The Jurisdictional Map of Institutional Crypto: VARA, MiCA, MAS, and the End of Regulatory Arbitrage

For most of the history of cryptocurrency, the regulatory question for an exchange was "where can we operate." That phrasing is now out of date. Operating somewhere is no longer the same thing as operating credibly. An exchange registered in a jurisdiction with no active supervision is increasingly indistinguishable, in the eyes of an institutional counterparty, from an exchange registered nowhere at all. The new question is "where are we supervised, and how does that map onto our clients' risk policies."

This article is a working map of the jurisdictions that matter in 2026 for institutional crypto, with a particular focus on the ones TX24 operates under and the ones we read closely. It is not a legal opinion. It is a perspective from the inside of a regulated venue trying to be useful to clients who themselves are regulated.

Why "licensed" is no longer enough on its own

There is a tier of crypto exchanges that hold a license — sometimes several licenses — in jurisdictions whose supervisory regimes are minimal. The license is real. The supervision is not. For most retail clients, this distinction is invisible and probably does not matter. For an institution whose policy committee will not approve a counterparty without an active regulator on the other side, it matters completely.

The screen is not whether the exchange has a license. The screen is whether its regulator has examination power, has used it, publishes its register, and would respond to a complaint within a defined window. Read through that lens, the credible jurisdictions for institutional crypto narrow to a short list.

Dubai (VARA): the crypto-specialist regulator

The Virtual Assets Regulatory Authority of Dubai is the only regulator in the world whose entire remit is virtual assets. It was established in 2022, has issued a tiered set of activity-based licenses, supervises holders directly, and publishes its rulebook. The rulebook is detailed in places where most regimes are still drafting — market conduct, prudential requirements, retail product distribution, treatment of marketing — and it is updated on a public cycle.

What VARA gives an institutional client is a regulator that understands the product. A query about, say, the treatment of a perpetual contract under market-manipulation rules does not have to start with an explanation of what a perpetual is. The fluency at the regulator level is genuinely different from a regulator whose crypto remit is bolted onto a securities or banking framework. TX24 is licensed under VARA, and that license is the anchor of our headquarters in Dubai.

The trade-off is that VARA is a young regime. Its case law is thin. Some interpretive questions still go through informal guidance rather than formal rulings. We treat this as a feature rather than a bug — the same conditions allow a constructive supervisory dialogue that would be hard to get in a more bureaucratic environment — but it is a feature with a shelf life, and we expect VARA to mature into a regime closer in style to the European one over the next several years.

Europe (MiCA / VASP): the passport regime

MiCA — the Markets in Crypto-Assets regulation — replaced the patchwork of national VASP regimes across the European Union with a single rulebook and, crucially, a passport. An entity authorized in one member state can operate across the EU under uniform rules. The transition has been complex; some member states have been slower than others to complete the authorization pipeline, and there are still differences in how national supervisors approach specific issues. But the architecture is sound, and the passport has begun to mean what it is supposed to mean.

TX24 holds a European VASP authorization through Lithuania, which has been one of the more constructive national supervisors. Lithuania's role in the early stages of the European crypto industry has been substantial, and the regulator has built genuine expertise in the area. Operating under Lithuania means we are subject to the full MiCA rulebook, with the passport that lets us serve clients across the EU under harmonized rules.

What MiCA gives an institutional client is a one-page answer. The legal team does not need to map twenty-seven national regimes. They need to know which entity is authorized, in which member state, with which passport. That is a meaningful reduction in counterparty diligence cost, and it is the reason MiCA-authorized venues are now the default for European institutional flow.

Singapore (MAS): the high-bar, low-volume regime

The Monetary Authority of Singapore has, for years, been the regulator with the highest bar to entry and the smallest set of authorized crypto entities. The Payment Services Act framework is rigorous, the authorization process is long, and the supervisory expectations are demanding. The result is a small, credible cohort of MAS-authorized service providers serving institutional clients across Asia.

We follow MAS closely because Singapore is the gateway for a meaningful portion of Asian institutional flow, and because MAS's standards have a way of being adopted, in modified form, by other regulators in the region. An exchange that wants to serve Asian institutional clients does not necessarily need a MAS license, but it should be able to articulate how its conduct standards compare to MAS expectations.

United States: the disaggregated landscape

The United States is the most important market in crypto and the hardest to characterize. Authority is split between the SEC, the CFTC, FinCEN, the OCC, state money transmitter regimes, and now several specialized regimes for stablecoins. The result is an environment in which a small number of US-only venues operate under a particular configuration of these authorities, and most non-US venues — including ours — choose not to serve US persons rather than navigate the full perimeter.

