what reliably triggers rework:
Implying guaranteed or low-risk returns.
Cherry-picking performance without context or timeframes.
Confusing a licence with endorsement. Being licensed means you can operate under rules; it’s not a thumbs-up on your token or strategy.
Hiding key limitations in microprint while shouting about benefits in 200-point type.
Using technical jargon to the point of being misleading for a retail audience.
Fair, plain-language claims travel better. “Earn yield” is dicey unless you explain from what, under what risks, and who bears them. “Lower fees than X” needs a footnote defining the comparison and the time period.
Pro tip: Disclaimers aren’t a magic eraser. If the headline is misleading, no footer can fix it. Fix the headline.
A lightweight compliance workflow for teams
You don’t need a 50-page SOP to stay onside. A simple, repeatable checklist goes a long way.
Map the audience and reach. Could anyone in the UAE see this? If yes, assume VARA applies. If not, double-check platform geos and organic spillover.
Verify the licence. Get the VARA VASP licence details in writing. Confirm the activity scope aligns with the creative.
Draft with compliance in mind. Write the ad copy with the ad label and risk disclaimer baked in. Don’t try to glue them on at the end.
Design for legibility. Test on a 5.4-inch phone in bright mode. If you can’t read “Ad” and the disclaimer at arm’s length, they’re too small.
Approve in sequence. Internal brand and legal, then VASP sign-off. Keep a single source of truth for approved assets.
Publish with controls. Use platform paid-partnership toggles, correct geos, and turn off auto-placement where it breaks your labels.
Archive everything. Save briefs, approvals, final creatives, links, and screenshots. If a regulator asks, you’ll be glad you did.
VARA guidance figure showing compliant vs non‑compliant influencer/social posts (examples of how sponsorship labels and disclaimers must appear) — useful because it visually demonstrates the prominence and placement VARA requires for paid crypto posts. — Source: VARA — Guidance on the Regulations on the Marketing of Virtual Assets and Related Activities (Guidance on Marketing Regulations)
Creative examples: compliant vs noncompliant
Short-form video ad (15 seconds)
Compliant: First frame shows “Ad — Sponsored by [VASP Name, VARA‑licensed]” plus on-screen disclaimer “Virtual assets are highly volatile. You may lose all the money you invest.” The label and disclaimer remain visible for at least 5 seconds, with the disclaimer returning on the end card. Caption starts with “Ad” and repeats the volatility warning.
Noncompliant: Hype intro with no on-screen label, a caption that says “collab,” and a 0.5-second microtext disclaimer at the end.
Static banner
Compliant: Top-right “Ad” tag, balanced claim like “Spot trade BTC with transparent fees,” and a visible line “Virtual assets are highly volatile; you can lose all invested funds.” CTA sits next to the disclaimer, not a screen away.
Noncompliant: “Guaranteed profits” headline, no ad label, and a legal line so small it disappears on mobile.
Influencer post
Compliant: Creator says on-camera, “This is a paid ad with [VASP], which is licensed by VARA for [activity].” On-screen “Sponsored” bug in the corner; caption starts with “Ad” and repeats the risk warning.
Noncompliant: Creator opens with “Not financial advice,” includes a profile bio note about partnerships, but the post itself has no label and no risk warning.
Cross-border and geo-targeting questions that trip up teams
One of the hardest parts is figuring out whether your content “targets” the UAE. VARA looks at substance, not intent. If your ad uses UAE geos, Arabic copy clearly aimed at local users, Dubai-specific references, or you run OOH in the city, that’s targeting. If your global post has no geo and gets organic reach in Dubai, you’re still in sensitive territory.
Geo-fencing helps but isn’t absolute. If a campaign leaks into the UAE, expect questions. When in doubt, design to the stricter standard.
Organic vs paid is not a shield. A paid post needs labels; an organic post that includes promotional offers or CTAs can still be marketing.
Third-party affiliates matter. If your affiliates or referral partners push your offer in the UAE, you’re responsible for the outcome. Give them compliant templates and monitor them.
Bottom line: if a reasonable person in Dubai could see it and act on it, build it to VARA’s spec.
Frequently Asked Questions
Can an unlicensed overseas exchange run UAE-targeted brand ads without a call to action?
Not safely. VARA’s rulebook says marketing in or targeting the UAE must be done by a VARA‑licensed VASP or on their behalf with approval. Brand advertising that nudges users toward your platform still counts as marketing.
Is a profile bio disclosure enough for influencers?
No. VARA’s Guidance says each sponsored post must have its own clear, prominent disclosure. Bios help, but they don’t replace in-post labels.
What exact words should the risk disclaimer use?
VARA doesn’t mandate a single sentence, but the warning must convey that virtual assets are extremely volatile and you can lose all invested funds. Keep it plain and visible, sized properly for the medium.
Do platform “paid partnership” toggles satisfy the ad label requirement?
Treat them as additive, not sufficient. VARA expects obvious, legible disclosure. Use the platform toggle and put “Ad” or “Sponsored” directly on the creative and in the caption.
How do agencies prove compliance if asked?
Archive the licence verification, approvals from the VASP, final assets, screenshots of live posts (showing labels and disclaimers), and media plans with geo settings. If you can show what ran and where, conversations go smoother.
Are educational posts exempt if there’s no offer?
Pure education without a call to action is safer, but if the content nudges toward a product or includes referral links, it looks like marketing. Build to the higher standard if there’s any doubt.
Can small disclaimers sit only at the end of a 15-second ad?
That’s risky. VARA expects disclaimers to be unmissable and appropriately persistent. In short spots, keep them visible for a meaningful portion of the runtime, not a blink-and-you-miss-it flash.
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

アルゼンチンはトークン化証券の「電源を入れました」。誇大宣伝ではなく、実際に配線を行うことで、誰が何を保有しているのか、誰が議決できるのか、そしてその権利が会社法に抵触せずにどのように行使されるのかが分かるようにするものです。発行体としてブロックチェーンのレールに目を向けているのか、あるいはウォレットアドレスが株主に等しいのか疑問を持つ投資家なのか——そのためのガイドです。
新しいレジーム（制度）は、証券ルールブックの中に収まっています。外ではありません。つまり、古い疑問もまだ重要です：公式の登録簿（official register）に誰が載っているのか、指図はどうやって会議へ届くのか、そしてプラットフォームが同期しなかった場合に何が起きるのか。推測せずに意思決定できるように、分解して整理しましょう。

Brazil flips the switch on October 30, 2026. If you serve Brazilian users, touch BRL rails, or rely on local banking partners, that date isn’t just a circle on the calendar — it’s the line between continuity and getting shut out.
The short version: by that day, you either need to be authorised or demonstrably in the authorisation process with the Central Bank of Brazil (BCB). Otherwise, Brazilian banks and payment institutions won’t be able to deal with you. That’s not conjecture — it’s in black and white.
This guide trims the legal noise into a practical plan. What to file. How to keep banking intact. Where the capital bites. And the stuff that tends to blow up in the final week if you leave it too late.
