# Is OTC crypto trading legal? Regulation by region

Trading crypto OTC as a client is lawful where crypto is. Running a desk needs a licence or registration: the US, EU, UK, Singapore and Dubai rules compared.

---


Yes: trading crypto over the counter is legal for a client wherever holding and trading crypto is itself lawful, because none of the regimes covered here bans the bilateral trade. What the law regulates is the business of doing it for others: a firm that runs an OTC desk needs a registration or a licence in the United States, the European Union, the United Kingdom, Singapore and Dubai, and each of the five sets its own test.

This article covers those five jurisdictions and no others. It is general information, not legal advice: rules change, each one below is described as its regulator publishes it, and whether a rule applies to your firm or your trade is a question for counsel in the place concerned.

OTC, or over the counter, means a trade agreed directly between two parties, or through a desk or a broker, instead of on an exchange order book. A desk that quotes you a price and trades against you from its own inventory acts as principal. A broker that finds the other side and passes your order on acts as agent.

<figure class="keyfacts">
<div class="keyfacts-grid">
<div><b>180 days</b><span>to register with the US financial intelligence unit after starting to transmit crypto as a business</span></div>
<div><b>10</b><span>crypto-asset services defined by the EU regulation, four of which describe what OTC desks and brokers do</span></div>
<div><b>25 October 2027</b><span>the date from which the UK regulator expects full authorisation to replace registration for crypto firms</span></div>
</div>
<p class="fig-src">Figures published by the Financial Crimes Enforcement Network, in the EU Markets in Crypto-Assets Regulation and by the Financial Conduct Authority.</p>
</figure>

## Is it legal to trade crypto OTC as a client?

Trading crypto OTC as a client is legal in the United States, the European Union, the United Kingdom, Singapore and Dubai, because the licensing rules in all five attach to the firm that provides the service and not to the customer who uses it. A fund, a treasury or a private holder that trades its own assets through a desk is a customer, not a regulated business.

That answer has three limits. The first is the line between trading for yourself and trading as a business: a holder who starts quoting prices to third parties, matching buyers with sellers for a fee, or moving other people's assets has started doing what the licensing rules describe, whatever it calls itself. The second is the law that applies to every person regardless of licence: sanctions, anti-money-laundering offences, fraud rules and tax. The third is the asset: a token that qualifies as a security or a financial instrument, and any derivative on a token, falls under a different rulebook from the one described here for spot trades.

## What changes when you run an OTC desk as a business?

Running an OTC desk as a business moves you from the client side of the rules to the provider side: in each of the five jurisdictions, a firm that exchanges crypto for money or for other crypto on behalf of customers must be registered or licensed before it trades, and must then run a compliance programme.

The table describes the general pattern across the five regimes, not a legal test.

| Activity | Typical legal position | Why |
| --- | --- | --- |
| Selling your own holdings through a desk | Client: no licence | You use a service; you do not provide one |
| Buying for your own balance sheet from a desk | Client: no licence | Same reason |
| Quoting two-way prices to customers from your own inventory | Provider: licence or registration | Exchange carried on as a business |
| Arranging trades between two customers for a fee | Provider in most regimes | Receiving, transmitting or executing orders for others |
| Holding customers' crypto before or after a trade | Provider: custody permission | Safeguarding assets for others |
| Introducing one client to a desk, once, without handling the trade | Depends on the regime and the facts | Some regimes cover introducing; others do not |

A broker that never touches the assets is not automatically outside the rules, because several regimes regulate the handling of orders as well as the handling of money. A group that trades only inside itself is treated differently: the EU regulation, for instance, does not apply to persons who provide crypto-asset services exclusively for their parent companies or their own subsidiaries.

## How is OTC crypto trading regulated in the United States?

In the United States, an OTC desk that accepts and transmits crypto as a business is a money transmitter under the Bank Secrecy Act and must register with the Financial Crimes Enforcement Network, known as FinCEN, as a money services business. Its customers have no registration duty for trading their own assets.

FinCEN set this out in its guidance of 9 May 2019 on business models involving convertible virtual currencies. The guidance sorts people into three roles. An exchanger is a person engaged as a business in the exchange of virtual currency. An administrator is a person engaged as a business in issuing a virtual currency. A user obtains virtual currency to purchase goods or services. In FinCEN's words, exchangers and administrators generally qualify as money transmitters, while users do not.

Three points of that guidance matter to an OTC desk.

