Question 1

What licenses are required to operate a crypto payment business?

Accepted Answer

First look at what the client asks you to complete, not at what the product is called When assessing licensing, the most useful material is not the "Web3 payment" label in a business plan, but the complete process of a single order: to whom the client gives instructions, whose wallet or account the assets first enter, who can sign or freeze, who quotes the price, and to whom the merchant ultimately has recourse for payment. Merely providing a billing page is not the same type of service as undertaking to convert stablecoins into US dollars and pay the merchant. Even if client assets remain for only a few minutes, they should be included in the business analysis. Client funds should also be marked separately from the company's own liquidity: for the same outbound transfer, using client balances to perform instructions and a company disposing of its own assets may require different analyses. The crypto-asset side and the fiat-currency side may each be subject to regulation Taking the EU as an example, Article 59 of MiCA ties admission to crypto-asset services to specific operating entities and authorized services, rather than giving a company a pass of unlimited scope. The European Banking Authority's opinion on the interaction between MiCA and PSD2 also indicates that certain e-money token services may simultaneously involve payment regulation. Therefore, after obtaining crypto-asset service qualifications, it is still necessary to separately verify how fiat currency is collected and paid after conversion; the fiat-currency-side analysis cannot be skipped merely because the wallet does not display a fiat-currency balance. Two merchant collection solutions have different liability structures Assume an overseas e-commerce merchant uses the same checkout page. In Solution A, the merchant contracts directly with an institution authorized to provide the relevant services; that institution collects the crypto assets, converts them and settles, and the software company only provides order integration. In Solution B, the software company quotes in its own name, collects the crypto assets and guarantees that the merchant receives a fixed amount in US dollars, and then engages an upstream party to perform. The two appear similar, but the service the client purchases and the entity bearing the risk differ; Solution B cannot be treated as pure technical services merely because the upstream party holds a license. First form an access checklist, then decide the order of applications It is advisable to list the service entity, country, qualifications and contracts corresponding to each stage in a table, identify stages not yet covered, and then compare the costs of applying independently and cooperating. Mainland China cannot directly apply the above overseas models; Yinfa [2026] No. 42 imposes restrictions on domestic virtual-currency-related business and on overseas entities unlawfully providing services to domestic parties. The team's location, the clients' location and the source of funds should be reviewed together; an overseas company registration certificate cannot replace a market-access conclusion. Recommended actions Draw a flow chart of assets, instructions and liability for one normal payment and one refund. Verify the exact names, status and scope of services of each cooperating entity against public regulatory registers. For the first batch of client countries, form a list of "permitted, permitted with conditions, and not currently open". Information note: This article provides general information only and does not replace legal advice based on specific facts. Reference basis MiCA Article 59 — Authorisation — ESMA The EBA advises national authorities on actions at the end of the PSD2/MiCA No-Action Letter transition — EBA Notice on Further Preventing and Addressing Risks Associated with Virtual Currencies and Related Matters — Issued by eight departments including the People's Bank of China; published on the official website of the China Securities Regulatory Commission MiCA Article 70 — Safekeeping and related payment services — ESMA Related Q&A 2. We already hold a traditional payment license. Do we need a new license to add stablecoin collection and payment services? 3. If we only provide payment technology interfaces and do not handle customer funds, do we need a license? 12. For global crypto payment services, do we need to apply for a license in every country? 46. If the upstream exchange and payment institutions both hold licenses, do we still need a license ourselves? All crypto payment Q&A Next question 2 →

Question 2

If We Already Hold a Traditional Payment License, Do We Need a New License to Add Stablecoin Collection and Payment Services?

Accepted Answer

First, verify what the original license permits "Payment company" is merely an industry label; the actual qualification may be money remittance, acquiring, e-money issuance or other services. The review should begin with the licensing decision, the attached conditions and the public register, and then compare each item against the new product. A distinction should also be drawn between using stablecoins to settle fiat currency on one's own account and directly providing customers with services to buy, hold and transfer coins: the obligations owed to customers differ between the two products, and the original market-access conclusion cannot simply be carried over merely because both are embedded in the existing payment page. At the same time, check whether the original license is subject to restrictions on business scale, customer type or geographic scope of service. Adding a stablecoin function may change the business and risks described in the original application even if the licensed entity remains unchanged. The EU notification route is not available to all payment institutions Article 60 of MiCA establishes a route for certain financial institutions to provide some crypto-asset services. Among these, the notification arrangement for e-money institutions concerns the custody and transfer of e-money tokens they issue themselves; it does not permit them to operate all third-party stablecoins under their original license. Ordinary payment institutions also cannot assume that they fall within the institutions listed in that article merely because they belong to the financial sector. Whether the applicable route is notification, application for CASP authorization or expansion of an existing authorization should be matched item by item against the entity and the service. Assume a new "stablecoin payment" button is added An offshore company that already has a fiat-currency collection business plans to let customers deposit stablecoins into a platform balance and then pay suppliers. The new function does not merely add a payment option; it introduces asset custody, transfer authorization and on-chain exception handling. If a qualified third party instead contracts directly with customers and undertakes these services, the company's role may differ; however, the actual interactions and contracts should be examined, rather than merely adding the partner institution's name at the bottom of the page. Check qualification changes together with operational changes before launch EU EMT services also involve an intersection between MiCA and PSD2, and the EBA continues to address the interface between authorizations in its 2026 opinion; earlier regulatory transition recommendations cannot be understood as a permanent exemption. In practice, the company should also re-obtain confirmation from banks and payment channels regarding the new business, and update customer terms, asset segregation, refunds, wallet permissions and incident response plans. Bank confirmation here is a check of cooperation feasibility and does not mean that a bank can approve a business that is otherwise not permitted by law. Recommended actions Prepare a gap table comparing the original license scope with the new functions, and clearly define the boundary between operating in-house and operating through third parties. If relying on a notification or an add-on, record the specific provisions, preconditions and procedures of the competent authority. Set the threshold for launching real transactions only after completing changes to bank, upstream channel and customer contracts. Information note: This article provides general information only and does not replace legal advice based on specific facts. References MiCA Article 60 — Provision by certain financial entities — ESMA The EBA advises national authorities on actions at the end of the PSD2/MiCA No-Action Letter transition — EBA Related Q&A 1. What licenses are required to operate a crypto payment business? 10. What are the main changes a traditional payment company needs to make when transitioning to crypto payments? 28. After obtaining an EU MiCA license, is a payment or e-money license still required? 98. Does adding a new country, new product or new currency require a new license application? ← Previous question 1 All crypto payment Q&A Next question 3 →

Question 3

Does providing only a payment technology interface, without handling client funds, require a license?

Accepted Answer

The interface name does not determine the nature of the business An API may merely display third-party quotes, or it may receive orders and then select counterparties on the customer's behalf, split orders and initiate transfers. It is necessary to clarify: does the customer establish a service relationship directly with a licensed institution? Who can modify the receiving address, cancel orders or release payments? Who bears responsibility for making up shortfalls if a transaction fails? These questions reveal more clearly than the statement that "the funds did not pass through the company's bank account" whether the company is actually selling software or providing financial services. Not holding assets does not necessarily mean being outside the scope of regulation When Singapore's MAS expanded the scope of payment services regulation in 2024, it expressly included certain activities facilitating the transfer or exchange of funds or digital payment tokens without holding the funds or tokens. Therefore, the fact that the server merely transmits instructions and assets move directly from the customer's wallet to a third-party wallet is not a globally applicable licence-free structure. By contrast, the US FinCEN guidance on software development distinguishes between merely developing and selling software and using software to operate a money transmission business; that conclusion addresses only its specific regulatory scope and cannot substitute for the assessment of other states or countries. Testing the boundary with a hypothetical change Suppose a merchant originally placed orders independently on a third-party page, and the software only synchronised order status; later, to "optimise the experience", the team had customers uniformly accept terms on its own page, with the platform automatically selecting the quoting party and guaranteeing the exchange rate and arrival of funds. Even if the underlying payment address remains unchanged, the newly added customer commitments, order control and performance arrangements may also change the legal characterisation. The technical team's permission design, product copy and contracts must be reviewed together, rather than checking only the receiving account after development is complete. Turning technical boundaries into verifiable evidence If the intention is to operate on a purely technical model, the company should retain data-flow and instruction-flow descriptions, an interface permission list and division-of-labour contracts with service providers, and confirm that an applicable exclusion or exemption basis genuinely exists locally. Do not describe the real business as a different business in order to reduce regulatory costs; customers should know who provides the exchange, custody and payment services. New features added after launch should also undergo change review, especially features such as unified balances, automatic currency conversion and platform signing on behalf of customers. During review, do not look only at front-end flowcharts; have technical personnel demonstrate administrator permissions, key sharding, contract upgrades and manual release functions, to confirm that the division of labour on paper matches actual capabilities. Recommended actions List the read and write permissions of each API one by one, and check whether the platform can independently or jointly change the destination of assets. Verify whether the actual service provider stated in the interface, terms and customer service commitments is consistent. For the "purely technical" conclusion, create a record of the applicable jurisdictions, specific provisions and functional boundaries. Information note: This article provides general information only and does not replace legal advice based on specific facts. References MAS expands scope of regulated payment services — MAS Virtual Currency Software Development and Certain Investment Activity — FinCEN Related Q&A 47. If I use a licensed institution's white-label solution and operate under my own brand, do I need a license? 61. If I only charge technical service fees and do not profit from exchange rate spreads, do I still need a license? 66. Do I need to apply for a license to develop and operate a self-hosted wallet? 75. Does a product where an AI agent makes payments on behalf of users require a payment license? ← Previous question 2 All crypto payment Q&A Next question 4 →

Question 4

Is it lawful to collect stablecoins on behalf of merchants and then settle them in fiat currency?

Accepted Answer

A single settlement usually involves more than one service From the customer's payment to the merchant's receipt of US dollars, at a minimum the following questions must be answered: who receives the stablecoin, who holds the assets, who executes the exchange, and who pays the fiat currency. If the platform promises settlement at a fixed exchange rate, it should also specify the point in time at which the rate is locked and who bears the risk of network congestion or upstream refusal to pay. The crypto asset services listed in the EU's MiCA include exchange, custody and transfer on behalf of clients; the specific licence cannot be selected based merely on the word "collection", and the fiat payment stage should also be separately checked against payment regulation. It should also be confirmed whether the merchant statement shows the coins pending exchange, the fiat currency pending payment, or the amount already received, so as to avoid treating upstream operations that have not yet been completed as funds already at the merchant's disposal. Domestic merchants cannot bypass restrictions through offshore entities Yinfa [2026] No. 42 of 2026 continues to prohibit the conduct of fiat currency and virtual currency exchange and other related business within the territory, and restricts offshore entities and individuals from unlawfully providing related services to domestic entities. This notice has already replaced the 2021 notice. Therefore, packaging RMB or domestic trade receivables as offshore stablecoin payments, or arranging for an offshore company to sign the contract, does not by itself prove legality; the customer's actual business operations, the provision of services and the use of funds still need to be reviewed. Assume the merchant is in an offshore market that permits receipt of coins An offshore hotel that wishes to accept stablecoin payments from guests while receiving local fiat currency can compare two structures: a qualified institution contracting directly with the hotel and responsible for exchange and settlement, or the platform acting as the hotel's settlement obligor and then engaging upstream providers. The latter structure causes the platform to bear more performance risk and makes it more necessary to verify its own qualifications. Even if the former structure is adopted, it should still be confirmed that the currency, network, merchant industry and settlement destination are all within the scope acceptable to the cooperating institution. Lawful collection of payments must also be able to handle refunds and anomalies The assessment of a solution should not merely demonstrate a successful payment. It is advisable to also design processes for underpayment, overpayment, wrong chain, sanctions screening hits, stablecoin freezing and consumer refunds. For example, whether a refund upon return of goods is made in the original coin quantity or the original fiat amount should be specified before the transaction; this is a matter of contract and risk allocation, not simply "reversing" the original on-chain transaction. Only when the entity, qualifications, transaction purpose and anomaly handling can all be closed off is it suitable to proceed to testing with real merchants. Recommended actions Place the merchant's place of business, the place where the service contract is signed, the asset flow and the location of the settlement account on the same chart. Verify the qualifications of each entity involved in receiving coins, exchange, custody and fiat settlement, as well as the scope of currency support. Conduct tabletop exercises using three scenarios—refunds, freezing and upstream refusal to pay—and revise the merchant terms. Information note: This article provides general information only and does not replace legal advice based on specific facts. References MiCA Article 3 — Definitions — ESMA Notice on Further Preventing and Addressing Risks Associated with Virtual Currency and Related Matters — People's Bank of China and seven other departments EBA No Action letter on PSD2 and MiCA — EBA MiCA Article 70 — Safekeeping and related payment services — ESMA Related Q&A 7. What qualifications are required to pay an overseas supplier in stablecoins on behalf of an enterprise? 36. Can crypto payment services be operated in mainland China? 42. Can we provide stablecoin settlement services to cross-border trade enterprises? 87. If a stablecoin depegs or is frozen, must the platform compensate merchants? ← Previous question 3 All crypto payment Q&A Next question 5 →

Question 5

Does exchanging the company's own stablecoins for fiat currency for customers require a license?

Accepted Answer

Asset ownership and the nature of the business are two separate issues Who owns the assets before a transaction is a question of asset attribution; whether a company provides financial services to external customers is a question of regulatory characterization. Suppose a company purchases stablecoins in advance as inventory and delivers them after a customer places an order; the fact that it is "selling inventory" does not by itself exclude regulation. Conversely, an ordinary enterprise occasionally disposing of assets to pay its own expenses and a business continuously operating exchange as a customer-acquisition product must be analyzed separately and cannot be covered by the same conclusion. The fact that a company bears inventory price fluctuations does not automatically turn a transaction into an ordinary investment; the key remains whether this transactional capability is offered as a continuous service to customers. External quotation records and customer contracts can both help reconstruct the facts. Official rules do not regulate only buying and selling on behalf of clients Article 3 of the EU's MiCA defines exchange services for buying and selling crypto assets with customers using own capital, which shows that proprietary inventory and operational exchange can coexist. The U.S. FinCEN also distinguishes individuals or enterprises acting as users for their own payments and investments from those conducting business as exchange operators; an interpretation limited to investing for one's own account cannot be expanded into a blanket exemption for providing over-the-counter exchange to customers. These are determinations under their respective regimes, not a globally uniform licensing rule. Where customer funds go adds further issues Suppose a customer, after selling coins, asks for fiat currency to be paid to its own corporate account, versus asking for payment to multiple suppliers; these are two different delivery methods. The latter may no longer merely complete a bilateral sale but may also involve transferring value on the customer's behalf. Allowing customers to retain balances over the long term, withdraw in installments, or offset receipts and payments among different customers should also be analyzed separately; writing a contract as an asset sale cannot automatically eliminate actual custody and payment functions. Only by assembling the complete transaction facts can the threshold be assessed It is advisable to compile the frequency of quotations, external marketing methods, number of customers, sources of funds, and the sequence of execution and delivery, and to explain whether third-party payments and receipts are permitted. The assessment cannot rest solely on the amount being small or the absence of service fees. After completing the jurisdictional analysis, decide whether to merely manage the company's own assets or to establish access, customer due diligence, quotation and abnormal-transaction systems as an exchange business; operational exchange in mainland China must still be separately assessed under the current prohibitory provisions. Recommended actions Prepare separate processes for proprietary asset management and customer-facing exchange, and avoid mixing accounts and external statements. Check whether customers can require third-party receipt, balance retention, or delivery split across multiple transactions. Confirm the exchange definition and exceptions in the market you intend to serve, and do not substitute "proprietary trading" or "spread" for legal analysis. Information note: This article provides general information only and does not replace legal advice based on specific facts. References MiCA Article 3 — Definitions — ESMA Application to Persons Administering, Exchanging, or Using Virtual Currencies — FinCEN Virtual Currency Software Development and Certain Investment Activity — FinCEN Notice on Further Preventing and Addressing Risks Associated with Virtual Currency and Related Matters — People's Bank of China and seven other departments ESMA Q&A 2293 — Proprietary trading under MiCA — European Commission response, published by ESMA Related Q&A 3. If we only provide payment technology interfaces and do not handle client funds, do we need a license? 21. What crypto payment business can U.S. MSB registration support? 61. If we only charge technical service fees and do not earn exchange spreads, do we still need a license? 64. Can cross-border collection and payment business be completed entirely on-chain? ← Previous question 4 All crypto payment Q&A Next question 6 →

Question 6

Do crypto payment platforms serving only corporate clients also need a license?

Accepted Answer

B2B describes clients and does not replace service classification Enterprises paying suppliers, merchants accepting customer payments, and groups managing funds all have different commercial purposes, but whether a platform handles assets on behalf of clients still requires an independent assessment. Taking the EU's MiCA as an example, the definition of client includes natural and legal persons receiving services, and does not protect only individual investors. Therefore, merely closing the registration channel for individual account opening cannot automatically remove from the regulatory scope business that originally constituted CASP services; the specific services and potentially applicable exemptions should still be examined. Corporate identity and professional qualifications cannot be conflated Although small trading companies, investment funds and licensed financial institutions are all legal persons, their experience, purposes and applicable rules may differ. If reliance on professional clients, qualified investors or other specific category arrangements is intended, the definitions and corresponding rules of the target jurisdiction must be verified as to exactly what they reduce or exempt. Certain arrangements only change disclosure, marketing or investor protection requirements and do not automatically eliminate business licensing. A sales team cannot complete the legal classification merely by having clients tick "corporate account". Assume the platform only pays for goods on behalf of an exporting company Where a platform receives corporate funds, converts currencies and then delivers them to an overseas supplier, it may still be conducting money or virtual asset transfers. A genuine procurement contract helps explain the purpose of the transaction but cannot replace business qualifications. Conversely, if the platform only provides invoice matching and payment approval software, and the enterprise directly instructs a qualified institution to execute, the role may differ. The two models should be distinguished by actual instructions, asset control and contractual obligations, rather than conflated on the ground that all clients are engaged in trade. B2B compliance should be designed around enterprise risk The MAS DPT anti-money laundering notice in Singapore requires identification of clients and beneficial owners and ongoing monitoring of relevant risks. For corporate payments, it is advisable to further verify whether the actual chain of control, authorized payers, business scale and payees match. For batch payments in particular, the link from the corporate client to each ultimate payee must be retained; checking only the first-tier company is insufficient. Focusing on a small number of industries helps deepen the inquiry, but does not mean that all clients holding a business licence may be onboarded. Corporate clients may also change controllers, add operating regions or suddenly change transaction scale, and passing initial onboarding does not mean no further review is needed later. It is advisable to pre-set business changes that trigger re-review. Recommended actions Clarify the categories of legal-person clients and the legal purpose for adopting such classification, and retain evidence of qualifications. Establish a checklist for corporate control, authorized personnel and transaction purposes. Sample one batch payment and verify that each ultimate payee can be linked to a specific order and instruction. Information note: This article provides general information only and does not replace legal advice based on specific facts. References MiCA Article 3 — Definitions — ESMA Notice PSN02 — AML/CFT for Digital Payment Token Service — MAS Related Q&A 7. What qualifications are required for an enterprise to use stablecoins to pay overseas suppliers? 56. Merchants in which industries may crypto payment institutions provide services to? 76. What are the most basic anti-money laundering obligations of a crypto payment company? 77. If we serve only corporate clients, will anti-money laundering work be somewhat simpler? ← Previous question 5 All crypto payment Q&A Next question 7 →

Question 7

What qualifications are required to pay an overseas supplier in stablecoins on behalf of an enterprise?

Accepted Answer

First, clarify the starting point and endpoint of payment When preparing a proposal, the enterprise should specify from which country and which account it pays what assets, and in which country the supplier ultimately receives what assets. An enterprise paying US dollars while the supplier receives stablecoins, versus an enterprise paying stablecoins while the supplier receives local fiat currency, creates different requirements for exchange and payment channels. It should also be stated whether the platform advances funds first, whether it pools funds from multiple enterprises, and who bears the ultimate obligation to ensure receipt; these are not purely technical details, but the basis for determining the content of the service and the allocation of risk. The customer contract should also state whether the supplier's receipt of the specified currency has already discharged the enterprise's payment obligation for the goods. The platform's completion of the technical transfer and the buyer's and seller's confirmation that the debt has been performed should not be conflated in product presentations. The enterprise paying itself differs from the platform paying on the enterprise's behalf In FinCEN's interpretation, using virtual currency to pay for one's own goods or services differs from operating a business of accepting and transferring value on behalf of others. Assume the enterprise independently controls its wallet and signs payments to the supplier, with the platform only managing invoices; in another model, the platform receives the enterprise's funds, decides on its own to exchange currencies and transfer funds, and delivers a "paid" result to the enterprise. The latter model cannot be regarded as the enterprise's own use merely on the ground of trade payment, and the upstream execution of transactions does not automatically eliminate the platform's liability. Both ends must be verified, not only the issuing side FINTRAC's business guidance in Canada includes virtual currency exchange and transfer within the relevant MSB activities, reflecting that currency transfer itself may also trigger regulation. An actual cross-border product should also be examined end by end: whether the payer side covers the service, whether the receiving side permits the supplier to receive currency, and whether the ultimate fiat currency account accepts that source. The above Canadian definitions cannot be directly applied to all countries, but they are sufficient to show that "using only stablecoins for transit and not touching local currency" is not a universal exemption. Domestic trade and abnormal payments require a separate checkpoint Where Mainland Chinese enterprises, domestic receipts and payments, or services provided to the domestic market are involved, a separate assessment should be made under the 2026 notice and relevant foreign exchange and other rules, and a genuine contract must not be treated as a green channel for stablecoin settlement. For permitted overseas business, it is advisable to agree in advance on confirmation of the receiving address, erroneous payments, exchange rate differences and the handling of supplier refusal, and to retain the linkage among contracts, invoices, customer instructions and final receipt evidence, so as to avoid having only an on-chain hash while being unable to explain the purpose of payment. Recommended actions Fix the two countries, customer types, receipt and payment currencies and ultimate accounts of the first payment corridor. Retain trade documents in linked form with payment instructions, exchange records, on-chain transfers and bank receipts. Verify separately the service qualifications at both ends and the supplier's receipt conditions, and do not open destinations that have not been confirmed. Information note: This article provides general information only and does not replace legal advice based on specific facts. References Application to Persons Administering, Exchanging, or Using Virtual Currencies — FinCEN Money services businesses — FINTRAC Notice on Further Preventing and Addressing Risks Associated with Virtual Currency and Related Matters — People's Bank of China and seven other departments Related Q&A 4. Is it lawful to collect stablecoins on behalf of merchants and then settle them into fiat currency? 42. Can we provide stablecoin settlement services for cross-border trade enterprises? 60. What legal issues arise when making payments to overseas employees and contractors on behalf of an enterprise? 64. Can cross-border receipt and payment business be conducted entirely on-chain? ← Previous question 6 All crypto payment Q&A Next question 8 →

Question 8

If a company is incorporated offshore and serves only overseas clients, where does it need to be licensed?

Accepted Answer

First, clarify what “overseas” is being measured against A company incorporated in jurisdiction A, operated by a team in jurisdiction B, and serving customers in jurisdiction C may need to analyze all three places at the same time. A certificate of incorporation reflects the legal entity, but it cannot fully answer who is taking orders, managing wallets, and making risk decisions. It is advisable to determine the actual place of performance by function, including contracting, marketing, customer onboarding review, transaction execution, asset control, and complaint handling; the mere fact that servers are located abroad does not establish that core operations are also abroad. The existence of cloud services, outsourced customer support, and remote employees should likewise not be mechanically equated with a local licensing obligation, but these facts should be included in the factual inventory so that local rules can determine whether the connection is sufficient, rather than being disregarded at the outset. Some regimes look at local outbound business In 2025, the Monetary Authority of Singapore (MAS) clarified that a DTSP that falls within the relevant regime and provides digital token services only to customers outside Singapore also requires the corresponding licence, and stated that it would generally not grant such licences. This example shows that “not serving customers in the place of incorporation” does not necessarily reduce the difficulty of market entry and may even make a particular establishment structure unsuitable for the actual business. However, this should be assessed by reference to the specific entity, tokens, and scope of services, and that position should not be extended to all Singapore technology companies. Some regimes look at whether services are solicited overseas for local customers The FMSB conditions listed by FINTRAC in Canada include having no place of business in Canada but directing and actually providing relevant services to individuals or entities in Canada; both the manner of marketing and customer contact are relevant. Therefore, a website statement that services are provided “only overseas” and the use of a foreign company to sign contracts do not mean that the customer market can be ignored. Active promotion, local agents, and service support for a particular market should be examined together with the actual location of customers; the assessment cannot be completed solely on the basis that a customer provides an overseas address. Even if the place of incorporation remains unchanged, the business may still change Assume that the team originally served only one assessed market, but later had sales personnel continuously solicit customers in another country and had local employees approve large payments. The articles of association have not changed, but new customer and operational connections have been added. It is advisable to establish country admission approval: first confirm the licensing or cross-border service basis, and then open registration, marketing, and transactions, rather than conducting business first and supplementing the research afterward. Where a mainland team is involved, its actual functions and mainland restrictions should also be separately reviewed; an overseas licence cannot replace this step. Recommended actions Create a three-layer map of entities, personnel functions, and customer markets, rather than listing only the company’s registered address. For each initial market, record the factual connections relating to active marketing, service contact, and payment channels. Include new countries, personnel permissions, and local agents in compliance change approval. Information note: This article provides general information only and does not replace legal advice based on specific facts. References MAS clarifies DTSP regulatory regime — MAS Money services businesses — Foreign MSB criteria — FINTRAC Notice on Further Preventing and Addressing Risks Associated with Virtual Currency and Related Matters — People's Bank of China and seven other departments Related Q&A 11. Where is it more appropriate to register a crypto payment company? 12. To operate a global crypto payment business, must a license be applied for in every country? 31. If a Singapore company serves only overseas clients, does it still need a local license? 39. If employees of an offshore crypto payment company work in mainland China, are there legal risks? ← Previous question 7 All crypto payment Q&A Next question 9 →

Question 9

Can a crypto payment project launch a trial operation first and apply for a license only after the business takes off?

