This article explains when a crypto payment gateway, a service that accepts cryptocurrency from customers on behalf of merchants, needs a licence. It covers how a gateway works, how regulators in the EU, the US and the UK classify its activities, which customer checks and transaction monitoring are required under anti-money laundering (AML) rules, what the Travel Rule is and which steps to take before launch.
Checked on 8 November 2026 against the text of MiCA, the EU regulation on transfers of funds and crypto-assets, FinCEN guidance and FCA and ESMA publications. Rules differ by country and change, so confirm the position for your own model.
How a crypto payment gateway works
A gateway sits between a customer who wants to pay in cryptocurrency and a merchant who wants to receive payment. It lets a business accept crypto without building its own blockchain infrastructure by processing payments, monitoring transactions, managing wallets, converting currency and handling settlement.
Choice of payment method
The customer selects cryptocurrency at checkout.
Payment address
The gateway generates a payment address or a transfer request.
Transfer
The customer sends cryptocurrency to that address.
Blockchain check
The gateway detects and verifies the transaction.
Forwarding or conversion
Depending on the model, the gateway forwards the cryptocurrency to the merchant or converts it into fiat currency.
Settlement
The merchant receives cryptocurrency or fiat money in its bank account.
For example, a customer buys goods for EUR 500 and pays in USDT. The gateway receives the USDT, converts it into euros and transfers the corresponding amount to the merchant. Its revenue usually comes from transaction fees, conversion spreads or both.
Not every gateway performs all of these functions, and the legal classification depends on the actual flow of funds and the services provided. For the other side of the market, a company that itself accepts crypto, see our article on accepting crypto payments.
Does a crypto payment gateway need a licence
There is no single international licence designed for crypto payment gateways. Regulators assess the activities a company performs. The main distinction is between a software provider and a financial intermediary.
Software only
The company supplies APIs, payment widgets and blockchain monitoring tools but does not receive or control customer funds. For example, the payment address belongs to the merchant and the money goes straight to it. If the company provides only technical infrastructure and no regulated crypto-asset service, a crypto licence may not be needed. Absence of custody does not make a business unregulated, though, because it still matters how the company initiates, arranges or executes transfers.
Processor with custody
The gateway receives cryptocurrency into wallets it controls. It generates deposit addresses, temporarily holds funds, aggregates merchant payments, transfers crypto to merchant wallets, keeps balances and handles refunds and payouts. These functions are much more likely to fall within crypto-asset or money transmission regulation.
Conversion to fiat
Automatic conversion of cryptocurrency into fiat adds another dimension. The provider may be offering exchange services between crypto-assets and money, while the fiat settlement may fall within payment services regulation. The fact that conversion is automated or goes through a third-party exchange does not remove the gateway’s obligations.
| EU | US | UK | |
|---|---|---|---|
| Software only | Check whether transfer services are provided | Depends on whether the provider accepts and transmits value | Assessed against the MLR definitions, no automatic registration |
| Custody and transfers | CASP authorisation | Likely a money transmitter, plus state licences | MLR registration as a wallet provider, then FSMA authorisation |
| Conversion to fiat | CASP and possibly payment services | Likely a money transmitter, plus state licences | MLR registration as an exchange provider, then FSMA authorisation |
The table shows the typical picture, not a final classification. The result depends on the real payment flow.
Map the path of every payment, including merchant settlement and refunds. Note who controls the keys, who initiates each transfer and where conversion takes place. The licensing analysis is built on that map.
European Union, MiCA and payment services
The main framework is Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA). Under Article 59, companies providing crypto-asset services in the EU generally need authorisation as a crypto-asset service provider (CASP), unless an exemption applies. The services most relevant to gateways are custody and administration, exchange of crypto-assets for funds or for other crypto-assets, execution and transmission of orders, and transfer services.
MiCA defines transfer services as transferring crypto-assets on behalf of a client from one distributed ledger address or account to another. Even a business without an exchange function may therefore fall inside the perimeter. A provider that receives crypto into its own wallets and then transfers it to merchants may be providing custody and transfer services. We explain authorisation in our article on the CASP licence under MiCA and on the page about the CASP licence in the EU.
Once authorised, a company can provide services across the EU through passporting after a notification. The transitional periods ended no later than 1 July 2026. In its statement of 23 June 2026, ESMA reminded unauthorised firms, including those established outside the EU, that they cannot provide MiCA services to EU clients, and that this applies in a business-to-business context too. The reverse solicitation exception is narrow. The service must be provided strictly at the client’s own exclusive initiative, and a disclaimer in the terms does not legitimise actively soliciting EU clients.