- **Principal trading is covered.** FinCEN's guidance covers exchangers that are parties to the transactions using their own reserves, in crypto or in real currency, which is how a principal desk trades.
- **Individuals are covered.** A natural person who acts as a peer-to-peer exchanger must comply as a money transmitter, according to the guidance, regardless of the regularity or formality of the transactions. The exception FinCEN gives is for activity carried out on an infrequent basis and not for profit or gain.
- **Location does not help.** The guidance states that the requirements apply equally to domestic and foreign-located money transmitters doing business in the United States, even if the foreign-located entity has no physical presence there.

Once a desk is a money transmitter, the same guidance lists what follows. It must register with FinCEN within 180 days of starting to engage in money transmission. It must develop, implement and maintain an effective written anti-money-laundering programme. It must meet recordkeeping, reporting and transaction-monitoring obligations, including the filing of suspicious activity reports and currency transaction reports. And it must comply with the Funds Travel Rule, which requires information about the parties to travel with a transmittal of funds of $3,000 or more, or its equivalent in crypto.

## Do US states and other federal agencies add their own rules?

US states and other federal agencies do add their own rules: registration with FinCEN is a federal anti-money-laundering status, not a licence to operate in each state, and federal commodities law reaches fraud and manipulation in crypto markets.

New York is the best-known state regime. The New York State Department of Financial Services states that a person, whether an individual or a company, that engages in virtual currency business activity requires a licence under its virtual currency regulation, 23 NYCRR Part 200, commonly called the BitLicense. The department lists buying and selling virtual currency as a customer business, and performing exchange services as a customer business, among the covered activities. A firm may instead operate under a New York banking charter, such as a limited purpose trust company, with the approval of the Superintendent.

The same department confirms the client side of the picture. Consumers who hold virtual currency solely for investment purposes do not need the licence, and neither do merchants and consumers that use virtual currency solely for the purchase or sale of goods or services.

Other states have their own laws, and the rule in one state must not be carried over to the next; a desk checks each state where it has customers.

At federal level, the Commodity Futures Trading Commission has stated that virtual currencies such as Bitcoin have been determined to be commodities under the Commodity Exchange Act. The Commission says its jurisdiction is implicated when a virtual currency is used in a derivatives contract, or if there is fraud or manipulation involving a virtual currency traded in interstate commerce.

## How is OTC crypto trading regulated in the European Union?

In the European Union, an OTC desk needs authorisation as a crypto-asset service provider under the Markets in Crypto-Assets Regulation, known as MiCA, and the regulation applies in the same terms in every member state. Clients of the desk need no authorisation.

MiCA defines ten crypto-asset services. Four of them describe what desks and brokers do in an OTC trade.

- **Exchange of crypto-assets for funds.** MiCA defines it as the conclusion of purchase or sale contracts concerning crypto-assets with clients for funds by using proprietary capital. That is the principal desk selling Bitcoin for euros from its own book.
- **Exchange of crypto-assets for other crypto-assets.** The same activity when both legs are crypto, such as a stablecoin against another token.
- **Execution of orders for crypto-assets on behalf of clients.** The agency desk that works your order in the market.
- **Reception and transmission of orders for crypto-assets on behalf of clients.** The broker that takes your order and passes it to a desk.

The remaining six include custody and administration of crypto-assets on behalf of clients. A desk that keeps client assets between trade and settlement needs the custody service as well as the exchange service.

The recitals of MiCA state that crypto-asset services should only be provided by legal persons that have a registered office in a member state, and that certain firms already authorised under EU financial-services law may provide them after notifying their competent authority instead of obtaining a separate authorisation. An individual cannot hold the authorisation in a personal capacity.

The transition is over. According to the European Securities and Markets Authority, firms that were already operating under national rules could continue until 1 July 2026 at the latest, or until they were granted or refused a MiCA authorisation.

The same authority publishes the MiCA register, which includes a file of authorised crypto-asset service providers and a file of non-compliant entities. An authorisation names the services it covers, so the entry tells you whether the desk may exchange, execute, hold or only transmit.

## Can a desk outside the European Union serve EU clients?

A desk outside the European Union can serve an EU client without a MiCA authorisation only where the client approached the desk on the client's own initiative. The recitals of MiCA state that where a firm from outside the EU provides a service on the own initiative of a person established in the EU, the service should not be deemed to be provided in the EU.

The practical name for this is reverse solicitation, and it is an exception built on the facts of how the relationship started. The European Securities and Markets Authority has issued guidelines on reverse solicitation, and a desk that relies on the exception keeps the evidence of who contacted whom, when, and about which service.

For the EU client, the position is the usual one: no licence is needed to trade, and the client's own due diligence on a desk that holds no EU authorisation carries more weight.