Accepted Answer

The key question is what was tested, not how long it was called a trial operation If a client has already handed real funds or stablecoins to the platform, and the platform is responsible for exchange, custody or delivery, the test label does not change the fact that assets and responsibility have already shifted. By contrast, simulated orders, test-network assets, internal technical demonstrations and user interviews that do not collect client funds can be used to validate processes. The two should be designed separately; in particular, do not casually complete a real payment on behalf of a prospective client during the demonstration stage and then conclude that no business is being conducted because no fee was charged. Signing a confidentiality agreement, inviting only familiar enterprises, or having participants bear the risk themselves does not automatically change the nature of the activity; a testing contract cannot replace the licensing or registration basis required by law. Whether to register first or operate first depends on the specific regime Canada's FINTRAC expressly requires the relevant MSBs to register before commencing operations; this is not an arrangement under which a business reports retroactively once it reaches a certain scale. The form and timing of market access may differ in other markets, and the filing deadline in one jurisdiction cannot be used to explain the prior authorization requirement in another. Even where the registration procedure differs from licensing approval, anti-money laundering, record-keeping and other applicable obligations should not be treated as matters that may be deferred during a trial operation stage. Formal sandboxes still have market-access boundaries The UK FCA's regulatory sandbox guidance emphasizes that testing involving regulated activities still requires appropriate authorization or registration first, and may be subject to restrictions such as the number of clients, duration and scope of activities. The fact that a payment project is approved to test within a designated client scope does not mean the same product can be opened globally. Written approval or legally applicable arrangements should govern; verify who the approved entity is, which functions are being tested, and how the project will exit or transition to formal operations after testing ends. Break the launch threshold into verifiable milestones It is advisable to divide the launch plan into three stages: technical validation, partner integration testing and real business, with each stage clearly specifying what assets may be accessed and who bears the service obligations. Before real transactions, check the client agreement, qualification status, fund segregation, transaction monitoring and incident handling, rather than merely checking whether the interface is available. If unlicensed operations have already occurred, it is inadvisable to continue accumulating transaction volume while waiting for approval; historical records should be preserved, new risks should be limited, and options for cessation, client exit and subsequent filings should be assessed. Recommended actions Determine whether the test environment involves client assets with real value, and close any unreviewed channels for real deposits. Retain the applicable market-access basis or sandbox approval documents, and verify the entity, duration, client and product restrictions. Add sign-off on qualifications, client protection and exception handling to the launch acceptance checklist; the technical lead alone should not be able to clear the launch. Information note: This article provides general information only and does not replace legal advice based on specific facts. References Register your MSB or FMSB — FINTRAC Regulatory Sandbox — FCA Related Q&A 3. If we only provide payment technology interfaces and do not handle client funds, do we need a license? 15. How long does it generally take to apply for a crypto payment license? 96. We have been operating for some time without a license; can we still apply for one retroactively? 98. If we add a new country, new product or new currency, do we need to reapply for a license? ← Previous question 8 All crypto payment Q&A Next question 10 →

Question 10

What must traditional payment companies primarily change when transitioning to crypto payments?

Accepted Answer

Decide on the new service first, not buy the system first The team should first answer what commitment it intends to offer to whom: give merchants an additional payment collection method, make payments on behalf of enterprises, or let users hold and transfer out stablecoin balances? For the same payment company to offer these three types of products, the required licenses, wallet permissions and customer terms may differ. The specific financial institution pathway under Article 60 of the EU's MiCA also has service limitations; one cannot presume that all new functions merely require notification simply because traditional payment qualifications are already held. The ledger needs to explain both bank money and on-chain assets The original "order success" may have relied mainly on payment channel receipts; after adding on-chain transfers, it is also necessary to define when a transaction is considered finally completed, and how to handle wrong chains, insufficient receipt and incomplete exchanges. It is recommended to distinguish order amount, token holdings, exchange price and final settlement amount, so that customer receivables, platform inventory and on-chain addresses can be reconciled. Do not treat all stablecoins as equivalent US dollar deposits, and do not directly equate on-chain success with receipt into the merchant's bank account. The existing finance and customer service teams also need to understand these statuses in sync, to avoid manual oral explanations of delays after the system marks "completed." A single order can first be used to run through finance, technology and customer service for full-process acceptance testing. Risk control extends from bank cards to wallets and partner institutions EU MiCA governance requirements include appropriate personnel, continuous operations and secure information technology arrangements; Singapore's 2024 related measures also strengthened DPT customer asset protection. At the product level, the team should clarify private key and signing permissions, wallet backups, on-chain transaction review, and handling when upstream services are suspended. Using third-party custody or on-chain analytics tools can provide capabilities, but the company still needs to know who judges alerts, who can stop payments and who explains to customers. Test the business model with one hypothetical corridor For example, first provide one stablecoin, one network and one fiat settlement method to specific overseas merchants in markets that permit receiving coins, rather than supporting global wallets and multi-currency balances on day one. When assessing, simultaneously calculate exchange spreads, on-chain fees, exception handling, banking channels and personnel costs, and first obtain confirmation from partners on the nature of the business. If the original customers are mainly located in mainland China, the current restrictions should be assessed first, rather than directly migrating domestic merchant resources under an overseas entity's name. Action recommendations Clarify which functions in the first version are limited to payment collection, payment disbursement or balance wallets, and freeze functions that have not been assessed. Complete four-way reconciliation testing of the order ledger, on-chain addresses, exchange records and bank receipts. Use drills involving freezes, wrong chains and upstream service suspension to confirm the respective authority of customer service, finance, technology and compliance. Information note: This article provides general information only and does not replace legal advice based on specific facts. References MiCA Article 60 — ESMA MiCA Article 68 — Governance arrangements — ESMA MAS expands scope of regulated payment services — MAS Notice on Further Preventing and Addressing Risks Associated with Virtual Currency and Related Matters — People's Bank of China and seven other departments Related Q&A 2. If we already hold a traditional payment license, do we need a new license to add stablecoin payment and collection services? 50. How should a crypto payment company choose a bank for account opening? 65. Can a crypto payment platform support multiple stablecoins such as USDT and USDC at the same time? 89. If a wallet is compromised or a transfer error occurs, what liability does the platform bear? ← Previous question 9 All crypto payment Q&A Next question 11 →

Question 11

Where Is It More Appropriate to Incorporate a Crypto Payment Company?

Accepted Answer

Choose the service market first, then the company address The first table for site selection should be a customer map, not a ranking of tax rates. Identify the countries where the first batch of customers are located, the payment and receipt currencies, the account or wallet functions required, and whether the company will directly hold customer assets. If the main customers are concentrated in the EU, the EU's market access and cross-border service mechanisms should be studied; if the business relates to only one country, there is also no need to first build a complex group structure for a "global footprint." Company registration, financial licensing and market customer acquisition should be verified separately and cannot substitute for one another. Use hard conditions to first rule out unsuitable options Article 59 of the EU's MiCA sets out clear requirements for the registered office, actual place of management and director residency arrangements of an authorized CASP; Singapore also has a strict licensing position for certain DTSPs that serve only overseas customers. Such conditions directly affect whether an option can be implemented and should not be ranked after registration fees. If the team is unwilling to relocate management functions or bear local personnel costs, the gaps should be identified before applying, rather than registering a shell company first and then looking for a nominee responsible person. Assume the registration quotes for two jurisdictions differ greatly Jurisdiction A is cheap to establish, but cannot support the first batch of customers' market, and the intended bank does not accept the business; Jurisdiction B is more expensive to establish, but has an access pathway that matches the product. What should really be compared at this point is the overall cost of lawfully completing a single transaction, not the price of the company certificate. Whether a bank account can be opened is not determined solely by the place of registration; it is advisable to verify the actual transaction process and customer types with shortlisted banks, exchange and settlement institutions, and avoid treating a service provider's oral assurances as resources already in place. Turn the choice into a reviewable decision table For each retained candidate jurisdiction, record separately the permitted services, customer coverage, management personnel, application materials, capital or safeguards, tax and exit costs. Tax burden, capital contributions and domestic team arrangements should be analyzed separately in detail; it is not appropriate to draw a total-cost conclusion from any single nominal tax rate. The final choice should be able to answer: which lawful businesses will generate revenue in the first year, which prerequisite failing would make the option unfeasible, and whether future new markets will require a second entity or another type of qualification. For each candidate jurisdiction, an "exit condition" can be listed: for example, key positions cannot be filled, core customers cannot be served, or a bank expressly refuses the corresponding process. Once triggered, the location should be reconsidered rather than continuing to invest sunk costs. Recommended actions First lock in the first batch of customers' market and the first version of the product, and list the non-negotiable functional requirements. Score two to three candidate jurisdictions using the same table covering access, team, banking, capital and ongoing costs. Require cooperative resources to specify the actual entities, businesses and countries covered, and do not accept vague statements such as "global accounts can be opened." Information note: This article provides general information only and does not replace legal advice based on specific facts. References MiCA Article 59 — ESMA MiCA Article 65 — Cross-border provision — ESMA MAS clarifies DTSP regime — MAS Related Q&A 8. If a company is incorporated offshore and serves only overseas clients, in which jurisdictions does it need to hold a license? 14. With a limited budget, which license should be applied for first? 18. To apply for an overseas crypto payment license, are a local office and local staff required? 50. How should a crypto payment company choose a bank at which to open an account? ← Previous question 10 All crypto payment Q&A Next question 12 →

Question 12

For global crypto payment services, must a licence be obtained in every country?

Accepted Answer

Regional access has boundaries; it is not global access The EU MiCA regime establishes a cross-member-state service mechanism for CASPs authorized to provide the relevant services and requires the corresponding notifications under Article 65. Its value lies in reducing duplicative authorization within the EU, but it does not mean automatic coverage outside the EU, nor does it expand crypto service permissions into all fiat payment or credit permissions. When planning, the list of countries and the scope of services should be set out together, to avoid promoting "one set of regional rules" as "one global license." Even where overseas clients approach the firm on their own initiative, the exemption cannot be used at will The EU has a narrow arrangement for services requested by clients on their own exclusive initiative, and the ESMA guidance on reverse solicitation emphasizes looking at the facts; contrary marketing conduct cannot be covered by a contractual checkbox. Assuming a company advertises to the EU and then has clients declare that "I found the platform on my own initiative," this cannot establish a compliance basis. Similar rules cannot be directly extended to other countries; absent verification, "clients voluntarily visiting" should not be used as a default reason for opening all markets. Payment destinations and client markets are two separate lists Serving an enterprise in an approved market and paying its suppliers in other countries is a different scenario from directly providing wallets, exchange and account services to those suppliers. The former requires verification of the payment corridor and local delivery conditions; the latter additionally involves new client-market access. Canada's FMSB rules also indicate that an overseas entity targeting and providing services to Canadian clients may trigger local registration requirements; the analysis cannot end merely because formalities have been completed in the place of incorporation. Break "global" down into a country scope rolled out in phases It is advisable to first open markets for which a clear conclusion has been reached and where the cooperation channels have also confirmed support; for markets requiring new licenses or presenting prohibition risks, retain restrictions and set review conditions. Restrictions should be implemented in marketing, account opening and registration, payment routes and cooperation contracts, not merely as a one-line country list in the terms. Client relocation, agency client acquisition and newly added balance functions may all change the original assessment, so the country list should be maintained together with product versions. Geographic controls should also not rely solely on IP addresses. An enterprise's registered address, actual operations and client relationships may differ; it is advisable to verify by combining account-opening materials with transaction purposes, and to set up manual review for situations suspected of circumventing restrictions. Recommended actions Establish separate lists of client-access countries and payment destinations, noting the basis for each. Verify the entity, services, notifications and effective conditions of regional cross-border mechanisms. Check whether advertising placements, account-opening links, sales commitments and system geographic restrictions are consistent. Information note: This article provides general information only and does not replace legal advice based on specific facts. References MiCA Article 65 — ESMA Guidelines on reverse solicitation under MiCA — ESMA Money services businesses — Foreign MSB criteria — FINTRAC Related Q&A 8. If a company is incorporated outside the jurisdiction and serves only overseas clients, where does it need to hold licenses? 27. To enter the EU and provide crypto payment services now, is a MiCA license required? 29. If a company is not in the EU, may it still provide crypto payment services to EU clients? 55. When serving multiple countries, can a single set of banking and settlement channels be shared? ← Previous question 11 All crypto payment Q&A Next question 13 →

Question 13

What Are the Differences Between MSB, VASP and CASP Licenses?

Accepted Answer

MSB: First Distinguish Between the United States and Canada MSB registration with the U.S. FinCEN primarily falls within the federal anti-money laundering framework. FinCEN expressly states that registration is not an operating license, nor is it an endorsement of a business's legality; state-level and other requirements must still be verified. Canada's FINTRAC likewise has an MSB and foreign MSB registration regime, and states that provincial or territorial qualifications cannot substitute for federal registration. The names in the two countries are similar, but the definitions of services, applicable nexus and obligations are not entirely the same. One cannot assume that purchasing an "MSB certificate" means one can serve all of North America. VASP: A Category Name, Not an International Certificate The FATF uses the concept of VASP to describe entities that, on a commercial basis, provide services to others such as virtual asset exchange, transfer and custody. The FATF sets international anti-money laundering standards, but it does not issue companies a VASP license that permits global operation. Individual countries bring the relevant business within registration, licensing or other regulatory approaches, and local law should be consulted. Promotional materials that state only "holds a VASP" without stating the country, the regulator and the scope provide far from sufficient information. CASP: EU Authorization Still Depends on the Approved Services Under MiCA, a CASP may engage in different services such as custody, exchange and transfer on behalf of clients; the authorization should specify the concrete scope, and qualifying existing financial institutions have a specific pathway as well. Accordingly, obtaining an exchange qualification should not be directly interpreted as also permitting the operation of all wallet or trading platform functions. A CASP is also not equivalent to a stablecoin issuance qualification, and it does not automatically cover fiat payment business; "crypto-asset service provider" and "issuer" are roles that must be kept separate. How to Compare a "License Package" Suppose two service providers quote MSB registration and CASP authorization respectively; one cannot compare only the fees and estimated completion dates. Each should be required to explain, using the same product flow: which entity provides which services, which customers it may serve, whether local management personnel are required, and which business is still undertaken by third parties. Then verify the results against the official registers to confirm that what is displayed is a valid status rather than an application receipt, an expired registration or the qualification of another company within the group. It should also be confirmed which legal entity holds the qualification; certificates, training attestations or association memberships produced by agents should not be treated as an operating license granted by a regulator merely because they look similar. Recommended Actions Require quotes to specify the country, the regulator, the name of the law, the concrete scope of services and the matters not covered. Distinguish between statuses such as completed registration, formal authorization, application in progress and transitional operation. Match the planned receipt of funds, exchange, custody, transfer and fiat payment item by item, rather than judging by packaged abbreviations. Information note: This article provides general information and does not replace legal advice based on specific facts. References FinCEN alert on scams involving MSB registration — FinCEN Register your MSB or FMSB — FINTRAC Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs — FATF MiCA Article 59 — ESMA Related Q&A 21. What crypto payment business can U.S. MSB registration support? 23. What crypto payment business is Canadian MSB registration suitable for? 27. To enter the EU to conduct crypto payment business now, is a MiCA license required? 33. After joining a Swiss SRO, can crypto payment business be conducted? ← Previous question 12 All crypto payment Q&A Next question 14 →

Question 14

With a Limited Budget, Which License Should Be Applied for First?

Accepted Answer

Work backward from the first legitimate revenue stream, not from the cheapest certificate First determine what fees the company will charge customers and which regulated functions it must perform itself. Assume the first batch of customers is in a certain European market and the business needs to custody and transfer stablecoins; purchasing an offshore registration unrelated to market access in that market does not solve the core problem. What should really be compared is the complete plan for carrying out this business: the required authorizations, entities and personnel, and qualified alternative partners, rather than the market prices of certificates in various jurisdictions. A free government registration does not mean low operating costs Official FinCEN and FINTRAC materials state that the relevant registration procedures do not charge a registration fee, but this does not mean there are no company, personnel, compliance or other licensing costs. FinCEN in the United States also makes clear that MSB registration is not an operating license. Therefore, a low quote should be further broken down: does the fee cover only filing the form, or does it also include business characterization, implementation of policies and procedures, and follow-up support? Are bank account opening, local licensing and customer protection requirements excluded from the scope of delivery? These questions are more worth asking first than "how long until the number is issued." Cooperation models must account for responsibility and long-term costs If custody or exchange capabilities are not to be built in-house in the first phase, consideration can be given to having qualified institutions directly undertake the relevant services. However, it is necessary to verify whether one's own actual functions also trigger regulation; one cannot retain own-brand collection of payments, unified pricing and settlement guarantees while describing oneself as a technology provider. The EU MiCA outsourcing rules also emphasize that a licensed entity cannot transfer responsibility away along with the outsourcing; control over the partner and the ability to exit should be included in the plan, rather than merely comparing interface fees. Set a minimum scope that can operate sustainably It is advisable to first select one customer group, one payment corridor and a limited set of currencies, and then calculate the fixed costs that must still be paid if the expected transaction volume is not reached. Assume the self-licensed plan is more expensive in the first year but has a lower unit transaction cost, while the cooperation plan requires less initial investment but has minimum commitments and exit restrictions; the comparison should be made on conservative business volume, not merely on ideal growth. When funds are insufficient to maintain the necessary team and customer protection, narrowing the business scope is more prudent than obtaining a license first and then looking for operating budget. For capabilities temporarily outsourced, it should also be clarified whether customer and transaction records can be exported if the provider is switched in the future, whose consent is required and how balances are to be migrated. Low upfront costs accompanied by dependencies that are difficult to exit should also be included in the comparison. Recommended actions Prepare a list of the functions and qualifications required for the first business, and remove decorative registrations that cannot support that business. Calculate the first-year, ongoing operating and exit costs for the self-licensed and cooperation models respectively. Conduct cash-flow stress tests using conservative transaction volumes to confirm that compliance obligations can still be met if revenue targets are not achieved. Information note: This article provides general information only and does not replace legal advice based on specific facts. References Enforcement actions for failure to register — FinCEN Register your MSB or FMSB — FINTRAC FinCEN alert on registration scams — FinCEN MiCA Article 73 — Outsourcing — ESMA Related Q&A 11. Where is it more appropriate to register a crypto payment company? 16. Approximately how much does it cost to apply for and maintain a crypto payment license? 46. If the upstream exchange and payment institutions both hold licenses, do we still need to hold a license ourselves? 47. If we use a licensed institution's white-label solution and operate under our own brand, do we need a license? ← Previous question 13 All crypto payment Q&A Next question 15 →

Question 15

How long does it generally take to apply for a crypto payment license?

Accepted Answer

First, clarify which period the other party is referring to. "Three months for the application" and "eight months for the project" may use entirely different starting points. The overall project usually also includes the business plan, entity and equity arrangements, background materials, personnel and policy preparation, and responses to regulatory requests for additional information. Even after a license or registration is obtained, banking and upstream access may not yet be completed. When comparing service proposals, you should require the other party to specify who is responsible for each stage and what the conditions for commencement are, rather than merely providing a fastest-case date. How should the official Canadian processing timeline be understood? FINTRAC's registration page states that most complete applications are processed within three months after receipt of a complete application package, and that complex applications may take longer; incomplete materials may be closed and require resubmission. Therefore, this figure cannot be directly applied to a project that has not yet determined its shareholders or prepared its background documents, nor is it a guarantee of approval. It describes the processing of complete applications and does not establish that pre-registration communications, preparation of materials, and subsequent commercial access can all be completed within the same period. Applicants should also keep records of the time when they receive confirmation of completeness or a notice of additional information, so as to avoid mistaking the date on which the pre-registration form was first sent for the date on which review of a complete application began. Other licenses also require distinguishing completeness review from substantive review. For example, the CASP process published by the Austrian FMA distinguishes between the completeness check of an application, supplementary materials, and the substantive assessment once the application is complete, and states that certain supplementary submissions can pause the review clock. It follows that a statutory or published processing period does not mean that approval will be granted on a countdown basis after a service contract is signed. Assume two teams with products of similar complexity: one already has usable policies and management personnel, while the other is still changing its business model. Even if they face the same regulator, their overall preparation paths may differ significantly. Financing and launch plans should include dependency conditions. It is advisable to set separate milestones for complete materials, formal submission, confirmation of completeness, regulatory decision, banking readiness, and launch acceptance. For steps that cannot yet be determined, identify dependencies and buffers rather than fabricating industry averages. In particular, do not tie customers' formal deposit of funds, fixed launch publicity, or irrevocable procurement of channels to the most optimistic schedule; where commercial commitments are required, the regulatory and counterparty prerequisites should be clearly stated to avoid timing deviations turning into performance disputes. Recommended actions Require the service proposal to provide a phased schedule and the conditions for commencement, distinguishing regulatory time from adviser preparation time. Prioritize verifying whether background materials, personnel, and policies are complete, and establish a responsible person and version records for supplementary submissions. Set banking availability and product launch readiness as independent acceptance milestones, not equivalent to obtaining registration or a license. Information note: This article provides general information only and does not replace legal advice based on specific facts. References Register your MSB or FMSB — FINTRAC Information for CASP applicants — Austrian FMA Related Q&A 9. Can a crypto payment project begin trial operations first and apply for a license only after the business has grown? 14. With a limited budget, which license should be applied for first? 18. To apply for an overseas crypto payment license, are a local office and local staff required? 19. How should one choose between acquiring a licensed company and applying for a license oneself? ← Previous question 14 All crypto payment Q&A Next question 16 →

Question 16

How much does it roughly cost to apply for and maintain a crypto payment license?

Accepted Answer

First distinguish which funds are spent and which funds must be continuously satisfied Company formation, translation, legal and application service fees generally constitute project expenditure; salaries, audits, systems and channels constitute ongoing costs; regulatory capital or safeguards are a separate category of requirement. The three should be presented separately, and available operating cash must not be treated simply as the same budget as regulatory requirements, still less may client funds be counted as start-up capital freely usable by the company. Quotations should also state whether taxes and fees, supplementary submissions, business changes and post-failure service arrangements are included. For tools and channels charged by transaction volume, budgets may be presented for low business volume, expected business volume and stress scenarios; a one-off promotional price should not be treated directly as a fixed maintenance cost for future years. Free registration only answers whether the government charges a registration fee Both FinCEN and FINTRAC have official materials stating that the relevant MSB registration carries no registration fee. This conclusion does not cover fees charged by other competent authorities, nor does it exempt the personnel, policies and systems investment required for operations. Suppose a consultant quotes a very low price but is only responsible for filling in forms; the team must still establish client review, transaction monitoring and record-keeping capabilities itself. Therefore, the price of "completing the filing" should be separated from the budget for "being ready for ongoing operations," to avoid discovering only after obtaining the number that there are no compliance execution resources. How the EU monetary thresholds enter the budget Article 67 of MiCA requires CASPs to maintain prudential safeguards, in principle the higher of the minimum amount applicable by class of service and one quarter of the previous year's fixed expenses; where the business has operated for less than one year, the corresponding forecast is used. The fixed tiers listed in the AMF's official explanation are EUR 50,000, EUR 125,000 and EUR 150,000. Depending on the legal conditions, the safeguards may take the form of own funds, insurance or a comparable guarantee; the three tiers must not all be understood as cash deposits, nor should only the lowest tier be selected while ignoring the actual class of business. A calculation example, not a market quotation Assume a project falls within the EUR 125,000 tier and its annual fixed expenses calculated under the applicable rules are EUR 800,000; one quarter, i.e. EUR 200,000, is higher than the fixed tier. This merely demonstrates the comparison logic; how actual expense items are included, whether the safeguard form may be used, and how the calculation is made where other licences are also held all require specific verification. The budget should separately reserve the funds required by banks' or channels' commercial conditions and an operating buffer; it must not be assumed that once the minimum safeguard is met, other expenditures will resolve themselves. Recommended actions Require quotations to separately set out one-off fees, annual fixed fees, volume-based fees and exclusions. Prepare a separate capital or safeguard calculation, stating the class of business, the expense basis and the source of funds. Check the ongoing operating budget against a conservative transaction volume, and do not double-count client funds or unusable safeguards as available cash. Information note: This article provides general information only and does not replace legal advice based on specific facts. References Enforcement actions for failure to register — FinCEN Register your MSB or FMSB — FINTRAC MiCA Article 67 — Prudential requirements — ESMA The European regulation Markets in Crypto-Assets — French AMF MiCA Article 70 — Safekeeping of client assets and funds — ESMA Related Q&A 14. With a limited budget, which license should I apply for first? 15. How long does it generally take to apply for a crypto payment license? 18. To apply for an overseas crypto payment license, are a local office and staff required? 28. After obtaining an EU MiCA license, is a payment or e-money license still required? ← Previous question 15 All crypto payment Q&A Next question 17 →

Question 17

Does a Chinese Shareholder or Founder Affect an Overseas License Application?

Accepted Answer

Nationality, residence and actual control are not the same thing A founder with Chinese nationality may reside outside China for a long period, or may actually manage the business in mainland China; a foreign-national shareholder may also be controlled by a domestic entity. Regulatory applications must disclose the true structure, and a passport cannot substitute for an analysis of actual control. In making the assessment, one should separately list who contributes capital, who enjoys the economic benefits, who holds appointment and veto rights, and who is responsible for operations, and then examine the different conditions that the target market imposes on shareholders, directors and management personnel. Do not mistake director residency requirements for shareholder nationality requirements. Taking the EU as an example, the key points include reputation and suitability Article 68 of MiCA sets out requirements concerning the reputation, knowledge, experience and time commitment of management, as well as the reputation of qualifying shareholders; these are not a rule that "Chinese shareholders are of course prohibited from applying." It cannot, however, be relied on to promise that all applications with a Chinese background will be approved; sanctions, funds, complex shareholding structures and other applicable reviews must also be examined. Canada's FINTRAC registration materials also require disclosure of the control structure and the submission of background documents for specified persons, which shows that substantive transparency matters more than a superficial packaging of identity. Domestic connections require a separate analysis In addition to prohibiting the relevant domestic business, the 2026 mainland notice imposes restrictions on domestic entities and the overseas entities they control issuing virtual currency overseas without consent, and also sets out provisions on the overseas issuance of RMB-pegged stablecoins. Particular attention should be paid to the fact that issuing virtual currency and providing payment or exchange services to clients are not the same activity, and the provisions must not be expanded or narrowed at will. Projects involving mainland capital contributions, control and teams should be reviewed separately according to their actual business; it should not be assumed that obtaining an overseas licence will resolve mainland issues as well. Suppose the founder considers asking a friend to hold shares on his behalf If the nominal shareholder is replaced by an overseas friend, but the founder still contributes capital and controls the company, the true control relationship does not thereby disappear. Such an arrangement may also cause the application, bank materials and internal agreements to contradict one another. A more prudent approach is to prepare in advance a complete equity chart, the formation of funds and the capital contribution chain, past regulatory or criminal matters, and the division of management responsibilities; where conditions present obstacles, the actual operating structure should be adjusted in accordance with law, rather than circumventing review through inaccurate application materials. Inconsistencies in the spelling of names, historical addresses and dates of equity changes across different documents should also be explained consistently. Differences that can be explained by original documents should be clarified proactively; true facts should not be altered for the sake of superficial consistency. Recommended actions Look through to the ultimate natural persons and set out the equity, voting, profit and actual control relationships. Prepare verifiable materials on source of funds, background records and management experience, and ensure that the regulatory and bank versions are consistent. Conduct separate reviews of the applicable rules for mainland capital contributions, the actual team and any possible token issuance, rather than using one overseas licence opinion to cover all issues. Information note: This article provides general information only and does not replace legal advice based on specific facts. References MiCA Article 68 — Governance arrangements — ESMA Register your MSB or FMSB — FINTRAC Notice on Further Preventing and Addressing Risks Associated with Virtual Currency and Related Matters — People's Bank of China and seven other departments Related Q&A 18. To apply for an overseas crypto payment license, are local offices and employees required? 38. Can we serve overseas enterprises and individuals with a Chinese background? 39. Are there legal risks if employees of an overseas crypto payment company work in mainland China? 95. If an overseas company is used to operate the business, may founders and management still bear personal liability? ← Previous question 16 All crypto payment Q&A Next question 18 →

Question 18

When applying for an overseas crypto payment licence, are local offices and staff required?