MiCA does not replace other financial services law. If a gateway also holds fiat funds for merchants, keeps fiat balances or executes payment transactions, it may need a separate payment institution or electronic money institution authorisation under national rules implementing PSD2. We compare the two in our article on choosing between an EMI and a PI licence. MiCA also treats e-money tokens (EMTs) as electronic money, so some services involving them can overlap with payment services. A CASP authorisation is not permission to provide every type of fiat payment service.
United States, FinCEN and state licences
In the US, crypto payment gateways may be classified as money services businesses (MSBs), particularly money transmitters, under the Bank Secrecy Act. The main federal regulator is the Financial Crimes Enforcement Network (FinCEN). Its 2019 guidance on convertible virtual currency (FIN-2019-G001) addresses payment processors specifically. Under section 4.6, a processor that accepts virtual currency from a customer and transmits money or other value to a merchant generally qualifies as a money transmitter and does not fall within the payment processor exemption.
The exemption applies only if every condition is met. The processor must facilitate the purchase of goods or services rather than merely transmit funds, operate through clearance and settlement systems that admit only BSA-regulated financial institutions, provide the service under a formal agreement and have a formal agreement with the seller or creditor. A typical blockchain gateway will not satisfy the second condition.
A company that qualifies as a money transmitter registers with FinCEN as an MSB within 180 days after the business is established and renews the registration every two years by 31 December. It needs an AML programme, a responsible person, transaction records and suspicious activity reports (SARs) where required. Federal registration does not replace state licensing. Many states require their own money transmitter licence, and New York runs a separate BitLicense regime under the Department of Financial Services (NYDFS). A gateway serving US customers therefore needs a state-by-state assessment before launch. Our page on crypto licensing in the USA gives an overview.
United Kingdom, FCA registration and the new regime
In the UK, a gateway may fall within the Money Laundering Regulations 2017 (MLRs), depending on what it does. The Financial Conduct Authority (FCA) supervises relevant cryptoasset businesses. Registration is required for cryptoasset exchange providers and custodian wallet providers acting by way of business in the UK. A gateway that exchanges crypto for fiat for merchants, or safeguards crypto-assets or private keys for customers, may fall within the current requirements. A provider doing only technical blockchain monitoring or standalone transfers should not automatically be assumed to need registration, because its activities must be measured against the statutory definitions.
The UK is also introducing a broader cryptoasset regime under the Financial Services and Markets Act 2000 (FSMA). The FCA says it is expected to come into force on 25 October 2027. Its authorisation gateway opened on 30 September 2026 and the application period closes on 28 February 2027. Existing MLR registration does not convert automatically into authorisation under the new regime. A company should therefore assess both the registration it holds today and the permissions it will need under FSMA.
AML and KYC for crypto payment gateways
A licence is only one part of compliance. Gateways face significant money laundering and terrorist financing risk. Blockchain addresses can be anonymous or pseudonymous, transactions pass through several networks and transfers can move between hosted and unhosted wallets. A risk-based programme should therefore cover both merchant onboarding and payment processing.
Merchant KYB
Verify the legal entity and registration details, directors and ultimate beneficial owners, the source of funds, the business model and expected volumes, geographic exposure and licences in regulated sectors. Pay particular attention to high-risk sectors such as gambling and investment platforms. Our article on KYC and KYB for payment providers covers the procedures.
Transaction monitoring
Blockchain analytics should identify sanctioned addresses, darknet marketplaces, ransomware wallets, stolen funds, mixers, high-risk exchanges and unusual patterns. Monitoring must cover incoming payments and merchant settlements. Exposure to an address is a risk indicator, not proof that funds are criminal, so assessment and escalation procedures are needed.
Sanctions
Screen customers, merchants, beneficial owners and wallet addresses against the sanctions regimes that apply. Companies with a US nexus may be subject to OFAC requirements, and EU businesses must follow EU restrictive measures. You need procedures for blocking, rejecting or suspending transactions.
Suspicious reports
Set out how to identify and escalate suspicious activity, investigate alerts, record decisions and retain data. Where the law requires, reports go to the Financial Intelligence Unit (FIU).
The Travel Rule, which data accompanies a transfer
The Travel Rule requires information about the originator and the beneficiary of a crypto-asset transfer to accompany it when regulated providers handle the transfer. It comes from FATF Recommendation 16. In the EU it is implemented by Regulation (EU) 2023/1113, which has applied since 30 December 2024. Crypto-asset service providers must ensure that transfers carry identifying information on both parties, including names and distributed ledger addresses or account numbers.
