Five Flags, One Licence: How a Crypto Exchange Chose Its Jurisdiction in 2026 (A Case Study)

1. The 2026 map: where the industry actually went

Three years ago “popular crypto jurisdiction” meant whoever handed out registrations fastest. Lithuania alone had around 850 registered crypto companies by late 2022. Then MiCA arrived, and popularity started to mean something else: where can you still get a licence that banks, counterparties and app stores recognise?

The data tells the story better than any sales brochure. When MiCA’s transitional period expired on 1 July 2026, ESMA’s interim register held 213 authorised crypto-asset service providers across 23 jurisdictions; by the end of July the count had reached 321, per Cointelegraph. Five member states hold roughly 60% of the licences, and the old “registration capital” of Europe had issued just three CASP licences by January 2026, per Fintech Baltic — while fielding 102 applications from 55 companies in 2025.

Outside the EU, the centre of gravity moved to places that wrote their own rulebooks instead of waiting for a directive. Dubai’s VARA publishes fee schedules down to the dirham. Hong Kong’s SFC lists exactly 13 licensed trading platforms and names the applicants it has sent home. Switzerland quietly granted the first DLT trading facility licence in March 2025 and is now rewriting its Financial Institutions Act to create a “Crypto Institution” category. The Cayman Islands turned custody and trading platforms from a registration into a licence on 1 April 2025.

So when our client arrived — let’s call them Meridian — the shortlist wrote itself: the EU under MiCA, Dubai under VARA, Hong Kong under the SFC, Switzerland under FINMA, and the Cayman Islands under CIMA. Five flags, five very different conversations.

2. The client, and the question behind the question

Meridian was a spot exchange with a custody arm, founded by two former prime-brokerage people and a CTO who had already built matching engines for other people. They had a market-maker lined up, seed funding closed, and customers in two places: professional traders in the EU and family offices in the Gulf. They wanted, in their words, “the fastest serious licence”.

That phrase is where most jurisdiction decisions go wrong. “Fastest” and “serious” pull in opposite directions, and the trade-off is different for every activity. Our first job was not to recommend a country. It was to pin down the regulatory perimeter: which activities, which clients, which assets, and which of those were negotiable. We have written about this framework before in how to choose the right jurisdiction for your crypto licence; Meridian was the stress test.

3. Five jurisdictions, one scoring matrix

We score jurisdictions on six axes, and we show the client the scores before we show them our opinion. It keeps everybody honest, including us. Here is Meridian’s matrix as of early 2026, with the regulatory references that drove each score.

Capital figures are statutory minimums; regulators routinely ask for more based on the business plan. Timelines are our own experience, not official service levels.

Two things jump out of that table. First, Hong Kong fell away early — not because it is a bad regime, but because the SFC built its VATP licence around retail protection, and Meridian had no retail. Paying for insurance on 98% cold storage you do not need is a strange way to spend a seed round. Second, the EU and Dubai were the real contest, and the deciding factor turned out to be the calendar.

4. The calendar problem nobody puts on a slide

MiCA is a magnificent piece of legislation and, for an exchange launching in 2026, a slow one. Article 63 requires the competent authority to assess completeness within 25 working days and decide within 40 working days of a complete application; in practice the “complete” part is where months disappear. Lithuania’s own numbers — 102 applications, 3 licences — told us that filing in the Bank of Lithuania’s queue in January 2026 meant launching in 2027. Malta, with 15 authorised CASPs and a supervisor that had used the full 18-month transition wisely, was faster but not fast.

Dubai was different in one specific, boring, decisive way: VARA splits the process in two. The Approval to Incorporate lets you form the company, hire, and rent the office while the full licence file is being built. Nothing in the rulebooks is lighter — the VARA Rulebooks run to four compulsory volumes plus one per activity — but the work happens in parallel rather than in series. For a client with a twelve-month term sheet, parallel beats series.

The EU was not abandoned; it was sequenced. Professional EU clients could be onboarded on a reverse-solicitation basis only in the narrowest sense, and we told the client plainly that any EU-facing marketing before a CASP authorisation would be a breach of Article 59 — a point ESMA has made with increasing impatience. The plan became: Dubai first, EU CASP via a licensed partner in year two, own authorisation in year three. Not glamorous. Legal.

5. What actually went wrong (and how we fixed it)

Every licensing project has a moment where the Gantt chart meets reality. Meridian had four.