Accepted Answer

Registered address and genuine operations are two separate requirements A registered address resolves legal nexus and service-of-process issues, whereas actual operations must explain who makes decisions, who understands customer risk, and who can respond swiftly when problems arise. Even if some work can be performed remotely, it is still necessary to verify whether the relevant roles can discharge their duties outside the jurisdiction. Application materials should not contain only a lease contract and an organizational chart; they should also be able to explain how day-to-day approvals, reporting, risk escalation and record access actually operate; otherwise the address itself cannot demonstrate sufficient operational capacity. EU CASPs cannot be assessed on the basis of a single minimum provision Article 59 of MiCA sets out the EU registration, actual management and director residency requirements for authorised CASPs. ESMA's supervisory briefing on CASP authorisation further focuses on local personnel, substantive decision-making authority and the actual performance of duties by management. Accordingly, "at least one director meets the residency condition" does not mean that all other functions may remain outside the jurisdiction, nor does it mean that every company must replicate the same headcount. The specific staffing arrangements must still be determined in light of business scale, key functions and the requirements of the competent authority. Do not assume that a nominee responsible person has real authority The company engages local personnel to serve as responsible persons, but all customer approvals, transaction suspensions and risk budgets are decided by an overseas headquarters, and the local personnel cannot access system records. Such an arrangement falls short of "local management" in substance. Conversely, a group may provide shared technical or administrative support, but the licensed entity should retain the corresponding professional capabilities, oversight and decision-making resources. The EU MiCA outsourcing rules make clear that outsourcing cannot transfer away the licensed entity's responsibilities to customers and regulators. Costing based on a roles and decisions checklist It is advisable first to list functions such as business management, compliance, risk, finance, asset control and technical security, then verify which must be performed locally, which may be part-time or outsourced, and what qualifications and backup staffing are required. Do not promise "only one employee is needed" or "no office is required" before verification. The team should also check whether actual office, employment, tax and data access arrangements are consistent; reducing resource requirements through a smaller business scope is more sustainable than maintaining a team on paper. For cross-time-zone teams, it should also be tested whether the local responsible person can promptly access records, approve emergency actions and communicate with regulators when an upstream service outage occurs; key authority must not rest solely with overseas personnel who cannot be reached. Recommended actions For each role, specify the work location, time commitment, system permissions and decisions that can be made independently. For outsourcing and group-shared functions, review item by item the permitted scope, supervisory responsibilities and alternatives. Ask local advisers or the competent authority to confirm expectations for key roles before finalising long-term staffing and office budgets. Information note: This article provides general information and does not replace legal advice based on specific facts. References MiCA Article 59 — ESMA Supervisory Briefing on Authorisation of CASPs — ESMA MiCA Article 73 — Outsourcing — ESMA Related Q&A 11. Where is it more appropriate to register a crypto payment company? 16. Approximately how much does it cost to apply for and maintain a crypto payment license? 17. If a shareholder or founder is Chinese, will it affect an overseas license application? 80. If third-party identity verification and on-chain risk management services are used, is one's own compliance team still needed? ← Previous question 17 All crypto payment Q&A Next question 19 →

Question 19

Acquiring a Licensed Company Versus Applying for a License Yourself: How to Choose?

Accepted Answer

First determine whether what is being acquired is the company or an operational business Financial qualifications generally attach to a specific entity and scope of services. An equity acquisition gives the buyer control of the company, but it does not automatically expand the license, nor should the company's qualifications be treated as an asset that can be independently transferred to another entity. Suppose the target company is licensed only for exchange services, and the buyer plans to launch a customer balance wallet and transfer services on behalf of clients; the new functions would still need to be verified. Registrations or qualifications under legacy regimes that the target previously held should also be checked for their current status, rather than relying solely on historical certificates. A change of control may first require regulatory procedures Taking EU CASPs as an example, Article 83 of MiCA establishes notification and regulatory assessment procedures for transactions intended to acquire qualifying holdings or reach the corresponding control thresholds. Transaction documents may set conditions in advance, but signing an agreement should not be equated with being able to immediately complete a change of control or replace management. Which approvals or notifications apply and whether closing can occur first should be confirmed on a jurisdiction-specific basis; in addition, change-of-control clauses in bank, payment channel and material contracts should be reviewed. Due diligence cannot be limited to licenses and bank balances It is advisable to review regulatory correspondence, outstanding remediation, consistency between customer assets and ledgers, handling of historical suspicious transactions and complaints, tax matters and material contracts. Wallet control must also be verifiable; obtaining a screenshot of assets is not sufficient. It should also be checked whether the original team and outsourced institutions are willing to continue performing their duties and which key systems cannot be transferred; if the so-called mature company in fact has only certificates and no operational capability, the buyer will still bear most of the cost of rebuilding. If the actual transaction is a purchase of customers, technology and brand rather than equity in the company, customer migration and service continuity must be analyzed separately; an asset transaction does not automatically carry over the original entity's financial qualifications. Compare an acquisition and a new application using the same endpoint The comparison endpoint should be "the ability to continue lawful operations as planned on a sustained basis," not "signing" or "submitting an application." The acquisition option should account for due diligence, approvals, remediation, integration and potential historical liabilities; the new application option should account for preparation, hiring and regulatory engagement. Acquisition documents may set conditions such as the qualifications remaining valid, completion of regulatory procedures, confirmation of key channels and asset handover, as well as liability arrangements for historical issues, but contractual indemnities cannot replace regulatory compliance, nor can they ensure that the seller will have the ability to pay in the future. Recommended actions First verify the entity, status, licensed services and restrictions against official registries and licensing documents. Include regulatory control procedures and consents from key banks and channels in the transaction conditions checklist. Complete targeted due diligence on customer assets, regulatory history, key personnel and system controls before comparing total costs and launch timelines. Information note: This article provides general information only and does not replace legal advice based on specific facts. References MiCA Article 83 — Assessment of proposed acquisitions — ESMA MiCA Article 59 — ESMA Supervisory Briefing on Authorisation of CASPs — ESMA Related Q&A 15. How long does it generally take to apply for a crypto payment license? 17. If a shareholder or founder is a Chinese national, will that affect an overseas license application? 20. Can multiple products and subsidiaries of a group share a single license? 97. Before financing or M&A, what legal issues do crypto payment companies most need to resolve? ← Previous question 18 All crypto payment Q&A Next question 20 →

Question 20

Can multiple products and subsidiaries of a group share a single license?

Accepted Answer

How many products a single licence can support depends first on the functions involved Even if a checkout counter, a corporate payment back office and a mobile wallet have different names, where they are all operated by the same entity, it is still necessary to verify item by item whether their functions fall within the authorised services. Conversely, adding balance custody, currency exchange or credit functions to the same App may already go beyond the original scope. Article 59 of the EU's MiCA requires that authorisation list the services, and newly added crypto services require an application to extend it; therefore, "the same product" and "the same regulated activity" are not the same thing. Different subsidiaries cannot simply rely on group marketing Assume Company A holds the relevant authorisation, while Company B independently contracts with customers, quotes prices and collects customer assets, and the terms merely state that "the group holds a licence". Company B's actual role should be re-analysed, and it cannot be deemed authorised merely on the basis of brand affiliation. If Company A is in fact the entity genuinely providing the regulated services, customers should be able to identify Company A's identity, the scope of its services and the party against whom they have recourse; Company B's customer-acquisition or technical role must also comply with the applicable rules, and it is not enough simply to change the contract name to Company A. The intra-group services exemption requires strict separation Article 2 of MiCA excludes from scope entities that provide crypto-asset services solely to their parent undertaking, their own subsidiaries or other subsidiaries of the same parent undertaking. It addresses a specific purely intra-group relationship; it does not permit any company in a group to conduct business externally without authorisation. A group treasury centre that manages only internal assets and a structure that receives external merchant funds through a subsidiary and then processes them centrally should be assessed separately; nor may this be used to bypass payment, anti-money-laundering or other potentially applicable regimes. Shared systems and shared responsibility are not the same thing A group may explore shared technology, customer service or risk management, but it should clearly determine how data, assets, permissions and fees are attributed. Article 73 of MiCA indicates that outsourcing cannot transfer the licensed entity's own responsibilities, and intra-group outsourcing cannot cause it to lose its supervisory capability. In practice, it is advisable to set out clearly, for each product, the contracting entity, the customer funds account, wallet control and complaint handling, and to check whether the App, statements, emails and marketing pages are consistent; services provided across countries also require separate review of customer market access. Unified login and group-shared databases should also be able to distinguish each entity's customers, balances and authorisations, so as to avoid customers not knowing that the service provider has changed when switching products, or funds attribution being commingled in internal ledgers. Recommended actions Prepare a mapping table of "product — legal entity — service function — scope of licence — customer market". Check whether the customer agreement, bank and wallet ownership, interface displays and customer-service commitments all point to the same genuine service provider. Record purely intra-group business and external customer business separately, and do not apply the intra-group exemption to external-facing platforms. Information note: This article provides general information and does not replace legal advice based on specific facts. References MiCA Article 59 — ESMA MiCA Article 2 — Scope — ESMA MiCA Article 73 — Outsourcing — ESMA Related Q&A 8. If a company is registered overseas and serves only overseas clients, where does it need to hold licenses? 44. Can the same group operate both mainland fiat currency payment business and overseas crypto payment business at the same time? 46. If the upstream exchange and payment institutions both hold licenses, do we still need to hold licenses ourselves? 98. To add a new country, new product or new currency, is it necessary to reapply for a license? ← Previous question 19 All crypto payment Q&A Next question 21 →

Question 21

What crypto payment businesses can US MSB registration support?

Accepted Answer

Look at the transaction role first, not at buying an “MSB license” first Under FinCEN's virtual currency guidance, accepting and transmitting convertible virtual currency as a business, or providing related exchange services, may constitute money transmission. Receiving stablecoins and then converting them to US dollars for payment to merchants cannot be split into two technical steps for which no one is responsible merely because the receipt of coins and the payment of US dollars occur in different systems. Conversely, a business using virtual currency to purchase goods for itself is different from operating an exchange or payment business for third parties. The assessment must list the payee, the quoting party, the wallet controller and the final delivery obligation together. What registration resolves, and what problems remain unresolved FinCEN expressly cautions that registration does not mean the government endorses the legality of the business, still less that it reviews or endorses the company's compliance level. Once within the scope of MSB regulation, a business must still establish anti-money laundering systems suited to its business and perform applicable recordkeeping, reporting and other obligations. Purchasing an anti-money laundering template and finding a registration number does not mean these obligations have been fulfilled. Registration also cannot directly resolve bank account opening, customer fund protection or business qualifications in other countries. The same payment and collection chain may also require state-level licensing Assume a platform collects stablecoins for a New York merchant and then pays US dollars to the merchant. Even if it has registered with FinCEN, the public FAQ of the New York State Department of Financial Services still requires a separate assessment of the BitLicense route or the approved bank or trust company route; if it also operates fiat money transmission, the New York money transmission license may also be involved. This example cannot be used to infer that all states adopt New York's rules, but it is sufficient to show that the state of incorporation and the federal registration location do not mean that all states where customers are located have granted permission. Issuing stablecoins is another business that requires separate planning Using third-party stablecoins for settlement is not the same market-access question as issuing and redeeming one's own stablecoins. As of October 29, 2026, the OCC has issued final rules implementing the GENIUS Act, and the official announcement lists the effective date of the rules and the Act as January 18, 2027; this cannot be written in advance as already fully applicable. Projects preparing to issue coins should separately list the transition work for issuer market access and the reserve and redemption regime; projects that only provide payments should also track changes in the issuance and sale rules of the supported currencies and cannot substitute MSB registration for this. Recommended actions Map out the fund flows and contractual responsibilities of each product, and confirm whether the company is using its own assets or operating transmission and exchange for others. List the states where the first batch of US customers are located, and record state-level licenses, exemptions and their applicable conditions separately; do not use “nationwide MSB” as a substitute for this table. Verify that the FinCEN registration information is consistent with the actual entity and business, and clearly designate the internal compliance officer and the reporting and recordkeeping processes. Include issuance, wallets and merchant settlement separately in the go-live approval process, and verify the specific effective dates of the forthcoming stablecoin rules. Information note: This article provides general information and does not replace legal advice based on specific facts. References Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies — FinCEN FinCEN Alert on Fraud Schemes Abusing FinCEN’s Name, Insignia, and Authorities — FinCEN Virtual Currency Business Licensing—BitLicense FAQs — New York Department of Financial Services GENIUS Act Regulations: Final Rule, OCC Bulletin 2026-50 — Office of the Comptroller of the Currency Related Q&A 13. What are the differences between MSB, VASP and CASP qualifications? 22. When is an MTL required for crypto payments to US customers? 65. Can a crypto payment platform support multiple stablecoins such as USDT and USDC at the same time? ← Previous question 20 All crypto payment Q&A Next question 22 →

Question 22

When Is an MTL Required for Providing Crypto Payment Services to U.S. Clients?

Accepted Answer

Start by determining who is transferring what to whom A common risk point is where a platform receives customer funds or assets with monetary value and then undertakes to transfer them to other persons, other accounts or other locations. The analysis must not focus solely on whether a transfer has occurred once on-chain; it must also examine whether the platform accepts payment instructions, bears delivery obligations and holds balances pending settlement. FinCEN's federal money transmission test and state law are not the same checklist, and completing federal registration does not by itself lead to the conclusion that no state-level license is required. Stablecoins and other virtual assets may be treated separately in certain states Take the Texas Department of Banking's 2025 revised Supervisory Memorandum 1037 as an example: it distinguishes general non-stablecoin virtual currency from stablecoins that meet the local statutory definition; the latter involves anchoring to a sovereign currency, reserve backing and redemption rights. The Department expressly states that for a transaction involving fiat currency or such stablecoins, whether it constitutes money transmission must be determined by reference to how the asset is handled. Accordingly, the proposition that "a Bitcoin business does not require an MTL in a given state" cannot be directly applied to the same company's U.S. dollar stablecoin payment product. The New York example shows that the absence of an MTL issue does not mean the absence of other licensing issues The New York State Department of Financial Services brings activities such as holding virtual currency on behalf of customers, buying and selling, exchanging and transferring virtual currency within the BitLicense regime, and makes clear that out-of-state companies conducting such business with New York residents may also be subject to regulation. Fiat money transmission may in addition require a separate license. Assume a platform provides only stablecoin custody and transfer to New York enterprises and does not provide U.S. dollar remittance services; even if the MTL analysis reaches a particular conclusion, the platform still cannot skip the assessment of the BitLicense route or the approved bank or trust route. The state-by-state licensing table must be capable of constraining actual customer acquisition It is advisable first to select a few states where there is genuine demand, set out the states where customers are located, the business steps, the assets used and the basis, and then decide whether to apply independently or adopt a cooperative arrangement permitted by local law. A licensed partner's ability to complete end-point payments does not necessarily cover the platform's front-end collection of funds or balance management. In states where licensing has not yet been completed, restrictions should be implemented in sales, customer onboarding and transaction review; it is not enough to state in a website footer that "services are not provided to that state" while continuing to accept customers from that state. Recommended actions Form a separate conclusion for each target state, stating the applicable statutes and regulations, asset types, exemption conditions and review date. Verify with counterparties whether their licenses cover your specific model, and what your legal status is as an agent, service provider or independent counterparty to the transaction. Check MTL and virtual-asset-specific licenses separately, and examine whether a customer's change of address or expansion across states triggers a reassessment. Information note: This article provides general information and does not replace legal advice based on specific facts. References Supervisory Memorandum 1037, revised 28 January 2025 — Texas Department of Banking Virtual Currency Business Licensing—BitLicense FAQs — New York Department of Financial Services FinCEN Alert FIN-2024-Alert005 — FinCEN Related Q&A 8. If a company is incorporated offshore and serves only overseas clients, where does it need to hold licenses? 12. For global crypto payments, must a license be applied for in every country? 21. What crypto payment business can U.S. MSB registration support? ← Previous question 21 All crypto payment Q&A Next question 23 →

Question 23

Which crypto payment businesses are suitable for Canadian MSB registration?

Accepted Answer

Which stablecoin services fall within the scope of MSBs The virtual currency business activities listed by FINTRAC include fiat-to-virtual-currency exchange, virtual-currency-to-virtual-currency exchange, transferring virtual currency at a client's request, and receiving virtual currency for onward transmission to a beneficiary. Where an institution collects virtual currency on behalf of merchants or pays bills for enterprises, the mere fact that the activity is a commercial payment rather than an investment transaction does not exclude its application. The assessment also requires satisfaction of the relevant business and geographic conditions; not every company that holds stablecoins must register. A company paying its own procurement invoices should be analyzed separately from continuous payment on behalf of others. Canadian-registered companies and foreign MSBs are two different pathways FINTRAC's interpretation of "having a place of business in Canada" looks beyond physical premises and also includes circumstances such as Canadian registration, local employees, agents or branches. An entity that has no place of business in Canada but targets Canadian clients with the listed services and actually carries them out may qualify as a foreign MSB. Where an offshore platform does not establish an office in Canada but advertises to the Canadian market and accepts local clients for exchange, it is inappropriate to deny a registration obligation solely on the ground that "both the servers and the company are located offshore." Fiat payment functions should be separately tested for central bank registration The Bank of Canada examines payment functions, retail payment activities, geographic connections and exclusions under the Retail Payment Activities Act. "Retail" does not mean that only natural-person clients are considered; enterprise payment products must likewise be tested. Where, for example, a platform maintains fiat receipt and payment accounts for clients and initiates or executes electronic funds transfers, it cannot be assumed that no further review is required merely because FINTRAC registration has been completed. Conversely, merely providing virtual currency functions does not mean that fiat payment service requirements can be applied wholesale without analysis. Registration is not a product safety certification, nor a global operating passport FINTRAC expressly states that registration does not constitute recognition or licensing of a business, nor does it issue any so-called "certificate of registration" to businesses. For purchasers, it is more useful to verify the entity, status and actual contracting party in the official directory than to rely on certificate images produced by the service provider. For applicants, compliance programs, client identity verification, and recordkeeping and reporting capabilities must still be continuously implemented; bank access and licensing in clients' jurisdictions must be resolved independently. Recommended actions Record the facts concerning Canadian registration, team, agents and client acquisition, and determine whether the local MSB pathway or the foreign MSB pathway applies. Separately list exchange, transfer, fiat accounts and remittance, and issue separate assessments against FINTRAC and central bank requirements. Check registration status in the official directory and verify whether the client agreement, bank account and website disclosures all refer to the same legal entity. Establish identity verification, transaction recordkeeping and reporting processes by currency and product, rather than merely submitting application documents. Information note: This article provides general information and does not replace legal advice based on specific facts. References Money services businesses: FINTRAC’s requirements — FINTRAC Money Services Business Registry — FINTRAC Criteria for registering payment service providers, updated 29 June 2026 — Bank of Canada Related Q&A 13. What are the differences among MSB, VASP and CASP qualifications? 8. If a company is incorporated offshore and serves only overseas clients, where does it need to be licensed? 53. Can we provide clients with virtual accounts or virtual IBANs for receiving payments? ← Previous question 22 All crypto payment Q&A Next question 24 →

Question 24

Can a Hong Kong MSO Licence Be Used for Stablecoin Exchange and Crypto Payments?

Accepted Answer

First, separate fiat currency remittance from stablecoin transactions The Hong Kong Customs and Excise Department's 2026 MSO licensing guidelines set out access requirements, business information and continuing obligations in relation to money changing and remittance. Accordingly, the fact that a company holds an MSO licence proves only its eligibility under that regime; it does not by extension prove that wallet custody, stablecoin sales or virtual asset platform business are all permitted. Nor is the specific combination a mechanical stacking of licences: the incidental money services of certain regulated institutions benefit from statutory exemptions, and this must be confirmed on the basis of the entity and the actual business. MSOs are not on the list of permitted stablecoin providers According to the Hong Kong Monetary Authority's guidance on stablecoin licensing, the permitted providers of specified stablecoins include licensed stablecoin issuers, authorized institutions, licensed SVF licensees, SFC-licensed virtual asset trading platforms and corporations licensed for Type 1 regulated activity. Holding an MSO licence alone does not place a company on this list. The Hong Kong Government's reply to the Legislative Council also makes clear that ordinary over-the-counter virtual asset trading institutions cannot offer specified stablecoins to retail or professional investors merely by virtue of their operating status. Calling a product "remittance" does not allow the stablecoin offer analysis to be skipped Assume a customer delivers Hong Kong dollars, the platform quotes and undertakes to deliver a certain US dollar stablecoin to the customer's wallet, and the customer then pays a supplier. Here there is not only a remittance narrative; there may also be an arrangement under which the platform sells stablecoins to the customer. The offer analysis under the Stablecoins Ordinance focuses on whether, in the course of business, information on the currency, terms and channel sufficient for the other party to decide to purchase is conveyed; it cannot be assumed that a quote in a private chat, or the customer making the first inquiry, is necessarily unrestricted. Cooperation may involve a division of labour, but it must be clear with whom the customer is transacting Another assumption is that the customer directly enters into a stablecoin transaction with an institution that meets the requirements, and the MSO undertakes only fiat currency remittance within its lawful scope. The contracts, quotations, asset control and refund liability under the two arrangements should genuinely differ; it is not enough merely to change the name in the agreement. Hong Kong's new regimes for virtual asset trading, custody and the like remain subject to the final legislation and commencement documents; published consultation conclusions cannot be treated as ready-made licences, nor as a reason to disregard the existing stablecoin restrictions. In practice, changes of counterparty, the addition of supported currencies and adjustments to refund paths should also be set as triggers for review, so that an initial review does not permanently cover subsequent products. Recommended actions Identify the actual seller on each page, chat quotation and order step, and check whether a specified stablecoin offer is constituted. Verify the counterparty's status as a permitted provider and its specific business restrictions, and check the currencies and customer types it may accept. Form separate access conclusions for fiat currency remittance, stablecoin sales, custody and transfer, and check whether the funds and liabilities are consistent with the contract. Information note: This article provides general information only and does not replace legal advice based on specific facts. References Licensing Guide for Money Service Operators, May 2026 — Hong Kong Customs and Excise Department Explanatory Note on Licensing of Stablecoin Issuers, sections 2.9–2.10 — Hong Kong Monetary Authority LCQ10: Regulation of digital assets, 10 September 2025 — Hong Kong Government FSTB and SFC conclude consultations on virtual asset dealer and custodian regimes, 24 December 2025 — Financial Services and the Treasury Bureau / Securities and Futures Commission Related Q&A 25. Does operating a payment wallet with balances in Hong Kong require an SVF licence? 26. Can a crypto payment company provide stablecoin collection and payment services in Hong Kong? 46. If the upstream exchange and payment institutions both hold licences, do we still need to be licensed ourselves? ← Previous question 23 All crypto payment Q&A Next question 25 →

Question 25

Does a payment wallet with a balance in Hong Kong require an SVF licence?

Accepted Answer

The wallet interface is not the basis for assessment; the promise behind the balance is. The HKMA's explanation of SVFs focuses on stored value and payment uses: the customer pays funds first, the instrument stores the corresponding value, and then, in accordance with the issuer's arrangements, pays for goods or services or transfers funds to other persons. Merely displaying an external bank account balance differs from the platform itself accepting top-ups and undertaking commitments in respect of the use of the balance. Even if the funds are actually held at a partner bank, it is still necessary to ascertain who the instrument issuer is, to whom the customer asserts the balance, and who is responsible for refunds; it is not enough to look only at whether the money has entered an account in the platform's name. Single-purpose, non-stored-value and multi-purpose should be identified separately The HKMA has made clear that multi-purpose stored-value instruments fall within its licensing regime; single-purpose instruments that can only be used to purchase the issuer's own goods or services, and payment methods without a stored-value function, are treated differently. Suppose a software vendor collects prepayments that can only be used to purchase its own subscription services; this is a different structure from a wallet balance that can be used to pay multiple independent merchants. Calling multiple merchants "ecosystem partners" does not automatically turn a multi-purpose instrument into a single-purpose instrument; where an exemption applies, the statutory conditions must still be checked item by item. A fiat wallet combined with stablecoins cannot be subject to a one-off licensing analysis only Once stablecoin top-ups, conversions and on-chain withdrawals are supported, the product may raise issues of offers of specified stablecoins, virtual asset trading or custody. Although SVF licensees are included in the category of permitted providers under the Stablecoins Ordinance, this does not mean that their existing product approvals and licensing conditions automatically cover the newly added services, nor does it mean that they may offer any overseas stablecoin to retail customers. Conversely, a stablecoin issuance qualification cannot replace the assessment of the wallet's stored-value structure. Decide in advance how balances are protected and exited The HKMA's SVF licensing guidance focuses not only on application materials but also on ongoing compliance with licensing conditions and the management of stored-value funds. Teams are advised to set out, at the product design stage, the complete path for top-ups, payments, refunds, incomplete transactions and account termination, and in particular to clarify whether the balance is a fiat currency claim, a token held in custody, or an external asset displayed for information only. If customers believe they can withdraw Hong Kong dollars at any time, while the platform can in fact only return stablecoins whose price or redemption arrangements differ, this is not merely a naming issue; it also affects the contractual and funding arrangements. Recommended actions Map the fund flow from top-up to refund, and identify item by item the issuer, the debtor of the balance, the custodian and the permitted payees. If intending to rely on the single-purpose or other exemptions, list the specific basis and verify it against the actual merchant structure and payment functions. Communicate the proposed wallet model to the HKMA, and prepare explanations of stored-value funds management, customer terms and the newly added stablecoin functions. Information note: This article provides general information and does not replace legal advice based on specific facts. References Explanatory Note on Licensing for Stored Value Facilities — Hong Kong Monetary Authority e-Wallets and Prepaid Cards — Hong Kong Monetary Authority Explanatory Note on Licensing of Stablecoin Issuers, section 2.10 — Hong Kong Monetary Authority LCQ10: Regulation of digital assets, 10 September 2025 — Hong Kong Government Related Q&A 24. Can a Hong Kong MSO licence be used for stablecoin exchange and crypto payments? 26. Can a crypto payment company provide stablecoin collection and payment services in Hong Kong? 53. Can we provide virtual accounts or virtual IBANs to clients for receiving payments? ← Previous question 24 All crypto payment Q&A Next question 26 →

Question 26

Can Crypto Payment Companies Provide Stablecoin Collection and Payment Services in Hong Kong?

