An overview of virtual asset regulatory regimes in popular jurisdictions in North America, Europe, Asia and the Middle East for top centralised crypto exchanges (CEXs)
Considering the fragmented landscape of virtual asset regulation globally, many virtual asset service provider (VASP) institutions have established legal entities in more than one country in order to service an international customer base.
At the end of 2024, VASPnet published a comprehensive report covering insights on the regulatory footprint of the world’s top 100 centralised crypto exchanges (CEXs) globally. In assessing regulatory reference data from 95 regulators and public authorities in 75 different countries, VASPnet identified regulatory data on 88 of the top 100 CEXs from 64 regulatory authorities in 54 countries.
In February 2025, VASPnet refreshed the data on the most popular jurisdictions for top CEXs and identified the most VASP legal entities in the countries listed in the table below.
For the purposes of this article, an anti-money laundering and countering the financing of terrorism (AML/CFT) regime refers to the application of AML/CFT requirements to certain virtual asset activities.
A wider market regime refers to a virtual asset regulatory regime that addresses wider consumer protection, market conduct or prudential requirements in addition to AML/CFT requirements.
*Considers the Markets in Crypto-assets (MiCA) Regulation’s transitional period for existing regulated entities in EU countries.
The article below summarises the scope of supervision in each of the popular countries for top CEXs and notes key changes over the last three months since the data was last reported in November 2024.
North America led the world in the total number of top CEXs with regulated VASP entities, with 64 in the United States and 22 in Canada, respectively.
In the United States, all 64 VASP entities have registered with the Financial Crimes Enforcement Network (FinCEN) and are subject to anti-money laundering and countering the financing of terrorism (AML/CFT) requirements.
Nine of these 64 VASP entities are also subject to wider market requirements. In Louisiana, Crypto.com, CEX.IO, OKX, Kraken and Pionex are virtual currency licensees and are supervised by the Louisiana Office of Financial Institutions (LOFI). In New York, Bitflyer and Gemini hold Bitlicenses and are supervised by the New York Department of Financial Services (NY DFS). Coinbase and Bitstamp have a VASP entity regulated in both Louisiana and New York.
In Canada, all 22 VASP entities are registered with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) and are subject to AML/CFT requirements. Since the data was last assessed at the end of 2024, Coinbase’s Canadian entity, Coinbase Canada Inc., is now no longer regulated, bringing the total number of regulated VASP entities down from 23 to 22.
As the implementation of the Markets in Crypto-assets (MiCA) Regulation rolls out across the European Union, many top CEXs have existing regulated VASP entities that will benefit from various “grandfathering” periods before they are required to fully comply with MiCA. In such cases, these VASP entities will remain subject to AML/CFT requirements in their respective Member States and not subject to MiCA’s wider market regime until their respective deadlines.
Since the regulatory data on top CEXs was last assessed at the end of last year, we’ve identified additional VASP entities that achieved AML/CFT registrations in the EU just in time to benefit from a grandfathering period.
In Italy, three additional VASP entities (associated with Whitebit, Bitget, and Binance) are now regulated, bringing the total number to 17. The country currently has the most VASP entities of top CEXs than any other country in the EU.
Lithuania comes in second with 15 VASP entities, followed by Spain with 11 and Poland with 10. Bitmarkets registered one additional VASP entity in Poland since the end of last year.
France and the Netherlands both have nine regulated VASP entities that will benefit from 18-month and 6-month grandfathering periods, respectively.
All nine of the VASP legal entities in France were registered as digital asset businesses prior to 1 July 2023 and are not currently subject to the wider market legislation[2] for digital asset service providers that applied to new market entrants following that date.
From the beginning of this year, three MiCA authorisations were granted to crypto-asset service providers (CASPs) in the Netherlands. However, none of these authorisations are associated with top CEXs.
Ireland has seven VASP entities associated with top CEXs, which has increased by one since the data was last reported. The Central Bank of Ireland (CBI) is now regulating a VASP entity associated with Hashkey.
In the United Kingdom, a jurisdiction in Europe that is not subject to MiCA, the Financial Conduct Authority (FCA) has approved the registration of Coinbase’s UK entity as of February 2025, bringing the UK’s total number of VASP entities from top CEXs to seven. VASPs in the UK are currently subject to AML/CFT requirements, and a wider market regime is expected sometime in 2026.
Türkiye is the most popular country in the Asia Pacific (APAC) region for top CEXs with 12 regulated VASP entities. Türkiye subjects regulated VASPs to wider consumer protection and market conduct requirements at the federal level.[3]
In South Korea, Singapore, and Hong Kong, the other most popular jurisdictions for top CEXs in the APAC region, regulatory regimes with wider market requirements for virtual assets are in place.
South Korea has seven VASP entities regulated by the Financial Services Commission. Six VASP entities in Singapore are regulated under the Payment Services Act and hold licenses from the Monetary Authority of Singapore (MAS). Six VASP entities in Hong Kong hold licenses from the Securities and Futures Commission (SFC).
In the United Arab Emirates (UAE), Dubai and Abu Dhabi have distinct, wider market regulatory regimes for virtual assets. Dubai’s market falls under the oversight of the Virtual Assets Regulatory Authority (VARA), while Abu Dhabi’s is governed by the ADGM Financial Services Regulatory Authority. Since the last update on the regulatory status of major CEXs, VARA has issued three additional in-principal licenses to VASPs associated with Gate, HashKey, and Bybit, raising the total number of regulated VASP entities in the UAE to nine.
While most popular jurisdictions for top crypto exchanges are now subjecting VASPs to wider consumer protection and market conduct requirements, the majority of the VASP entities associated with top international VASP institutions are concentrated in jurisdictions where they are still only subject to AML/CFT requirements at the federal level.
As countries continue to implement and develop regulatory regimes, the landscape of VASPs is constantly shifting. Firms must monitor the global regulatory footprint of VASP counterparties, partners or clients in real-time in order to inform risk-based decisions and leverage accurate market data.
For access to more comprehensive data on the world’s regulated VASPs, please write to us at contact@vaspnet.com.
[1] The UK's FCA brought virtual assets within the scope of the financial promotions regime in October 2023, but this is a complementary regulation and the existing registration regime currently only addresses AML/CFT requirements.
[2] Loi numéro 2023-171 du 9 mars portant diverses dispositions d'adaptation au droit de l'Union européenne dans les domaines de l'économie, de la santé, du travail, des transports et de l'agriculture.
[3] Entities currently regulated there have, “declared that they will operate in accordance with the Temporary Article 11 of the Capital Markets Law No. 6362 (Law)” as stated in Amendments to the Capital Markets Law. (Source)