Aspect What to Know Hard cutoff From October 30, 2026, BCB-supervised entities can’t conduct or facilitate virtual-asset operations with counterparties that aren’t authorised or in the authorisation process (Banco Central do Brasil — Resolução BCB nº 520). First filing deadline Pre-existing VASPs must submit the phase‑1 authorisation package by October 30, 2026 to be considered “in process” (Instrução Normativa BCB nº 704). Who’s affected Exchanges, brokers, custodians, OTC desks, payment/settlement operators, and any platform interfacing with Brazilian banking or payment rails. Capital floors Minimum paid‑in capital for SPSAVs is risk‑based and has been reported across business models from roughly R$10.8m to R$37.2m under the prudential framework (Resolução BCB nº 517 / Conjunta (CMN)). FX and per‑transaction caps Recent industry analyses flag USD 100k caps for standard VASPs and USD 500k for banks/authorised FIs on cross‑border transactions; structure flows accordingly (Avalon Blockchain Consulting). Continuity trigger File phase‑1 before the deadline to maintain relationships with Brazilian counterparties who must refuse non‑authorised parties after the cutoff (Fystack 90‑day action plan). Scope creep risk Activities touching custody, exchange, brokerage, and settlement each carry different risk weights and supervisory expectations; map your exact model early.
Core concepts behind Brazil’s 2026 cutoff
Brazil formalised crypto service providers under a regime that puts the Central Bank in the driver’s seat for most virtual‑asset operations. If you’re going to operate at scale — take custody, match orders, settle, or intermediate — you’re expected to do it as an SPSAV, a supervised entity with prudential, governance, and conduct rules.
Authorisation happens in phases. Phase‑1 is the gateway: you file the core corporate and programmatic documentation that shows you’re real, capitalised, and organised. Hit that by the deadline and you’re treated as “in the process,” which lets Brazilian counterparties continue to serve you while the Central Bank works through the rest. Miss it and counterparties will likely step back overnight because they legally have to.
The prudential layer matters. Minimum capital scales with what you do and how risky it is. Industry write‑ups on the rules as implemented report floors ranging roughly from R$10.8 million to R$37.2 million across VASP business models, aligning with the methodology in the BCB/CMN rules (Resolução BCB nº 517). That’s paid‑in capital, not just a promise on a spreadsheet.
Operationally, plan for FX and transfer constraints. Recent market notes cite per‑transaction caps at USD 100,000 for standard VASPs and USD 500,000 for banks/authorised institutions within the BCB framework. That shapes how you manage settlement, pre‑funding, and partner selection for BRL on/off‑ramps (Avalon Blockchain Consulting).
Quick glossary
SPSAV: The supervised corporate form for virtual‑asset service providers in Brazil, subject to BCB prudential and conduct rules.
VASP: Virtual‑asset service provider. Covers exchanges, brokers, custodians, and similar businesses handling client assets or transactions.
Phase‑1 authorisation: The initial filing that gets you recognised as “in the process” with the BCB; essential for keeping banking and payment partners engaged (Instrução Normativa BCB nº 704).
Prudential capital: Paid‑in capital calibrated to your activities and risks. Reported floors range roughly from R$10.8m to R$37.2m under the BCB/CMN framework (BCB nº 517).
PIX: Brazil’s instant payment system. If you’re plugging into BRL rails, PIX uptime, limits, and reconciliation flow right into your compliance controls.
“In the process”: Regulatory status that kicks in when you’ve properly filed phase‑1; it’s what lets partners keep transacting after the deadline (Fystack).
Step-by-step playbook to be ready by October 30
Map your activities precisely. List everything you do in Brazil or with Brazilian users — custody, order matching, brokerage, settlement, staking, remittance — and align each with the SPSAV categories and risk drivers.
Assemble the phase‑1 package. Work with local counsel to compile the corporate docs, governance chart, key‑person fit‑and‑proper attestations, AML/CFT framework, risk program overview, business plan, and capital plan required under the phase‑1 submission (Instrução Normativa BCB nº 704).
Lock down paid‑in capital. Calibrate minimum capital to your model using the BCB/CMN methodology. Don’t rely on “soft” commitments — the floors reported for SPSAVs are material and need to be evidenced (BCB nº 517).
Harden AML, sanctions, and Travel Rule. Document KYC tiers, sanctions screening, blockchain analytics, Travel Rule implementation, and suspicious activity workflows. Make sure these controls actually plug into PIX, fiat rails, and your wallet stack.
Prove client asset segregation. Spell out your wallet architecture, omnibus vs. segregated accounts, reconciliation cadence, key management, and incident response. If you use a third‑party custodian, include diligence files and SLAs.
Banking and FX design. Align BRL on/off‑ramps with per‑transaction caps and liquidity needs. Test flows end‑to‑end with partner banks and payment institutions so there are no surprises on day one (Avalon).
File early and confirm “in process” status. Submit before October 30 and get written confirmation. Partners will ask for proof to keep accounts open after the cutoff (Fystack).
Prep for supervisory Q&A. Expect clarifications, not just a rubber stamp. Designate a local point person and keep a tracker for RFI responses, translations, and updated appendices.
Choosing your route: full licence, partner, or pause
Not every exchange will sprint toward a full SPSAV licence on day one. Some will file to keep options open, then operate through a licensed partner while the application matures. Others will geofence and revisit later. The choice comes down to control, time, cost, and risk tolerance.
Option Control Time to market Cost profile Banking continuity post‑deadline Biggest risk Apply as SPSAV (in‑house) High: you own custody, matching, and risk Medium/long: filing, Q&A, buildout High: capital floors, governance, staffing Strong if phase‑1 filed by Oct 30 and partners accept proof Regulatory delays; capital drag if scope is too broad Operate via licensed partner Medium: you focus on front‑end; partner runs rails Short: piggyback on existing permissions Medium: integration and partner fees Depends on partner’s status and your own phase‑1 filing Concentration risk; partner control over flow and limits Geofence / pause Brazil High (outside Brazil), zero locally Immediate (but no Brazil growth) Low near‑term; opportunity cost N/A — counterparties will disengage after the cutoff Loss of market share; recovery later may be harder
One practical note: even if you plan to rely on a partner route, filing your own phase‑1 by the deadline creates optionality and reduces the chance of abrupt de‑risking by banks that prefer counterparties “in process.”
Keeping banking open: FX corridors, PIX, and the cutoff reality
The tender spot for exchanges is always fiat access. Brazil is no different, but the 2026 rule changes heighten the stakes. After October 30, BCB‑supervised entities are prohibited from conducting or facilitating virtual‑asset operations with non‑authorised or non‑filing counterparties. That includes your settlement bank, your payment institution, and the fintech that powers your PIX. If they keep you onboard without your filing in place, they’re the ones out of bounds (Resolução BCB nº 520).
On top of the legal bright line, there are practical throughput constraints. Industry notes put per‑transaction caps at USD 100,000 for standard VASPs and USD 500,000 for banks/authorised institutions in the BCB framework. That won’t kill you if you batch well and pre‑fund where needed, but it does change treasury routines, especially for OTC and institutional flows (Avalon).
Pro tip: don’t wait for “final approval” to test rails. File phase‑1, secure written acknowledgment, then run low‑value live tests across PIX, FX, and reconciliation. You want operational proof before volume arrives.
Two housekeeping items that save pain later. First, get explicit, written partner policies on what they accept as proof of “in process” status and how long they’ll maintain service while your file is under review. Second, align reporting cadences — suspicious activity reports, chargeback monitoring, and blockchain analytics escalations — with the formats your partners expect. It’s easier to inherit their templates than push your own.
Capital and custody: where the regulator will lean in
Capital isn’t just a box tick. It’s the lens the Central Bank uses to size your risk. The rules’ methodology ties minimum paid‑in capital to activity and profile, with floors that industry commentary pegs between roughly R$10.8m and R$37.2m across typical VASP setups (Resolução BCB nº 517 / Conjunta). If you under‑capitalise on paper and then describe an aggressive product roadmap, expect questions.
