State Money Transmitter Licensing for Crypto: The Patchwork Compliance Challenge

OKX processed over $1 trillion in U.S. customer transactions. Without a money transmitter license. For six years.

On February 24, 2025, the operating entity behind the world’s third-largest crypto exchange — Aux Cayes Fintech Co. Ltd — pleaded guilty to operating an unlicensed money transmitting business and agreed to pay $505 million in fines and forfeited fees. The company also committed to retaining an external compliance consultant through February 2027. For good measure, the DOJ noted that OKX employees had actively helped U.S. customers bypass geographic restrictions using VPNs.

The case wasn’t unusual in its substance — it was unusual in its scale. The legal framework it applied, 18 U.S.C. § 1960, which criminalizes operating an unlicensed money transmitting business, has been on the books for decades. State money transmitter laws have covered crypto in most jurisdictions for years. The “we’re offshore and didn’t know” defense stopped working a long time ago.

What makes 2025-2026 different is that the regulatory infrastructure is catching up to the enforcement posture. California’s new Digital Financial Assets Law takes effect July 1, 2026. Pennsylvania reversed its position in 2024. Illinois passed comprehensive digital asset regulations in 2025. The patchwork is getting denser.

TL;DR:

• 49 states require money transmitter licenses for crypto businesses — Montana is the only exception
• OKX’s $505M guilty plea in February 2025 confirms that offshore operations don’t create a U.S. licensing exemption
• New York BitLicense (12–24 months), California DFAL (effective July 1, 2026), and standard MTLs create a three-tier licensing challenge
• All-state licensing costs $710K–$1.95M upfront; sequencing strategy matters as much as the applications themselves

The Two-Layer Problem: Federal and State

Crypto money transmission compliance operates on two parallel tracks that both require attention.

Federal layer — FinCEN MSB registration: Any business that qualifies as a Money Services Business under 31 C.F.R. § 1010.100 must register with FinCEN. For crypto businesses, the relevant MSB categories are money transmitter (if you transfer value on behalf of customers) and dealer in foreign exchange (if applicable). FinCEN registration is federal and doesn’t substitute for state licenses — it’s the floor, not the ceiling.

OKX failed at both levels: no FinCEN MSB registration and no state money transmitter licenses. But FinCEN registration is relatively straightforward. The state-level challenge is where compliance complexity compounds.

State layer — money transmitter licenses in 49 states: Each state has its own application, bonding requirements, net worth thresholds, annual reporting obligations, and renewal process. Montana doesn’t require an MTL. Every other state does, though the specific requirements for how crypto fits vary substantially.

The Regulatory Tiers: New York, California, and Everyone Else

Tier 1: New York BitLicense

New York’s BitLicense, administered by the Department of Financial Services, is the most stringent crypto-specific license in the United States. Requirements include:

• Application fee: $5,000
• Processing time: 12–24 months (realistically closer to 24 for first-time applicants)
• Surety bond: Minimum $500,000, scaled to business volume
• Cybersecurity program: Extensive documentation required, aligned with NYDFS Cybersecurity Regulation (23 NYCRR 500)
• AML/BSA program: Full program submission and review
• Capital requirements: NYDFS discretion based on the nature and volume of business
• Annual examination: NYDFS conducts ongoing supervisory exams of BitLicense holders

If you have any customers in New York — and you almost certainly do if you’re operating at any meaningful scale — you need either a BitLicense or an arrangement with a licensed entity. Blocking New York IP addresses isn’t a compliance strategy; OKX tried that with VPN carve-outs and it ended with a $505M check.

Start your New York application before any other state. It will be processing while you complete the faster-turnaround states.

Tier 2: California DFAL (Effective July 1, 2026)

California’s Digital Financial Assets Law (DFAL), administered by the Department of Financial Protection and Innovation (DFPI), takes effect July 1, 2026 — which is very soon. This is not a future planning item; applications should be in process now.

DFAL requirements beyond the standard MTL include:

• Reserve requirements: 100% customer liability reserves, with specific cold storage mandates
• Proof-of-reserves: Mandatory quarterly reporting
• CPA examinations: Quarterly reserve examinations by an independent CPA
• Recordkeeping: Five-year retention requirement
• Token listing review: Securities analysis for each digital asset listed on any exchange operating under DFAL
• Order book surveillance: Trading surveillance systems required for exchange operations
• Enhanced cybersecurity: Incident response requirements beyond standard MTL

California is the largest state by GDP and population. If you’re serving U.S. retail customers, you have California customers. The DFAL’s reserve and proof-of-reserves requirements directly address the failure modes that led to the FTX collapse — California explicitly designed this law in response to 2022’s crypto market crisis.

