Where and how to register a crypto company

The founder keeps personal money and company money in separate accounts and separate wallets, and the company keeps its own books.

If you are preparing an application now, start with this checklist and mark each line “done” or “not done.” Do not file the application while any line about people, the office, or the visa of the director is still marked “not done.”

Chapter 3. Banking for a crypto company: why banks say no, and how to open an account

The short answer. A bank usually refuses a crypto company not because something is wrong with the license of the company, but because the bank is protecting itself. A license does not decide the question. The bank looks at how money will actually move through the account and at how well the company checks its own clients. This chapter explains why banks refuse crypto companies, how a bank, an electronic money institution, and a crypto payment provider differ, what documents a bank asks for, why a company needs more than one account, and what to do when a bank freezes an account.

Why does a bank refuse a crypto company that has a license?

A bank does not refuse a crypto company because something is wrong with the license of the company. The bank refuses the company because the bank is protecting itself. Founders almost never understand this difference at the start. For this reason, a refusal from a bank feels like a personal failure. In fact, a refusal is a standard and predictable reaction of the financial system to a whole category of business. It is not a judgment on one specific company.

Bankers have a name for this practice: de-risking. De-risking means that a bank cuts off a whole category of clients because of their industry, instead of reviewing each client individually. The Financial Action Task Force, known as FATF, is the international body that sets the standards against money laundering. FATF has said many times that de-risking is a problem. FATF describes de-risking as banks ending or limiting relationships with clients “to avoid, rather than manage, risk.” According to FATF, its standards require a case-by-case, risk-based approach. Cutting off whole classes of clients without a serious assessment of the risk of each client is not in line with the FATF standards. FATF returned to this topic in its 2021 report on the unintended consequences of its standards and in its 2023 targeted update on virtual assets.

Banks still practice de-risking because each bank is itself under supervision. If the regulator of a bank decides that the anti-money-laundering controls of the bank are weak, the bank faces fines and can even lose its own license. For the bank, it is simpler to turn away a hundred legitimate clients than to miss one illegitimate client. Many banks choose exactly this logic.

There is one more reason. Every bank works with correspondent banks. Correspondent banks are other banks through which international transfers actually move. A correspondent bank can set its own condition: either the bank reduces its number of high-risk clients, or the bank loses its ability to make international payments through that correspondent bank. In this situation, the bank is not really making a decision against one client. The bank is protecting its whole payment system, and the crypto company simply gets caught in a decision that has nothing to do with the company itself. Chapter 14 explains correspondent banking and sanctions risk in detail.

How does a bank decide which transactions look risky?

Banks mostly do not work with hard limits, such as “a transfer above this amount is blocked automatically.” Banks use a risk-based approach. Under a risk-based approach, the bank does not assess one single transaction. The bank assesses a combination of factors and, most importantly, any change from the usual behavior of the client.

For example, one large deposit with a clear origin and supporting documents can pass without trouble. At the same time, ten small transfers from different individuals over a short period can look riskier, even if the total amount is smaller. This is why a license alone does not settle the question. The bank is not looking at the permit to operate. The bank is looking at how money actually moves through the account, day by day.

Should I use a bank, an EMI, or a crypto payment provider?

A bank account, an account at an electronic money institution, and a crypto payment provider are three different tools. The company should choose between them based on what it actually needs. The company should not choose a bank only out of habit or because “a normal bank is what everyone uses.”

A traditional bank. A bank account gives the most status and the fullest range of banking services. In the European Union, bank deposits are protected by a deposit guarantee scheme up to 100,000 euros under EU Directive number 49 of 2014 on deposit guarantee schemes. Outside the European Union, the amount of protection depends on the law of each country. A bank also gives access to SWIFT, the international network that banks use to send payments to each other. However, banks usually take the longest to review an application, even when the set of documents is complete. Banks are also the most likely to refuse a company that has no physical presence in the country or whose beneficial owners have no local connections.

An EMI. EMI stands for electronic money institution. An EMI is a company licensed to issue electronic money and to process payments without a banking license. In the European Union, EMIs work under EU Directive number 110 of 2009 on electronic money. If an EMI also provides payment services, it follows EU Directive number 2366 of 2015 on payment services, known as PSD2. EMIs have historically been more willing to take clients from higher-risk sectors, such as crypto, online gambling, and financial technology. EMIs were built from the start around a more flexible compliance model. Opening an account at an EMI is usually much faster than opening an account at a bank.

