How to Start a Crypto Business

Cryptocurrency businesses in the United States often face oversight from several regulators at once, depending on the products they offer. Knowing which regulators apply to you is the first step in building a workable filings strategy.

Several federal agencies play a role. The Financial Crimes Enforcement Network (FinCEN) treats most businesses that exchange, transmit, or administer convertible virtual currency as money services businesses (MSBs). Those businesses must register and run a Bank Secrecy Act (BSA) program. The Securities and Exchange Commission (SEC) views many tokens as securities, which can pull token issuers, broker-dealers, and trading platforms into the securities framework. The Commodity Futures Trading Commission (CFTC) treats Bitcoin and Ether as commodities and regulates derivatives on digital assets. The Internal Revenue Service treats virtual currency as property for tax purposes, which has filing implications for both the business and its customers.

States add another layer. Most regulate the receipt, holding, and transmission of fiat and digital assets on behalf of others through their money transmitter laws. A growing number have updated those statutes to address virtual currency directly, or have enacted standalone digital asset frameworks. Cornerstone helps crypto founders build a regulatory map specific to their product surface area before they file the first application.

Most US-based crypto exchanges, custodial wallet providers, and payment platforms register with FinCEN as money services businesses. Registration is filed on FinCEN Form 107 and is typically renewed every two years. The registration itself is straightforward. The obligations that come with it are extensive.

A crypto MSB is generally expected to run a written BSA/AML program sized to its risk profile. The core pillars usually include a designated BSA officer with day-to-day responsibility for the program. They include written policies and procedures for customer identification and transaction monitoring. They also include ongoing employee training, independent testing or audit on a regular cadence, and a documented risk assessment that is updated as the business changes.

Reporting obligations sit on top of the program. These include Currency Transaction Reports for cash transactions above $10,000 and Suspicious Activity Reports when activity meets the reporting thresholds. They also include recordkeeping for transmittals of funds and certain virtual currency transactions under the Recordkeeping and Travel Rules. Crypto businesses also screen counterparties against the sanctions lists maintained by the Office of Foreign Assets Control (OFAC), and they block or reject transactions that hit a match.

State money transmitter laws are the dominant licensing layer for crypto businesses in the United States. The treatment varies significantly from state to state, and a business model that is exempt in one state can be a licensed activity in the next. Building a state-by-state matrix early helps avoid expensive mid-launch pivots.

New York remains one of the most consequential states for any crypto business with US customers. That comes down to the size of the market and the depth of the New York Department of Financial Services (NYDFS) framework.

The BitLicense is codified at 23 NYCRR Part 200. It applies to any business engaged in virtual currency business activity involving New York or a New York resident. Covered activity includes receiving virtual currency for transmission, storing or holding it on behalf of others, buying and selling it as a customer business, performing exchange services, and controlling, administering, or issuing a virtual currency.

The application is detailed. It typically requires a thorough business plan and written policies covering AML, cybersecurity, capital adequacy, business continuity and disaster recovery, complaint handling, and consumer protection. It also requires biographical and background materials on each principal, audited financials, fingerprint cards for control persons, and a cybersecurity program that satisfies 23 NYCRR Part 500.

An alternative pathway is the New York limited purpose trust company charter, which several major crypto custodians have used. A trust charter typically carries higher capital and governance expectations than a BitLicense. In return, it lets the business hold customer assets as a fiduciary and passport into other states more easily through trust company recognition. NYDFS also maintains a Greenlist of pre-approved coins. Listing a coin outside the Greenlist generally requires a separate coin-listing approval or self-certification process.

Capital requirements for crypto businesses can be significant, and they typically stack across the states where the business is licensed.

Crypto BSA/AML programs share the same statutory pillars as any other MSB program, but the operational tooling looks very different. Regulators and examiners increasingly expect crypto businesses to use blockchain analytics, address screening, and on-chain transaction monitoring alongside traditional fiat controls.

A practical crypto BSA/AML program is generally expected to cover several fronts. It runs risk-based customer due diligence and enhanced due diligence with documented thresholds. It integrates blockchain analytics for wallet screening and source-of-funds checks. It calibrates monitoring rules to typologies common in digital asset abuse, such as mixers and tumblers, sanctioned protocols, darknet exposure, ransomware addresses, and structuring across wallets. It builds Travel Rule capability for transmittals at or above the applicable thresholds. It screens for sanctions and politically exposed persons at onboarding and on an ongoing basis. It also ties a clear SAR investigation and filing workflow to the monitoring output.

The FinCEN Travel Rule, the Treasury sanctions framework, and state-specific examination manuals all reward businesses that can show working controls rather than paper policies. Cornerstone helps crypto businesses select analytics vendors, draft the procedures that wrap around them, and prepare for the BSA examinations that follow licensure.

Whether your business takes custody of customer assets is the single most important business model question for US crypto licensing.

Crypto regulators evaluate technology and security with a level of scrutiny rarely applied to other financial services categories. The application package, the pre-licensing review, and the ongoing examinations all probe the same set of controls.