Accepted Answer

First determine whether the client is buying coins or merely paying with coins it already holds Stablecoin payment does not mean that every participant is issuing or selling stablecoins. A merchant accepting payment for its own goods, a platform quoting a price to customers for the sale of stablecoins, and a platform controlling a wallet and transferring funds on a customer's behalf are activities that should be analyzed separately. The Hong Kong Monetary Authority's stablecoin licensing guidance states that an offer to provide depends on whether the business communications contain sufficient information about the coin type, terms and channels for the other party to decide to purchase. Payment buttons, quotations and automatic conversion functions should all be included in the review; it is not sufficient to review only the company's business scope. Retail services are subject to two gates: "who may provide" and "which coins may be provided" The Stablecoins Ordinance took effect on 1 August 2025. A 2025 Legislative Council reply by the Hong Kong Government states that permitted providers may provide regulated stablecoins issued under a Hong Kong licence to retail and professional investors; the provision of stablecoins other than such regulated stablecoins is limited to professional investors. "Professional investor" is defined under securities law and does not mean, in ordinary language, a "person who understands coins" or a "corporate client". Accordingly, corporate payment products should verify client eligibility and must not treat a corporate client's ticking a box on the registration page as sufficient. Check the official register, and also check what the institution is actually permitted to do The Hong Kong Monetary Authority's current register of issuers already lists licensed institutions, so the earlier 2025 statement that "there are not yet any licensed issuers" can no longer be relied on. However, inclusion in the issuer list does not mean that all of an issuer's products, or coins of the same name sold by other institutions, are subject to the same regulation. It is advisable to verify the specific issuing entity, the coin type and the service arrangements, and at the same time to check the seller's own qualifications, business conditions and client onboarding, so as to avoid treating an issuer's licence as a qualification that a platform may borrow. Test the entire chain using a merchant payment collection scenario Assume that a platform receives stablecoins from customers on behalf of a Hong Kong merchant and then undertakes that the merchant will receive Hong Kong dollars. The team must explain item by item: whether the payer first buys coins from the platform; who controls the receiving wallet; who completes the conversion; who remits the Hong Kong dollars; and whether refunds are made in Hong Kong dollars or in the original coin. If the arrangement is changed so that the merchant contracts directly with a permitted institution and the platform only displays orders, the responsibilities and onboarding requirements may differ, but they must be consistent with actual operations. The official consultation conclusions on the new transaction and custody regimes should also be tracked separately and must not be treated in advance as licences already in effect or as existing exemptions. Recommended actions Map, transaction by transaction, the paths for buying coins, payment, conversion, fiat settlement and refunds, and identify the transacting party at each stage. Check the issuer register and provider qualifications separately, and record the coin type, client scope and licensing conditions, rather than merely collecting screenshots of licences. Verify professional investor eligibility, or use coin types and channels suitable for retail clients, and do not substitute a corporate business licence for an eligibility assessment. Before launch, review the webpage, private chat and automated quotation processes, and establish a re-review mechanism for changes in currency or partner institutions. Information note: This article provides general information and does not replace legal advice based on specific facts. References Regulatory Regime for Stablecoin Issuers — Hong Kong Monetary Authority LCQ10: Regulation of digital assets, 10 September 2025 — Hong Kong Government Register of Licensees under the Stablecoins Ordinance — Hong Kong Monetary Authority Explanatory Note on Licensing of Stablecoin Issuers, section 2.9 — Hong Kong Monetary Authority FSTB and SFC conclude consultations on virtual asset dealer and custodian regimes, 24 December 2025 — Financial Services and the Treasury Bureau / Securities and Futures Commission Related Q&A 4. Is it lawful to collect stablecoins on behalf of merchants and then settle them into fiat currency? 24. Can a Hong Kong MSO licence be used for stablecoin exchange and crypto payments? 25. Does a payment wallet with a balance in Hong Kong require an SVF licence? 65. Can a crypto payment platform support multiple stablecoins such as USDT and USDC at the same time? ← Previous question 25 All crypto payment Q&A Next question 27 →

Question 27

Do I Need a MiCA Licence to Enter the EU and Provide Crypto Payment Services Now?

Accepted Answer

First select the scope of services, then determine the content of the application MiCA is not a single "European crypto licence" that applies regardless of business line. Article 59 requires the authorisation to specify the crypto-asset services that have been approved; if services are added later, an application to extend the authorisation must be made to the original competent authority. For payment projects, at least the roles of custody on behalf of clients, exchange of funds with clients using own funds, execution or transmission of orders, and transfer on behalf of clients should be verified separately. The classification and issuance eligibility of stablecoins under MiCA must also be checked separately; CASP authorisation does not mean that any token issued by the platform is already compliant. Whether a stablecoin can be used depends not only on whether the platform has CASP authorisation On 8 October 2026, ESMA published a supervisory opinion requiring competent authorities to supervise CASPs to cease providing services involving stablecoins that do not meet MiCA requirements to EU clients, including transfer and custody, and not only trading. Existing assets may only be subject to necessary, time-limited exit arrangements under supervision, and new business may not be conducted on that basis. This is a supervisory expectation addressed to competent authorities, not a redefinition of every service as a public offering; new projects should treat token compliance review and platform licensing as parallel matters. Legacy registration and "the application has been submitted" do not equal authorisation to operate The maximum CASP transitional period under Article 143(3) of MiCA ended on 1 July 2026; before that, different Member States could adopt shorter periods. As of October 2026, new entrants cannot rely on the historical transitional treatment of legacy virtual asset registration. Assume an intermediary sells a company that holds a legacy registration, but the company has not completed MiCA authorisation; the buyer cannot directly resume token receipt and settlement business on that basis. Acquisition due diligence should examine the current authorisation, the specific services and the attached conditions, and not only the past registration date. EU entities need genuine operational arrangements Under Article 59, an entity applying for CASP authorisation must generally have a registered office in the Member State in which it carries out at least part of its services, have an actual place of management in the EU, and have at least one director resident in the EU. What the regulation requires is a supervisable operating structure, not the purchase of a mailing address. It is advisable, when choosing a location, to determine at the same time who is responsible for client assets, risk-management decisions and outsourcing management; where all core functions are undertaken by an overseas team, the plan should be explained in advance to the competent authority of the intended applicant country, rather than supplementing the structure after obtaining the licence. Cross-border expansion after authorisation still involves procedures, and fiat payment still requires separate checks Article 65 of MiCA establishes a cross-border notification mechanism, requiring submission of information such as the Member States in which services are to be provided, the services, the start date and other non-MiCA activities. It can reduce the burden of applying repeatedly in each country for the same CASP authorisation, but it should not be promoted as unconditional clearance of the entire product in all countries. If merchant settlement also involves euro accounts or e-money token payments, the payment regime should be checked separately; client contracts, complaints and locally applicable rules should also be included in the launch plan. Recommended actions Map MiCA service categories according to each product function, and clarify who separately bears issuer issues and payment issues. Verify the current authorization, entity status and scope of permissions of the proposed acquisition target or cooperating company against the registers of the competent authorities and ESMA. Choose a jurisdiction of application that can support actual management, local governance and service capabilities, rather than merely comparing agency quotations. Set CASP authorization, cross-border notifications and fiat/EMT payment access as separate go-live milestones. Information note: This article provides general information and does not replace legal advice based on specific facts. References MiCA Article 59—Authorisation — ESMA / European Union MiCA Article 143—Transitional measures, paragraph 3 — ESMA / European Union MiCA Article 65—Cross-border provision of crypto-asset services — ESMA / European Union EBA publishes No Action letter on the interplay between PSD2/3 and MiCA — European Banking Authority Opinion on services in relation to non-MiCA-compliant ARTs and EMTs, ESMA75-113276571-1742, 8 October 2026 — ESMA Related Q&A 19. How should one choose between acquiring a licensed company and applying for a license oneself? 28. After obtaining an EU MiCA license, is a payment or e-money license still required? 29. Can a company outside the EU provide crypto payment services to EU customers? 65. Can a crypto payment platform support multiple stablecoins such as USDT and USDC at the same time? ← Previous question 26 All crypto payment Q&A Next question 28 →

Question 28

After obtaining an EU MiCA licence, is a payment or e-money licence still required?

Accepted Answer

MiCA and the payments regime do not address the same matter CASP authorisation covers the listed crypto-asset services; functions such as fiat-currency accounts, money remittance and acquiring should still be checked against the payments rules. EMTs have an additional specific feature: Article 48 of MiCA treats EMTs as electronic money, and in principle their issuers must hold credit-institution or electronic-money-institution status and complete the white paper procedure, subject to any statutory exceptions. Therefore, a platform that only handles third-party EMT payments and a company preparing to issue its own EMT cannot resolve the matter with the same licence checklist. Even for the same on-chain operations, exchange and payment on behalf of clients may differ The EBA opinion on the interaction between MiCA and PSD2 requires particular attention to EMT transfers on behalf of clients and to custodial wallets that allow clients to receive and make EMT payments to and from third parties. The latter may constitute a payment account. Suppose an enterprise exchanges euros for EMTs on a platform and immediately withdraws them to its own wallet; this is not entirely the same service as the platform maintaining an EMT balance for the enterprise over the long term and paying suppliers on instructions. Each case should be assessed segment by segment: the payment character should not be denied merely because the interface is called “exchange”, nor should all crypto-to-crypto transactions be described across the board as payment services. A supervisory opinion of no priority enforcement is not a permanent licence exemption The transition period set by the EBA's initial opinion ended on 2 March 2026. The follow-up opinion of 12 February 2026 sets out conditional supervisory treatment arrangements for some CASPs that have applied but not yet obtained payment authorisation, and requires those that do not meet the conditions to cease the relevant EMT payment services. These are supervisory opinions addressed to competent authorities, not an indefinite extension that an enterprise may declare applicable on its own. When planning new products as of October 2026, an enterprise should obtain the applicable qualifications or implement a lawful licensed cooperation arrangement, and cannot rely solely on old news from 2025 as the basis for conducting business. Cooperation arrangements must also address fund control and client rights Article 70(4) of MiCA allows a CASP to provide the relevant payment services itself or through a third party, but the actual provider must hold the qualifications required by PSD2 and must explain to clients the nature of the service and the identity of the provider. If a payment institution directly undertakes EMT payments and the CASP handles exchange within the lawful scope, the parties should clarify with whom the client contracts, who accepts payment instructions, who controls the assets, and who handles unauthorised transactions and refunds. Where a platform connects a licensed service provider in the back end but still promises clients that it itself provides all payment services, the access separation may not have been completed. Budgeting should also include additional client protection, authentication and operational controls, rather than merely comparing the cost of applying for one more licence. Recommended actions Prepare a separate function table for fiat currency, EMTs and other tokens, identifying the issuance, exchange, custody, account and transfer roles. Verify the PSD2 classification and the applicability of the EBA opinion with the competent authority of the member state in which the business is intended to operate, and do not presume on your own that a transition period still applies. If a cooperation route is adopted, verify the licensed items and geographic scope of the payment partner, and implement client contracts, instructions and complaint responsibilities. When issuing own EMTs, the credit institution/electronic money institution qualification and white paper work are addressed separately and do not depend on CASP authorization. Information note: This article provides general information and does not replace legal advice based on specific facts. References MiCA Article 48—Requirements for the offer to the public or admission to trading of e-money tokens — ESMA / European Union EBA publishes No Action letter on the interplay between PSD2/3 and MiCA — European Banking Authority EBA advises national authorities on actions at the end of the No-Action Letter transition period, 12 February 2026 — European Banking Authority The interplay of MiCAR and PSD2 for services in relation to EMTs — Austrian Financial Market Authority MiCA Article 70—Safekeeping of clients’ crypto-assets and funds, paragraph 4 — ESMA / European Union Related Q&A 2. If we already hold a traditional payment license, do we need a new license to add stablecoin collection and payment services? 27. To enter the EU and provide crypto payment services now, do we need to apply for a MiCA license? 53. Can we provide virtual accounts or virtual IBANs to clients for receiving payments? 65. Can a crypto payment platform support multiple stablecoins such as USDT and USDC at the same time? ← Previous question 27 All crypto payment Q&A Next question 29 →

Question 29

Can a company outside the EU still provide crypto payment services to EU customers?

Accepted Answer

Overseas companies do not automatically obtain EU cross-border operating rights MiCA's EU cross-border notification facilitation is built on entities that meet its access requirements; a US MSB or offshore VASP registration cannot be converted into equivalent rights. For the general CASP application route, Article 59 requires, among other conditions, an EU registered office and effective management. Non-EU teams may assess establishing a local operating entity or allocating functions with an authorized institution, but an EU shell alone cannot take orders while all regulated services continue to be directly promised and delivered by an unauthorized overseas company. "The client approached us on its own initiative" depends on whether solicitation occurred earlier The core of MiCA Article 61 is that the client requests the service entirely on its own initiative. Where the company, its affiliates, or persons acting on its behalf have previously promoted to EU clients, contractual terms cannot be used to recast that relationship as client-initiated. ESMA guidance interprets solicitation broadly and in a technology-neutral manner; advertising, emails, social platforms, referral activities, and sponsorships may all be relevant. The fact that a website can be accessed from the EU does not mean every access necessarily constitutes a violation, but the absence of an EU flag on the website does not by itself establish that no solicitation exists. A checkbox cannot change the actual facts of client acquisition Suppose a platform buys advertising targeting French companies and pays local promotion partners commission based on successful account openings, and the client ultimately clicks to register on its own and checks "I am contacting you on my own initiative." Such a declaration will not eliminate prior solicitation. Conversely, where a client genuinely approaches the platform on its own initiative without solicitation and requests specific services, the platform still needs to record the client's source, the communication process, and the scope of services. Article 61 does not permit the company to continue actively marketing new types of crypto assets or services on that basis; the exception is not an unlimited sales license for that client. Ongoing operations should have a repeatable, verifiable structure It is advisable to treat the EU market as a separate product region: who signs clients, which services are authorized, which promotions may be conducted, and where client assets are handled must all be determined before launch. When cooperating with an EU CASP, verify whether its licensed activities cover the actual delivery, rather than assuming that all of the platform's actions are covered once the client is introduced to a licensed party. If not entering the EU for the time being, sales policies, geographic restrictions, and client onboarding should be kept consistent, and arrangements should address clients relocating or changing their business location. Recommended actions Review advertising placements, agent commissions, event sponsorships, and affiliate promotions, and maintain traceable records of EU client acquisition. Where intending to rely on the client-initiated exception, preserve the facts case by case; do not substitute a uniform declaration for legal judgment. Before continuing EU business, determine the authorized entity, the contracting entity, and the specific service boundaries, and verify the counterparty's license. Re-examine new features, currencies and subsequent marketing to avoid expanding a one-off proactive request into a long-term exemption. Information note: This article provides general information and does not replace legal advice based on specific facts. References MiCA Article 59—Authorisation — ESMA / European Union MiCA Article 61—Provision at the exclusive initiative of the client — ESMA / European Union Guidelines on reverse solicitation under MiCA, ESMA35-1872330276-2030 — ESMA Related Q&A 8. If a company is incorporated offshore and serves only overseas clients, where does it need to hold licenses? 12. For global crypto payments, does one need to apply for a license in every country? 27. To enter the EU now to provide crypto payment services, is a MiCA license required? 48. If one only refers clients to licensed payment institutions and charges commissions, is a license required? ← Previous question 28 All crypto payment Q&A Next question 30 →

Question 30

What licences are primarily required to conduct crypto payment business in Singapore?

Accepted Answer

DPT services are not limited to "receiving coins and then selling them" The expanded scope rules published by the Monetary Authority of Singapore (MAS) in 2024 have brought activities such as digital payment token (DPT) custody, facilitating the transfer of tokens, and facilitating exchanges without holding funds or tokens within the regulatory perimeter. Therefore, describing oneself as a "technology platform" or "non-custodial" is not a conclusion. Teams should explain who organizes transactions, accepts instructions, arranges counterparties, and who can alter the path of asset transfers; whether technical services have entered regulated activities depends on actual functions. Payment institution classes and the scope of permitted services must be considered separately Standard Payment Institutions (SPIs) and Major Payment Institutions (MPIs) are licence classes, whereas DPT services and the like are business items. Obtaining a licence in a given class does not mean that functions such as fiat remittance, merchant acquisition, and account issuance are all automatically permitted. The scope of application should be determined according to the applicable thresholds, conditions, and the combination of services intended to be carried on. In 2024, MAS also expanded the scope of cross-border transfer services; certain cross-border arrangements in which funds do not flow through Singapore may still be regulated, and the fund path cannot be treated as the sole criterion for determining geographic scope. Break down the merchant coin-collection product into two verifiable segments Assume that the platform first collects stablecoins on behalf of the merchant and then remits fiat currency to the merchant's overseas account. The first segment requires an assessment of DPT transfer, exchange, or custody, while the second segment requires a separate review of payment services such as cross-border transfers. If the second segment is completed by a licensed partner, it must still be clear to whom the customer gives instructions, who bears the commitment that funds will be credited, and who handles refunds when they occur. Only where the contract, system permissions, and fund arrangements are consistent with the division of responsibilities can the admissibility of the platform's remaining activities be assessed; pasting a partner's licence on one's own website cannot be regarded as completing licensing. Before applying, first test whether the team can perform its duties over the long term MAS's licensing page requires verification of matters such as local entity and office arrangements, directors and officers, and compliance and technology risk capabilities. For start-ups, more useful preparation is to enable specific personnel to explain the product and the customer asset flow, rather than to accumulate policy documents. It is advisable to first determine the launch customer regions, core currencies, and minimum service scope, and then allocate customer verification, asset safekeeping, system anomalies, and complaint responsibilities to positions; when adding new services, re-examine the licence scope to avoid developing beyond the perimeter after obtaining a licence. Recommended actions List DPT exchange, transfer, custody, trading arrangement, and fiat payment functions item by item, and identify the respective roles of the company and its partners. Confirm the SPI/MPI class, business items, and applicable conditions in accordance with MAS's current licensing guidelines, and verify the partner against the official register. Prepare genuine local management, personnel, and technology risk arrangements, and test whether responsibilities are complete through a normal payment and a refund. Establish a separate business line for overseas clients, confirm whether the PSA or the overseas DTSP regime applies, and do not conflate the place of establishment with the client's region. Information note: This article provides general information and does not replace legal advice based on specific facts. References MAS Expands Scope of Regulated Payment Services, 2 April 2024 — Monetary Authority of Singapore Licensing for Payment Service Providers — Monetary Authority of Singapore MAS Clarifies Regulatory Regime for Digital Token Service Providers, 6 June 2025 — Monetary Authority of Singapore Related Q&A 3. If we only provide payment technology interfaces and do not handle client funds, do we need a license? 18. To apply for an overseas crypto payment license, do we need a local office and staff? 31. If a Singapore company only serves overseas clients, does it still need a local license? 98. To add a new country, new product or new currency, do we need to reapply for a license? ← Previous question 29 All crypto payment Q&A Next question 31 →

Question 31

Does a Singapore company serving only overseas clients still need a local licence?

Accepted Answer

Overseas clients do not sever the Singapore regulatory nexus Section 137 of the Financial Services and Markets Act distinguishes between entities: where a Singapore legal person carries on a business of providing digital token services to places outside Singapore, a licence is not automatically excluded merely because the business is in fact operated elsewhere; for individuals or partnerships, the question is whether the business is carried on from a place of business in Singapore. The exceptions under that section and the application of other financial laws must also be examined. Accordingly, the assessment is not merely whether there are Singapore clients; the place of incorporation, the place of business and the services provided should all be included in the legal analysis. This is not an easily obtainable "overseas business licence" In its official clarification of June 2025, MAS stated that DTSPs serving only overseas clients and involving DPTs or capital markets product tokens face higher money-laundering risks and supervisory difficulties, that the licensing threshold is high, and that licences will generally not be granted. The relevant regime took effect on 30 June 2025; affected businesses that have not obtained a licence must cease operations, and there is no general grace period that would allow new entrants to wait indefinitely. A business plan should not first assume that a licence can be obtained and then relocate clients and teams to Singapore. Do not misread the overseas DTSP regime as a blanket prohibition on cross-border services MAS also made clear that licensed service providers serving Singapore clients and already regulated under the Payment Services Act, the Securities and Futures Act or the Financial Advisers Act may also serve overseas clients, and their existing business capabilities do not uniformly disappear because of this regime. However, whether this pathway applies depends on the actual business, the licensed activities and the conditions, and a conclusion cannot be manufactured by arranging a nominal local client. Other tokens with only utility or governance uses should also not all be treated as DTSP tokens without classification. Test the "headquarters in Singapore" plan against the actual operating entity Assume a Singapore company directly contracts with overseas merchants, quotes prices and collects service fees, while an overseas team operates the wallets. It cannot conclude that Section 137 does not apply merely because "neither the personnel nor the wallets are in Singapore". If the Singapore company genuinely only performs group holding or internal support functions while client services are undertaken by other entities, the assessment should be redone based on the actual functions; at the same time, the overseas operating entities and access to target markets must also be examined. Changing the contracting party while retaining all actual control is not reliable compliance restructuring. Recommended actions Set out the Singapore legal person's contracts, revenue, quotations, instructions and wallet permissions, and confirm whether it is carrying on a digital token service business. Check the entity type, place of business, token categories and existing licences against Section 137 and the corresponding exceptions, rather than merely counting client nationalities. Treat the overseas DTSP licensing policy as a precondition for the feasibility assessment and, where necessary, first explain the complete business facts to MAS. Design a justified cessation, transfer or restructuring plan for existing business, and review client authorization, asset handover and target-market access. Information note: This article provides general information and does not replace legal advice based on specific facts. References Financial Services and Markets Act 2022, section 137 — Singapore Statutes Online / Singapore Government MAS Clarifies Regulatory Regime for Digital Token Service Providers, 6 June 2025 — Monetary Authority of Singapore Related Q&A 8. If a company is incorporated offshore and serves only overseas clients, where does it need to be licensed? 30. What licenses are primarily required to provide crypto payment services in Singapore? 39. If employees of an offshore crypto payment company work in mainland China, are there legal risks? 20. Can multiple products and subsidiaries of a group share a single license? ← Previous question 30 All crypto payment Q&A Next question 32 →

Question 32

What qualifications are required to conduct crypto payment business in Australia?

Accepted Answer

The scope of VASP registration now extends beyond the buying and selling of crypto assets with fiat currency The virtual asset services currently specified by AUSTRAC include fiat-to-coin exchange, coin-to-coin exchange, arranging related exchanges, custody, and accepting instructions to transfer on behalf of clients. Whether a service is regulated also depends on the specific service definition and the territorial nexus; an ordinary enterprise merely holding its own coins does not automatically become a VASP on that basis. If a product also remits fiat currency on behalf of clients, the remittance service registration must be checked separately, and it cannot be assumed that on-chain settlement covers the fiat collection and payment leg. The 2026 transitional rules must distinguish between legacy registrations and historical pending applications Entities previously registered as DCEs automatically convert to VASPs from 31 March 2026 and do not need to re-register for the name change, but they must still update their information and implement the new obligations. The obligations for some new categories of services are deferred to 1 July, and the application window for eligible applicants closes on 29 July; the official rules state that specified persons who apply on time and have not yet received an approval or refusal decision may continue the relevant business. By October, new entrants cannot use this historical window to "operate first and apply later," nor can it be concluded in the reverse that all historical pending applicants are already in breach. The transitional periods for other obligations must be checked separately. Whether a payment product can be offered must also clear the ASIC hurdle ASIC's INFO 225 guidance requires determining, on the basis of rights and functions, whether digital assets and related facilities constitute financial products, and non-cash payment facilities are one such category. If a platform allows clients to maintain stablecoin balances and continuously make payments to merchants, it cannot claim that the entire wallet has financial product licensing merely on the strength of AUSTRAC registration. Even if some functions do not involve the platform directly holding assets, it should still be checked whether the specific facilities and services trigger an AFSL, authorised representative status or an applicable exemption, rather than ending the analysis with a "non-custodial" label. The new platform law has been passed, but it cannot be written up in advance as a full set of obligations currently in force The Corporations Amendment (Digital Assets Framework) Act 2026 received Royal Assent on 8 April 2026, and the Act provides that the entire amending Act commences on 8 April 2027. As of this verification, ASIC has consulted on the implementing rules. Accordingly, this is neither merely a policy proposal that has not yet been passed, nor does it mean that all new platform obligations are in force in October 2026. When designing custody, trading and client asset arrangements now, provision should be made for adjustment to the new digital asset platform and tokenised custody platform regimes, while complying with the rules applicable today. Recommended actions Classify each service specified by AUSTRAC item by item, and verify VASP and remittance registration, territorial nexus and current status. If relying on historical transitional treatment, retain records of the service start date, application date, application category and AUSTRAC decision notices. Complete the financial product and non-cash payment facility analysis separately, verify AFSL, representative or exemption conditions, and do not treat AML registration as product approval. Prepare an implementation checklist for the new platform regime in 2027, distinguishing between bills already passed and supporting rules still under consultation. Information note: This article provides general information and does not replace legal advice based on specific facts. References Virtual asset designated services — AUSTRAC AML/CTF transitional rules 2026 — AUSTRAC Explanatory Statement to the AML/CTF Transitional Rules 2026, Part 5 item 14 — Australian Government, Federal Register of Legislation Digital assets: Financial products and services, INFO225 — Australian Securities and Investments Commission Corporations Amendment (Digital Assets Framework) Act 2026, section 2 — Australian Parliament / Federal Register of Legislation 26-245MR ASIC consults on implementation of new digital asset laws — Australian Securities and Investments Commission Related Q&A 2. If we already hold a traditional payment license, do we need a new license to add stablecoin receipt and payment services? 13. What are the differences among MSB, VASP and CASP qualifications? 66. Do we need to apply for a license to develop and operate a self-hosted wallet? 76. What are the most basic anti-money laundering obligations for crypto payment companies? ← Previous question 31 All crypto payment Q&A Next question 33 →

Question 33

After Joining a Swiss SRO, Can a Crypto Payment Business Be Operated?