This speed comes at a cost. A deposit guarantee scheme does not protect money at an EMI the way it protects a bank deposit. Instead, safeguarding protects the money. Safeguarding means that the EMI must keep the money of its clients separate from its own money. Under the directive on electronic money, the EMI must safeguard the money it receives no later than five business days after it issues the electronic money. If the EMI fails, the money of its clients does not go into the general pool that the creditors of the EMI share.

Before a company keeps large amounts at an EMI, the company should understand exactly how safeguarding works at that specific EMI. Safeguarding is a different kind of protection from a bank deposit. How reliable safeguarding is depends on how the specific EMI arranges it. The law allows each EU country to decide which methods of safeguarding an EMI may use.

A crypto payment provider. Crypto payment providers are the third type of tool. They are built specifically to handle payments for crypto companies. They usually understand the industry and do not react badly to the word “crypto” in the description of a business. Crypto payment providers also have a weak point. A crypto payment provider still depends on its own banks or correspondent banks. If that connection breaks, the money of the clients at the provider can get stuck, just as money at an ordinary bank can get stuck. For this reason, the company should check the provider one level deeper: which banks the provider itself uses and how stable those relationships are.

Here is a short comparison of the three tools.

A bank gives a full range of services, status, and access to SWIFT. The weak points of a bank are a slow review of applications and frequent refusals for crypto companies. A deposit guarantee scheme protects the money in a bank account, in the European Union up to 100,000 euros.

An EMI opens an account faster and is more open to crypto companies. The weak point of an EMI is that it offers fewer services than a bank. Safeguarding protects the money at an EMI: the EMI keeps the money of its clients separate from its own money.

A crypto payment provider understands the crypto business. The weak point of a crypto payment provider is that it depends on its own banks. The protection of the money depends on the provider, so the company should check the banks of the provider and the structure of the provider.

Why does a licensed crypto company still need a bank?

A license does not remove the need for a bank. In the European Union, MiCA, the regulation on markets in crypto-assets, sets a clear rule in its Article 70. A crypto-asset service provider that holds client funds must deposit those funds with a credit institution or a central bank by the end of the business day after it receives them. A credit institution is a bank. The provider must also keep these funds in an account that is separate from the accounts with its own money. So a crypto company that holds client money in the European Union cannot work legally without an account at a bank or at a central bank.

The same article of MiCA, Article 70, also covers payment services. If a crypto-asset service provider offers payment services linked to its crypto services, the provider itself or the third party that provides these services must have a license under PSD2.

What documents does a bank ask a crypto company for?

A bank looks at three areas when it reviews an application from a crypto company. The next three paragraphs describe these areas one by one.

The first area is the source of funds. The source of funds means documented proof of where the money of the company and of its beneficial owners actually came from. The beneficial owner is the individual who finally owns or controls the company. A bank does not accept “we made it in crypto” as an answer. The bank wants contracts, tax returns, statements from exchanges, proof of asset sales, or other documents that show a specific chain of where the money came from. A general success story is not enough.

The second area is the business plan. The bank does not want a generic business plan written for investors. The bank wants a document that explains how the company actually makes money, who its clients are, what transaction volumes the company expects, and why the payments on the account will look the way they do.

The third area is the anti-money-laundering policies of the company. These policies are usually called AML policies. The bank checks not only the company itself, but also how the company checks its own clients, because part of the risk of these clients passes to the bank through the account. If a crypto company has no real process for checking its clients and monitoring transactions, the bank reasonably assumes that the bank itself will carry this risk. In that case, the bank will probably refuse the application before a thorough review. Chapter 7 explains the AML and KYC work of a crypto company in detail.

Checklist for a bank application. Before you apply to a bank, prepare six things.

First, prepare documents that prove the source of funds of the company and of each beneficial owner.

Second, prepare a chart of the group structure that shows every owner, up to the individuals who finally own the company.

Third, prepare a business plan with the expected clients, countries, and monthly transaction volumes.

Fourth, prepare the license of the company, or proof that the license application is in progress.

Fifth, prepare the AML policy, the procedure for identifying clients, and a description of how the company monitors transactions.

Sixth, prepare proof of a real office and of real staff, as Chapter 2 explains.

Why does a crypto company need more than one account?

Multi-banking means that a company opens accounts with more than one provider at the same time. Usually this is a mix of a bank and one or two EMIs, sometimes in different countries. Multi-banking is not a luxury and not excessive caution. It is a direct way to reduce risk.