Custody is the other big lever. Whether you run keys yourself or use a third‑party custodian, the file should show end‑to‑end control: segregation of client assets, reconciliation frequency, access management, incident playbooks, and insurance where available. Don’t bury service‑level terms. The supervisor will look for them, and so will your banks.
For groups with global tech stacks, avoid the “we’ll fix it later” trap. If your wallet system or analytics vendor doesn’t meet Brazil’s data or auditability expectations, switch now or layer compensating controls you can defend in writing.
90‑day VASP authorisation timeline / action plan (shows key milestones and the October 30, 2026 filing deadline) — useful visual for exchanges planning tasks and dates. — Source: Fystack
Pitfalls & red flags that trip teams up
Missing the definition of “in process.” A submission isn’t enough if it’s incomplete. Aim for a clean phase‑1 file and obtain acknowledgment; partners will ask for it (Fystack).
Underestimating capital floors. Treat the reported ranges seriously and evidence paid‑in funds. Conditional parent letters don’t meet prudential intent (BCB nº 517).
Banking letters without enforceable terms. General “support” notes won’t save your accounts after October 30 if you’re not authorised or in process (Resolução BCB nº 520).
FX flow design that ignores caps. Treasuries built for uncapped corridors break under USD 100k/500k per‑transaction limits; redesign batching and pre‑funding now (Avalon).
Unclear Travel Rule handling. If you can’t show how you exchange originator/beneficiary data with counterparties, approvals slow and partners balk.
Late translations and document hygiene. Sloppy Portuguese, missing board minutes, or outdated org charts trigger follow‑ups that burn the clock you don’t have.
Frequently Asked Questions
Who exactly needs to file by October 30, 2026?
Any virtual‑asset service provider with Brazilian clients, BRL rails, or Brazilian banking/payment partners that falls within the SPSAV scope. If your counterparties are supervised by the BCB, they’ll be barred from operating with you after the cutoff unless you’re authorised or in the authorisation pipeline (Resolução BCB nº 520).
What counts as being “in the authorisation process”?
A proper phase‑1 submission under the BCB’s procedural rules. Pre‑existing providers are expected to file that package by October 30, 2026 to preserve continuity with Brazilian counterparties (Instrução Normativa BCB nº 704).
What happens if we miss the deadline?
Expect Brazilian banks and payment institutions to suspend service quickly to comply with the prohibition in BCB Resolution 520. Re‑opening later is possible, but you’ll be starting from a cold stop and may face tighter onboarding thresholds (BCB nº 520).
How much capital do we need to evidence?
It depends on activities and risk profile. Under the BCB/CMN prudential methodology, industry write‑ups of the implemented rules report floors from roughly R$10.8m to R$37.2m for SPSAVs. Your counsel can help map the exact calibration to your model (BCB nº 517).
Can we rely entirely on a licensed partner instead of filing?
You can operate via a licensed partner for some functions, but many counterparties will still ask for your own phase‑1 filing as assurance. Filing preserves optionality and reduces the risk of sudden de‑risking after the deadline.
Are there limits on cross‑border transaction sizes?
Market analyses published this quarter flag per‑transaction caps at USD 100,000 for standard VASPs and USD 500,000 for banks/authorised FIs under the BCB framework. That shapes treasury, batching, and pre‑funding strategies (Avalon).
Where should we start if we’re late?
Prioritise the phase‑1 file: capital evidence, governance, AML/Travel Rule, and custody segregation. Several industry timelines suggest a focused 90‑day push is realistic if you dedicate a cross‑functional team and move decisions quickly (Fystack).
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

スイスの暗号資産カストディは急速に成熟しました。銀行は金庫のようなサービスを提供します。フィンテックは機敏な鍵管理を売り込みます。ファミリーオフィスは、単に分別がきれいで、出金が迅速であればよいのです。この難しい問いは同じ場所に着地します。カストディ業者が失敗したらあなたのコインはどうなるのか、そしてスイスのルールはあなたをどう守ろうとしているのか？
この項では、スイスで分別管理（セグリゲーション）が実際にどのように機能するか、破産時に何が起きるのか（実務として）、そしてカストディリスクが今もどこに潜むのかを説明します。さらに、チューリッヒからサービス提供されているものの、EU域内に住所（ドミサイル）を持つクライアント向けに、EU側から生じる新たな越境上の摩擦がスイスの体制に入り込む可能性も指摘します。

シンガポールで暗号資産（クリプト）ビジネスを運営しているなら、最初に素早く突きつけられるマーケティングの疑問はこれです。実際に広告は出せるのか？ 短い答えは「はい」ですが、通れるのはかなり狭い車線の中だけです。シンガポールでは、ライセンスを持つデジタル決済トークンの事業者であれば、自社サービスについて語ることが認められます。ただし、大衆向けの誇大な訴求を避け、保守的で事実に基づいたコミュニケーションに徹する必要があります。
簡単そうに聞こえます。ですが実際には迷路です。広告を掲載する場所、言うべき内容、ユーザーに対するインセンティブの設計、そしてトークンの上場に関するコンプライアンスの承認まで、すべてが重要になります。手抜きをすると、意図が良くてもMAS（シンガポール金融管理局）の問題に巻き込まれる可能性があります。

オンラインのスポーツブックはしばしば「ライセンスを受けている」と自らを説明しますが、このラベルは、非常に異なる規制システムを指し得ます。英国ガンブル委員会のライセンス、キュラソーのライセンス、アンジョアンのライセンスはいずれも、何らかの形でギャンブル活動を認可しますが、規制の範囲、コンプライアンス要件、プレイヤー保護、そして運営者が合法的に対象にできる市場は異なります。
これは、暗号ベッティングで特に重要です。国際的なスポーツブックは、顧客、決済ネットワーク、運営が複数の国にまたがるため、オフショア管轄を利用することがよくあります。たとえばDexsportは、コモロ連合（Union of Comoros）内のアンジョアン自治島政府が発行したライセンスのもとで運営しています。

分散型スポーツブックは、オンライン賭博の裏側にあるインフラを変えています。従来の決済プロセッサや閉じた社内システムに全面的に依存するのではなく、暗号ウォレット、ブロックチェーンネットワーク、そして場合によってはスマートコントラクトを使って、賭けのプロセスの一部を処理します。
賭け手にとって、見えるプロセスはなじみのあるものです。つまり、アカウントに資金を入れるかウォレットを接続し、イベントを選び、マーケットを選択し、賭け金を入力して、精算を待ちます。重要な違いはその下にあります。暗号により、価値がどのようにプラットフォームに出入りするかが決まり、ブロックチェーンのインフラによって、取引や賭博活動をより簡単に検証できるようになります。

ニューヨークの“日曜の夜”を思い浮かべてください。暗号取引所の法務チームが、共有画面の周りに集まり、トークンを明確なバケットに仕分けようとする新しいSEC文書を読み解いているところです。これが定着すれば、上場委員会の“プレイブック”は月曜の朝から変わります。
それがSECの2026年の暗号資産タクソノミー（分類）プロジェクトをめぐる空気感です。これは法律ではありません。すべてに答える単一のルールでもありません。しかし地図です。お金を動かす人、資産をリストする人、コードを出荷する人にとって、この地図は重要です。
本質的な緊張はシンプルです。証券ラインはどこで終わり、デジタル・コモディティはどこから始まるのか。その答えが、誰が何を規制するか、開示はどう機能するか、そしてどの市場が開いたままになるかを決めます。

アルゼンチンは暗号資産サービス提供者向けに名称付きの門を用意しました。PSAV、つまり仮想資産サービスの登録制度です。あなたが取引所、カストディアン、OTCデスク、またはアルゼンチンの利用者に触れるプラットフォームを運営しているなら、今後はこの枠組みを気にする必要があります。問いはシンプルです。運用を始める前にその登録が必要なのか、そして必要だとした場合に日々の業務に何が変わるのか。
トークンの上場にも曲球があります。90日未満の新規コインは、プラットフォーム上で特別な取り扱いが必要です。また、UVAで測定される少額の自然人活動に関する免除のしきい値もあります。何が確定しているのか、どこがまだ進行中なのか、そしてロールアウトで引っかからないためにどうすればよいかを整理していきましょう。

Picture a Monday stand-up at a São Paulo exchange. The compliance lead opens with three bullets: Resolution 520 is live, 580 just raised the prudential bar, and a 24-hour hold on big stablecoin transfers might land soon. Operations sigh. Legal reaches for coffee. Everyone knows the crypto business in Brazil just shifted for good.