Accepted Answer

What layer of compliance does SRO supervision cover? An SRO is a self-regulatory organization recognized by the Swiss Financial Market Supervisory Authority (FINMA) and supervises its members' performance of anti-money-laundering obligations in accordance with the law. FINMA's guidance on fintech lists virtual currency exchange, payment and certain wallet activities as businesses requiring review of anti-money-laundering requirements. Therefore, SRO membership is not devoid of regulatory significance, but it also must not be promoted as FINMA having approved all of the company's products, confirmed the safety of client assets, or guaranteed the company's solvency. After "the client has paid," how does the legal relationship change? The key to entering the scope of other licenses is not merely whether the wallet is called custody, but what assets the client hands over to whom, how the assets are kept, whether the company may use them, and whether the client obtains a right to return of the original assets or a claim for repayment against the company. FINMA explains that public deposits, custody of certain crypto assets and securities-related business may involve banking, FinTech or other licenses. Recording client funds on the company's internal ledger while holding only an SRO certificate cannot replace this classification. Compare instant exchange with a long-term balance Assume Model A completes the exchange immediately after confirming the transaction and delivers the agreed assets directly to the client; Model B instead lets the client retain a long-term balance withdrawable at any time, with the company centrally controlling the assets. Both may require anti-money-laundering arrangements, but the fact that Model A's SRO route is viable does not mean Model B requires no other license. If the balance is further invested, lent out or promised a return, the nature changes again. FINMA's existing FinTech license page expressly states that the relevant assets it is permitted to accept may not be invested and bear no interest, showing that a "FinTech license" itself is not an unlimited right to conduct deposit-taking business. Client protection cannot rely on a membership directory alone FINMA notes that client assets at FinTech institutions do not automatically enjoy bank deposit protection and requires that clients be informed of the relevant arrangements. SRO membership certainly cannot be used to make an equivalent promise. When choosing a structure, it is advisable to design at the same time the ownership of assets, account or wallet segregation, reconciliation, return and wind-down processes, and to keep them consistent with client contracts. For projects with unclear boundaries, the complete model may be explained to FINMA before applying; when serving overseas clients, the destination rules must also be independently verified, as Swiss status itself does not replace the counterparty's market access requirements. Recommended actions Verify whether the SRO is recognized by FINMA, whether the company is a valid member, and whether the declared activities are consistent with the actual products. Prepare a table of fund and asset rights, explaining item by item the custody, rights of use, repayment or return obligations and client bankruptcy risk. Assess banking, FinTech and other licenses separately for long-term balances, collective custody, securities or yield functions, and do not carry over the conclusion from the original exchange model. Accurately disclose the regulatory nature and asset protection in marketing materials and client contracts; do not state "FINMA guarantee" or unsupported deposit protection. Information note: This article provides general information and does not replace legal advice based on specific facts. References FinTech—Authorisation requirements — Swiss Financial Market Supervisory Authority FINMA FinTech licence — Swiss Financial Market Supervisory Authority FINMA Authorised institutions, individuals and products — Swiss Financial Market Supervisory Authority FINMA Related Q&A 13. What are the differences among MSB, VASP and CASP qualifications? 18. To apply for an overseas crypto payment license, are local offices and staff required? 73. Can a wallet or U-card account add a balance yield feature? 92. If a payment company fails, will client funds be used to repay the company's debts? ← Previous question 32 All crypto payment Q&A Next question 34 →

Question 34

If a crypto payment company is established in the BVI or the Cayman Islands, does it also need local qualifications?

Accepted Answer

BVI: Determining Whether Managed Services Are Operated Locally or From the Territory The British Virgin Islands Financial Services Commission (FSC) VASP application guidance requires operators providing virtual asset services in or from within the BVI to apply for registration. Custody and virtual asset exchanges must also satisfy the corresponding additional requirements. Accordingly, the statement that an "offshore company has no local clients" cannot substitute for a business analysis. It should be explained which legal entity contracts, who holds the assets, from where business decisions are made, and who controls the wallets and trading systems, rather than merely asking whether a registered agent can incorporate a company. Cayman: Distinguishing General VASP Registration From the Two Categories of Business Licence The Cayman Islands Monetary Authority (CIMA) states that, with effect from 1 April 2025, virtual asset custody and trading platforms are subject to a licensing regime; other regulated virtual asset services generally follow the registration route, and arrangements lawfully granted an exemption are treated separately. Where a company simultaneously engages in activities requiring registration and activities requiring a licence, the overall route should be determined in accordance with CIMA rules, and "registered VASP" must not be understood to mean that any custody or trading business may be carried on. When purchasing a shelf company, particular attention should be paid to the actual approvals, not merely the licence name used by the seller. Legacy Institutions in the Transitional Period Must Not Be Conflated With New Applicants CIMA established a 90-day licence application window for institutions that were already registered and operating custody or trading platforms at the relevant time, and permits institutions that meet the arrangements to continue the relevant business during the licence review. Accordingly, the original draft's statement that "business cannot be carried on on the basis of ordinary registration alone" has cautionary value for new entrants, but it cannot be relied on to conclude that all legacy institutions awaiting approval have no authority to operate. Due diligence should obtain the original registration, the application filed on time and the records of subsequent decisions, and then confirm their current status; newly established projects cannot borrow the transitional experience of others. The Value of an Offshore Structure Must Be Verified Against Genuine Business Needs A structure in which the group establishes a holding company in the BVI and a licensed subsidiary in another location directly serves clients is different from one in which the BVI company itself contracts and quotes, controls receipt of funds and assumes redemption commitments to clients. Outsourcing custody does not automatically turn the latter into a pure holding company. Even where the local VASP route has been implemented, the target client market, fiat payment and banking access must still be verified separately. When selecting a location, operations, regulation and responsibility for client assets should be placed on the same structure chart, so as to avoid creating an entity that cannot open an account or explain its responsibilities merely for ease of incorporation. Recommended Actions Map the contracting, client acquisition, asset control, exchange and settlement relationships by legal entity, and determine the actual connection of "operating in or from the territory". Verify registration, licensing and scope of activities through official FSC or CIMA channels, and require counterparties to provide complete approvals and conditions. For existing Cayman institutions relying on transitional treatment, verify that applications were filed on time and the status of pending approval; do not accept oral statements that a licence "is being changed". Treat client market access, fiat payment arrangements and bank account opening as separate feasibility conditions, and do not promote offshore global access. Information note: This article provides general information and does not replace legal advice based on specific facts. References Guidance on Application for Registration as a Virtual Assets Service Provider — BVI Financial Services Commission Amendments to the Virtual Asset (Service Providers) Act in Effect 1 April 2025 — Cayman Islands Monetary Authority MiCA Article 61—Provision at the exclusive initiative of the client — ESMA / European Union Related Q&A 8. If a company is incorporated offshore and serves only overseas clients, where does it need to be licensed? 11. Where is it more appropriate to incorporate a crypto payment company? 19. How should one choose between acquiring a licensed company and applying for a license oneself? 20. Can multiple products and subsidiaries of a group share a single license? ← Previous question 33 All crypto payment Q&A Next question 35 →

Question 35

Which regulatory regime should be chosen for crypto payments in Dubai or Abu Dhabi?

Accepted Answer

Neither "Dubai" nor "Abu Dhabi" is a single licence name VARA's virtual asset regulatory scope covers mainland Dubai and the relevant free zones, but does not include the Dubai International Financial Centre (DIFC). The Abu Dhabi Global Market (ADGM) is a financial free zone that applies its own financial services regime, and "a company incorporated in Abu Dhabi" cannot automatically be equated with being licensed by ADGM. Accordingly, the specific jurisdiction in which the office, contracting and service provision take place should first be clarified, and the competent authority then identified; the fact that a registered agent can incorporate a company does not mean that the financial regulator has already consented to the conduct of business. Look first at regulated activities, then at the assets permitted for use VARA has dedicated rules for the virtual asset transfer and settlement business; other activities such as exchange and custody should be verified separately for authorisation, and all functions cannot be inferred from a single activity. The ADGM requires operation under an FSRA financial services permission and its specific conditions. Its amendments relating to fiat-referenced tokens (FRTs) took effect on 1 January 2026 and cover accepted tokens, regulated activities and client token arrangements. The fact that a certain coin is popular in the market does not mean it already meets the asset admission requirements of the jurisdiction to which the platform belongs. For payments to ordinary merchants, central bank rules may change product choices The Central Bank of the UAE's Payment Token Services Regulation distinguishes issuance, exchange, custody and transfer, and imposes limits on merchants' acceptance of virtual asset payments. Within the scope of application of Article 2 of that Regulation, payment for general goods or services cannot freely accept foreign-currency stablecoins; the payment use of approved foreign-currency payment tokens is mainly limited to the purchase of virtual assets or their derivatives, while dirham payment tokens are handled separately under licensed issuance requirements. That article expressly excludes the financial free zones and cannot be mechanically applied within the ADGM or DIFC, but the provision of services from within a zone to clients outside it requires re-examination. Compare using two scenarios: merchant business and institutional trading Assume that Option A serves catering merchants in mainland Dubai, and Option B provides services relating to approved tokens to institutions in the ADGM. The same qualifications and token lists cannot be applied to both merely because both use US dollar stablecoins. For A, it should first be confirmed whether merchant payments are permitted and what central bank and local admissions are required; for B, the FSRA approved activities, tokens and client conditions should be verified. Only then should the team, banking, asset custody and costs be compared; that is an executable choice of location. A licence in any one place should not be promoted as covering the whole of the UAE or the entire Middle East. Recommended actions Clarify the actual place of business in the mainland, an ordinary free zone, the DIFC or the ADGM, and allocate the competent authority according to the scope of contracting and client services. Map exchange, custody, transfer and settlement, issuance and fiat-currency payments item by item to licences and counterparties, and verify each condition. Verify the token and the payment use separately, and in particular confirm whether different restrictions apply to ordinary merchant receipt of payments and to the purchase of virtual assets. Before applying, conduct a preliminary verification of the complete fund flow with the relevant competent authorities or local counsel, and assess the boundaries of services provided from the financial free zone to outside the zone. Information note: This article provides general information and does not replace legal advice based on specific facts. References VA Transfer and Settlement Services Rulebook — Dubai Virtual Assets Regulatory Authority Digital Assets in ADGM — Abu Dhabi Global Market / Financial Services Regulatory Authority ADGM FSRA finalises regulatory framework for Regulated Activities involving Fiat-Referenced Tokens, 31 October 2025 — Abu Dhabi Global Market / Financial Services Regulatory Authority Payment Token Services Regulation, Articles 2 and 5 — Central Bank of the UAE Related Q&A 4. Is it legal to collect stablecoins on behalf of merchants and then settle them into fiat currency? 11. Where is it more appropriate to register a crypto payment company? 12. To operate global crypto payments, is it necessary to apply for a license in every country? 65. Can a crypto payment platform support multiple stablecoins such as USDT and USDC at the same time? ← Previous question 34 All crypto payment Q&A Next question 36 →

Question 36

Can crypto payment businesses operate in mainland China?

Accepted Answer

First, break “crypto payments” down into actual actions A merchant receiving stablecoins, a platform converting them into RMB, and fiat currency being paid to suppliers may look like a single product, but in practice it may simultaneously involve virtual currency exchange, fund transfers and cross-border foreign exchange. To determine whether such a business may be operated in mainland China, it is not enough to look at whether the product name contains “payment”; instead, it is necessary to confirm item by item whose assets the platform receives, who makes the conversion decision, and who ultimately bears the payment obligation. Merely labeling the revenue as a technical service fee does not change the services actually provided. The current basis has been updated to 2026 Notice Yinfa [2026] No. 42, issued by the People's Bank of China and seven other departments, has replaced the relevant 2021 notice. The new rules continue to prohibit, within mainland China, businesses such as the exchange of fiat currency for virtual currency, and prohibit financial institutions, including non-bank payment institutions, from providing services such as account opening, fund transfers and clearing and settlement for virtual-currency-related business. Stablecoins such as Tether do not acquire legal-tender status merely because their prices are relatively stable. Therefore, this is not a problem that can be solved by “obtaining an ordinary payment license to complete the formalities.” Offshore registration cannot change the actual recipients of services Assume that an offshore company receives stablecoins from mainland merchants and then arranges for a mainland account to pay RMB to the merchants. Even if the contract chooses foreign law, it is still necessary to examine whether it is illegally providing services to mainland entities. By contrast, arrangements that genuinely take place in offshore markets where the relevant business is permitted and that serve offshore customers require a separate assessment of local market access and China-related factors, and cannot be inferred from this question to be lawful as a matter of course. In particular, where an offshore company controlled by a mainland entity issues virtual currency, the restrictions in the 2026 notice must also be checked separately. First conduct business exclusion, then product design In practice, one should first draw a relationship map of customers, contracting entities, wallets, bank accounts and ultimate payees, and mark out mainland residents, mainland merchants, mainland marketing and fund operations item by item. Where a business is confirmed to be prohibited, it should be excluded from the scope of mainland products, rather than seeking collection accounts, offshore shell companies or a change of contract name. For functions that genuinely constitute ordinary software services, it should also be checked whether they in fact undertake transaction pricing, instruction execution or assistance to illegal business, and it must not be presumed that a “technology company” is naturally exempt. Recommended actions Prepare a one-page map of fund flows and service flows, listing the controller of each account and wallet. Screen out, item by item, mainland customer onboarding, RMB conversion, mainland settlement and promotional functions. Review old plans and contracts against the 2026 notice, and no longer cite only the 2021 document. Information note: This article provides general information only and does not replace legal advice based on specific facts. References Notice on Further Preventing and Addressing Risks Associated with Virtual Currency and Related Matters (Yin Fa [2026] No. 42) — People's Bank of China and seven other departments Related Q&A 4. Is it lawful to collect stablecoins on behalf of merchants and then settle them into fiat currency? 37. If an overseas company already holds a license, may it provide crypto payment services to clients in mainland China? 41. Is it unlawful to collect RMB domestically and pay foreign currency overseas, using stablecoins for settlement in between? 44. Can the same group simultaneously operate domestic fiat currency payment business and overseas crypto payment business? ← Previous question 35 All crypto payment Q&A Next question 37 →

Question 37

Can an Offshore Company That Is Already Licensed Provide Crypto Payment Services to Clients in Mainland China?

Accepted Answer

Licences cannot resolve prohibitive rules in the client's location An offshore licence first establishes that a given entity is permitted to carry on specific business in the licensing jurisdiction; it does not equate to global client access. The restrictions in mainland China and whether an entity is licensed offshore are two separate questions: business being lawful in the place of registration does not mean services can be delivered to mainland clients. The wording of the 2026 notice is not limited to exchanges, and it cannot therefore be assumed that payment platforms, merchant collection tools or enterprise-only versions fall outside its scope of review. A determination cannot be made solely on the basis of identity documents or contractual addresses A practical review should also examine who actually uses the client account, where the client operates, who issues payment instructions and for whom settlement is ultimately completed. Suppose a mainland trading company opens an account in the name of an affiliated offshore company, but a mainland business team continuously uses that account to arrange exchanges for mainland transactions; in that case, retaining only the offshore registration certificate is insufficient to explain to whom the services are provided. Conversely, a Chinese national genuinely living abroad cannot be treated as a mainland client for the purposes of this question on the basis of nationality alone; it remains necessary to ascertain their location, the substance of the business and any China-related arrangements. "The client approached us on its own initiative" is likewise not an automatic exception The 2026 notice does not establish a general exemption for offshore licensed institutions permitting them to provide services merely because a client makes a request on its own initiative. The absence of Chinese-language product materials and of a mainland office does not, on its own, prove that no services are being unlawfully provided into the mainland. Where mainland traffic already exists, website application forms, sales chats, referral commissions and payment records should be reviewed to prevent a situation in which the front office claims not to serve the mainland while the back office still manually approves access. Existing clients should be handled on the facts, not by changing identity in order to continue First identify the restricted services and incomplete transactions, and then compliance, legal and operations should jointly determine the path for ceasing new business, communicating with clients and lawfully handling existing assets. Clients must not be asked to use offshore addresses, re-sign with shell companies or change payees in order to continue trading. Whether reporting is required and how frozen funds or refunds should be handled must be confirmed according to the specific account and the status of the matter, so as to avoid simply closing accounts and leaving client assets with no one to deal with them. Recommended actions Sample account-opening, marketing and settlement files, and verify the named client against the actual user. Implement the mainland restrictions in product access, manual review and channel management rules. Formulate a plan for ceasing new business and winding down existing mainland business, and retain complete records. Information note: This article provides general information and does not replace legal advice based on specific facts. References Notice on Further Preventing and Addressing Risks Associated with Virtual Currencies and Related Matters (Yin Fa [2026] No. 42) — People's Bank of China and seven other departments Related Q&A 8. If a company is registered overseas and serves only overseas clients, where does it need to hold licenses? 29. If a company is not in the EU, may it still provide crypto payment services to EU clients? 38. May we serve overseas enterprises and individuals with a Chinese background? 40. May an overseas crypto payment company advertise and solicit business in mainland China? ← Previous question 36 All crypto payment Q&A Next question 38 →

Question 38

Can We Serve Overseas Enterprises and Individuals with a Chinese Background?

Accepted Answer

First distinguish between customer background and place of business "Chinese background" may mean that the shareholder is a Chinese enterprise, that the founder holds a Chinese passport, or that the customers mainly speak Chinese; it may also mean that operations, employees and funds all remain in the mainland. These situations cannot be conflated. A reasonable onboarding review should not treat nationality directly as a conclusion on the legality of the business; it should first answer: who signs the contract, who uses the service, where the business takes place, and which entity bears the payment or remuneration obligations. Genuine overseas business still requires a local operating basis Suppose an enterprise invested in by Chinese shareholders, which genuinely has overseas employees and warehousing, wishes to pay local suppliers: a locally licensed service provider should assess whether the product, currency, customer industry and payment purpose fall within the scope of its licence. For example, the EU's MiCA imposes onboarding requirements on entities providing crypto-asset services, and the relevant fiat-currency payments must also be separately checked for payment qualifications. What is discussed here is the scope for case-by-case assessment, not a compliance endorsement of all overseas enterprises. What needs to be excluded is an overseas presence in name only while the business is actually domestic The 2026 notice prohibits overseas entities from unlawfully providing virtual-currency services to mainland entities. If an overseas company is merely a shell set up to open accounts, and its real purpose is to buy coins for mainland enterprises, exchange for RMB, or circumvent foreign-exchange administration, the place of registration does not eliminate the risk. Another easily overlooked scenario is where a customer or group intends to issue tokens itself: without the lawful and compliant consent of the relevant authorities, domestic entities and the overseas entities they control may not issue virtual currency overseas, and ordinary payment use cannot be judged together with issuance business. Onboarding materials must corroborate one another It is advisable to cross-check registration materials against actual contracts, proof of office operations, payment obligations, sources of funds and beneficial ownership information. If a customer declares overseas operations, but orders, operating personnel and settlement receipts are all concentrated in the mainland, onboarding should be suspended and the inconsistency explained, rather than simply obtaining an overseas address declaration. Periodic review is equally important, because a customer may change its business or the regions it serves after account opening. The above are risk-review recommendations and cannot replace the customer-classification rules of a specific jurisdiction. Recommended actions Record equity control, tax residence, place of business and place of service use separately, and do not merge them into a single "Chinese background" label. Require the customer to explain the commercial purpose of the stablecoin and cross-check it against orders and payment obligations. Trigger a dedicated legal review where factors of domestic equity interests, overseas issuance or mainland RMB settlement are present. Information note: This article provides general information only and does not replace legal advice based on specific facts. References Notice on Further Preventing and Addressing Risks Associated with Virtual Currency and Related Matters (Yin Fa [2026] No. 42) — People's Bank of China and seven other departments MiCA Article 59: Authorisation — European Parliament, Council of the European Union / ESMA official rulebook MiCA Article 70: Safekeeping of clients’ crypto-assets and funds — European Parliament, Council of the European Union / ESMA official rulebook Related Q&A 17. If a shareholder or founder is Chinese, will that affect an overseas licence application? 37. If an offshore company is already licensed, can it provide crypto payment services to clients in mainland China? 42. Can we provide stablecoin settlement services for cross-border trade enterprises? 45. If a company is established outside mainland China, is income from its crypto payment business still subject to taxation in mainland China? ← Previous question 37 All crypto payment Q&A Next question 39 →

Question 39

Do employees of an offshore crypto payment company working in mainland China face legal risks?

Accepted Answer

Job titles matter less than authority and work records The 2026 notice expressly holds domestic entities and individuals liable where they know or should know that an overseas entity is unlawfully providing relevant services within the PRC and still assist it. Customer service, R&D, sales and finance personnel may all be involved in key steps, and the job title on the labor contract is not the only thing to look at. It is necessary to verify whether an employee handles account-opening approvals, exchange quotations, trading instructions, private-key signing, RMB receipts and payments, or the channeling of mainland clients, and what the employee actually knows about the business risks. Ordinary support work is not equivalent to trading operations Suppose an employee only maintains general office systems and has no access to clients, orders or assets; the factual basis there differs from that of a team organizing OTC quotations or handling deposits and withdrawals within the mainland. But this is only a distinction in risk analysis; the law contains no rule that "general technical positions are always safe." For products said to serve only overseas clients, the scope of clients and the actual manner of operation must also be verified; where the relevant business itself is unlawful, or an employee continuously handles obviously abnormal requests, an overseas license cannot eliminate the risk on the employee's behalf. Contracts cannot replace the real employment arrangement Signing contracts directly with an overseas company, being employed through a domestic affiliate, and engaging independent contractors involve different assessments of entity qualification and labor relations. Where an employee is subject to long-term attendance, performance and day-to-day direction within the mainland, the employment assessment cannot be skipped merely because the contract calls the person a "consultant." Responsibility for remuneration payment, individual income tax filing, social insurance and client data access must be determined separately; whether wage payment is compliant does not mean the business in which the employee participates is lawful. Enterprises should embed the boundaries in systems and processes It is advisable to prepare a position-authority matrix that specifies the data that may be accessed, the instructions that may be executed and the escalation paths. Where problems such as solicitation within the mainland, fictitious trade or collecting payments on behalf of others are discovered, the relevant operations should be suspended and referred for compliance handling, with work orders and review records retained, rather than requiring employees to fill gaps using personal accounts or personal wallets. Contracts, training and access controls should be consistent with actual conduct; a paper policy stating "no service to China" is not enough. Recommended actions Check system access, client contact, fund operations and sales targets position by position. Review client onboarding for the overseas platform and conduct sample checks for manual approvals within the mainland. Confirm the lawful employing entity, remuneration filing and data access paths, and establish an abnormal-escalation mechanism. Information note: This article provides general information only and does not replace legal advice based on specific facts. References Notice on Further Preventing and Addressing Risks Associated with Virtual Currency and Related Matters (Yin Fa [2026] No. 42) — People's Bank of China and seven other departments Interim Provisions on Wage Payment (Lao Bu Fa [1994] No. 489) — Former Ministry of Labour / Shanghai Municipal Human Resources and Social Security Bureau Individual Income Tax Law of the People's Republic of China — Standing Committee of the National People's Congress / State Taxation Administration Related Q&A 37. If an overseas company already holds a license, may it provide crypto payment services to customers in mainland China? 40. May an overseas crypto payment company advertise and solicit business in mainland China? 43. May an overseas crypto payment company pay wages to employees in mainland China in USDT? 84. Will using overseas identity verification, cloud services, or banks raise cross-border data transfer issues for customer data? ← Previous question 38 All crypto payment Q&A Next question 40 →

Question 40

Can an Offshore Crypto Payment Company Advertise and Solicit Investment in Mainland China?

Accepted Answer

First, examine where the event directs participants Whether an event constitutes marketing cannot be determined solely by whether it is labeled a closed-door meeting, a technical exchange, or an investment promotion briefing. Distributing account-opening links after product presentations, inviting deposits, promising conversion into RMB, and paying channel commissions based on completed transactions will all cause the event to be connected to actual business. Suppose the first half of a seminar discusses compliance while the second half instructs mainland merchants to use overseas accounts to receive crypto and settle payments; the research nature of the first half cannot be used to cover the solicitation conduct in the second half. Online traffic diversion and offline sales must be reviewed together Yinfa [2026] No. 42 imposes restrictions on internet companies providing online business premises, commercial displays, marketing promotion, and paid traffic diversion, and requires strengthening relevant advertising supervision. Where domestic agents channel clients to overseas products through official accounts, community groups, QR codes, or direct messages, the fact that the final step occurs overseas does not by itself mean there is no mainland risk. Where participants know or should know that the platform is unlawfully serving the mainland, liability for assisting may also arise. Lawful fiat currency products cannot become an entry point for crypto business Where the same brand operates both fiat currency payment and overseas stablecoin business, the promotional page must correspond to the services that are genuinely approved to be provided to that customer. For example, if an advertisement displays ordinary cross-border collection services, and sales staff subsequently direct mainland customers to stablecoin exchange through a "faster solution," the assessment must still be based on the complete sales pathway. Changing the contracting entity between teams or moving referrals into private chats will not automatically change the service recipients and the actual business. Content and conversion pathways can be reviewed first General research, risk education, and commercial promotion must be distinguished based on the facts. It cannot be promised that all industry exchanges are prohibited, nor can it be promised that merely not distributing account-opening links will necessarily be lawful. Before publishing content or holding events, complete course materials, lecture scripts, registration conditions, sponsorship arrangements, and post-event contact plans should be retained, and a review should be conducted as to whether they contain inducements to product transactions. For mainland customer acquisition demands that cannot be explained, the promotion pathway should be stopped first, rather than continuing conversion by deleting words, changing groups, or hiding the brand. Recommended actions Review the complete pathway from advertising and registration to sales private chats and account opening. Verify channel commissions, customer lists, and the actual tasks of mainland sales personnel. Approve research content and product solicitation separately, and retain complete versions and review opinions. Information note: This article provides general information only and does not replace legal advice based on specific facts. References Notice on Further Preventing and Addressing Risks Associated with Virtual Currency and Related Matters (Yin Fa [2026] No. 42) — People's Bank of China and seven other departments Related Q&A 37. If an overseas company is already licensed, may it provide crypto payment services to clients in mainland China? 39. Is there legal risk for employees of an overseas crypto payment company working in mainland China? 48. If I only refer clients to a licensed payment institution and receive a commission, do I need a license? 71. May an overseas U-card project be promoted to residents of mainland China? ← Previous question 39 All crypto payment Q&A Next question 41 →

Question 41

Receiving RMB domestically and paying foreign currency offshore, with stablecoins used for settlement in between: is this unlawful?