The logic is simple. Suppose a company has a single account and the bank freezes it. The whole business stops at the same moment, together with the client money that the company needs, and the company has no other legal place to hold that money. Now suppose the company has several accounts that are not directly linked to each other. A freeze on one account does not stop the whole business. The company gets time to solve the problem with that specific bank while the other accounts keep working.

Multi-banking has a cost: extra administrative work. Every bank and every EMI has its own onboarding process, its own regular reporting, and its own contact person for compliance questions. This means that someone on the team must actually manage all of these accounts all the time, not only once when the company opens them.

Hypothetical example. A company keeps all its money at one EMI. The EMI receives a warning from its own bank and closes the accounts of all its crypto clients within a month. The company now has nowhere to receive client payments, and the business stops. A second company has an account at the same EMI, but it also has a bank account in another country. When the EMI closes its account, the second company moves its payments to the bank account and keeps working while it looks for a new EMI.

What should I do if the bank freezes my account?

A bank can freeze an account or place it on hold. A hold is a temporary block on some operations while the bank checks something. The company should prepare its plan for a hold in advance, not in a moment of panic. The plan has five parts, and the next five paragraphs describe them.

Part one of the plan. Answer the request of the bank quickly and in writing. Do not ignore the message and hope that the problem disappears. Banks give a specific deadline for an answer, and the bank does not read silence in favor of the client.

Part two of the plan. Do not move the money to another bank right after you receive the hold notice. The bank reads this behavior as an attempt to escape with risky funds. This behavior can turn a temporary hold into a full account closure. It can also lead the bank to send a suspicious transaction report to the financial intelligence unit. The financial intelligence unit is the state body that receives reports about suspicious transactions.

Part three of the plan. Keep the documents ready in advance. Prepare the documents that prove the source of funds, the business model, and the internal AML procedures before any request comes. Do not start collecting them only after the request arrives. How fast the company answers directly affects the outcome.

Part four of the plan. Know the escalation path inside the bank. Most banks have a separate internal channel for compliance disputes. The company should use this channel before the case goes to a financial ombudsman or to a court. A financial ombudsman is an independent body that reviews complaints of clients against financial institutions. Use the right channel on purpose, and do not write to general customer support at random.

Part five of the plan. Bring in a lawyer at once. Bring in a lawyer at the start of the hold, not as a last resort after the talks with the bank have stalled.

Here multi-banking matters again. A plan for a freeze works only if the company has another account to work from during the dispute. If the frozen account is the only account of the company, the plan cannot help much.

Why does the bank not explain its decision?

Founders often expect the bank to explain why it froze or closed an account. Often the bank cannot explain. In the European Union, the anti-money-laundering rules prohibit a bank and its staff from telling the client, or any other third person, that the bank has sent information about the client to the authorities. This rule is called the prohibition of tipping off. The rule comes from Article 39 of EU Directive number 849 of 2015 on the prevention of money laundering.

For this reason, a short answer from the bank, or no explanation at all, does not always mean that the bank is ignoring the client. Sometimes the bank is not allowed to say more. This is one more reason to prepare the documents in advance and to keep a second account.

Where should I start?

If your company is preparing to open a bank account now, start with two documents: proof of the source of funds of each beneficial owner and a realistic business plan. Then apply to a bank and to an EMI at the same time, not one after another. Do not keep all the money of the company and of its clients in one account.

Part II. Token and money

Chapter 4. Security token or utility token: legal status of your crypto token

The short answer. The legal status of a token does not depend on the code of the token. It depends on how the project sells the token, what the project promises the buyer, and who does the work after the sale. The same code can be a security, a means of payment, a key that gives access to a service, or none of these. The legal status of the token decides what license the project needs, to whom the project may sell the token, what the white paper must say, and which court will hear a dispute. This chapter explains how the United States, the European Union, and the United Kingdom classify tokens, what utility tokens, governance tokens, stablecoins, and NFTs are, how the other countries of this book name tokens, and why one token can have different legal statuses in different countries at the same time.

Why does the legal status of a token matter?

The legal status of a token is not a detail that the project can sort out later. The legal status is a fork in the road that decides almost everything that follows: what license the project needs, to whom the project can legally sell the token, what the white paper of the project must contain, and which court will hear a dispute if something goes wrong.

The exact same code behind a token can end up, legally, as a security, as a means of payment, as a simple digital key that gives access to a service, or as none of these. The difference almost never comes from the technology. The difference comes from three things: how the project sells the token, what return the project promises, and who does what after the sale.