That’s where we are. The Central Bank of Brazil now sits squarely over virtual-asset service providers. If you run a platform here — or serve Brazilian users from abroad — the rulebook isn’t a side document anymore. It’s the main story.
Let’s unpack what changed, what’s being proposed, and how both companies and users should navigate the next few months.
Brazil has pulled crypto into its mainstream financial perimeter. The Central Bank of Brazil (BCB) formally set out the authorization and supervision regime for virtual-asset service providers (VASPs), called PSAVs in Portuguese. The core rule, Resolution BCB No. 520, took effect on 2 February 2026, laying out how players get licensed and how the Bank will oversee them. The Bank followed up by classifying PSAVs as Type 3 institutions for prudential supervision via Resolution BCB No. 580 on 1 July 2026, with transitional mechanics that tighten how groups led by PSAVs are supervised until dates the rule specifies. See the BCB’s note and text for the official framing: Banco Central do Brasil (press release) and Resolução BCB nº 580/2026.
Brazil isn’t banning crypto; it’s domesticating it — pulling exchanges and custodians into a prudential regime that looks and feels like mainstream finance.
Who’s affected? Local exchanges and custodians, wallet providers with Brazilian users, fintechs that touch crypto rails, and foreign platforms that onboard Brazilians. Tokens that qualify as securities remain within the CVM’s orbit, but spot crypto and most platform activity now answer to the Central Bank.
Inside the new BCB rules: 520 and 580 in plain English
There are two pillars to understand: authorization to operate (Resolution 520) and how you’ll be supervised once you’re in the system (Resolution 580).
Authorization: who can legally serve Brazilians
Resolution 520 establishes the authorisation gate and ongoing supervisory expectations. The Bank’s press note makes it clear: if you’re providing virtual-asset services in Brazil, you need to be in the Central Bank’s line of sight as a PSAV/VASP. Foreign platforms with Brazilian activity are expected to regularize a local presence or migrate local customers to an authorized Brazilian entity during the transition window.
Prudential classification: how hard the guardrails are
Resolution 580 classifies PSAVs as Type 3 institutions for prudential supervision. In practice, that signals capital, governance, risk, and reporting standards that are tighter than a casual startup regime. The rule also sets transitional and segment deadlines, including stricter treatment for PSAV-led prudential conglomerates until specified dates, so groups can’t sidestep requirements by sitting crypto in a lightly supervised affiliate. See the rule: BCB 580.
What materially changes for operators
There are two pillars to understand: authorization to operate (Resolution 520) and how you’ll be supervised once you’re in the system (Resolution 580).
Topic Before BCB 520/580 After BCB 520/580 License status Patchwork. AML registration and best-effort compliance; no full prudential license specific to VASPs. Formal authorization required as PSAV under Central Bank supervision per BCB note. Prudential category Unclear category for crypto-only firms. PSAVs designated Type 3 institutions, with transitional, stricter segment treatment for PSAV-led groups per BCB 580. Group supervision Conglomerate rules not tailored to crypto-led groups. Prudential conglomerates led by PSAVs receive stricter oversight until deadlines in the rule. Consumer asset handling Market practice; segregation not uniformly specified. Stronger expectations on segregation, safeguarding, and disclosures as part of authorization and ongoing oversight. Cross-border/self-custody flows Standard AML/monitoring; no crypto-specific 24h hold. Proposal (under consultation) to allow up to 24h holds for reviews when totals hit US$10k same day; not final yet (Investidores Brasil).
Getting authorised: what a VASP must line up
The authorisation pack won’t read like a seed-stage deck. Expect something closer to a bank-lite application, tuned for crypto rails. Exact checklists belong to the Central Bank’s process, but if you’re planning, here’s the general flow that aligns with how Brazilian supervised institutions typically onboard.
Map your legal footprint. Decide whether you’ll form a Brazilian entity or partner with an authorised PSAV to serve local users. Foreign platforms need to regularize or exit Brazilian retail.
Assemble governance. Name accountable directors, an independent board or advisory oversight, and a designated compliance and risk head with real authority.
Design your safeguarding model. Detail how client assets are segregated, how wallets are managed (hot/cold), who has signing authority, and how you reconcile balances daily.
Put monitoring on rails. Implement transaction monitoring tuned to crypto typologies, sanctions screening, travel rule connectivity where applicable, and case management with audit trails.
Prove resilience. Document cybersecurity posture, key management, vendor risk controls, incident response, disaster recovery, and business continuity tests.
Capital and liquidity. Prepare to evidence financial resources in line with Type 3 expectations. That means buffers and reporting cadence, not just runway.
Customer treatment. Set transparent fee schedules, clear risk disclosures, complaint handling, and a user support channel consistent with Brazilian norms.
Regulatory reporting. Build the data pipes to file periodic reports on operations, risk, and prudential metrics according to Central Bank formats and timelines.
Local presence vs. partnering
A local license is the cleanest route for full retail access. Some foreign firms may instead white-label through an authorised Brazilian PSAV. It’s workable, but you still inherit due-diligence and oversight burdens. If you market directly to Brazilians or touch their funds, expect the Central Bank to expect accountability.
What to expect in reviews
The Bank will look for substance over slides. Do the people in charge have experience in financial risk and crypto infrastructure? Are you actually segregating assets, or just saying so? Can you pause suspicious flows quickly? Systems, not promises.
The 24-hour stablecoin hold proposal and how it would work
There’s a separate, hot-button topic: a proposal to let VASPs hold certain crypto transfers for up to 24 hours for risk review when the amount is large. According to reporting on the consultation, the measure would allow holds on transfers to self-custody wallets or destined abroad when a single transaction — or same-day aggregate — hits US$10,000. The consultation period closed in early July 2026, and the Bank is reviewing feedback. See coverage here: Investidores Brasil.
What users might notice
If adopted, users could encounter a short review delay when pushing large sums out to an external address or foreign venue. It’s not a freeze; it’s a timeout window to run enhanced checks. Below the threshold, normal speed. Above it, a pause for risk screens, source-of-funds lookbacks, and sanctions checks.
What platforms need ready
Two things: good thresholds and fast triage. If your rules fire too often, you’ll throttle legitimate flows and annoy customers. If they fail open, you’ll miss the point. Also note the aggregation rule: multiple same-day transfers that sum to US$10k or more could trigger a hold.
Key point: this is still a proposal. Don’t implement on rumor. Monitor the Central Bank’s final text if it proceeds.