Accepted Answer

Look at the final exchange outcome, not just a single on-chain transaction This model typically involves the client paying RMB in mainland China, a designated overseas payee receiving foreign currency, and the operator using stablecoins to replenish positions at both ends. From the client's perspective, what is purchased remains a cross-currency, cross-border funds delivery service. The fact that no single sum is directly remitted between accounts does not prove that no currency exchange occurred; the quotation, orders, RMB transaction records, on-chain addresses and foreign-currency payments need to be examined together. Existing official cases directly address this structure In a typical case published by the Supreme People's Procuratorate and the State Administration of Foreign Exchange in 2023, Zhao and others operated currency exchange by collecting dirhams overseas, paying RMB domestically, and using Tether to circulate funds. The official case expressly states that using virtual currency as a medium to achieve conversion between domestic and foreign currencies falls within the scope of illegal foreign exchange trading. This is the judicial conclusion in a specific case and does not mean that any holding of tokens or ordinary token transfers automatically constitutes this offence. Even with a trade contract, the lawful payment and receipt path must be verified The Foreign Exchange Administration Regulations require that current-account foreign exchange receipts and payments have a genuine and lawful underlying transaction and that foreign exchange be purchased and paid through qualified institutions in accordance with the rules. Suppose the client genuinely has import payment obligations, but the platform collects RMB and has an overseas affiliate pay US dollars on its behalf; a genuine order does not confer foreign exchange operating qualifications on the platform. Splitting entities, splitting orders, or renaming the spread as a service fee are not paths to lawfulness. When faced with such requests, verify and stop unlicensed arrangements First confirm whether the client needs to resolve trade payment, investment, or personal funds transfer, and then refer the matter to a bank or institution with the corresponding qualifications to assess it according to the genuine purpose. The platform should reject arrangements premised on concealing the payer, falsifying the purpose, or borrowing accounts. Where transactions have already occurred, complete order, communication, funds and wallet records should be preserved, existing funds reconciled, and dedicated legal advice obtained promptly; transactions must not continue to be added or records deleted in order to balance the books. Recommended actions Reconcile RMB receipts, on-chain transfers and foreign-currency payments against the same order. Verify who provides the exchange rate quotation, who bears the overseas payment obligation, and whether that party holds the relevant operating qualifications. Refer genuine needs to qualified institutions for assessment and stop unlicensed exchange or matched-order arrangements. Information note: This article provides general information and does not replace legal advice based on specific facts. References Typical Cases of Punishing Illegal and Criminal Activities Involving Foreign Exchange — Supreme People's Procuratorate and State Administration of Foreign Exchange Regulations of the People's Republic of China on Foreign Exchange Administration (2008 Revision) — State Council / National Database of Administrative Regulations, Ministry of Justice Notice on Further Preventing and Handling Risks Associated with Virtual Currency and Related Matters (Yin Fa [2026] No. 42) — People's Bank of China and Seven Other Departments Related Q&A 36. Can crypto payment businesses operate in Mainland China? 42. Can we provide stablecoin settlement services to cross-border trade enterprises? 60. What legal issues are involved in making payments to overseas employees and contractors on behalf of an enterprise? ← Previous question 40 All crypto payment Q&A Next question 42 →

Question 42

Can We Provide Stablecoin Settlement Services to Cross-Border Trading Enterprises?

Accepted Answer

Trade authenticity and settlement legality are two separate reviews First verify the buyer and seller, the goods or services, the amount and the payment obligation, and then verify the payment instrument and the service pathway. The first item answers "why the payment is made"; the second answers "who pays lawfully, and by what means." If a platform has only a trade contract but cannot clearly explain who owns the wallet receiving the tokens, who bears exchange losses, and who pays the seller, then even if the order is genuine, the issues concerning customer assets and licensing remain unresolved. Where mainland enterprises are involved, orders cannot substitute for foreign exchange requirements Yinfa [2026] No. 42 restricts the relevant virtual currency business and supporting settlement, while Articles 12 to 14 of the Regulations on the Administration of Foreign Exchange separately set out the genuine and lawful basis for current account transactions and the requirements for purchasing and paying foreign exchange. Suppose a mainland exporter has the buyer deliver stablecoins to an offshore channel, and then an unrelated domestic individual transfers RMB to the exporter. This not only requires an explanation of the source of the payment for goods, but may also involve prohibited services and illegal foreign exchange. An invoice cannot be treated as a document that eliminates all risks. Offshore arrangements must specify the point at which payment is completed For buyers and sellers genuinely operating outside the mainland, it should first be confirmed that the applicable law permits the instrument and that the service provider holds the required qualifications. For example, the EU's MiCA distinguishes crypto-asset services from related payment services, and obtaining a crypto licence does not automatically permit handling all fiat currency steps. The contract should also specify whether the seller accepts stablecoins or fiat currency, whether on-chain confirmation equals completion of payment, who handles de-pegging or freezing, and in what currency and amount refunds are to be made. Use a single order to link four categories of records Before launch, a hypothetical order may be selected to simulate how contractual obligations, on-chain transfers, exchange receipts and fiat currency credits correspond one to one, and then to test scenarios of underpayment, refunds and address errors. Such an exercise is an implementation recommendation, not proof of regulatory approval. If the finance team can provide only an on-chain hash but cannot prove the attribution of the funds and the commercial reason, tax, bank review and dispute resolution will all lack evidence, and the gaps should be filled first rather than launching with unresolved issues. Recommended actions Distinguish the actual locations of the buyer and seller, and confirm whether mainland funds or service recipients are involved. Establish a unified numbering system linking trade contracts, orders, wallet records, exchange records and bank receipts. Specify in the contract the party bearing completion of receipt, refunds, fees and de-pegging risk. Information note: This article provides general information only and does not replace legal advice based on specific facts. References Notice on Further Preventing and Addressing Risks Associated with Virtual Currency and Related Matters (Yin Fa [2026] No. 42) — People's Bank of China and seven other departments Regulations of the People's Republic of China on Foreign Exchange Administration (2008 Revision) — State Council / National Database of Administrative Regulations, Ministry of Justice MiCA Article 59: Authorisation — European Parliament, Council of the European Union / ESMA official rulebook MiCA Article 70: Safekeeping of clients' crypto-assets and funds — European Parliament, Council of the European Union / ESMA official rulebook Related Q&A 7. What qualifications are required for an enterprise to use stablecoins to pay overseas suppliers? 38. Can we serve overseas enterprises and individuals with a Chinese background? 41. Is it illegal to receive RMB domestically and pay foreign currency overseas, with stablecoins used for settlement in between? 59. What costs and time can stablecoin cross-border payments typically save? ← Previous question 41 All crypto payment Q&A Next question 43 →

Question 43

Can an Offshore Crypto Payment Company Pay Mainland Employees' Salaries in USDT?

Accepted Answer

First determine whether the wages are subject to mainland rules The Interim Provisions on Wage Payment apply to employees who have formed an employment relationship with an employer within the territory, and Article 5 requires wages to be paid in the lawful currency. Where an overseas company directly hires a person working in the mainland, issues of the employer's capacity to employ, the employment relationship and the applicable law also arise, and no conclusion can be drawn merely from the statement that "the person is in the mainland" or "the contract is overseas." It should be ascertained who recruits, manages, assesses and pays the person, and whether a mainland-affiliated employer exists. USDT does not become a US-dollar wage merely because it is pegged to the US dollar Yinfa [2026] No. 42 clarifies that virtual currencies such as Tether do not have a legal status equivalent to that of the lawful currency. Assuming a contract provides for a monthly wage in RMB and the company instead transfers an equivalent amount of USDT, the employee may still assert that wages were not paid in accordance with the law; an on-chain record of receipt does not of itself prove that the wage obligation has been performed. A signed declaration consenting to receive payment in crypto assets likewise cannot serve as a reliable basis for the company to be relieved of its mandatory wage obligations. Base salary, bonuses and genuinely independent services must be examined separately A fixed salary cannot be renamed a project bonus and then continue to be paid in crypto assets; genuinely independent contracting, overseas employment or other remuneration must be reassessed according to the specific relationship and the applicable rules, and mainland employment conclusions cannot simply be carried over, nor can stablecoin payment therefore be found to be feasible. Regardless of what the remuneration is called, the recipient's tax status, the nature of the income and the filing obligations must be confirmed. The form of payment is not inherently a tax-exemption condition. Where wages have already been paid in crypto assets, reconcile the accounts first and then rectify It is advisable to compile the employment contract, payroll schedules, amounts payable, withholding records, the type and quantity of crypto assets and the actual transfer times, and have employment and tax professionals verify the unperformed obligations and how to address them. Employees should not be required to sell the crypto assets themselves first, or to sign a waiver of claims, in place of rectification. Going forward, a lawful wage payment channel should be established, wage statements should be provided on schedule, and how overseas funds may be used for remuneration in compliance should be explained separately. Recommended actions Verify the actual employer, the employment relationship and the applicable law, rather than looking only at the title of the contract. Stop using USDT as a substitute payment method for lawful wages in the mainland. Reconcile month by month the amounts payable, paid, withheld and potentially in arrears, and design a lawful path for correction. Information note: This article provides general information only and does not replace legal advice based on specific facts. References Interim Provisions on Wage Payment (Lao Bu Fa [1994] No. 489) — Former Ministry of Labour / Shanghai Municipal Human Resources and Social Security Bureau Notice on Further Preventing and Addressing Risks Relating to Virtual Currency and Other Matters (Yin Fa [2026] No. 42) — People's Bank of China and seven other departments Individual Income Tax Law of the People's Republic of China — Standing Committee of the National People's Congress / State Taxation Administration Related Q&A 39. If an employee of an overseas crypto payment company works in mainland China, are there legal risks? 45. If a company is established overseas, does its crypto payment business income still need to be taxed in mainland China? 60. What legal issues are involved in paying overseas employees and contractors on behalf of an enterprise? ← Previous question 42 All crypto payment Q&A Next question 44 →

Question 44

Can the Same Group Operate Both Mainland Fiat Currency Payment and Offshore Crypto Payment Businesses?

Accepted Answer

Two companies do not mean the two businesses have been separated Group isolation should be reflected in a genuine division of contracting, decision-making, funds and service recipients, not merely an organizational chart. Assume that a mainland payment institution provides ordinary collection services for merchants, and an overseas subsidiary provides stablecoin services permitted locally. If mainland sales directly channel merchants into overseas products and domestic accounts redeem RMB for them, the arrangement must still be reviewed as a whole. An affiliate relationship between licensed entities cannot convert prohibited activities into lawful business. A mainland payment license has its own boundaries The Regulations on the Supervision and Administration of Non-bank Payment Institutions require operation within the business types and operating regions stated in the license, prohibit renting, lending or disguised transfer of licenses, and impose restrictions on outsourcing of core business and merchant management. The 2026 virtual currency notice separately prohibits financial institutions, including non-bank payment institutions, from providing related account opening, transfer and clearing and settlement services. Therefore, mainland fiat currency business cannot become a RMB on-ramp and off-ramp tool for overseas crypto business. Overseas payments and overseas issuance of coins cannot be conflated The group's plan to connect to existing stablecoin payments and its own issuance of stablecoins are different projects. The 2026 notice provides that, without the consent of the relevant authorities in accordance with laws and regulations, domestic entities and the overseas entities they control may not issue virtual currencies overseas; RMB-pegged stablecoins are also subject to special restrictions. The room to assess general overseas services cannot be expanded into permission to issue coins through an overseas subsidiary. Investment, control structures and other approval obligations should also be separately verified before implementation. Turn the isolation design into a verifiable responsibility matrix It is recommended to separately list customer contracts, bank accounts, wallet controllers, brand pages, customer acquisition sources, employee permissions and related-party transactions. Sharing back-office, customer service or risk management systems is not merely a matter of signing an outsourcing agreement; it is also necessary to examine whether the mainland team actually undertakes restricted business and whether cross-border data transfer is involved. Banks and regulators need enforceable boundaries and evidence, not a statement that "the two entities are each responsible." Business that does not meet access requirements should be excluded rather than packaged. Recommended actions List licenses, customers, asset accounts and personnel permissions by entity, and identify points of cross-use. Review item by item whether mainland channels divert customers, collect payments on behalf of others, or undertake delivery of overseas products. Submit overseas issuance, group investment and related services for separate special reviews. Information note: This article provides general information only and does not replace legal advice based on specific facts. References Regulations on the Supervision and Administration of Non-Bank Payment Institutions — State Council / State Administration for Market Regulation Notice on Further Preventing and Addressing Risks Associated with Virtual Currencies and Related Matters (Yin Fa [2026] No. 42) — People's Bank of China and seven other departments Related Q&A 20. Can multiple products and subsidiaries of a group share a single license? 36. Can crypto payment services be operated in mainland China? 39. Are there legal risks for employees of offshore crypto payment companies working in mainland China? 52. Can an ordinary corporate bank account be used to receive and settle client funds? ← Previous question 43 All Crypto Payment Q&A Next question 45 →

Question 45

If a company is established overseas, is income from crypto payment business still subject to taxation in mainland China?

Accepted Answer

Place of company registration is not the sole determining factor Articles 2 and 3 of the Enterprise Income Tax Law include within the scope of resident enterprises those enterprises established under foreign laws whose place of effective management is within China, and prescribe the corresponding tax obligations on domestic and foreign-source income. The Implementing Regulations refer to place of effective management as substantive, comprehensive management and control over operations, personnel, books and records, and property. Accordingly, arrangements in which key approvals are completed by a mainland team over the long term and in which books, records and funds are all controlled from the mainland must be assessed on the facts; producing a foreign registration certificate alone is not sufficient. Not being a resident enterprise does not necessarily mean no Chinese tax relevance Where a foreign enterprise establishes an establishment or place of business in China or derives China-source income, non-resident enterprise taxation may also arise. Whether a permanent establishment exists within the meaning of a tax treaty, and how profits are attributed, must be determined in light of the applicable treaty and the working facts. Suppose an offshore company has a mainland team that signs contracts externally on its behalf over the long term; the mere fact that the contracting payer is offshore does not exclude a tax nexus. Conversely, the presence of one remote employee does not warrant a direct assertion that a permanent establishment exists. Company profits, shareholder dividends and individual salaries are handled separately The Individual Income Tax Law determines resident individuals by rules including domicile and length of residence; in principle, the domestic and foreign-source income of a resident individual enters the corresponding tax regime, while specific incentives, tax treaties and foreign tax credits must still be separately verified. A company earning service fees, distributing dividends to shareholders and paying salaries to employees are distinct tax events and cannot be assessed uniformly on the basis that "the money stays in the company" or "it has not been converted into RMB." Nor should Chinese nationality be equated directly with a conclusion of tax residency for any given year. Establish auditable source records for stablecoin income first Client contracts, fee rules, transaction times, currency types and amounts, wallet ownership, exchange records and foreign tax payment certificates should be retained, and only then should the nature of the income, the recognition point and an appropriate valuation method be determined. This question does not provide a uniform valuation rule applicable to all token income. If the business touches upon mainland prohibitions, filing and paying tax will not render it lawful; the business boundaries must be addressed at the same time, rather than treating tax payment as proof of compliance. Recommended actions Compile evidence of where effective management decisions, personnel, books and records, and funds are controlled. Separate company income, shareholder returns and individual remuneration into three tax checklists. Retain stablecoin receipt, payment and exchange materials transaction by transaction, and verify the certificates required for foreign tax credits. Information note: This article provides general information only and does not replace legal advice based on specific facts. References Enterprise Income Tax Law of the People's Republic of China — Standing Committee of the National People's Congress / State Taxation Administration Implementation Regulations of the Enterprise Income Tax Law of the People's Republic of China (Second Amendment in 2024) — State Council / State Taxation Administration Individual Income Tax Law of the People's Republic of China — Standing Committee of the National People's Congress / State Taxation Administration Related Q&A 17. If a shareholder or founder is Chinese, will this affect an overseas license application? 38. Can we serve overseas enterprises and individuals with a Chinese background? 39. If employees of an overseas crypto payment company work in mainland China, are there legal risks? 43. Can an overseas crypto payment company pay its mainland China employees' salaries in USDT? ← Previous question 44 All crypto payment Q&A Next question 46 →

Question 46

If upstream exchange and payment institutions are licensed, do we still need to hold a license ourselves?

Accepted Answer

First, ask the client to whom it is actually purchasing services. The starting point for the assessment is the client contract and actual operations. Suppose a merchant contracts directly with a licensed institution, delivers assets to it, and that institution confirms the exchange rate and receipt of funds, while the company only provides order software. This is clearly different from the company quoting prices itself, collecting stablecoins, and then finding an upstream party to pay out fiat currency. In the latter arrangement, the upstream party may merely be your supplier; the client's claims against you do not disappear simply because a licensed party stands behind you. Not touching funds is not the only criterion either. Taking the UK payment regime as an example, the exclusion for technical services is subject to specific conditions, and payment initiation and account information services are not automatically excluded merely because no funds are held. Accordingly, where a company receives client instructions, determines the execution of payments, or arranges specific services, it must examine its actual activities rather than merely checking whether funds pass through its own bank account. This example illustrates only the method of assessment; the UK exclusion rules cannot be applied directly to other jurisdictions or to all crypto asset services. Acting as an agent is permitted, but the conditions for agency must also be met. UK FCA guidance makes clear that an agent of a payment institution must be registered by the principal institution and may provide only the payment services of the principal institution; it may not hold itself out as independently providing services in its own capacity. The EU's MiCA, in turn, requires entities providing crypto asset services to meet the corresponding admission requirements, and the related payment services carry separate qualification requirements. Therefore, "the upstream party holds a licence + we are partners" is not a licence-free formula that can be used across jurisdictions. Align the contractual allocation of responsibilities with system permissions. It is advisable to assign a responsible party, one by one, across the seven stages of account opening, client due diligence, quotation, collection and payment, refunds, complaints, and data retention, and to specify who has the final decision-making authority. Then check whether the product pages, customer service scripts, API permissions, and client statements are consistent. If the contract says the upstream party is responsible for payment, but the platform first promises receipt of funds and the upstream party has the right to reject orders at any time, there is a responsibility gap that should be closed before launch, rather than leaving clients to pursue the upstream party after the fact. Recommended actions Collect the original text of the upstream licence and its restrictive conditions, and verify that the name of the cooperating legal entity matches the contracting entity. Prepare a responsibility and authority matrix covering the seven service stages, and check it against the actual front-end experience. Obtain advice on your own role in the target market; where agent registration is required, complete registration before providing the relevant services. Information note: This article provides general information and does not replace legal advice based on specific facts. References The Payment Services Regulations 2017，Schedule 1 — HM Treasury / legislation.gov.uk FCA Handbook PERG 15.4：Small payment institutions, agents and exempt bodies — UK Financial Conduct Authority (FCA) Article 59 of MiCA: Authorisation — European Parliament, Council of the EU / ESMA official rulebook Article 70 of MiCA: Safekeeping of clients’ crypto-assets and funds — European Parliament, Council of the EU / ESMA official rulebook Related Q&A 1. What licences are required to operate a crypto payment business? 3. Is a licence required where only payment technology interfaces are provided and client funds are not handled? 47. Is a licence required to operate under one’s own brand using a licensed institution’s white-label solution? 49. Can we use a bank's license to provide crypto payment services in cooperation with a bank? ← Previous question 45 All crypto payment Q&A Next question 47 →

Question 47

If I use a licensed institution's white-label solution and operate under my own brand, do I need a license?

Accepted Answer

First, separate the three layers of brand, contract and funds A white-label arrangement may be merely rebranded software, or it may include accounts, exchange, custody of funds and payment capabilities. In an assessment, it is not enough to look only at the supplier's demonstration page; the brand owner, the counterparty to the service contract, and the person controlling the bank or wallet account should each be confirmed separately. A scenario where the page uses your brand but the customer contract is signed by an upstream licensed institution and funds are paid directly to the upstream institution is a different structure from one where the customer contracts only with you and the upstream institution bears no obligations to customers at all. Whether customers can understand it matters more than a single line in the footer The actual service provider, its regulated status and the complaints channel should be clearly displayed before account opening, confirmation of a quote and payment. If the main page claims "we provide licensed accounts" while deep in the agreement it states "we only provide software", this can easily cause confusion about roles. The EU's MiCA prohibits entities without the relevant qualifications from using names or advertising that could easily lead people to mistake them for crypto-asset service providers; this also shows that brand presentation cannot be designed independently of the legal role. The UK payment agent model is not a global white-label passport Under FCA guidance, payment institution agents must meet registration requirements, and the principal institution must also effectively supervise them and bear corresponding responsibility for the agent's conduct. This cannot be established merely by writing "agent" into a contract between the parties, nor can payment agency be automatically extended to all crypto-asset activities. If the white-label provider separately controls customer stablecoins, arranges exchange or provides its own balance services, it is necessary to examine further whether that part exceeds the scope of lawful cooperation. Set out exit and customer migration clearly before signing What is most easily overlooked in white-label products is who handles customers after service suspension. It is advisable to agree on termination notice, transactions in progress, return of funds, complaint handling, export of customer data and the necessary account reopening procedures. Customer assets cannot be transferred away by the platform at will simply because the supplier changes, nor can data necessarily be transferred across institutions merely because the contract says "transferable". Conducting a service-suspension drill before launch is more likely to reveal gaps in responsibility than merely comparing interface prices. Recommended actions Cross-check consistently the service entity shown on the account-opening page, the user agreement, the quote confirmation and the bill. Verify the agency or distribution arrangements and registration status, and do not treat a supplier's licence number as your own licence number. Clearly set out in the contract the responsibility for funds, orders in progress and customer data handling after service suspension. Information note: This article provides general information only and does not replace legal advice based on specific facts. References Payment institution applicants：Registering agents and responsibilities — UK Financial Conduct Authority (FCA) MiCA Article 59: Authorisation — European Parliament, Council of the EU / ESMA official rulebook MiCA Article 73: Outsourcing — European Parliament, Council of the EU / ESMA official rulebook Related Q&A 20. Can multiple products and subsidiaries of a group share a single licence? 46. If the upstream exchange and payment institutions are both licensed, do we still need to be licensed ourselves? 68. When a wallet integrates third-party deposit and withdrawal services, who is responsible for compliance? 88. If an upstream channel suspends services or freezes funds, may we suspend settlement to customers? ← Previous question 46 All crypto payment Q&A Next question 48 →

Question 48

Does merely introducing clients to a licensed payment institution and receiving commissions require a license?

Accepted Answer

Make clear where “introduction” ends An ordinary introduction usually involves passing prospective client information to a service provider, which then decides on its own whether to onboard, contract and execute transactions. If the introducer goes on to recommend specific currencies, negotiate exchange rates, receive payment instructions, collect client assets or promise that funds will arrive, the role cannot be assessed merely as that of handing over a business card. Commission based on registrations, trading volume or revenue share may be a risk indicator, but no single billing method can by itself determine whether a licence is required. A service provider's compliance does not mean the introduction is compliant Suppose an offshore institution is licensed locally to exchange stablecoins, while a domestic channel advertises to mainland merchants that they can “exchange directly into RMB.” An upstream licence cannot resolve the mainland risks of the channel itself. The 2026 notice expressly addresses liability for related marketing and traffic referral and for assisting the provision of services to the mainland unlawfully. A channel cannot automatically exclude its participation in client acquisition merely by sending account-opening links in private chats and having clients submit applications themselves. Overseas promotion must also check client-market rules The UK FCA has made clear that financial promotions of relevant crypto assets directed at UK consumers must comply with local rules regardless of whether the promoter is located overseas. Websites, social media and app content may all be subject to scrutiny; merely introducing products operated by others does not mean the content is unrestricted. This example concerns relevant crypto asset promotions in the UK. It does not mean the same rule applies to all business-to-business introductions; rather, it is a reminder to check business licences and marketing licences separately. Cooperation agreements should be able to prevent channels from overstepping It is advisable to agree on the promotional materials that may be used, prohibitions on making promises, the method of passing on leads, personal information handling and the referral of complaints, and to make clear that channels may not collect funds on their behalf, sign service agreements on their behalf or modify quotations without authorization. Service providers should retain mechanisms for spot checks and for terminating non-compliant channels, and introducers should also keep approved materials and versions. If the business in practice requires channels to handle transactions in depth, the question of agency or of holding a licence in their own right should be reassessed, rather than merely changing the title of the contract. Recommended actions Map the channel's involvement from client acquisition to payment, and indicate whether it receives transaction instructions. Review separately the solicitation and business rules of the introducer's location and the client's location. Use reviewed promotional materials and maintain records of commissions, complaints and channel spot checks. Information note: This article provides general information only and does not replace legal advice based on specific facts. References Notice on Further Preventing and Addressing Risks Associated with Virtual Currency and Related Matters (Yin Fa [2026] No. 42) — People's Bank of China and seven other departments Cryptoasset firms marketing to UK consumers — UK Financial Conduct Authority (FCA) Related Q&A 3. If we only provide payment technology interfaces and do not handle client funds, do we need a license? 40. Can an overseas crypto payment company advertise and solicit business in mainland China? 46. If both the upstream exchange and the payment institution hold licenses, do we still need a license ourselves? 72. If we only operate a U-card brand and handle customer acquisition, and are not responsible for card issuance, do we still need a license? ← Previous question 47 All crypto payment Q&A Next question 49 →

Question 49

Can a Bank Partnership Allow Us to Use the Bank's License to Conduct Crypto Payment Business?

Accepted Answer

First, ask exactly which part of the service the bank actually provides "Bank cooperation" may mean nothing more than a corporate operating account; it may also mean custody of client funds, payment accounts, agency collection and payment, or other products. Suppose the stablecoin is controlled and exchanged by the platform, and the bank pays out US dollars only on the platform's instructions; in that case the bank participates in fiat currency transfers, but that does not mean the bank becomes the operator of the stablecoin exchange, nor does it automatically guarantee all of the platform's obligations to its clients. Each segment of the actual service should be set out in writing, to avoid substituting a bank logo for legal analysis. An account-opening relationship and an agency relationship are not the same thing Taking the United Kingdom as an example, the FCA's PERG guidance distinguishes between payment institution agents and payment agents of credit institutions such as banks, and the latter are treated differently for agent registration under the payment services regulations. However, this specific regime still presupposes a genuine agency status; it does not mean that any bank client can independently carry on business in its capacity as a bank. Whether crypto asset services are separately regulated, and whether the place where the agent is located recognizes the arrangement, must also be checked further; this cannot be inferred directly from fiat currency agency. Who bears client losses must be answerable The cooperation agreement should specify when funds are handed over to the bank, to whom the bank owes the payment obligation, how notice is given when an instruction is refused or delayed, and how the platform refunds clients. If the bank provides only an account to the platform, while the client contract is signed by the platform, clients may need to assert their rights against the platform first. The platform's commitments to the outside world must not exceed the services the bank has agreed to in writing; otherwise the upstream party may be entitled to refuse payment while the downstream obligation has already fallen due, and the funding gap will still fall on the platform. Mainland banks are also subject to clear restrictions Yin Fa [2026] No. 42 prohibits financial institutions from providing account, transfer and clearing and settlement services related to virtual currency business. Therefore, the bank cooperation model used in overseas markets cannot be applied directly in the mainland, nor can ordinary trade accounts be used to handle coin-related settlements. In practice, confirmation should be obtained from the bank as to the real business, client types and account use; however, a bank's willingness to provide services cannot replace an independent legal assessment of market access. Recommended actions Require the bank to specify whether it provides an operating account, client fund services or agency payment services, and retain the contractual basis. Confirm, segment by segment, the service provider and licence for coin receipt, exchange, fiat currency custody and payment. Check the bank's suspension of payment, refusal of instructions and client refund responsibilities against the commitments made to clients, item by item. Information note: This article provides general information and does not replace legal advice based on specific facts. References FCA Handbook PERG 15.4：Small payment institutions, agents and exempt bodies — UK Financial Conduct Authority (FCA) Notice on Further Preventing and Handling Risks Associated with Virtual Currency and Related Matters (Yin Fa [2026] No. 42) — People's Bank of China and seven other departments Related Q&A 2. We already hold a traditional payment license. Do we need a new license to add stablecoin collection and payment services? 46. Both the upstream exchange and payment institutions hold licenses. Do we still need to be licensed ourselves? 50. How should a crypto payment company choose a bank for account opening? 86. If customer funds are held at a bank or custodian, does the platform still bear liability? ← Previous question 48 All crypto payment Q&A Next question 50 →

Question 50

How Should Crypto Payment Companies Choose a Bank for Account Opening?