## How is OTC crypto trading regulated in the United Kingdom?

In the United Kingdom, a cryptoasset business must register with the Financial Conduct Authority under the Money Laundering Regulations before it provides in-scope services, and a fuller authorisation regime is scheduled to take over. The registration covers cryptoasset exchange providers and custodian wallet providers that act in the course of business carried on in the UK.

The Financial Conduct Authority is explicit about what this registration is. It describes registration under the Money Laundering Regulations as a legal requirement to carry on business, and adds that it is not a recommendation or endorsement of the business. The regulator states that its responsibility under this regime is limited to anti-money-laundering and counter-terrorist-financing registration, supervision and enforcement, and that registration does not mean customers benefit from the protections of the Financial Ombudsman Service or the Financial Services Compensation Scheme.

Ownership is controlled as well as activity. A person who wants to acquire control of a registered cryptoasset firm must submit a change in control notification and wait for approval, and the regulator states that it is a criminal offence to acquire control of such a firm without that approval.

Marketing is a separate regime. The regulator states that the cryptoasset financial promotions rules apply to all firms marketing cryptoassets to UK consumers, regardless of whether the firm is based overseas. The rule is written for consumers, so the classification of each client decides whether a communication falls inside it.

The UK is the one jurisdiction of the five where the main rule is about to change. The Financial Conduct Authority states that firms carrying on the new regulated cryptoasset activities will need to be authorised under the Financial Services and Markets Act 2000, and that its final rules apply to firms granted that permission on or after 25 October 2027. Until then, registration is the status to check.

## How do Singapore and Dubai regulate OTC desks?

Singapore and Dubai both require a licence for the business of buying and selling crypto for customers: Singapore under its Payment Services Act, Dubai under the rulebook of its dedicated virtual-assets regulator.

**Singapore.** The Monetary Authority of Singapore regulates seven types of payment services under the Payment Services Act, and states that payment service providers must hold a licence to provide them in Singapore unless exempted. One of the seven is the digital payment token service. The authority describes it as covering the buying or selling of digital payment tokens, commonly known as cryptocurrencies, and its description extends to operating an exchange platform, transmitting tokens, providing custodian wallets and facilitating trades without holding the funds or the tokens. Arranging a trade is therefore inside the Singapore description even when the broker never holds anything.

**Dubai.** The Virtual Assets Regulatory Authority describes itself as the sole authority regulating virtual assets across Dubai's free zones and mainland, except within the jurisdiction of the Dubai International Financial Centre. The authority has identified eight activities that define its perimeter: advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement, and issuance. A firm seeking to offer any of them must apply for and receive a licence, and the authority says the same of a traditional-economy entity that wants to offer them in or from Dubai.

The rule above is the Dubai rule; it does not describe the financial centre inside Dubai or the other emirates of the United Arab Emirates.

## How do the five regimes compare?

The five regimes share one structure, a permission for the provider and none for the client, and differ on three things: what the permission is, who grants it, and what it covers beyond money-laundering controls.

| Jurisdiction | What a desk needs | Granted by | What the status covers |
| --- | --- | --- | --- |
| United States | Federal registration as a money services business, plus state licences | Financial Crimes Enforcement Network; state regulators | Anti-money-laundering duties federally; each state licence for that state |
| European Union | Authorisation as a crypto-asset service provider | The national authority of a member state | The named services, across the EU |
| United Kingdom | Registration, with authorisation from 25 October 2027 | Financial Conduct Authority | Anti-money-laundering supervision only, until the new regime |
| Singapore | Licence for the digital payment token service | Monetary Authority of Singapore | Payment services provided in Singapore |
| Dubai | Licence for each activity offered | Virtual Assets Regulatory Authority | Activities in or from Dubai, outside the financial centre |

The word used tells you something. A registration, as in the US federal regime and the current UK regime, is a money-laundering status. Neither a registration nor a licence is a guarantee of how a desk will perform on your trade.

## Which rules does one desk trigger with clients in five regions?

A single desk with clients in five regions triggers five separate analyses, because a permission obtained at home does not travel beyond the area its law covers. The worked example below is illustrative: the desk, the client numbers and the volumes are invented to show the mechanism.

The assumptions: a principal desk established and authorised in an EU member state for the exchange of crypto-assets for funds and for other crypto-assets. It has 40 active clients: 14 in the United States, 12 in the EU, 8 in the United Kingdom, 4 in Singapore and 2 in Dubai. Its annual volume is $600 million: $240 million with US clients, $150 million with EU clients, $120 million with UK clients, $60 million with Singapore clients and $30 million with Dubai clients.