Tier 3: Standard MTL States

The remaining 47 states (excluding Montana) require standard money transmitter licenses. Requirements vary but share common elements:

States That Changed the Rules Recently

The regulatory environment has been moving fast. Key developments since 2024:

Pennsylvania (Effective October 15, 2024): Pennsylvania reversed its prior position and now classifies virtual currency as “money” under the state’s Money Transmission Business Licensing Law. Businesses that were operating under the assumption that PA didn’t require an MTL for crypto needed to get licensed by October 2024.

Illinois — Digital Assets and Consumer Protection Act (2025): Illinois enacted comprehensive digital asset regulations in 2025, adding consumer protection requirements on top of existing MTL obligations. Illinois now requires disclosures about digital asset risks, transaction fees, and the irreversibility of transactions.

Oklahoma (Effective November 1, 2025): Oklahoma now explicitly requires MTLs for crypto ATM operators. Additional requirements include advance notice before placing or relocating kiosks, quarterly reporting of kiosk locations, daily transaction limits for new customers, and mandatory fraud monitoring tools.

Massachusetts (Effective November 2025): Massachusetts finalized comprehensive money transmission regulations requiring tangible net worth thresholds tied to statutory liabilities, permissible investments matching outstanding obligations, and audited financial statements. These apply to crypto businesses transmitting value in the state.

Maine (Consent Agreement, January 2026): Maine entered a consent agreement with a bitcoin kiosk operator regarding unlicensed activity, emphasizing that operators must verify wallet control rather than relying solely on customer representations.

The MTMA: Partial Harmonization

The Money Transmission Modernization Act (MTMA) is a uniform state law that 31 states have adopted in whole or in part. The MTMA creates standardized application procedures, examination protocols, and licensing requirements across signatory states — theoretically reducing the burden of multi-state licensing.

The catch: the MTMA’s virtual currency provisions are optional. States including Virginia, Mississippi, and Colorado excluded them. This means that even among MTMA states, crypto-specific treatment varies. The MTMA reduces compliance complexity for standard payment transmission; its benefit for crypto businesses is more limited.

States where MTMA adoption is most complete include South Carolina, Wisconsin, and Kansas (all effective January 1, 2025). For multi-state licensing strategy, MTMA states with full adoption should be processed first — the standardized applications move faster.

The Wyoming Alternative: SPDI Charter

Wyoming offers a Special Purpose Depository Institution (SPDI) charter — an alternative to money transmission licensing that functions as a form of banking charter specifically designed for digital asset businesses. Four institutions have been chartered: Kraken Bank (Kraken Financial), Avanti Financial, WY Deposit & Transfer Co., and Commercium Financial.

An SPDI charter doesn’t substitute for MTLs in other states — Wyoming’s charter doesn’t provide federal preemption of state licensing requirements. But it does provide a regulated banking framework for custody and asset management operations, which may be preferable to operating under MTL limitations for certain business models.

States with Notable Crypto-Specific Frameworks

Beyond New York and California, several states have enacted or proposed distinct frameworks:

Texas — Requires standard MTL with explicit guidance that virtual currency transmission is covered. The Texas Department of Banking has published supervisory guidance on crypto business expectations. Fee: $10,000. Processing: 3–6 months for standard applications.

Florida — One of the faster-processing states. Application fee: $375. Processing: 60–90 days with complete application. Florida’s MTL expressly covers virtual currency under its “monetary value” definition.

New Hampshire — Businesses “solely dealing in convertible virtual currency” are exempt from MTL requirements. One of the few genuine state-level exemptions for crypto.

Alaska, Utah, Wyoming, Montana — Offer partial or complete exemptions for specific cryptocurrency activities, though scope of exemptions varies significantly.

Common Mistakes That Create Liability

1. “We block U.S. IP addresses” — The OKX lesson

OKX implemented geo-blocking and claimed it wasn’t operating in the U.S. The DOJ found that OKX employees knew U.S. customers were bypassing the restrictions with VPNs and didn’t stop it. A geographic restriction that isn’t enforced — or that you know is being circumvented — doesn’t create a licensing exemption. If you have U.S. customers transacting on your platform, you need U.S. licenses. Full stop.

2. Federal registration as a substitute for state licenses

FinCEN MSB registration is required and important. It is not a substitute for state licenses. The “we’re registered with FinCEN” defense has never worked in state enforcement, and 18 U.S.C. § 1960 covers operating without state licenses as a federal crime independent of FinCEN status.