Foreign platforms and Brazilian users: migration clocks are ticking
Brazil’s framework expects foreign VASPs with Brazilian activity to either regularize their presence locally or stop serving local customers, migrating them to an authorized Brazilian VASP within the transition timetable. Legal commentary and market practice guides flag 2026 milestones, with an October 30, 2026 target cited for certain transitions and operational changes. See an overview in the Brazil chapter from Chambers: Chambers and Partners.
What this means for users
Expect emails and in-app banners from foreign exchanges over the coming months. Some will open local entities and keep you in place. Others will ask you to move to a Brazilian partner or close positions. If you ignore the notices, you risk cutoffs at inconvenient times. Read them.
What this means for operators
Audit your user base. If you have non-trivial Brazil exposure, plan the migration path now: data portability, KYC portability within local law, asset transfer mechanics, and clear communications. Sloppy migrations create consumer harm and regulatory heat.
What this means for markets in 2026 and after
Short term, expect some friction. Onboarding slows as applications queue up. Banks and larger fintechs may feel more comfortable partnering with licensed PSAVs, which could pull liquidity toward compliant venues. Retail might notice tighter withdrawal checks, especially if the 24-hour proposal is adopted for high-value transfers.
Medium term, spreads could narrow on local books as institutional market makers enter with better comfort on counterparty risk. Insurance, custody, and audit providers will likely grow a Brazil desk. Internationally, Brazil joins the list of major markets with a defined crypto licensing path, alongside the EU’s MiCA and the UK’s FSMA crypto regime — different details, same direction of travel.
Key dates to keep in mind
Date What happened / may happen Why it matters Feb 2, 2026 Resolution BCB No. 520 takes effect Authorization and supervision of PSAVs is formally in force (BCB). Jul 1, 2026 Resolution BCB No. 580 published PSAVs classified as Type 3; transitional/segment deadlines set (BCB). Early Jul 2026 Consultation window closes on 24h hold idea BCB reviews feedback on US$10k stablecoin/crypto transfer holds (Investidores Brasil). Oct 30, 2026 Market-cited transition milestone Guides cite this as a target for certain foreign VASP migrations/changes (Chambers).
Risks & What Could Go Wrong
Approval bottlenecks. If application reviews pile up, smaller firms could be left in limbo, eroding competition.
Overcorrection on withdrawals. A blunt 24-hour hold regime, if adopted, could frustrate legitimate users and push volumes to informal channels.
Operational drag. Type 3 prudential demands raise costs; weakly capitalized startups may exit or cut product lines.
Migration mishaps. Foreign platforms could mishandle customer moves, creating stranded assets or tax surprises.
Perimeter gaps. DeFi front ends and P2P brokers might sit just outside the easy-to-supervise perimeter, inviting regulatory whack-a-mole.
Legal overlap. Boundary cases between spot crypto (BCB) and tokenized securities (CVM) can confuse disclosures and marketing.
Regulation reduces chaos, not risk itself. Poor execution can still create outages, user harm, and arbitrage into less safe venues.
Frequently Asked Questions
Does every crypto company in Brazil now need a Central Bank license?
Any business providing virtual-asset services in Brazil falls under the Central Bank’s authorization and supervision framework introduced by Resolution 520. Some edge cases remain (for example, tokens that are securities stay with CVM). If you have Brazilian users, assume you need to either be authorized as a PSAV or work through one.
What is a Type 3 institution and why should I care?
Under Resolution 580, PSAVs are slotted into the Type 3 prudential category. That drives expectations around capital, governance, risk, and reporting. In plain English: you need more structure and safety tooling than a lightweight fintech. It also affects how your wider group is supervised, especially during the transitional period.
Is the 24-hour hold on stablecoin withdrawals already in force?
No. It’s a proposal from the Central Bank’s consultation process, reported as allowing up to 24 hours of hold time for risk review when transfers to self-custody or abroad hit or exceed US$10,000 in a day. The consultation closed in early July 2026 and the Bank hasn’t published a final rule yet.
I use a foreign exchange app. Will I be forced to move?
Possibly. Brazil’s framework expects foreign VASPs with Brazilian activity to regularize locally or migrate customers to an authorized Brazilian PSAV within the transition timetable. Market guides point to October 30, 2026 as a key target for certain transitions. Watch for official notices from your provider.
What changes for custody of client assets?
Oversight tightens. Expect explicit segregation, wallet management standards, reconciliation routines, and clearer disclosures under the authorization regime. You should see cleaner statements and stronger controls around who can move funds and how quickly exceptions are reviewed.
How will this affect trading spreads and liquidity?
Near term, some venues may slow onboarding or withdrawals while they adapt, which can widen spreads. Longer term, licensed PSAVs could attract deeper market maker participation and bank connectivity, which usually narrows spreads and improves fiat ramps.
What about P2P or DeFi?
Where an intermediary markets to Brazilians or custody touches Brazilian users, the Central Bank will expect accountability. Purely decentralized protocols are harder to supervise, but any front end or facilitator with Brazilian nexus should assume scrutiny. Don’t expect a free pass if you’re effectively operating like a VASP.
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

その呼びかけは通常、同じような形で始まります。創業者が一定の成果（トラクション）を持ち、見た目にも整っているキャップテーブルがあり、そして次の18か月を左右する問いがあります――「バミューダのテストライセンスで始め、事業を壊さずにフルの認可へ移行できるか？」
2026年7月下旬、バミューダはスローガンではなく、活動で静かに答えました。新しいテストライセンスが登録簿に現れ、その翌日には修正版ライセンスも登場。さらに、認知されたステーブルコインを保険、ILS、ファンドの仕組みの中にどう位置づけられるかについての新たな協議も行われました。ロードマップは、紙の上にも、そして実際の動きとしても存在しています。

Switzerland does something simple that sounds almost radical in crypto: it regulates what you do, not what you call it. The label on a token matters far less than the actual service or risk behind it.
In this piece, we unpack how the Swiss function-first model works in practice, how it compares to the EU and US, and what teams should check before launching. This matters now because Swiss supervisors have been busy in 2026, clarifying risk management and showing banks how to plug crypto into existing rails without reinventing the rulebook.
Quick Answer
Switzerland regulates crypto by function because its financial laws are technology neutral and risk based. FINMA looks at the activity you perform — custody, exchange, issuance, asset management, payments, trading venue operation — and applies the matching law and license. Token names rarely decide anything. The focus is on investor protection, market integrity, and AML controls anchored to actual risks.
DLT is slotted into existing frameworks, with the DLT Act enabling ledger-based securities and DLT trading facilities.
AML supervision follows FATF risk signals and counterparties, not token branding. See FINMA.
Swiss banks can offer crypto under banking rules when the service fits their license, as shown by BancaStato’s launch via Sygnum in July 2026. See Sygnum Bank.
When technology risk shifts, FINMA updates expectations based on function and exposure — for example, on quantum risk. See FINMA.
How does the function-first model actually work?
The core Swiss idea is technology neutrality. If you perform an activity that already exists in finance — taking deposits, managing assets, running a trading venue, providing custody, executing payments — you fall under the relevant law whether your rails are DLT or not. Labels like utility, payment, or governance don’t rescue you if the function is regulated.
That’s why the Swiss DLT Act, phased in during 2021, didn’t create a parallel universe. It added concepts like ledger-based securities and a DLT trading facility, then plugged them into the existing ecosystem. The point wasn’t to invent a new crypto silo. It was to describe blockchain-native instruments clearly so the usual protections still apply.
On AML, the emphasis is similar: risk first, activity first. In July 2026, FINMA reminded all intermediaries to build the FATF lists of high-risk and increased-monitoring jurisdictions into their risk controls, a direct supervision move that targets where the risk sits rather than which token is moving. You can read that statement here: FINMA.