<figure class="fig">
<figcaption><b>One desk, five analyses</b><span>Illustrative worked example: 40 clients, $600 million a year, desk authorised in the EU</span></figcaption>
<ol class="steps">
<li><b>EU clients: covered by the home authorisation</b>The 12 EU clients, 30% of the client list and $150 million or 25% of the volume, are served under the MiCA authorisation, provided each trade falls within the services it names.</li>
<li><b>US clients: federal registration, then the states</b>The 14 US clients are 35% of the list and $240 million or 40% of the volume. FinCEN's guidance applies to a foreign-located exchanger doing business in the United States, so the desk registers within 180 days of its first US business and then checks the licensing law of each state where a client is located.</li>
<li><b>UK clients: is business carried on in the UK?</b>The 8 UK clients are 20% of the list and $120 million or 20% of the volume. Registration attaches to business carried on in the UK, so the desk takes advice on whether its activity meets that test, and reviews every communication that could reach a UK consumer.</li>
<li><b>Singapore clients: is the service provided in Singapore?</b>The 4 Singapore clients are 10% of the list and $60 million or 10% of the volume. The licence is required to provide the service in Singapore, so the desk takes local advice on whether serving them from abroad does that.</li>
<li><b>Dubai clients: in or from Dubai?</b>The 2 Dubai clients are 5% of the list and $30 million or 5% of the volume. The desk has no office there; it takes local advice on whether its dealings amount to offering an activity in Dubai.</li>
</ol>
</figure>

The home authorisation answers the question for 12 of the 40 clients. The other 28, which is 70% of the client list and $450 million or 75% of the volume, sit in four regimes the authorisation does not reach.

## What does a licence or registration prove, and what does it not?

A licence or registration proves that a named legal entity has a named status for named activities with a named regulator on the day you look it up. It does not prove that the entity you are about to pay is that entity, that your trade falls within those activities, or that the desk will deliver.

Read the register entry itself, on the regulator's own site, and compare four things with your trade documents: the exact legal name, the activities or services covered, any restriction or condition, and the current status. A group often has one company that holds the permission and another that signs the trade and receives the funds.

<aside class="callout">
<span class="callout-label">Reading a register</span>
<h4>A registration is not an endorsement</h4>
<p>The Financial Conduct Authority says so in terms about its own cryptoasset register: registration is a legal requirement to carry on business, not a recommendation of the business. Read every regulator's register the same way: it confirms a status, and your own checks still have to be done.</p>
</aside>

The absence of an entry needs the same care. A fund or a treasury trading its own assets is often not a provider at all, so finding no licence for it proves nothing against it.

## When does an OTC trade fall under securities or derivatives rules?

An OTC trade falls under securities or derivatives rules when the asset traded is a security or a financial instrument, or when the contract is a derivative instead of an immediate exchange. Everything above describes spot trades in crypto-assets that are neither.

The EU draws the line in the text of MiCA: the regulation expressly excludes from its scope crypto-assets that qualify as financial instruments, which stay under the EU's existing financial-markets rules and need the permissions those rules require. MiCA also does not apply to crypto-assets that are unique and not fungible with other crypto-assets.

In the United States, the Commodity Futures Trading Commission's statement quoted earlier places derivatives on virtual currencies within its jurisdiction. An OTC forward, option or swap on a token is therefore a different regulatory question from a spot purchase of the same token.

The classification of a given token is a legal analysis of that token's features, and it can differ between two jurisdictions for the same asset. Where a trade involves a tokenised share, bond or fund unit, ask the desk which permission covers it, and take advice before agreeing terms.

## What should you check before your first OTC trade?

Before your first OTC trade, you check which side of the rules you are on, which permission the desk relies on for you, and whether the asset and the contract fit that permission.

- **Your own position.** Are you trading your own assets for your own account, in every trade of this relationship?
- **The desk's legal entity.** Which company signs the trade and receives the funds, and where is it established?
- **The permission relied on for you.** Which registration, authorisation or licence covers a client in your country, or which exception does the desk rely on, and what evidence supports it?
- **The register entry.** Looked up by you on the regulator's own register, with the date, the exact name, the services covered and the status saved to the file.
- **Principal or agent.** Does the desk trade against you from its own book or arrange the trade with a third party?
- **The asset and the contract.** Is the token a plain crypto-asset in each jurisdiction involved, and is the trade spot?
- **Change.** A date in your file for checking the status again, because registers are updated and at least one of the five regimes changes its main rule on a fixed date.