Do Crypto Payment Gateways Need a License?
Whether a crypto payment gateway needs a license usually turns on custody. Here is how MiCA, FINTRAC, and US money-transmitter rules treat custodial vs non-custodial.
Do this next
Accept crypto for your own sales
- Tax the supply in local currency at the tax point.
- Licensing usually follows custody, not invoicing.
- Keep a per-invoice fiat figure at settlement.
TL;DR
In most jurisdictions, whether a crypto payment gateway needs a license turns heavily on custody. Holding customer funds — safekeeping crypto or the private keys — typically triggers licensing: a MiCA CASP authorisation in the EU, MSB registration with FINTRAC in Canada, and state money-transmitter licenses plus FinCEN MSB registration in the US. Non-custodial models that never take control of funds often fall outside money-transmission definitions, though AML, sanctions, and consumer rules can still apply.
In most jurisdictions, whether a crypto payment gateway needs a license turns heavily on one thing: custody. If the gateway holds customer funds — safekeeping the crypto or the private keys — it typically needs a license: a MiCA CASP authorisation in the EU, money services business (MSB) registration with FINTRAC in Canada, and state money-transmitter licenses plus FinCEN MSB registration in the US. A genuinely non-custodial gateway that never takes control of funds often falls outside the core money-transmission definitions — but AML, sanctions, Travel Rule, and tax obligations can still apply.
We build Settlematic, a non-custodial gateway, so we have a view here. This is a general explainer, not legal advice, and every regulatory claim is sourced to a primary regulator or statute.
Why custody is the pivot
Money-transmission and crypto-service licensing regimes exist to protect the funds of people who hand them to an intermediary. The legal trigger, across regimes, is broadly the same: does the provider accept and control someone else's value? If yes, you are handling other people's money and the law wants you licensed, capitalised, and supervised. If the funds never leave the customer's or merchant's control, much of that rationale — and often the legal definition — does not apply.
This is why the custodial vs. non-custodial distinction is not just a security talking point; it is frequently the line between needing a costly license and not. It does not, however, switch off every obligation, as the jurisdiction-by-jurisdiction picture shows.
European Union: MiCA and CASP authorisation
Under the Markets in Crypto-Assets Regulation, providing crypto-asset services to EU clients requires authorisation as a Crypto-Asset Service Provider (CASP). Since 1 July 2026, full CASP authorisation is required and prior national regimes no longer suffice, per ESMA.
Custody is explicitly one of the regulated services. MiCA defines it around safekeeping crypto-assets or the means of access to them — the private keys — on a client's behalf, and it carries the heavier obligations: own-funds requirements, asset segregation, and client reporting. Non-custodial activity changes the surface area substantially, though other MiCA-adjacent duties and AML obligations under the EU framework can still apply depending on what the gateway does. See accepting crypto payments in the EU under MiCA.
United Kingdom: FCA perimeter, not MiCA
The UK is not in MiCA. The FCA perimeter covers cryptoasset activities such as custody, exchange, and promotions. A merchant whose invoice payment settles to a wallet it already controls is generally not carrying on a regulated cryptoasset activity. A gateway that takes custody and converts for the merchant is. Merchant tax and VAT: accept crypto payments in the UK.
Canada: FINTRAC MSB registration
Canada treats crypto payment processing as a money-services activity. Businesses dealing in virtual currency, including many crypto payment processors, generally must register as a money services business with FINTRAC under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, with no minimum transaction threshold, and must maintain AML/KYC programs, keep records, and file reports. See accepting crypto payments in Canada for the fuller picture, including CARF reporting.
United States: FinCEN MSB and state money-transmitter licenses
The US applies two layers. Federally, custodial crypto businesses that accept and transmit value are money transmitters and must register as an MSB with FinCEN. At the state level, most states require a separate money-transmitter license, obtained state by state — a significant undertaking.