So the Swiss question is always: what are you doing for clients and what risks does that create? If the answer looks like a security offering, a payment service, portfolio management, or exchange operation, then expect the corresponding Swiss rules to bite, token marketing spin aside.
What separates Switzerland from EU and US approaches?
Every major jurisdiction says it’s tech neutral, but they operationalize it differently. The EU’s MiCA leans on token categories and issuer obligations. The United States leans on case law and enforcement, using the Howey test to determine when something is a security. Switzerland plants its flag on function and licensing: start with the activity, map it to an existing license, and keep a narrow, codified set of DLT tweaks.
Here’s a simple comparison. It’s not exhaustive and it won’t capture every nuance, but it gives you the flavor.
Topic Switzerland EU (MiCA) United States Regulatory principle Function and risk drive the rule; tech neutral Token categories and issuer rules plus service provider regimes Case law and enforcement-led; Howey analysis dominates Primary trigger Activity performed (custody, exchange, issuance, venue) Token type and service permissions under MiCA Whether a token or scheme is an investment contract Licensing path Existing banking, securities firm, asset manager, or DLT venue licenses CASP authorization for services; issuer obligations for tokens Broker-dealer, ATS, money services; mixed federal and state Market venues DLT trading facility option inside financial market law Regulated trading services under MiCA and existing market rules ATS path possible; regulatory clarity varies AML approach FATF-aligned, risk-based; activity and counterparties center stage FATF-aligned with EU specifics FATF-aligned but fragmented by state and federal layers
Where this lands tactically: in Switzerland, teams spend more time mapping the operational flow than arguing over token metaphysics. In the EU, they spend more time on issuer disclosures, white paper obligations, and CASP scope. In the US, a lot of energy goes into figuring out if something will be treated as a security and who has jurisdiction.
How do banks and brokers deliver crypto under Swiss rules?
Because the model is activity-based, banks can extend into crypto if their license and controls fit the service. That showed up clearly on 23 July 2026 when BancaStato integrated Sygnum’s crypto trading stack into its Avaloq core and launched client trading in BTC, ETH, LTC, and SOL. The key takeaway is not the list of coins. It’s that a bank can plug crypto rails into its existing compliance, custody, and execution processes when the activity aligns with its permissions. See Sygnum Bank.
For brokers and asset managers, the logic is similar. If you custody, you need custody-grade controls and the right supervision. If you operate a matching engine for third parties, you look like an exchange or a DLT trading facility. If you hold client funds, you move into banking perimeter questions. The fact it’s a token doesn’t shrink the duty of care.
On the AML side, banks and intermediaries are expected to align with FATF risk signals and treat crypto flows like any other cross-border financial flow. FINMA’s July 14, 2026 update instructing firms to incorporate FATF’s high risk and increased monitoring lists into risk management is a clean example of risk-first AML supervision in action. See FINMA.
One practical effect is friction where it matters most. Transfers to or from higher-risk counterparties get extra checks. Transfers between well-known, KYC’d counterparties on audited infrastructure may move faster. Again, the throughput depends on risk, not the token sticker.
What happens when the tech changes? Quantum as a case
When the technology surface shifts, Switzerland doesn’t write a new crypto law. It updates expectations for how supervised firms manage the new risk. On 9 July 2026, FINMA issued Guidance 05/2026 on quantum computing, telling institutions to assess cryptographic and operational exposure as part of their normal risk frameworks. The guidance is technology focused, but the supervisory lens is still function and risk. See FINMA.
For crypto businesses and custodians, that means inventorying where you rely on public key cryptography, signing tools, and key ceremonies, and planning for cryptographic agility. If your business is custody, your duty is to protect client assets against feasible threats. If your business is issuance, your duty is to avoid breaking holder rights when you rotate keys or upgrade contracts.
Pro tip: Write a plain-English risk memo that maps your activities to controls. Don’t start with token labels. Start with who you serve, what you hold, what you move, and where it can fail.
That memo becomes your blueprint for conversations with banks, auditors, and FINMA. It also helps your own team make sane tradeoffs when the next wave of tech hype rolls in.
How do I self-classify a token or platform in Switzerland?
Start from the business flow. Walk through what users do and what you do for them. Then map each function to the Swiss perimeter. If you raise funds from the public with a profit expectation, you have securities law questions. If you take deposits or promise redemption at par, you are poking the banking bear. If you match orders for others, you’re in market infrastructure territory.
Here’s a short checklist to keep your internal review honest:
Money flows: Will you hold client fiat or crypto balances, even short term?
Issuance: Do buyers expect profit from your managerial effort or pooled assets?
Venue: Are you matching third-party orders or operating a multilateral system?
Custody: Are you safeguarding assets as a service, with signing authority?
Advice: Are you managing portfolios or giving individualized recommendations?
Payments: Are you executing transfers for the public or enabling spend at merchants?
Cross-border: Will clients or flows touch higher-risk jurisdictions or unregulated VASPs?
After that, decide if you need a Swiss license, a recognized SRO route for AML-supervised intermediaries, or a regulated partner. Many teams opt to partner with a licensed bank or securities firm for custody and fiat rails while they keep the on-chain logic in-house. It’s not glamorous, but it survives due diligence.
Is Switzerland worth it in 2026?
Short answer: it can be, if you aim for durability and banking access. The upside is legal predictability, well-understood licensing paths, and a regulator that communicates in risk language rather than token fashion. The downside is you will not dodge AML friction or governance obligations by slapping a trendy label on your token.
Banking connectivity is a real draw. The BancaStato and Sygnum integration shows that, in practice, Swiss banks can roll out crypto services within their current stack and supervision when the function fits. For many projects, aligning with that stack is the fastest route to users and institutional capital. See Sygnum Bank.
The bar is not low. Expect auditors to scrutinize your wallet ops, key management, segregation of client assets, and market abuse controls. Expect counterparty risk reviews, especially where FATF flags jurisdictions for higher monitoring, as highlighted by FINMA’s July 2026 note. See FINMA.
If your plan relies on regulatory arbitrage or opaque tokenomics, Switzerland will likely feel heavy. If your plan relies on clean execution and real users, the function-first model is more a map than a maze.
Common Mistakes
Starting with token labels, not activities. Fix it by mapping the end-to-end service and the risks it creates, then aligning to the right license.
Ignoring AML counterparties. Even if your product is non-custodial, on- and off-ramps face FATF-aligned screening. Build a travel and sanctions plan early.
Underestimating custody complexity. Institutional custody is not just key storage. It is segregation, signing policies, incident response, and audit trails.
Thinking decentralization removes obligations. If you operate a front end, aggregate orders, or market a product, you may still trigger rules.
Waiting to engage banks. Banking partners shape product limits. Talk to them before you write production code, not after you ship.
Frequently Asked Questions
Does FINMA approve tokens before they trade?
No. FINMA doesn’t run a token pre-approval list. It supervises institutions and activities. If your token offering is a security, you can trigger prospectus and other obligations. If your service is a regulated activity, you need the right license or a supervised partner.
Are NFTs outside Swiss financial rules?
Often yes, sometimes no. If an NFT is a pure collectible with no profit expectation or pooling, it typically sits outside financial market law. If you wrap NFTs into fractionalized investment schemes or managed portfolios, that changes the analysis fast.
Can a decentralized protocol avoid AML responsibilities?
If there’s no intermediary, AML obligations may not attach to the protocol itself. But front ends, hosted wallets, and fiat bridges usually count as financial intermediaries and face AML duties. Banks will also assess protocol risk before touching your flows.