3. Assuming the MTMA covers crypto automatically

MTMA adoption means harmonized procedures — it doesn’t mean crypto is automatically covered or that virtual currency-specific requirements don’t apply. Always verify the specific state’s treatment of virtual currency transmission, even in MTMA states.

4. Not updating the licensing analysis as states change their positions

Pennsylvania 2024, Illinois 2025, Oklahoma 2025 — states are actively changing their positions on crypto licensing. A licensing analysis done in 2022 is outdated. If you haven’t reviewed your state coverage in the last 12 months, do it now.

Building Your Licensing Strategy

The sequencing of a multi-state licensing program matters as much as the applications themselves.

Phase 1 (Months 1–3): File New York and fastest-processing states

File New York first because it’s the longest. Simultaneously file in states with 60–90 day processing times and complete application requirements: Florida, South Carolina, Wisconsin, Kansas. These will be approved while NY processes.

Phase 2 (Months 3–9): Core market states

File in your highest-revenue states by customer volume: Texas, California (DFAL ahead of July 1, 2026 deadline), Illinois. These take 3–9 months typically.

Phase 3 (Months 9–18): Remaining states

Complete the remaining states in order of your customer concentration. Montana doesn’t require a license; start with the most commercially relevant of the remaining states.

Total cost estimate:

These figures include application fees, surety bond premiums, legal fees, and compliance staff costs. They don’t include the cost of building the underlying compliance programs — AML, cybersecurity, consumer protection — that the applications require.

So What? The Compliance Case for Getting Licensed Now

The OKX outcome wasn’t exceptional. Binance’s $4.3 billion settlement in 2023 covered similar territory. BitMEX’s founders pleaded guilty to BSA violations. The enforcement pattern is consistent: exchanges that operate in the U.S. without licenses, even if they think they’re outside U.S. jurisdiction, eventually face U.S. enforcement.

The licensing environment is getting harder, not easier. California’s DFAL effective date is July 1, 2026. States continue to close exemptions and clarify that crypto is covered under existing MTL statutes. The GENIUS Act’s federal stablecoin framework, which passed in 2025, creates new federal obligations that layer on top of state licenses rather than preempting them.

If you’re launching a crypto business or a product with crypto components — a stablecoin, a crypto custody feature, a digital asset exchange — a new product risk assessment should include a licensing analysis that covers both FinCEN MSB registration and the full state MTL picture.

Reg E compliance for crypto platforms and state AG enforcement on UDAAP add additional layers on top of the licensing requirement. The licensing analysis is the starting point, not the whole picture.

If you’re assessing the compliance requirements for a new crypto product or feature, the New Product Risk Assessment includes a worked stablecoin example that covers the licensing, consumer protection, and regulatory risk dimensions of launching a digital asset product.

FAQ

If we only accept crypto from customers and don’t convert to fiat, do we still need an MTL?

Likely yes. Most state MTL statutes cover “transmission of monetary value” broadly, and regulators have consistently interpreted this to include crypto-to-crypto transfers when done on behalf of customers. The “no fiat conversion” argument has been rejected by multiple state regulators. Always get state-specific legal analysis before relying on any exemption theory.

Does the GENIUS Act change our state licensing obligations?

The GENIUS Act (passed 2025) creates a federal framework for payment stablecoins. For stablecoin issuers, it provides a pathway to federal oversight as an alternative to multi-state MTL requirements — but this pathway is not yet operational, and state licenses may still be required in the interim. For non-stablecoin crypto transmission, GENIUS Act doesn’t reduce state licensing obligations.

What’s the difference between an MSB (FinCEN) and an MTL (state)?

FinCEN MSB registration is federal, required for any qualifying money services business, and covers your federal BSA/AML obligations. State MTLs are separate, state-by-state licenses that authorize you to conduct money transmission operations in that state. You need both. FinCEN MSB registration doesn’t substitute for state MTLs, and state MTLs don’t substitute for FinCEN registration.

We use a licensed third-party payment processor. Does that cover us?

Only if your arrangement explicitly provides for the processor’s license to cover your activities — and only in states where that kind of agency relationship is recognized. Many crypto businesses attempt to operate under a payment processor’s license; regulators have challenged this approach in enforcement actions. Get written legal analysis of whether your specific arrangement provides genuine license coverage before relying on it.

How do we prioritize states if we can’t afford to license everywhere at once?

Prioritize by customer concentration and enforcement history. New York first (always — the application timeline demands it). Then your highest-revenue states. Then states with active enforcement: states that have recently taken action against unlicensed businesses (Maine, Oklahoma, and others). Avoid creating the impression of actively circumventing licensing requirements in states where you have significant customer activity.