Accepted Answer

Write the requirements document first; do not start by looking for a bank that is 'easy to open an account with' Before opening an account, you should at least explain the company's incorporation and licensing, which customers it serves, what role stablecoins play in the process, and where fiat currency comes from and to whom it is paid. Describe the company's own funds separately from customer-related funds, and list the expected currencies, transaction volumes and main payment countries. A bank's acceptance of ordinary software companies does not mean it is willing to take on equivalent transactions for payment platforms or crypto businesses. 'Supporting an industry' does not mean agreeing to your every pathway The 2023 HKMA circular requires banks to adopt a risk-based approach and encourages them to support the reasonable account-opening needs of licensed virtual asset service providers regulated by the Hong Kong Securities and Futures Commission; this is not a guarantee of account opening for any company, nor an approval of all transaction channels. You must still explain product and customer risks to the specific bank, and cannot substitute regulatory encouragement or peers' successful account opening for your own due diligence. Test product fit with real fund flows Assume the bank allows the company to collect service fees paid by overseas institutions, but does not allow it to collect large amounts of funds from unidentified merchants. Even if this account has already been opened, it is not suitable for directly launching merchant collection. It is advisable to submit the payer, account name, ultimate beneficial owner, refund path and intermediary institutions to the bank one by one for confirmation, and to verify whether third-party payments are accepted, whether the required clearing networks are supported, and whether further manual review may occur after funds arrive. Beyond fees, compare how matters can be handled after an interruption As a commercial due diligence recommendation, you should also compare transaction inquiries, returned remittances, reconciliation files, emergency contacts, return of funds after account closure and available backup arrangements. If customer funds need to be safeguarded, you should ascertain whether the bank provides the corresponding accounts and confirmation documents, rather than merely saying that 'funds are very safe in the bank'. Backup accounts must also disclose the same genuine business, and must not be used to continue operations under a concealed purpose after the main account is restricted. Recommended actions Prepare a business description, licences, beneficial owners, anti-money laundering framework and sample fund flows. Confirm separately the applicable account conditions for own funds, fees and customer funds. Include currencies/countries/customer types/refund and service-discontinuation arrangements in the bank comparison checklist. Information note: This article provides general information and does not replace legal advice based on specific facts. References Access to banking services for corporate customers (circular dated 27 April 2023) — Hong Kong Monetary Authority Safeguarding requirements for payment institutions and electronic money institutions — UK Financial Conduct Authority (FCA) Related Q&A 51. Having already obtained a licence, why does the bank still refuse to open an account? 52. Can an ordinary corporate bank account be used to receive and settle client funds? 54. When choosing a crypto payment channel, which legal risks require the most attention? 55. When operating in multiple countries, can a single set of banking and settlement channels be shared? ← Previous question 49 All crypto payment Q&A Next question 51 →

Question 51

Why Do Banks Still Refuse to Open Accounts Even After a License Has Been Obtained?

Accepted Answer

Regulatory admission and bank account purpose are two separate determinations A licence demonstrates that a specific entity is permitted to carry out specific activities, whereas a bank must assess entering into a specific account relationship with that company. The UK FCA's guidance on risk management states that banks need to assess risk on a customer-by-customer basis and cannot simply treat an entire industry as unacceptable; at the same time, relationships whose risks cannot be effectively managed should not be established or maintained. It follows that independent bank review and the avoidance of indiscriminate exclusion can coexist. A common problem is that the materials tell different stories Suppose the licence materials describe corporate remittance, the account opening form states software subscription revenue, yet the fund flow diagram shows the platform exchanging stablecoins on behalf of merchants; the bank then cannot determine what account is actually being requested. In other cases, the entity holds a licence, but the scope of permission, target countries or customer industries do not match the intended use in the application. Contracts, websites, financial forecasts and application forms should be checked for consistency, rather than repeatedly deleting words such as "crypto" to reduce visibility. First confirm what can be supplemented; do not ask the bank to commit to an outcome You may ask the bank to clarify whether materials are still missing, whether there is a suitable product or industry team, and whether there is an internal review channel. A bank may not be able to disclose all of its risk judgments or review details, and an applicant cannot infer specific problems from a single reference to "compliance reasons". HKMA circulars encourage banks to improve account opening processes for specialised industries and fair access to basic services; enterprises may raise specific process questions on that basis, but the circulars cannot be interpreted as mandating approval of account opening. Supplementary materials should focus on verifiable risk controls Useful supplements include the industry and country distribution of customers, samples of source-of-funds verification, on-chain risk handling procedures, segregation of customer funds, and escalation mechanisms for unusual transactions. If the bank expressly does not support this type of account, continuing to repackage the same application may not be effective, and an institution that accepts the genuine model should be sought. Where trading has already begun, it is also necessary to assess whether customer obligations can be performed while the account is unavailable, and reliance on employees' or shareholders' personal accounts for temporary receipt of funds is not permissible. Recommended actions Organise the rejection or supplementary-material communications, distinguishing supplementable facts, product limitations and risk decisions. Align the business description across the licence, website, user contracts and account opening forms. Submit verifiable control samples; if no match can be found, seek an appropriate bank without concealing the business. Information note: This article provides general information and does not replace legal advice based on specific facts. References De-risking: managing money-laundering risk — UK Financial Conduct Authority (FCA) Access to banking services for corporate customers (circular dated 27 April 2023) — Hong Kong Monetary Authority Related Q&A 50. How should crypto payment companies choose a bank for account opening? 76. What are the most basic anti-money laundering obligations of crypto payment companies? 82. If most customers come from high-risk regions, can we still apply for a licence and open a bank account? 88. If an upstream channel suspends services or freezes funds, may we suspend settlement to customers? ← Previous question 50 All crypto payment Q&A Next question 52 →

Question 52

Can an ordinary corporate bank account be used to receive and settle client funds?

Accepted Answer

Funds held in the company's name do not necessarily constitute company revenue. Suppose a platform collects payments on behalf of one hundred merchants, deducts fees and then pays out. The amounts owed to merchants generally cannot all be classified as freely usable operating revenue merely because they first entered the platform's account. The ownership of funds and payment obligations should be determined under the contracts and applicable law. By contrast, software service fees already earned and collected by the company may constitute its own funds, but the bank should still know the true business source, and this distinction cannot be used to conceal collection and payment on behalf of others. Different regimes provide for different forms of safeguarding funds The current FCA guidance in the United Kingdom requires payment and e-money institutions within scope to safeguard relevant client funds, which may be achieved through statutory segregation or qualifying insurance, guarantees and similar arrangements, together with record-keeping and reconciliation requirements. It therefore cannot be said broadly that the whole world must use the same type of trust account, nor can opening another ordinary account be regarded as completing safeguarding. The institution holding the funds, account confirmation and the legal effects in insolvency should all be verified under the applicable regime. Mainland payment reserve funds cannot be converted to crypto settlement China's Regulations on the Supervision and Administration of Non-bank Payment Institutions require reserve funds to be deposited in accordance with the rules and prohibit misappropriation, occupation, borrowing or use as security; a 2026 notice further restricts supporting settlement involving virtual currencies. Reserve fund arrangements under a mainland payment licence are not a lawful channel for receiving and paying RMB for stablecoin business. Naming an account a "client segregated account" cannot alter the prohibitive boundary. Use reconciliation and stress testing to detect commingling It is advisable to reconcile client ledgers, bank balances and funds in transit daily or at the applicable statutory frequency, and to record separately earned fees, refunds, security deposits and amounts pending settlement. Then test the following assumption: if the bank freezes the platform's own funds, can client funds be clearly identified and returned in accordance with law? If this can only be explained by the platform's internal Excel, without account and contractual safeguards, the risk remains. Before launch, withdrawal authority, bank set-off clauses and mechanisms to cover funding shortfalls should all be reviewed together. Recommended actions Define and segregate, by category, own revenue, client funds pending payment, refunds and security deposits. Obtain the bank's confirmation of the account's purpose and the necessary fund safeguarding arrangements. Establish internal and external reconciliation and discrepancy escalation procedures, with dedicated review of the effects of freezing, set-off and insolvency. Information note: This article provides general information and does not replace legal advice based on specific facts. References Safeguarding requirements for payment institutions and electronic money institutions — UK Financial Conduct Authority (FCA) Regulations on the Supervision and Administration of Non-Bank Payment Institutions — State Council / State Administration for Market Regulation Notice on Further Preventing and Handling Risks Associated with Virtual Currency and Related Matters (Yin Fa [2026] No. 42) — People's Bank of China and seven other departments Related Q&A 50. How should crypto payment companies choose a bank for account opening? 53. Can we provide clients with virtual accounts or virtual IBANs for receiving payments? 86. If client funds are held at a bank or custodian, does the platform still bear liability? 92. If a payment company becomes insolvent, will client funds be used to repay the company's debts? ← Previous question 51 All crypto payment Q&A Next question 53 →

Question 53

Can We Provide Virtual Accounts or Virtual IBANs to Clients for Receiving Payments?

Accepted Answer

First, ask who owns the account behind the number A typical virtual IBAN can allocate incoming payments from different sources to the same master account, making it easier to identify orders and customers. Suppose a customer receives a dedicated number, but the account name of the bank master account is the platform; the customer may only have a corresponding claim to the balance against the platform or the payment institution, rather than directly becoming a bank depositor. It is necessary to review the account-opening contract, the funds ledger and the provider's responsibilities; characterization cannot be based solely on the number format or on the ability to receive payments. Not all virtual IBANs are merely technical labels In their official 2026 report, the French ACPR and Tracfin stated that some virtual IBAN arrangements correspond to payment accounts separate from the master account; for virtual IBANs bearing the French country code, the report proposes that they be analyzed as payment accounts held in France. This is the specific position of the French authorities on the relevant arrangements and cannot be generalized to the rules of all countries, yet it is sufficient to serve as a reminder: a cross-border number does not inherently exempt one from local account regulation. The number, the balance and the payment function must be verified separately If a product only performs order reconciliation, the legal issues may differ from a situation where customers can retain balances over the long term, pay any third party at will, and transfer funds to other users. It should be confirmed who provides the payment service, who carries out customer identification, who controls withdrawals, and which regime applies to the protection of customer funds. The functions of an ordinary fiat currency account cannot automatically be extended to stablecoin exchange permissions, and bank deposit protection and the protection of funds at payment institutions must not be conflated. Test receipt, refund and account closure before launch It is advisable to use hypothetical transactions to verify whether the payee name entered by the payer, the country displayed and the actual destination of the funds are consistent, and to test duplicate payments, unknown incoming payments, and credits and refunds after a customer closes an account. Contracts and web pages should explain the actual service provider and the flow of funds; where automatic cross-border transfers are involved, particular attention should be paid to whether customers or payers are misled into believing that the funds remain local. Necessary data must be traceable to the actual payer and the ultimate beneficiary. Recommended actions Obtain a map of the contractual relationships among the master account, the virtual numbers and the end users. Verify, one by one, the country code, the actual location of the account, the customer-facing balance and the legal nature of the payment function. Verify the account-name display, refund and post-closure crediting processes, and correct inaccurate marketing such as "bank account". Information note: This article provides general information and does not replace legal advice based on specific facts. References ACPR and Tracfin: Overview and Analysis of Virtual IBAN Services Offered in France (2026) — French Prudential Supervision and Resolution Authority (ACPR), Tracfin Safeguarding requirements for payment institutions and electronic money institutions — UK Financial Conduct Authority (FCA) Related Q&A 25. Does operating a payment wallet with balances in Hong Kong require an SVF licence? 50. How should crypto payment companies choose a bank for account opening? 52. Can an ordinary corporate bank account be used to receive and settle client funds? 86. If client funds are held at a bank or custodian, does the platform still bear liability? ← Previous question 52 All crypto payment Q&A Next question 54 →

Question 54

What Legal Risks Warrant the Most Attention When Selecting a Crypto Payment Channel?

Accepted Answer

Break the brand down into the legal entities actually involved Behind a single channel brand there may be an exchange company, a custodian, a payment institution and several banks. The counterparty should be required to identify, for each step, the contracting entity, the entity actually performing the obligations and the person controlling the assets, and to explain whether subcontractors are used. If the contract is signed by Company A, stablecoins are transferred to Wallet B, and fiat currency is paid by an unrelated Company C, the relationships among the three, their legal basis and their respective responsibilities should be verified, rather than merely checking the licence displayed by Company A. Licences must correspond item by item to activities, customers and jurisdictions The EU MiCA regime distinguishes between crypto-asset service authorisation and the qualifications required for related payment services; holding a crypto-asset licence does not mean that all fiat currency payments can be completed unconditionally. UK payment agents must likewise act within the corresponding agency relationship and scope. Actual due diligence should therefore check official registers, licence restrictions and the uses accepted by banks, and in particular verify who is authorised to accept customer assets, effect exchanges, hold assets in custody and make payments, rather than merely asking whether a licence exists. Four documents are more useful than a one-line promise that funds will arrive It is advisable to review at least the service contract, the fund-flow chart, the fund-protection statement and the exception-handling procedures. The contract should specify when quotations take effect, fee deductions, completion of payment, the currency of refunds, reserves or security deposits, and dispute resolution; the fund-protection statement should explain whether customer assets are segregated from the channel operator's own operating property and who has withdrawal rights. These are due-diligence recommendations; the specific statutory obligations remain governed by the applicable market, and safety cannot be presumed merely because the counterparty describes an account as a "segregated account". Service-suspension scenarios should be rehearsed before signing One may assume that stablecoins are frozen by the issuer, that a bank returns a remittance, or that the channel loses its authorisation, and should then ask, item by item, how orders that have not yet been exchanged, orders already exchanged and orders for which payment has already been sent would each be handled. The EU MiCA regime emphasises, in relation to outsourcing, that a licensed service provider cannot thereby transfer its own responsibility; even if that rule does not apply directly to you, you should check whether the upstream disclaimers are unbalanced against the commitments you have made to your customers. Any replacement channel must complete legality and data review in advance; customer funds must not be taken over through unfamiliar accounts on an ad hoc basis. Recommended actions Establish a checklist mapping "legal entity—activity—licence—account/wallet", and verify it against official registers. Review the four documents: the service contract, the fund flow, the fund protection arrangements and the exception-handling procedures. Rehearse three scenarios—freezing, returned remittances and licence revocation—and clarify responsibility for tracing funds in transit and for returning them. Information note: This article provides general information and does not replace legal advice based on specific facts. References FCA Handbook PERG 15.4：Small payment institutions, agents and exempt bodies — UK Financial Conduct Authority (FCA) Safeguarding requirements for payment institutions and electronic money institutions — UK Financial Conduct Authority (FCA) MiCA Article 59: Authorisation — European Parliament, Council of the EU / ESMA official rulebook MiCA Article 70: Safekeeping of clients’ crypto-assets and funds — European Parliament, Council of the EU / ESMA official rulebook MiCA Article 73: Outsourcing — European Parliament, Council of the EU / ESMA official rulebook Related Q&A 46. If the upstream exchange and payment institutions are both licensed, do we still need to obtain a licence ourselves? 50. How should a crypto payment company choose a bank for account opening? 55. Can a single set of banking and settlement channels be shared across multiple countries? 88. If an upstream channel suspends services or freezes funds, may we suspend settlement to customers? ← Previous question 53 All crypto payment Q&A Next question 55 →

Question 55

Can a single set of banking and settlement channels be shared across multiple countries?

Accepted Answer

Currency, clearing coverage and client onboarding are three separate dimensions The fact that a channel can send US dollars does not mean it may solicit clients in any region or accept US dollar payments from all industries. Suppose the original channel only served corporate trade payments in one region, and the product adds personal wallet withdrawals in another country; although the currency has not changed, the clients, product and risk have. The local service rules and bank conditions need to be re-verified, rather than merely testing whether the API can submit an order. Regional passporting mechanisms also have scope and procedures Taking the EU as an example, providing crypto-asset services across member states under MiCA is subject to a clear notification mechanism, and the official Q&A of the Central Bank of Ireland requires submission of information such as the intended host member states, the types of services and the start date. This does not equate to a global operating licence, nor does it replace the qualifications required for fiat payment. For payment collection and disbursement markets outside the EU, local rules still need to be verified; EU market-access conclusions cannot be applied directly merely because funds pass through a European account. Build a coverage matrix rather than piling up a list of countries It is recommended that each row correspond to "client location + client type + product + payment/collection currency + final destination of funds", with the contracting entity, licensing basis, bank/channel permission, safeguarding of funds and refund method filled in separately. A technical back office showing that a country is supported only indicates that routing may be possible; it does not prove that the combination has been approved for launch. Bank contracts should also verify the actual end clients, not merely the place of incorporation of the company that directly opens the account. Shared channels also create concentration risk If all markets rely on the same bank or exchanger, suspension of an account may affect multiple product lines at the same time. A single technical monitoring and reconciliation framework may be shared, but the ownership and safeguarding of client funds in different markets should be identified, and all balances should not be commingled. Adding a backup is not a way to circumvent the restrictions of the original channel; rather, the same review must be completed for another lawful route. Before switching, client notification, transfer of information, in-flight orders and duplicate payments must also be addressed. Recommended actions Build a coverage matrix broken down by client, product, currency and destination of funds, stating the evidence and the date of approval. Obtain the necessary legal assessment and written confirmation of scope from the bank/channel before entering a new market. Conduct service-suspension drills for shared dependency points, and verify backup market access, ownership of funds and reconciliation of in-flight transactions. Information note: This article provides general information and does not replace legal advice based on specific facts. References MiCAR — frequently asked questions — Central Bank of Ireland De-risking: managing money-laundering risk — UK Financial Conduct Authority (FCA) MiCA Article 70: Safekeeping of clients’ crypto-assets and funds — European Parliament, Council of the European Union / ESMA official rulebook Related Q&A 12. For global crypto payments, is it necessary to apply for a license in every country? 27. To enter the EU and provide crypto payment services now, is a MiCA license required? 54. When selecting a crypto payment channel, which legal risks require the most attention? 98. When adding a new country, new product or new currency, is a new license application required? ← Previous question 54 All Crypto Payment Q&A Next question 56 →

Question 56

Merchants in Which Industries May Crypto Payment Institutions Provide Services To?

Accepted Answer

Industry name is only the first layer of screening Names such as software, e-commerce and consulting can help locate customers, but they cannot complete a compliance assessment. A software seller may sell ordinary office tools, or may in fact provide investment trading or gambling services; a cross-border trader may deal in entirely different goods, destinations and counterparties. Institutions should understand the specific sales content, customer base, performance methods and refund mechanisms before deciding whether they have the capacity to identify the risks. In its customer due diligence guidance, AUSTRAC of Australia emphasizes that verification is not merely collecting identity documents; it also requires understanding the customer and the business relationship and continuously updating information. What is cited here is an explanation of Australian regulatory requirements; other markets need to check their locally applicable rules, and this guidance cannot be treated directly as global law. A merchant being lawful in its place of incorporation does not mean it is lawful in every market Assume an offshore online gambling merchant holds a licence in its place of incorporation and wishes to accept UK customers through a stablecoin collection service. The UK Gambling Commission makes clear that providing remote gambling services to consumers in Great Britain requires its licence, even if the operator is established offshore. This example shows that payment teams cannot look only at where a merchant is incorporated, but must also look at whom it provides services to; nor can they ignore the underlying industry restrictions simply because the payment currency changes. Permitted by law, permitted by licence, and acceptable to the channel are three different gates A bank or settlement partner may refuse a lawful industry based on its own risk appetite, which is not the same thing as a legal prohibition. Conversely, a channel being willing to take on business is not proof that the operation is lawful. The true industry, customer base and transaction path should be explained to the counterparty, and written approval should be tied to the specific contracting entity and product, rather than relying on a salesperson saying orally that "we have handled similar customers". In practice, three lists can be established: permitted, enhanced review and refused, but the reasons for classification should be specific. An industry requiring additional materials, transaction limits or manual review does not mean it must be permanently excluded; where the purpose of funds cannot be explained, performance cannot be verified, or disclosure of the true business is refused, those gaps should be addressed first. Treat a new industry as a product change Before the client acquisition team introduces a new industry, it is recommended that the business, compliance, risk management and channel heads jointly confirm whether to onboard it, and record the required capabilities and limitations. After launch, observe deviations against the expected average transaction value, customer source regions and refund rate. The above classification and approval are management methods that may be adopted; they are not a standard format uniformly prescribed by any jurisdiction. The key point is that the institution can explain why it accepts the merchant and how it will handle anomalies when they arise. Recommended actions Obtain the merchant's actual website, product catalogue, main sales locations and samples of performance evidence. For specially regulated industries, verify the licensed entity, its valid status and the regions in which it may provide services. Apply to banks and payment channels for written admission confirmation consistent with the actual business. Establish re-review trigger points for new industries and merchant transformations. Information note: This article provides general information and does not replace legal advice based on specific facts. References Know your customer: getting customer due diligence right — AUSTRAC, Australia Remote sector guidance — UK Gambling Commission Related Q&A 57. When providing crypto collection services to merchants, is it necessary to understand what the merchants actually sell? 58. How does providing deposit and withdrawal services to exchanges and wallets differ from ordinary merchant collection? 54. When selecting a crypto payment channel, which legal risks require the most attention? 90. If a merchant is suspected of fraud, will the company providing payment services to it be held liable? ← Previous question 55 All crypto payment Q&A Next question 57 →

Question 57

When Providing Crypto Payment Collection Services to Merchants, Is It Necessary to Understand What the Merchant Actually Sells?

Accepted Answer

Identity verification is not the same as transaction background verification A business license can prove that an entity exists, but "who this company is" and "why it received this payment" are two separate questions. For merchant crypto asset collection, it should at a minimum be possible to understand the merchant's main business, the recipients of its payments, and the purpose of settlement. Otherwise, proceeds from ordinary sales, payments collected on behalf of others, and funds generated through fictitious orders will appear in the system as the same on-chain transfer. AUSTRAC's customer due diligence guidance makes clear that due diligence should understand customer risk and the purpose of the business relationship, and should be updated when circumstances change. FATF's virtual asset risk indicators also list amounts lacking a reasonable business explanation, frequency, and abnormal customer behavior as factors of concern. FATF documents are international references for risk identification; specific obligations and reporting procedures still depend on local law. Information should be collected around how the merchant earns money For ordinary physical-goods e-commerce, websites, product categories, price ranges, logistics, and after-sales samples can be checked; for subscription software, subscription terms, user sources, and service delivery records are more suitable. For professional services, service contracts and milestone deliverables can be reviewed. There is no need to request exactly the same large package of documents from every type of merchant, but it should be possible to match revenue sources, collection scale, and operating capacity. Assume a company declares that it sells low-priced software, then consecutively receives multiple payments far above its ordinary per-order price and requests settlement to an unrelated third party. The reasonable action is not merely to check whether an address has been flagged red by a risk tool, but to inquire about the transaction content, the payment relationship, and the reason for third-party collection, and then decide whether to continue processing based on the responses and evidence. This scenario is hypothetical and does not mean that a high amount is itself unlawful. On-chain traceability may still lack off-chain facts A transaction hash can help locate asset transfers, but it cannot independently prove that goods have been delivered, that the buyer agreed to pay, or that the merchant holds the necessary qualifications. Conversely, a formally complete invoice cannot automatically rule out problems. A more reliable approach is to cross-check on-chain records against orders, contracts, user behavior, and settlement accounts, and to retain records of how inconsistencies were handled. Ongoing verification should have trigger conditions It is advisable to establish a basic transaction profile at onboarding and to use newly added high-risk regions, changes in business type, concentrated complaints, or sudden changes in collection patterns as signals for review. Upon identifying anomalies, supplementary due diligence, restrictions on new transactions, or escalation for approval may be adopted in accordance with applicable law and contract; whether to report, freeze, or notify the customer must be determined separately, and all anomalies must not be treated uniformly as crimes, nor should the sales team be allowed to release them on its own. Recommended actions Set industry-specific lists of business information that are streamlined yet explanatory. Record the expected amount, frequency, payer type and settlement counterparty. Cross-verify on-chain records against sampled orders and performance evidence. Specify the person responsible for escalation of anomalies, authority to suspend processing and record-keeping requirements. Information note: This article provides general information and does not replace legal advice based on specific facts. References Know your customer: getting customer due diligence right — Australian AUSTRAC Virtual Assets Red Flag Indicators — Financial Action Task Force (FATF) Related Q&A 56. Merchants in which industries may crypto payment institutions provide services to? 76. What are the most basic anti-money laundering obligations of a crypto payment company? 90. If a merchant is suspected of fraud, will the company providing payment services to it be held liable? 91. If a client presents risks, may the platform freeze funds or close the account? ← Previous question 56 All crypto payment Q&A Next question 58 →

Question 58

What distinguishes providing deposit and withdrawal services for exchanges and wallets from ordinary merchant payment collection?