What is a DLT trading facility in Swiss law?
It’s a licensed market infrastructure for multilateral trading of DLT instruments. Think exchange-grade governance, participant rules, and surveillance, but purpose-built for ledger-based assets. It sits inside the existing market law rather than acting as a carve-out.
How does Switzerland treat stablecoins?
By function. If redemption at par is promised or reserves are managed, banking, securities, and AML questions arise. Issuers should expect stringent risk, disclosure, and governance expectations, especially where client funds are involved.
What happens if future quantum threats worsen?
Expect supervisors to push for cryptographic agility, key rotation plans, and operational adjustments. FINMA’s July 2026 guidance on quantum is an example of updating controls without rewriting core financial laws. See FINMA.
Will Swiss rules make cross-border EU access easier?
Not automatically. MiCA governs EU market access, so Swiss firms still need to consider EU permissions or partnerships. The Swiss model can make bank relationships and audits cleaner, which helps, but it isn’t a passport.
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Picture a Berlin exchange that spent years earning BaFin’s crypto custody licence. December comes, MiCA’s CASP rules switch on across the EU, and suddenly that hard-won German badge needs to morph into an EU passport. The board wants France and Italy on the roadmap. Compliance wants clarity on what BaFin will actually accept on day one.
That’s where the real work begins. Under MiCA, the license shifts from national nuance to a single EU template, but the first draft is still written at home. In Germany, that means BaFin. If you plan to serve EU clients from Germany, here’s what your licensing route really looks like.
MiCA creates one authorization for crypto-asset service providers, or CASPs, that works across the EU. Parts of MiCA already apply, like the stablecoin sections, and the remainder covers the full stack of services from custody to operating trading platforms. BaFin is Germany’s gatekeeper for firms based in the country, and once you’re in, you can passport across the bloc.
National flavor meets EU uniformity: MiCA harmonizes the license, but day-to-day supervision and first authorization still run through your home regulator.
The changes touch almost everyone building in Germany. Custody firms that were licensed under the German Banking Act, trading venues that relied on bespoke setups, payment and brokerage models that skirted edges. Now there’s a common vocabulary and a common bar. ESMA and the EBA are layering detailed standards, while BaFin maps Germany’s pre-MiCA categories to CASP permissions and stablecoin paths.
If you want the source texts: the MiCA regulation is on the EU’s legal database EUR-Lex. ESMA has guidance and technical standards in progress on authorization, complaints, conflicts, and market integrity ESMA. BaFin’s MiCA explainer and German specifics sit on its official site BaFin.
From Germany’s crypto custody licence to MiCA CASP
Germany has been out in front on licensing since 2020, when crypto custody got folded into the German Banking Act as a regulated activity. That helped establish governance, AML, and IT expectations early. But MiCA redraws the map. You no longer combine bits of banking, investment, and custody law to assemble a crypto stack. You apply for defined CASP services.
Mapping the old to the new
Here’s how common activities line up conceptually. Your lawyers will do a detailed scoping, but at a high level this is the translation you’ll end up arguing over in your application pack.
Business activity Pre-MiCA in Germany MiCA category Lead supervisor Custody of client crypto-assets Crypto custody under KWG licence Custody and administration of crypto-assets on behalf of clients BaFin (home), passportable EU-wide Operating a crypto trading platform Varied setups, often outside MiFID venue perimeter Operation of a trading platform for crypto-assets BaFin; market integrity rules under MiCA Exchange crypto-assets for funds or other crypto-assets Payment or brokerage constructs Exchange services (fiat-crypto and crypto-crypto) BaFin; AML and Travel Rule apply Execution of client orders Investment services analogies Execution of orders for crypto-assets BaFin Placing or advice on crypto-assets MiFID-adjacent models Placing; advice on crypto-assets BaFin Issuing or offering a non-stablecoin token Prospectus-lite marketing Crypto-asset whitepaper regime BaFin notification; no prior approval required Issuing an ART or EMT E-money and hybrid structures Asset-referenced tokens and e-money tokens BaFin, with EBA if token is significant
Two quick notes. First, staking and validator services can touch several buckets depending on design. Treat them as a scoping exercise, not a one-liner. Second, proprietary trading for own account sits outside MiCA’s CASP list but can trip other regimes. If in doubt, ask BaFin in writing.
What a German CASP application actually looks like
MiCA set the baseline. Germany adds its culture of detail. Expect a deep dive on governance, IT, and client asset protection. The legislation uses simple labels, but the file you submit doesn’t look simple at all.
Governance, people, and control
Senior managers must be fit and proper, with clear responsibilities and time commitments. BaFin wants a board that can challenge management, not a rubber stamp. Expect to document committees, escalation paths, and how you identify and manage conflicts of interest. If key functions sit abroad, explain how oversight actually works in practice.
Own funds and prudential cover
MiCA sets initial capital thresholds that vary by service. In plain terms, lighter services are at the lower end and trading platform or exchange activities sit at the top end. You can supplement own funds with professional indemnity insurance where the regulation allows, but the overall buffer has to make sense for your scale and risk profile. Assume BaFin will stress test your assumptions.
Safeguarding and wallet operations
This is always a focal point. You’ll need segregation of client assets, robust key management, documented recovery and reconstitution procedures, and a clean audit trail. If you use third-party wallet tech or cloud, bring a full vendor risk pack. The Digital Operational Resilience Act, or DORA, applies to in-scope financial entities and has real teeth on ICT risk and critical third parties. Build your CASP file with DORA in mind from the start.
Market integrity and surveillance
Trading platforms must monitor for abuse and disorderly trading. You’ll be expected to show surveillance tooling, alert governance, and incident reporting procedures. ESMA’s work on market integrity under MiCA gives a sense of what “good” looks like here ESMA.
AML and the Travel Rule
CASPs remain squarely under EU AML rules. The revised Transfer of Funds Regulation extends the Travel Rule to crypto transfers across the EU, which means originator and beneficiary information has to move with the transaction. BaFin will expect your Travel Rule vendor and procedures to be live, not theoretical, at authorization.
Outsourcing and third parties
Germany treats outsourcing as a governance topic, not a procurement one. Any critical or important function needs a contract with audit rights, exit plans, and continuous oversight. If a critical vendor sits outside the EU, be ready to explain data flows, sub-outsourcing, and incident playbooks in detail.
The application flow in practice
Scope your services against MiCA’s CASP list and confirm which entity will apply in Germany.
Engage BaFin early with a written scoping query if your model hits gray areas.
Draft core policies: governance, risk, AML, safeguarding, ICT and DORA alignment, outsourcing, complaints handling, and market abuse where relevant.
Build the people file: fit and proper evidence, org charts, role descriptions, and time commitments.
Assemble financials: capital, liquidity where applicable, insurance coverage, and realistic revenue projections.
Map and test your Travel Rule implementation end to end, including counterparty screening.
Submit the application and respond quickly to BaFin’s follow-up questions. Keep a clean log of changes.
BaFin has published MiCA-focused resources and will point to the primary EU text for definitions. Start there, then tailor to German expectations BaFin, EUR-Lex.
Passporting and day-two operations
Authorization in Germany is your home base. Passporting lets you serve clients across the EU without separate licenses in each country. There’s a notification step to your home regulator and to ESMA and the host authorities, and then you can operate cross border or establish branches. Marketing rules travel with you, so check that your materials and disclosures meet MiCA standards in every language you use.
Reverse solicitation, the fine print
MiCA preserves a narrow reverse solicitation concept. It’s not a marketing strategy. Document your controls so sales and partnerships do not accidentally turn into active solicitation in countries you haven’t notified yet.