How does the United States decide whether a token is a security?

In the United States, the main tool for deciding whether an asset is a security is the Howey test. The US Supreme Court created this test in 1946 in the case SEC versus W. J. Howey Company. The case was about the sale of plots in a citrus grove in Florida.

The Howey test has four parts. An asset is an investment contract, and therefore a security, if all four parts are present at the same time.

First, a person invests money.

Second, the money goes into a common enterprise, meaning a shared business.

Third, the person reasonably expects a profit.

Fourth, the profit comes from the efforts of other people, not from the efforts of the buyer.

The US Securities and Exchange Commission, known as the SEC, applies this test to crypto assets without any special crypto law. The SEC simply applies an old framework created by a court to a new technology. This is why the same token can pass or fail the test depending on how the project actually sold it, not on what the token technically is. As Chapter 1 explains, at the time this chapter was written the United States still had no broad federal law on the crypto market.

Has the US position on tokens changed recently?

Yes. In 2025 and 2026, the SEC changed its approach to crypto in several steps.

The staff statements of 2025. In 2025, the staff of the SEC published several statements. In early 2025, the staff said that the offer and sale of meme coins do not fall under the Securities Act. A meme coin is a token that gets its value mainly from internet culture and community interest, not from a product or from the work of a team. Later in 2025, the staff published a statement on stablecoins and a statement that certain protocol staking activities are not securities offerings.

The speech of November 2025. On November 12, 2025, the Chairman of the SEC, Paul Atkins, gave a speech about a program called “Project Crypto.” In the speech, he described a possible token taxonomy, meaning a system of token categories.

The joint interpretation of March 2026. On March 17, 2026, the SEC and the Commodity Futures Trading Commission, known as the CFTC, issued a joint interpretation of how the federal securities laws apply to crypto assets. An interpretation is a document in which a regulator explains how it reads the law. The interpretation divides crypto assets into five categories.

The first category is digital commodities, also called network tokens, such as bitcoin and ether. A digital commodity is not a security when its value depends on how the network itself works, not on the management efforts of other people.

The second category is digital collectibles, such as NFTs and meme coins with limited functions. Digital collectibles are generally not securities. However, a collectible can become part of an investment contract if a project splits it into fractions or if its value depends on the management efforts of a team.

The third category is digital tools, meaning tokens that people use rather than hold as an investment, such as memberships, tickets, or credentials. Digital tools are not securities.

The fourth category is stablecoins, and their treatment depends on the facts. Payment stablecoins under the GENIUS Act are excluded from the definition of a security by the law itself. Chapter 1 explains the GENIUS Act. The interpretation does not decide the status of every other stablecoin.

The fifth category is tokenized securities. A tokenized security represents ownership of an instrument that already falls under the legal definition of a security, so a tokenized security remains a security.

An investment contract can end. The interpretation also explains that a token can stop being part of an investment contract. This happens when buyers can no longer reasonably see the promises of the issuer as attached to the token, for example because the issuer has completed the work that it promised, or has publicly abandoned it. After that moment, later trades in the token fall outside the securities laws. For this reason, the SEC encourages issuers to describe their planned work in detail: the timeline, the milestones, the resources needed, and a public announcement when the work is complete. The interpretation also says that validation and staking, wrapping of tokens, and certain airdrops generally do not involve an offer or sale of securities. An airdrop is a free distribution of tokens to many wallets.

The proposal of August 2026. On August 18, 2026, the SEC proposed new rules called “Regulation Crypto Assets.” The proposal would create special exemptions for raising money through investment contracts tied to crypto assets that are not securities themselves. A startup exemption would allow a project to raise up to 5 million US dollars once in a period of four years. A larger fundraising exemption would allow a project to raise up to 75 million US dollars in any 12-month period, in two tiers with different disclosure duties. The proposal would also create a safe harbor under which an investment contract ends when the issuer completes or permanently stops its essential management work and files a report with the SEC. Chapter 5 explains how to raise money for a crypto project.

What these documents mean for a project. The joint interpretation shows how the SEC and the CFTC read the law today. It is not a statute passed by Congress, and a court can still read the law differently. Regulation Crypto Assets is only a proposal at the time this chapter was written, not a final rule. A project should treat these documents as an important signal, but should not treat them as a guarantee. Check the current position of the SEC and the status of the proposal before you rely on them, because the thinking of US regulators on crypto has been changing faster in recent years than the industry has been able to follow.