1. Two Responsible Individuals, both resident. VARA requires two RIs who are full-time employees and UAE residents or passport holders. The founders assumed one could stay in London. The fix was a relocation, a Golden Visa application and a revised employment structure — three weeks we had budgeted and the client had not.
2. Custody is a different company. The business plan had one entity doing everything. Under VARA, custody must sit in a separate legal entity with its own licence, its own capital (AED 600,000 or 25% of fixed annual overheads) and its own compliance officer. We restructured into an exchange entity and a custody entity under a holding, which — happily — also solved a tax question the client had not yet asked. Our tax structuring team did that part while the lawyers argued about intercompany agreements.
3. Capital in a trust account, not on a balance sheet. Rule VI.B.3 of the Company Rulebook requires paid-up capital to be held in a UAE-licensed bank trust account with VARA as beneficiary (or a surety bond). Opening that account before the licence exists is a chicken-and-egg problem that the banking team solved with a conditional arrangement — and seven weeks of patience.
4. The Travel Rule arrived mid-project. VARA’s FATF Recommendation 16 implementation took effect in February 2026 with a threshold of AED 3,500. Our AML/KYC programme had already been designed to a lower threshold, so the change cost a policy revision and a vendor integration test rather than a redesign. Designing for the strictest likely standard is cheaper than redesigning for the actual one; we say this to every client, and roughly half believe us until month seven.

Total elapsed time: nine months from signed mandate to operating licence, plus seven weeks for the operating bank account. VARA asked three rounds of questions, the longest about the matching engine’s order-priority logic — the kind of question that tells you the regulator actually read the file. The market-maker’s term sheet had six weeks left when the first trade cleared.

6. What the other four would have looked like

Clients sometimes ask whether we regret not choosing differently. A good lawyer answers that with a table, not a feeling.

Switzerland would have been the fastest registration and the slowest business: an SRO-affiliated VASP can exchange and transfer crypto, but holding client fiat at scale pushes you towards the fintech licence under Art. 1b of the Banking Act, and FINMA’s guidance on stablecoins and bank guarantees makes the perimeter unforgiving. Cayman would have suited a fund-facing custodian better than a trading venue; the 2025 amendments are well drafted, but “where is your bank?” remains the first question every counterparty asks. Malta was the runner-up and would be our first choice today for the EU leg. Hong Kong is the right answer to a different question — one with retail, Asian liquidity and HK$25 million for a stablecoin.

7. Lessons we now give every founder

• Perimeter first, flag second. Write down activities, clients and assets before you look at a map. If the list changes, the jurisdiction may change with it.
• Count licences, not registrations. A country with 850 registrations and 3 licences is telling you something about its supervisor’s capacity. Listen.
• Read the fee schedule as a statute. VARA’s Schedule 2 and MiCA’s Article 67 are not marketing; they are the cheapest due diligence you will ever do.
• Design AML to the strictest likely standard. Travel Rule thresholds move. Policies built for the loosest reading move with them, expensively.
• Sequence, do not sacrifice. You rarely get the EU, the Gulf and Asia in one licence. You can get them in three years if the first choice does not close doors to the second.
• Budget for the bank. The licence is month nine. The account is month eleven. The term sheet does not care.

If any of this sounds like your deck, you are in good company — Meridian’s first slide said “fastest serious licence” too. The honest version of that sentence is longer, and it starts with a conversation about what you actually plan to do. For the detail behind each jurisdiction, see our guides to the EU under MiCA, Dubai and VARA, Hong Kong, Switzerland and the Cayman Islands, our overview of the global crypto licensing landscape 2026, and — if you are tokenising rather than trading — our asset tokenization guide.

Frequently asked questions

Which crypto jurisdictions are most popular in 2026?

For licences that counterparties recognise: the EU under MiCA (Germany, the Netherlands, France, Malta and Ireland lead the ESMA register), Dubai under VARA, Hong Kong under the SFC, Switzerland under FINMA and SRO supervision, and the Cayman Islands under CIMA’s 2025 licensing regime.

How long does a crypto licence take in 2026?

In our experience: 6–9 months for VARA, 9–15 months for a MiCA CASP depending on the member state, 12–18 months for a Hong Kong VATP, 4–6 months for a Swiss SRO affiliation and 6–9 months for a Cayman licence. Add one to three months for banking in every case.

Can an exchange licensed outside the EU serve EU clients?

Only under a narrowly construed reverse-solicitation exemption. Since 1 July 2026 there is no transitional cover, and any EU-targeted marketing without a CASP authorisation breaches Article 59 of MiCA.

How much capital does a crypto exchange need?

€150,000 under MiCA Class 3 (plus own-funds requirements), AED 800,000–1,500,000 under VARA depending on custody arrangements, HK$5 million for a Hong Kong VATP, and case-by-case prudential capital in the Cayman Islands. Regulators regularly require more than the statutory floor.

Why separate custody from the exchange?

VARA requires it; MiCA and the SFC strongly encourage it through segregation and insolvency-protection rules; counterparties and insurers price it. A separate custody entity also simplifies group tax structuring and a future sale of either business.