Timelines that actually matter
MiCA rolled out in stages. The dates below help teams plan product sequencing and compliance delivery. Treat them as anchors and confirm the current status on the primary sources.
Milestone What changed MiCA published in EU Official Journal (2023) Regulation enters into force on a phased basis EUR-Lex Stablecoin sections apply (2024) ART and EMT issuance rules activate; EBA begins significant token framework EBA CASP regime applies EU-wide (late 2024) Authorization requirements for service providers begin; passporting framework starts ESMA Transitional window for existing national permissions Member states can allow a limited transition period for firms under national regimes; check BaFin’s implementation note BaFin
The headline point is simple. If you want Europe, plan your passport on the same timeline as your authorization. Waiting until after go-live is how launch dates slip into the next quarter.
Stablecoins through the German lens
Stablecoins are not one bucket under MiCA. There are asset-referenced tokens, ARTs, that peg to baskets or non-euro assets. Then there are e-money tokens, EMTs, that reference a single fiat currency, like the euro. The rules are different, and so are the authorizations.
EMTs usually mean e-money permissions
If you want to issue a euro EMT, you generally need to be a credit institution or an e-money institution under existing EU money rules, and then meet MiCA overlays on reserves, redemption, and governance. That often sends crypto-native teams into partnerships with e-money institutions or banks. Germany’s banks are watching this space closely.
ARTs and EBA oversight
ART issuers need authorization and a whitepaper approved by the home NCA. If your token becomes significant, the EBA steps in with additional standards, fees, and direct oversight, while BaFin remains your home authority. The EBA maintains a hub for MiCA-related standards and lists that’s worth bookmarking EBA.
Practical design choices
A few design calls simplify your German filing. Keep reserves conservative and simple. Build daily reconciliation and independent valuation into the operating model. Make redemption channels boring and reliable. And assume marketing claims will be read against the risk factors in your whitepaper.
What firms are running into now
Across the EU, people are discovering that the same MiCA text lands a little differently at each regulator. Germany is no exception, but its expectations are usually well documented and consistent. The sticky points show up in three places.
Service scoping at the edges
Hybrid models blur lines. Custody plus staking, brokerage plus platform features, wallet tech bundled with data services. Get these mapped early and get something in writing. It’s cheaper than reworking your stack a month before authorization.
ICT and operational resilience
DORA is not an afterthought. If your business runs on cloud, key management services, and external wallets, you’ll need to show layered controls and exit strategies. Expect BaFin to ask how you recover keys and reconstitute records after a severe incident, and how you monitor critical third parties in real time.
Travel Rule and counterparty frictions
The Travel Rule only works if both sides speak the same language. In practice, you’ll be dealing with different vendors, different data models, and inconsistent envelope handling. Build reconciliation and exception workflows that are visible to compliance, not buried in engineering tools.
Risks & what could go wrong
Backlog risk: national authorities face a surge of applications. Timelines stretch and product launches slip.
Scope creep: a small feature turns your service into a higher-risk CASP category with bigger capital and controls.
Vendor concentration: DORA highlights critical third parties. Over-reliance on a single wallet or cloud provider becomes a supervisory red flag.
Stablecoin flight risk: redemption mechanics that work in calm markets may break under stress without robust liquidity planning.
AML mismatches: Travel Rule data gaps with counterparties cause transfer delays and user frustration.
Marketing exposure: cross-border ads that miss MiCA disclosures can trigger action by host regulators even if your home license is clean.
Transitional misreads: assuming national permissions cover you longer than they do leads to unlicensed activity in the gap.
Build your authorization like you expect questions, then leave yourself time to answer them. The risk is rarely outright rejection. It’s delay.
Frequently Asked Questions
Do existing BaFin crypto custody license holders automatically become CASPs under MiCA?
No. MiCA is a separate EU regime. Some member states allow a limited transitional period for nationally authorized firms, but you still need to apply for CASP authorization to operate under MiCA long term. Check BaFin’s implementation notes for Germany-specific timelines BaFin.
What capital do we need for a German CASP authorization?
MiCA sets initial capital bands that depend on the services you choose. Lighter advisory or order transmission sits at the lower end, with custody and trading platform activities higher. Expect BaFin to assess the adequacy of your own funds and, where applicable, professional indemnity insurance against your specific risk profile.
How long does authorization take with BaFin?
There’s no guaranteed timeline. EU rules define steps and clocks once the application is deemed complete, but the reality depends on how complex your model is, how quickly you respond to questions, and regulator workload. Start early and budget time for at least one round of clarifications.
Can a non-EU firm serve German clients without a German or EU license under MiCA?
Only in very narrow reverse solicitation scenarios, where the client initiates the service without any prior marketing. If you actively target clients in Germany or elsewhere in the EU, you need an authorization and, if relevant, passport notifications.
Are NFTs covered by MiCA in Germany?
MiCA largely excludes unique, non-fungible tokens, but if tokens marketed as NFTs are in fact fractionalized or sold in large series with similar features, parts of MiCA may still apply. Treat NFT models as a scoping exercise and document the analysis for BaFin.
What happens if our euro stablecoin becomes “significant”?
Significance triggers extra obligations and oversight by the EBA, alongside your home authority. Expect higher reporting, potential capital add-ons, and tighter risk management rules. The EBA maintains the criteria and related standards on its public hub EBA.
What does passporting from Germany actually involve?
You notify BaFin with the services and countries you plan to cover. BaFin forwards the information to ESMA and host regulators. After the notification takes effect, you can provide those services cross border or set up a branch. Keep your marketing and disclosures aligned with MiCA in each target market.
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

フランスはスイッチを切り替えました。MiCAへの移行ウィンドウはすでに完了し、旧来のPSAN手引きは実質的に退役しています。いまフランスのユーザー向けに提供したいなら、新しいMiCA認可を持つか、パスポートで入れてください。中途半端な対応はありません。
良いニュース：道筋は明確で公開されています。あまり楽しくない部分：以前よりもハードルは高くなり、AMFはガバナンス、保管、行為、AMLの各領域であなたの取り組みを示すことを求めています。
以下は、暗号資産サービス提供者が、新しいルールに引っかからずにフランスで運営するために「実務として」正しく押さえる必要があることです。

UAEで暗号資産ビジネスを立ち上げたり拡大したりしようとしているなら、最初に全員が必ず聞く質問は同じです。『誰が実際にあなたをライセンスするのか？』答えは1つの規制当局ではありません。3つです。そして、どれを選ぶかが、プロダクトの範囲から銀行口座、採用計画に至るまで全てを左右します。
UAEが暗号資産の監督をどのように分けているかを、実務的に見ていきます。ドバイのVARA、アブダビのADGM/FSRA、そしてそれ以外をカバーする連邦SCAの3者です。誇大宣伝なし—地図、取捨選択、そして人々がつまずき続ける落とし穴をまとめます。

あなたはシンガポールの取締役会（ボードルーム）に座っていて、アジア計画を左右する質問をされます。「来四半期、ここで実際に小売にサービス提供できるのか。それともMASのライセンス規制で、もう1年足止めを食らうのか？」部屋がしんと静まります。全員がコンプライアンスを見ています。
その問いはさらに鋭くなっています。ライセンスされたDigital Payment Token提供者の顔ぶれが増え、ステーブルコインのルールブックは稼働し、AMLへの期待はより厳格な形になりました。シンガポールで暗号に触れるなら、今はマーケティングよりも詳細が重要です。