Accepted Answer

First, confirm what the user is actually buying An e-commerce payment generally corresponds to a single product or service; a deposit to an exchange may merely place funds into a tradable balance, with the coin purchase occurring afterward; a withdrawal from a wallet may involve selling crypto assets and paying funds to a bank account. Even if the interface has only one "pay" button, these arrangements differ in transaction object, delivery outcome and refund logic. They should be identified step by step along the flow of funds and assets, and an ordinary e-commerce acquiring contract cannot simply be applied. The licence must match the segment you actually perform For example, the Monetary Authority of Singapore (MAS) expressly brings certain facilitation of token transfer and exchange activities within the regulation of payment services, even where the service provider does not hold funds or tokens. Therefore, if a platform receives exchange instructions, arranges transactions or determines the flow of funds, it cannot conclude that it is merely providing technology solely because its partner exchange holds a licence. This is a specific example of Singapore's rules and does not mean that every country adopts the same definitions. For card deposits, Visa's public rules separately impose coding and page information requirements for non-sovereign-currency transactions, indicating that coin purchases cannot simply be disguised as ordinary retail transactions. The specific codes, acceptable customers and onboarding conditions should be confirmed by the acquirer on a product-by-product basis; card scheme rules, financial licences and bank contracts are constraints at different levels. Reviewing only the exchange does not necessarily reveal all risks Assume a platform receives a consolidated settlement payment from an exchange, but the exchange actually has a large number of individual users behind it. The platform should first clarify whether it is handling the exchange's own funds or collecting and paying on behalf of its users; who reviews end users, who retains payer information, and whether information can be obtained when an investigation or refund request arises. It cannot be asserted arbitrarily that all models must re-identify every user, nor can it be assumed that corporate customers inherently shield underlying risks. In particular, a distinction must be drawn between deposits by the customer personally, payments made by third parties on the customer's behalf, and centralized corporate payments. The three may require different supporting materials and rejection conditions. Mixing them within the same account and the same business description is neither conducive to due diligence nor easy to explain when a bank raises questions. Test both normal and failure flows before launch Deposits not credited, failed coin purchases, failed on-chain transmissions, refunds and account closures should each be run through, to confirm who owes what to the user at each step. It is advisable first to obtain written confirmation from counterparties on the scope of business and markets, and then to verify reconciliation fields and authority to handle exceptions. Successful technical integration only proves that the interface is usable; it does not prove that qualifications, customer relationships or risk allocation have been resolved. Recommended actions Separate the exchange's own funds from end-user funds, and confirm the contracting and identification counterparties. Disclose the purpose of crypto deposits and withdrawals to banks and payment channels and obtain the corresponding approvals. Agree with counterparties on the processes for obtaining underlying information, declining transactions and investigation cooperation. Test reconciliation and failure handling for four categories: deposits, exchanges, withdrawals and refunds. Information note: This article provides general information and does not replace legal advice based on specific facts. References MAS expands the scope of regulated payment services — Monetary Authority of Singapore (MAS) Visa Core Rules and Visa Product and Service Rules, version dated 2026-10-24, Tables 7-9 and 5-15 — Visa Indicators of suspicious activity for virtual asset service providers — Australian Transaction Reports and Analysis Centre (AUSTRAC) Related Q&A 4. Is it lawful to collect stablecoins on behalf of merchants and then settle them into fiat currency? 54. What legal risks should be given the most attention when choosing a crypto payment channel? 62. What conditions must be met to accept customer card payments for the purchase of crypto assets? 79. Can accepting only funds from the customer's own wallet reduce anti-money laundering risk? ← Previous question 57 All crypto payment Q&A Next question 59 →

Question 59

What costs and time can stablecoin cross-border payments typically save?

Accepted Answer

Set the comparison endpoints correctly first Does the client need "stablecoins received in a wallet" or "usable local currency received in the supplier's bank account"? The former can end once the on-chain transfer is complete, while the latter still has to go through selling the coins and the bank or local payment network. Comparing the on-chain stablecoin transfer time with the full settlement time of a traditional bank involves inconsistent starting and ending points, and it is easy to reach misleading promotional conclusions. Research by the Bank for International Settlements on stablecoin cross-border payments notes that on-ramp and off-ramp arrangements are an important part of the overall process. A 2026 small-value remittance field test by the Bank of Italy likewise found that costs and speeds vary widely, mainly due to on-ramp and off-ramp arrangements and local payment infrastructure. That study covered specific corridors and transaction sizes and cannot be directly extrapolated to quotes for large corporate settlements. A single payment should be broken down into at least four categories of cost The first category is explicit fees, including transfer, network and local payout fees; the second is implicit spreads, including fiat currency exchange, coin sales and foreign exchange conversion; the third is the cost of tied-up funds, including pre-funding, margin deposits and weekend reserves; and the fourth is operational risk cost, including reconciliation, manual review, refunds, failed retries and handling of asset anomalies. Not every item will actually arise, but each should be confirmed during assessment rather than assumed to be zero-cost. The same route may also be cost-effective only during certain periods Assume that both the payer and the payee of Enterprise A are willing to hold the same stablecoin, while Enterprise B must have its overseas employees receive funds in local bank accounts. A may save one coin sale and one payout, while B still depends on local bank business hours and processing arrangements. Even if the on-chain transfer fees are the same for both, the final cost and available time cannot be regarded as the same. This example illustrates structural differences; it is not a promise that stablecoins will necessarily save money. For high-frequency corporate payments, attention should also be paid to whether a single failed transaction drags down an entire batch of settlements, and how much funds the channel requires to be pre-deposited. Average speed may look good, but if funds cannot be paid out when funds are tight, the product promise may still not be fulfilled. Use small-scale compliance testing to build your own basis for quotes It is advisable to select specific corridors in which operations have been approved, record the full-process settlement time and net amount received on weekdays, weekends and at different amounts, and compare them with banks or other payment solutions on the same basis. Externally, present "on-chain confirmation," "conversion completed" and "available in bank" separately, and explain exceptional circumstances. Before stable data is available, it is not appropriate to promise global instant arrival, a fixed savings percentage or the complete absence of intermediary costs. Recommended actions Fix the payment starting point, the receiving endpoint and the actual delivery currency before comparing prices. Record the fees at each stage, the executed exchange rate, the net amount received, and the occupation of funds. Test normal transactions and failure and refund scenarios separately, and retain authentic timestamps. Use the measured corridor and applicable conditions to qualify external claims regarding timing and cost savings. Information note: This article provides general information and does not replace legal advice based on specific facts. References Considerations for the use of stablecoin arrangements in cross-border payments — Committee on Payments and Market Infrastructures (CPMI), Bank for International Settlements Are Stablecoins Efficient for Remittances? Evidence from a Mystery Shopping Exercise — Bank of Italy Related Q&A 7. What qualifications are required for an enterprise to use stablecoins to pay overseas suppliers? 54. When selecting a crypto payment channel, which legal risks require the most attention? 64. Can cross-border collection and payment business be conducted entirely on-chain? 87. If a stablecoin depegs or is frozen, must the platform compensate merchants? ← Previous question 58 All crypto payment Q&A Next question 60 →

Question 60

What legal issues arise when making payments to overseas employees and contractors on behalf of an enterprise?

Accepted Answer

First, distinguish three roles: employees, contractors and payment platforms The legal basis differs between an enterprise paying wages to employees and settling contractual fees with independent service providers. The determination should not rest solely on whether the contract describes the person as a "consultant" or whether the payment reference states "service fee"; rather, the work arrangement and the applicable local classification criteria should be verified. A payment platform generally need not make all employment determinations on behalf of its customers, but it should at least require customers to state the nature of the payment, so as to avoid designing a payroll product as a bulk transfer tool without payee classification. The platform's own business should also be broken down: does it merely execute payments on instruction, or does it calculate wages, withhold taxes, hold balances in custody, or even contract as an employer of record? The latter arrangements may change the scope of liability. Deliverables should be set out in quotations and contracts, and a single label of "global payroll" must not cover matters for which no one is in fact responsible. A payee's willingness to receive tokens does not mean the wage obligation has been performed Taking Singapore as an example, the Ministry of Manpower imposes requirements on the manner and timing of wage payment and on wage records, and its guidance on payment of wages in kind emphasizes that legal currency should be used. Accordingly, it should not be asserted, merely because an employee clicks to consent, that stablecoins can directly replace statutory wage payments. Different categories of employees, components of remuneration and arrangements still require specific review. Where an employer lawfully pays wages into an employee's bank account and the employee subsequently purchases stablecoins on their own, that is a different process from the employer sending tokens directly to a wallet and asserting that wages have been settled. For independent contractors, local contract, payment and tax rules should be examined separately; the conclusions reached for employee wages cannot be mechanically applied to all service fees. On-chain receipt does not automatically address taxes and supporting documentation HMRC guidance in the United Kingdom on tokens provided by third parties as employment income indicates that this method may still give rise to income tax and National Insurance obligations and involves employer PAYE processing. This example shows that changing the asset in which remuneration is delivered does not remove that remuneration from the tax system, and the specific tax liability cannot be determined solely by reference to the token symbol. Product design should include fields for fiat denomination, valuation point, allocation of taxes and fees, transaction charges and proof of receipt. If a net amount received is agreed, it should also be clear who makes up any shortfall after exchange-rate fluctuations or deductions; if the commitment is merely to execute customer instructions, the product should not be marketed as having resolved all local employment and tax compliance matters. Verify country by country rather than launching global payroll all at once It is advisable first to select the confirmed places of employment and places of receipt, verify the methods of receipt and the service permissions of the payment platform, and then configure contracts, payslips or invoices, necessary tax information and procedures for exceptional supplementary payments. Where personnel information is shared, the purposes and scope of data access by each party should also be limited. Initial testing should verify when the payee can actually use the funds, rather than merely confirming that the wallet address received tokens. Recommended actions Establish two separate lists—one for employees and one for contractors—based on the place of employment and the place of receipt of payment. Verify the payment methods permitted for the statutory wage component, bonuses, and service fees respectively. Clarify the calculation, withholding, and supplementary payment responsibilities of the employer, payroll service provider, and payment institution. Design fields for fiat currency valuation, receipt of funds, and tax documentation, and test exceptional supplementary payments. Information note: This article provides general information and does not replace legal advice based on specific facts. References Paying salary — Singapore Ministry of Manpower (MOM) Can wages be paid in kind? — Singapore Ministry of Manpower (MOM) CRYPTO42300：employment income provided through third parties — UK HM Revenue & Customs (HMRC) MAS expands the scope of regulated payment services — Monetary Authority of Singapore (MAS) Related Q&A 7. What qualifications are required for a company to pay an overseas supplier in stablecoins? 43. Can an overseas crypto payment company pay salaries to employees in mainland China in USDT? 45. If a company is established overseas, does its crypto payment business income still need to be taxed in mainland China? 84. Will using overseas identity verification, cloud services or banks raise cross-border data transfer issues for customer data? ← Previous question 59 All crypto payment Q&A Next question 61 →

Question 61

If we only charge a technical service fee and do not earn an exchange spread, do we still need a license?

Accepted Answer

What the fee is called cannot replace the characterization of the business Business review first looks at what service the customer is purchasing, what commitments the platform makes, and who executes key instructions. A company may charge monthly fees and still be continuously operating a payment service on behalf of customers; a company may charge per transaction and may genuinely be providing only software. The fee model can be part of the facts, but it cannot independently answer the market-access question. A contract may be written as "technical services," yet if it in substance promises to convert the customer's stablecoins and pay them into a designated account, the corresponding business still needs to be reviewed. Not touching funds is not the only criterion either The UK FCA's PERG payment regulatory guidance explains that software or technical services that merely support payments may fall within a specific exclusion, but payment initiation services do not fall within that technical-services exclusion. In other words, under the UK framework, not holding funds and not providing regulated payment services are not the same proposition. In Singapore, MAS's explanation of the scope of payment services likewise covers certain token-transfer and exchange-facilitation activities that do not involve holding funds or tokens. These rules do not mean that all interfaces require a license; rather, they remind teams to break down the order, authorization and execution process for analysis, and then determine whether a specific definition or exclusion is engaged. Comparing two products that both charge monthly fees Assume A provides order-management software to merchants; the merchants themselves contract with payment institutions, confirm conversions and make payments, and A only transmits business data. B also charges a monthly software fee, but B accepts payment requests, arranges conversions, selects the payout institution and is responsible for funds arriving. The two price lists can be completely identical, yet the legal relationships are different. B cannot directly rely on the pure-software conclusion applicable to A, and A should also confirm that its actual functions have not crossed the established boundaries. It is also necessary to check who charges whom, whether fees are deducted directly from customer assets, and whether fees are tied to quotations. Renaming an exchange spread as an interface fee, if the fund handling and customer commitments have not changed, generally does not resolve the original problem and may instead create an inconsistency between the accounts and the substance of the business. First make the contract, the system and the finance function say the same thing It is advisable to map each fee to a clearly defined service and list, item by item, the provider, customer authorization, delivery standards and failure handling. Then check whether the system logs are consistent with the contract: who receives instructions, who can modify the payee, and who has authority to deduct fees and issue refunds. If the genuine intention is to operate only a technical business, the permissions, contracts and customer experience should be genuinely adjusted, rather than merely changing the name on the invoice; the specific structure must still be verified against the target market. Recommended actions Use a process diagram to identify the entities responsible for receiving instructions, conversion, asset control and commitments regarding funds arriving. Match each fee item to the actual service on an item-by-item basis and verify the authority to deduct fees. Test the technology-service exclusion against the target jurisdiction and do not describe it as a global exemption. Re-review after any change in functionality or contract, and retain the version and the basis for the conclusion. Information note: This article provides general information and does not replace legal advice based on specific facts. References PERG 15: Guidance on the scope of the Payment Services Regulations, Q39 and Appendix 3 — UK Financial Conduct Authority (FCA) MAS expands the scope of regulated payment services — Monetary Authority of Singapore (MAS) Related Q&A 3. If we only provide payment technology interfaces and do not handle client funds, do we need a license? 46. If the upstream exchange and payment institutions are both licensed, do we still need a license ourselves? 66. Does developing and operating a self-hosted wallet require a license? 75. Does a product in which an AI agent makes payments on behalf of users require a payment license? ← Previous question 60 All crypto payment Q&A Next question 62 →

Question 62

What conditions must be met to accept card payments from customers purchasing crypto assets?

Accepted Answer

First confirm whether you are selling crypto assets or merely providing a payment entry point If a platform quotes prices to users and sells crypto assets in its own name, its eligibility to provide trading services must be reviewed; if users purchase crypto assets directly from an independent third party, the platform must also review whether it is receiving orders, arranging transactions or promoting regulated services. Taking Article 3 of the EU's MiCA as an example, exchanging own funds and executing orders on behalf of clients are distinct service items, and not all of them can be placed within "acquiring technology." Disclose the true transaction to the acquirer, rather than relabeling it as another product Visa's public rules contain dedicated coding arrangements for transactions involving the purchase of non-sovereign currencies and require the payment page to disclose relevant information. These are card network rules, not a government license. Actual onboarding should also require the acquirer to confirm the applicable transaction type, customer region, processing path and whether it accepts such business. Purchasing crypto assets must not be packaged as software, membership or other goods in order to obtain a channel that would otherwise not apply. The payment page should enable users to understand the currency they are purchasing, the total cost, the delivery destination and refund restrictions. The above information is not only used to reduce misunderstandings, but also affects whether it can later be explained what the user actually agreed to. Transaction coding and page disclosures should be tested together to avoid a situation where the front end displays a crypto asset purchase while the back end reports it as an ordinary good. A card having been authorized is not the same as the risk having ended Assume that after a user pays by card, the platform immediately sends the assets to a wallet that the platform cannot recall. If card fraud or another dispute subsequently occurs, on-chain delivery cannot automatically prevent the bank card dispute process. The Visa Merchant Dispute Guide distinguishes fraud, processing errors and consumer disputes, and identity verification is not a guarantee that covers all disputes. Therefore, risk management checks and failure handling should be specified before delivery is permitted. For example, where payment is authorized but the exchange fails, the asset transfer fails or the user submits an order repeatedly, it is necessary to design who reverses the charge, who bears the price difference and how duplicate refunds are avoided. Assets must not be held indefinitely for the purpose of preventing chargebacks, nor should users be promised that no refund is possible under any circumstances. Divide the launch checklist into three columns: legal, channel and operations The legal column confirms the service entity and market permissions; the channel column retains the acquirer approval, transaction codes and rule versions; the operations column verifies reconciliation, refunds, fraud review and customer service evidence. Only when all three columns are completed is there a basis to assess launch. There is no uniform answer on security deposits, settlement cycles and fees; these should be calculated based on the actual contract, with particular confirmation of disputes that may still arise after termination of cooperation and arrangements for retention of funds. Recommended actions Confirm the entities that sell the assets, receive card payments and deliver the assets, as well as the scope of each entity's licenses. Obtain the acquirer's written approval of the use for purchasing crypto assets and the target cardholder market. Verify the payment page information, transaction codes and asset delivery records. Test abnormal paths such as a successful charge but failed exchange or delivery, duplicate payments and refunds. Information note: This article provides general information and does not replace legal advice based on specific facts. References MiCA Article 3: Definitions — EU regulations / ESMA official rulebook Visa Core Rules and Visa Product and Service Rules, version dated 2026-10-24, Tables 5-15 and 7-9 — Visa Visa Dispute Management Guide for Merchants, October 2026 edition — Visa Related Q&A 58. How does providing fiat on-ramp and off-ramp services for exchanges and wallets differ from ordinary merchant payment collection? 63. If a chargeback occurs after purchasing crypto assets by card, what losses may the payment institution bear? 54. What legal risks require the most attention when choosing a crypto payment channel? 68. When a wallet integrates third-party fiat on-ramp and off-ramp services, who is responsible for compliance? ← Previous question 61 All crypto payment Q&A Next question 63 →

Question 63

What losses may a payment institution bear when a chargeback occurs after a card purchase of crypto?

Accepted Answer

First, distinguish the reasons for the chargeback A user's denial of having made the payment, duplicate charges, incorrect amounts, failure to deliver as agreed, and a promise to refund that was not honored are distinct issues. Visa's merchant dispute guide classifies disputes into multiple categories and requires evidence to be submitted according to the specific reason and applicable handling rules. Upon receiving a chargeback notice, the first step should be to confirm the reason, the transaction status and the response deadline, rather than issuing a uniform reply that "the assets are already on-chain, so the chargeback is not accepted." 3DS addresses only part of the authentication risk Visa's explanation of 3-D Secure indicates that fraud-related dispute protection depends on conditions such as how the transaction was processed and the required authentication data. Successful authentication does not mean that the goods or assets have been correctly delivered, nor does it automatically cover other disputes such as duplicate charges or incorrect amounts. Whether the specific protection applies should be determined by the acquirer based on the transaction records and the applicable rules. Assume a coin purchase transaction completed identity verification, but the platform charged the user twice due to an error in its retry logic. Even if both charges have authentication records, the duplicate charge cannot be denied solely on the basis that "3DS was passed." Conversely, where the assets were indeed delivered to the address confirmed by the user, the wallet address, on-chain transaction records and order information can serve as useful evidence, but their probative value still depends on the type of dispute. The loss is not limited to a single reversed principal amount Projects should calculate the losses that cannot be recovered after asset delivery, as well as contractual processing fees, rolling reserves, delayed settlement and labor costs. If an upstream party first deducts the amount from the platform's settlement funds, the platform may need to top up cash first, even if it can later seek recovery from the merchant or the user. The existence of a right of recovery and the actual recovery of funds are two different matters. Who ultimately bears the loss must be checked layer by layer along the contracts: who the merchant is, who signed the acquiring agreement, whether the platform has undertaken to backstop losses, in what circumstances deposits may be deducted, and what surviving obligations remain after the contract is terminated. This article does not provide a uniform reserve ratio or chargeback deadline, because these vary with transaction type, region, rules and contracts. Evidence should be generated at the time of payment, not reconstructed after a dispute arises It is advisable to link order confirmations, authentication results, charge and clearing records, the address confirmed by the user, asset delivery and refund status to the same transaction number, and to retain necessary materials in accordance with data protection requirements. After receiving a dispute, first rule out duplicate compensation caused by an already-issued refund, and then submit materials according to the reason. Risk management should also fix the root causes, such as duplicate requests, easily misidentified billing descriptors or customer service delays, and should not rely solely on case-by-case appeals. Recommended actions Establish an evidence checklist by dispute reason and a handling process for after notification by the acquirer. Verify the 3DS protection conditions and confirm that authentication data is transmitted completely. Assess asset losses, dispute costs and reserve occupation, rather than looking only at fee income. Review the deduction, recovery and post-termination liability provisions in acquiring, merchant and platform contracts. Information note: This article provides general information and does not replace legal advice based on specific facts. References Visa Dispute Management Guide for Merchants, October 2026 edition — Visa Visa Core Rules and Visa Product and Service Rules, version dated 2026-10-24 — Visa Related Q&A 62. What conditions must be met to accept a customer's card payment for the purchase of crypto assets? 87. If a stablecoin depegs or is frozen, must the platform compensate merchants? 88. If an upstream channel suspends service or freezes funds, may we suspend settlement to customers? 93. Can a payment institution limit its liability through a disclaimer clause? ← Previous question 62 All crypto payment Q&A Next question 64 →

Question 64

Can cross-border collection and payment business be completed entirely on-chain?

Accepted Answer

First define what "completion of payment" means When the parties agree to and lawfully use stablecoin settlement, on-chain delivery may form part of performance; however, whether a contractual debt has been discharged still depends on the applicable law and the agreement, and a general conclusion cannot be drawn from a single transaction hash alone. If the contract requires the payee's bank account to receive a specified fiat currency, sending stablecoins to an intermediary institution is merely one step in the overall process. Research by the BIS Committee on Payments and Market Infrastructures (CPMI) on stablecoin cross-border payments incorporates on- and off-ramp arrangements into its overall analysis. For payment products, this means that on-chain speed and the speed at which funds ultimately become available should be stated separately; round-the-clock on-chain operation cannot replace the processing capacity of the stablecoin seller, banks and local payment channels. Purely on-chain services may also be regulated services Article 82 of the EU's MiCA sets out requirements such as client agreements for crypto-asset transfer services on behalf of clients. ESMA's public Q&A further clarifies that activities meeting the definition of a transfer service, even if embedded in other crypto-asset services, should be analyzed against the corresponding authorization requirements. Therefore, "we only transfer coins, not fiat currency" cannot automatically exclude regulation. A distinction should be drawn between an enterprise paying its own debts with assets it controls and a platform accepting instructions from others to transfer assets on their behalf. This is not to say that the former is risk-free in all jurisdictions, but that the roles of the parties differ, and the same set of licensing conclusions cannot be applied interchangeably merely because an on-chain address appears in both cases. Information that does not go on-chain still requires someone to be responsible for it Suppose a procurement contract is denominated in US dollars and the supplier agrees to receive a certain stablecoin. The parties must still specify the conversion time point, the network used, how shortfalls or mistaken transfers are handled, and whether a top-up is required if the asset depegs. If all of these are left blank, disputes after receipt will merely shift from the banking stage to the contract level; they will not disappear. Tax records cannot be omitted either. The Singapore IRAS guidance on enterprises accepting or using digital tokens for payment requires treatment under the applicable income tax rules and generally requires transactions to be recorded at their Singapore dollar value. This is merely a jurisdictional example of tax treatment; it does not mean that any token payment is licensed for business, nor that every country adopts the same valuation method. Design systems backwards from the delivery outcome It is advisable to link client authorization, payee information, invoices, on-chain records, conversion and fiat disbursement evidence into a complete chain of evidence. Products that only provide on-chain delivery should clearly define their endpoint and limitations; products that promise fiat currency arrival should implement local disbursement and contingency plans for failures. Do not, in pursuit of a "fully on-chain" concept, exclude from the product the evidence, refunds or customer service responsibilities that clients actually need. Recommended actions Determine whether the contract provides for token delivery or the receipt of fiat currency in a bank account. Review payments made from one's own assets and transfers made on behalf of clients separately. Specify the currency, network, valuation time, receipt standard and supplementary payment for anomalies. Establish linked reference numbers for contracts, orders, on-chain transactions and payment vouchers. Information note: This article provides general information and does not replace legal advice based on specific facts. References Considerations for the use of stablecoin arrangements in cross-border payments — BIS／CPMI Article 82 of MiCA: transfer services on behalf of clients — EU regulations / ESMA official rulebook ESMA Q&A 2071 — ESMA / European Commission responses Taxable & Non-Taxable Income：Tax Treatment of Digital Tokens — Inland Revenue Authority of Singapore (IRAS) Related Q&A 7. What qualifications are required for a company to use stablecoins to pay overseas suppliers? 42. Can we provide stablecoin settlement services for cross-border trade enterprises? 59. What costs and time can stablecoin cross-border payments typically save? 86. If client funds are held at a bank or custodian, does the platform still bear liability? ← Previous question 63 All crypto payment Q&A Next question 65 →

How crypto payments are regulated

Virtual-asset services

Payment services

Electronic money

AML, CFT and sanctions

How Mankun can help

Global crypto-payments licensing

US MSB

US MTL

Canada MSB

Cayman VASP

CASP

EMI

PI

Hong Kong VATP

Hong Kong MSO

Singapore MPI + DPT

Australia DCE

Dubai VARA

Other jurisdictions

Selected clients

Whether the business can be conducted

First look at what the client asks you to complete, not at what the product is called

The crypto-asset side and the fiat-currency side may each be subject to regulation

Two merchant collection solutions have different liability structures

First form an access checklist, then decide the order of applications

Recommended actions

Reference basis

Related Q&A

First, verify what the original license permits

The EU notification route is not available to all payment institutions

Assume a new "stablecoin payment" button is added

Check qualification changes together with operational changes before launch

Recommended actions

References

Related Q&A

The interface name does not determine the nature of the business

Not holding assets does not necessarily mean being outside the scope of regulation

Testing the boundary with a hypothetical change

Turning technical boundaries into verifiable evidence

Recommended actions

References

Related Q&A

A single settlement usually involves more than one service

Domestic merchants cannot bypass restrictions through offshore entities

Assume the merchant is in an offshore market that permits receipt of coins

Lawful collection of payments must also be able to handle refunds and anomalies

Recommended actions

References

Related Q&A

Asset ownership and the nature of the business are two separate issues

Official rules do not regulate only buying and selling on behalf of clients

Where customer funds go adds further issues

Only by assembling the complete transaction facts can the threshold be assessed

Recommended actions

References

Related Q&A

B2B describes clients and does not replace service classification

Corporate identity and professional qualifications cannot be conflated

Assume the platform only pays for goods on behalf of an exporting company

B2B compliance should be designed around enterprise risk

Recommended actions

References

Related Q&A

First, clarify the starting point and endpoint of payment

The enterprise paying itself differs from the platform paying on the enterprise's behalf

Both ends must be verified, not only the issuing side

Domestic trade and abnormal payments require a separate checkpoint

Recommended actions

References

Related Q&A

First, clarify what “overseas” is being measured against

Some regimes look at local outbound business

Some regimes look at whether services are solicited overseas for local customers

Even if the place of incorporation remains unchanged, the business may still change

Recommended actions

References

Related Q&A

The key question is what was tested, not how long it was called a trial operation

Whether to register first or operate first depends on the specific regime