Custody is decisive here too. FinCEN's 2019 guidance (FIN-2019-G001) distinguishes hosted from unhosted wallets: hosted-wallet providers that receive, store, and transmit crypto on behalf of accountholders are money transmitters, while providers of unhosted-wallet software — where the owner retains total independent control of the value — are generally not money transmitters. The guidance is explicit that the analysis follows control of funds "regardless of the label the person applies to" its activities, so calling yourself non-custodial does not help if you actually control funds.
Licensing triggers at a glance
| Jurisdiction | Custodial gateway | Genuinely non-custodial |
|---|---|---|
| EU (MiCA) | CASP authorisation; own-funds, segregation | Custody rules generally not triggered; AML may still apply |
| UK (FCA) | Custody / exchange typically in perimeter | Merchant settlement to own wallet generally outside |
| Canada (FINTRAC) | MSB registration; AML/KYC, reporting | Depends on whether value is transmitted; analysis is fact-specific |
| US (FinCEN + states) | MSB registration + state money-transmitter licenses | Unhosted-wallet software generally not a money transmitter (FinCEN 2019) |
What non-custodial does NOT exempt you from
Being non-custodial is not a blanket exemption. Depending on activity and jurisdiction, these can still apply:
- AML and sanctions screening obligations attached to payment services generally.
- Travel Rule information-sharing where it applies to the transaction.
- KYB/KYC onboarding expectations for a payments business.
- Tax reporting and record-keeping duties, which are separate from money-transmission licensing.
- Consumer-protection and disclosure rules for merchant-facing services.
So the honest framing is: non-custodial can remove the heaviest licensing burden — the money-transmitter/CASP-custody layer — but a serious provider still runs compliance programs. Settlematic supports KYB/KYC onboarding and Travel Rule workflows precisely because non-custodial does not mean unregulated.
Where Settlematic sits
Settlematic is non-custodial by construction: deposit addresses are bound at issuance to a wallet the merchant controls, and we never hold keys or funds. That materially changes the licensing analysis relative to a custodial processor, while we still run KYB/KYC and Travel Rule workflows. Our compliance and security posture is documented on the security page. Your own licensing position as a merchant accepting crypto is separate — confirm it for your jurisdiction; start with is it legal to accept crypto payments.
If you want to see a non-custodial flow before assessing your own obligations, run a real payment in the free sandbox.
This article is general information, not legal advice. Licensing turns on specific facts and evolving rules — consult qualified counsel in your jurisdiction. Sourced to ESMA, MiCA Regulation (EU) 2023/1114, FINTRAC, and FinCEN FIN-2019-G001; verified 7 September 2026, rules change.
Sources
Frequently asked questions
- Do crypto payment gateways need a license?
- It depends on custody and jurisdiction. A gateway that holds customer funds almost always needs a license — a MiCA CASP authorisation in the EU, MSB registration with FINTRAC in Canada, or state money-transmitter licenses plus FinCEN MSB registration in the US. A genuinely non-custodial gateway that never controls funds often falls outside money-transmitter definitions, but other rules can still apply.
- Does non-custodial mean no license is needed?
- Not automatically. Non-custodial changes the analysis significantly — US FinCEN guidance says unhosted-wallet software providers are generally not money transmitters — but AML, sanctions screening, Travel Rule, tax reporting, and consumer-protection obligations can still attach depending on the activity and jurisdiction.
- What triggers a MiCA CASP license in the EU?
- Providing crypto-asset services to EU clients, including custody, requires CASP authorisation since 1 July 2026. Custody — safekeeping crypto-assets or the means of access, meaning private keys — is a regulated service carrying heavier own-funds and segregation obligations.
- Do crypto payment processors need to register in Canada?
- Yes. Crypto payment processors handling value transfers generally must register as a money services business with FINTRAC under the PCMLTFA, with no minimum threshold, and comply with AML/KYC and reporting duties.
- What about the United States?
- Custodial processors typically must register as an MSB with FinCEN and obtain money-transmitter licenses state by state. Per FinCEN's 2019 guidance, providers of unhosted-wallet software who never take control of funds are generally not money transmitters, though this is fact-specific.