MSB registration, state money transmitter licenses, VASP, EMI, and PSAV compared: who needs each, what triggers it, and when your provider covers you.
A stablecoin payment flow needs a license wherever someone accepts money from one party and moves it to another. In the US that means FinCEN MSB registration plus state money transmitter licenses. The EU requires MiCA authorization, and Brazil a PSAV. A business that pays and gets paid through a licensed provider usually needs none of them.
This article is general information, not legal advice. Licensing turns on your exact structure, so confirm your obligations with qualified counsel before launch.
Key takeaways
The types of stablecoin APIs guide explains who holds funds in each provider model. This page answers the follow-up question: which license sits behind each role.
Five regimes cover most stablecoin payment flows into and out of the Americas and Europe: US federal registration, US state licensing, MiCA, EU e-money, and national VASP regimes like Brazil's.
| License or registration | Region | Who grants it | Who needs it | Typical trigger |
|---|---|---|---|---|
| MSB registration | United States (federal) | FinCEN | Money transmitters, currency dealers, and other money services businesses, including foreign firms doing business in the US | Accepting and transmitting funds or value for others |
| Money transmitter license (MTL) | United States (each state) | State financial regulators | Firms transmitting money for residents of that state | Same activity, assessed state by state |
| CASP authorization | European Union | National competent authority under MiCA | Firms exchanging, transferring, or holding crypto-assets for EU clients | Providing crypto-asset services in the EU |
| Electronic money institution (EMI) | European Union | National competent authority under the E-Money Directive | Issuers of e-money, including e-money tokens under MiCA | Issuing a euro or dollar stablecoin to the public |
| PSAV authorization | Brazil | Banco Central do Brasil | Firms providing virtual asset services to people in Brazil, onshore or offshore | Exchanging, transferring, or holding virtual assets for Brazilian clients |
The UK runs its own regime: cryptoasset firms register with the FCA under the money laundering regulations today, and the FCA's new cryptoasset regime expands authorization from October 25, 2027, with applications open from September 30, 2026 to February 28, 2027.
MSB status is a federal registration with FinCEN, and a money transmitter license is a state permission. They stack. They don't replace each other.
The federal layer. Under 31 CFR 1010.100(ff)(5), money transmission means accepting currency, funds, or other value that substitutes for currency from one person and transmitting it to another location or person by any means. FinCEN's 2019 guidance on convertible virtual currency (FIN-2019-G001) confirms that stablecoins count as value that substitutes for currency.
A money services business registers under 31 CFR 1022.380:
Registration comes with a full AML program: policies, a compliance officer, training, and independent review.
The state layer. Each state licenses money transmitters separately, with its own capital, bonding, and examination rules. The Conference of State Bank Supervisors drafted the Money Transmission Modernization Act to standardize net worth, surety bond, and permissible investment requirements. As of September 2026, CSBS reports that 31 states have enacted it in full or in part. Everywhere else, the old state rules still apply.
That's why US licensing takes years to build. One federal filing, then dozens of state applications.
No. VASP is a category FATF created in 2019, and each country decides which license a VASP needs.
The FATF activity list is short: exchanging virtual assets for fiat or for other virtual assets, transferring them, safekeeping them, and taking part in issuance. The VASP explainer walks through each one.
What changes is the implementation:
So "are you a licensed VASP?" is an incomplete question. Ask which regime, in which country, for which activity.
You need an EMI license, or a banking license, to issue a euro or dollar stablecoin to the public in the EU. Not to hold or spend one.
MiCA Article 48 says a person may not offer an e-money token to the public in the EU unless it is the issuer and is authorized as a credit institution or an electronic money institution. The E-Money Directive sets the EMI baseline, including initial capital of at least EUR 350,000.
That's why Circle holds an EMI license in France for USDC and EURC, and why exchanges restricted USDT for EU clients. MiCA stablecoin rules explained has the details. For a payments company, the EMI question is mostly about your supplier: is the stablecoin you move issued by an authorized EMI, and is your provider authorized to handle it?
The trigger is control over someone else's money in transit. The activity matters, not what you call your company.
Activities that usually trigger licensing:
Activities that usually don't:
One trap catches crypto payment processors. US rules exempt payment processors that facilitate the purchase of goods through a clearance and settlement system by agreement with the seller. FinCEN's 2019 guidance says CVC payment processors are money transmitters anyway, because they don't meet every condition, including running through settlement systems that admit only BSA-regulated financial institutions. A public blockchain isn't one.
A provider's license covers what the provider does for the parties it has onboarded. It doesn't stretch to customers it can't see.
| Your setup | Who is moving the money | Licensing exposure |
|---|---|---|
| You pay your own contractors through a provider | The provider, for you | Low. You're the provider's customer |
| You collect stablecoins for your own sales | You receive, the provider converts | Low. You're a user |
| Your platform onboards each end customer directly with the provider | The provider, for each verified customer | Lower. The provider can see every party |
| You pool users' money in one provider account and pay out on their behalf | You | High. You may be transmitting for others |
| Your app holds user stablecoin balances in wallets you control | You | High. You're custodying value for others |
The pooled row is the one that surprises teams. Money moving through your account for parties the provider never verified looks, to the provider, like your own activity. To a regulator, it looks like unlicensed transmission. Who owns compliance in a crypto on-ramp runs the same test from the on-ramp side.
BlindPay draws that line explicitly: its nested payments rule bars customers from moving money for any party BlindPay hasn't onboarded or can't see. A platform that needs to serve its own customers can open a separate instance and onboard them directly, so every party sits inside the verified flow.
Responsibility splits, but it never disappears. This matrix assumes you don't hold customer funds and every party is onboarded with the provider.
| Duty | You | Provider | Shared |
|---|---|---|---|
| Onboarding (KYC and KYB) | Collect accurate data, describe your business truthfully | Verify identity, ownership, and documents | Keep data current when it changes |
| Sanctions screening | Follow OFAC and local sanctions as a business | Screen customers, counterparties, and wallets | Escalate matches fast |
| Transaction monitoring | Watch for misuse of your own product | Monitor payments flowing through its platform | Answer information requests |
| Suspicious activity reporting | File your own reports if you are a regulated entity | File reports on activity it sees | Cooperate on investigations |
| Record retention | Keep invoices, contracts, and approvals for each payment | Keep transaction and KYC records under its own rules | Produce records for audits |
| Disputes and complaints | Handle your end users' complaints | Handle failed or returned payments | Agree on who answers first |
The left column never goes to zero. A merchant accepting stablecoins still owns sanctions compliance and tax records, even without a license.
Eight questions cover most of the licensing risk:
BlindPay runs KYC, KYB, sanctions screening, and travel rule checks inside the payment flow, before money moves, and publishes its license status on its licenses page. The KYC requirements are in the KYC reference.
Start with question 3. Draw your fund flow on one page, mark every moment your company touches someone else's money, and take that diagram to counsel.
The evidence examiners expect from automated risk monitoring: a 10-item evidence table, good vs poor practice, SAR timelines, RFIs, and a 30-day plan.
Blockchain payments are legal for businesses in the US, EU, UK, Brazil, and Mexico, under different rules. What each country regulates, as of October 2026.
Stablecoin transfers settle final in minutes and cannot be reversed. That finality proves custody at every step, but it also opens a fraud gap on the fiat side of the payment.