For transfers above EUR 1,000 to or from a self-hosted address, the CASP must take adequate measures to assess whether the customer owns or controls that address. The regulation also requires procedures for transfers with missing or incomplete information. A gateway that qualifies as a CASP needs systems to collect, transmit and retain this data. In practice that usually means a specialised solution that exchanges data with other regulated providers, detects missing information, escalates high-risk transfers and rejects, suspends or returns transactions where the law requires. The rule generally does not apply to a purely peer-to-peer transfer between individuals without a CASP. We cover implementation in our article on the Travel Rule for crypto businesses.
Other requirements
Data protection
A gateway handles identification documents, transaction history, wallet addresses, IP addresses and device data. Where personal data are processed, the GDPR or other data protection law applies.
Cybersecurity
Private key storage, wallet infrastructure and access controls are critical, as are incident response and continuity plans. EU CASPs must also assess the requirements of DORA.
Client asset protection
If the gateway holds client assets, the regime may require segregation, reconciliation and safeguarding procedures. Under MiCA, custody providers have specific obligations on client assets and access to keys.
Merchant agreements
The contract should allocate responsibility for payment processing, conversion, settlement, monitoring, refunds and frozen transactions.
Third parties
Using an external exchange, custodian or analytics provider does not transfer the gateway’s regulatory responsibility. Outsourcing should be documented and monitored.
How to launch a crypto payment gateway legally
Before launch, carry out a structured legal assessment. Launching the technology first creates serious exposure, especially if the gateway starts processing for merchants in several countries.
Define the model
Decide whether you only provide software or also receive, hold, transfer or exchange cryptocurrency. Map every flow, including settlement and refunds.
Identify the regulatory perimeter
Assess whether the activities fall within CASP or VASP, money transmission, payment services or electronic money rules in the target markets.
Choose the jurisdiction
Consider customers, substance requirements, costs, capital and passporting rights. Incorporating in a crypto-friendly country does not authorise services elsewhere.
Build AML and KYC
Prepare a risk assessment, an AML policy, merchant onboarding procedures, monitoring rules, sanctions screening and a suspicious reporting process.
Build the technical base
Integrate blockchain analytics, address screening, a Travel Rule solution, secure wallet management and monitoring tools.
Prepare the documents
Draft merchant agreements, customer terms, privacy notices, AML policies, risk disclosures and agreements with exchanges, custodians and payment partners.
Map the flow of payments first, and only then choose a jurisdiction.The LegalBit team
Frequently asked questions
Does a gateway without custody of customer funds need a licence?
Not necessarily. A business that provides only technical infrastructure and no regulated crypto-asset service may operate without a CASP or VASP licence. Non-custodial status alone does not guarantee an exemption, so the real functions must be assessed.
Does a crypto payment gateway need a MiCA licence?
A gateway providing regulated crypto-asset services to clients in the EU generally needs CASP authorisation. That can include custody, exchange and transfer services performed for merchants or customers.
Can a gateway operate without holding customer funds?
Yes, depending on its structure. For example, it may provide software for direct payments to merchant-controlled wallets. Avoiding custody does not automatically exclude transfer or other regulated services.
Can a gateway use another company’s licence?
Not simply by renting it. A licence is generally granted to a specific legal entity and covers the activities authorised for it. Outsourcing and agency arrangements are assessed under the relevant regime.
Does a gateway need a bank or EMI partner?
Not in every case. A gateway that handles only cryptocurrency may not need its own fiat infrastructure. With fiat settlement, merchant balances or payment services, it needs a properly authorised bank, PI or EMI partner, or its own authorisation.
See also: How to Accept Crypto from Customers Legally; CASP licence under MiCA; Travel Rule for Crypto Businesses; How to Launch a Crypto Exchange Without Holding Customer Funds. Services: Legal services for crypto projects.
Primary sources8 documents
- Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA)
- Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets
- ESMA, public statement on the end of the MiCA transitional period, 23 June 2026
- FinCEN, Guidance FIN-2019-G001 on convertible virtual currency
- FinCEN, Money services business registration
- FCA, Cryptoasset businesses, who needs to register
- FCA, How the cryptoasset authorisation gateway will operate
- FCA, New regime for cryptoasset regulation
This material is general information and is not legal advice. Facts checked on 8 November 2026. Rules and deadlines change, so check the official requirements for your model and target markets before launch.
This is what we do
We help crypto and fintech businesses with CASP and money transmitter licensing, payment regulation and AML and KYC procedures.