We watch the US closely because its rules ripple. ETF approvals affect global flows. SEC enforcement actions reshape product availability worldwide. The progress of stablecoin legislation determines what the settlement layer of crypto will look like in five years. But for the purposes of a venue selection decision today, the practical question for non-US clients is whether the venue is suitable for them, not whether it serves the US.

United Kingdom: a regime in motion

The Financial Conduct Authority has been recalibrating its approach to crypto for several years. The current direction is toward a more comprehensive regime, with formal authorization, conduct rules, and the prospect of stablecoin and broader cryptoasset regulation in the medium term. For now, the UK is a regime in motion: the rules of tomorrow are clearer than the rules of today, and venues are positioning accordingly.

Switzerland and Liechtenstein: the early-mover regimes

Switzerland's FINMA was one of the earliest national regulators to publish a coherent framework for tokens, and its categorization — payment, utility, asset — has been adopted in modified form by several other regimes. Liechtenstein's Token and Trustworthy Technology Act, often called the Blockchain Act, was the first national law to provide a comprehensive framework for tokenized rights. Both jurisdictions remain important, particularly for asset-tokenization use cases and for clients with a Swiss banking relationship. Their volumes are smaller than the headline jurisdictions, but their regulatory durability is substantial, and a venue serving Swiss institutional clients almost always needs a credible answer for how it interacts with the Swiss regime.

Hong Kong: the renewed Asia gateway

Hong Kong's Securities and Futures Commission relaunched a comprehensive virtual asset service provider regime in 2023, and the resulting framework has attracted a meaningful set of regulated venues and ETF products. The regime is closer in style to MAS and to UK FCA than to the more crypto-native VARA, but its substance is real, and Hong Kong's role as an Asian institutional gateway gives it an outsized footprint relative to the size of its retail market. We watch Hong Kong as a potential expansion jurisdiction over the medium term, and we read its rule changes closely because they often signal the direction of broader Asian regulation.

What VASP, MiCA, and VARA actually require, in practice

Beneath the marketing language, the day-to-day obligations of operating under a credible regime are similar across jurisdictions, and worth naming. There are capital requirements, calibrated to the activity scope. There are governance requirements: named senior management responsible to the regulator, board oversight, separation of risk and operations functions, and conflict-of-interest policies. There are conduct requirements: best-execution obligations, market-manipulation surveillance, fair handling of client orders, suitability assessments where applicable. There are operational requirements: incident reporting timelines, business continuity plans, cybersecurity controls, and fitness assessments of key personnel. There are AML/CFT obligations: KYC standards, ongoing monitoring, suspicious activity reporting, and travel rule compliance for relevant transactions.

A venue that operates under one of these regimes has to maintain a compliance and operations function that is genuinely functional, not nominal. The internal cost of doing so is significant. The external benefit is that institutional clients can underwrite the venue without doing the regulator's job themselves. That bargain — internal cost in exchange for external trust — is the deal that any credible regulated venue accepts.

What an institutional counterparty actually screens for

Beyond the named jurisdiction, the counterparty diligence checklist looks broadly the same across institutional clients. The questions are: who is the regulator, what is the license number, when was it issued, has it been suspended, what is the scope of permitted activities, who are the senior management responsible to the regulator, and what is the supervisory status of the entity. A venue that can answer those questions in a one-page document, with public-register links, passes the bar. A venue that cannot, does not.

TX24's answer to those questions is short. We are headquartered in Dubai under a VARA license, with a European VASP authorization through Lithuania, a senior team whose names and roles are public, and active supervisory relationships with both regulators. That summary is the document our institutional onboarding team uses with new counterparties, because it is the document that gets a green light from a compliance committee.

Where the map is going

Three trends are visible in the regulatory map for the coming years. The first is convergence: VARA, MiCA, MAS, and the maturing US stablecoin frameworks are starting to share vocabulary, and the differences between them are shrinking on the substantive issues. The second is the end of the offshore arbitrage strategy: an exchange registered in a jurisdiction with no real supervision will increasingly find itself unable to access fiat rails, banking partners, and institutional flow. The third is the rise of bilateral memoranda — VARA with MAS, MiCA national supervisors with each other — that share information and reduce the value of forum shopping.

The implication for clients is that venue selection on regulatory grounds is becoming, paradoxically, simpler. The set of credible venues is shrinking, the rules each of them operates under are converging, and the cost of getting the choice right is falling. The implication for venues is the opposite: the bar is rising, and the only sustainable answer is to invest in being above it.

Closing

We did not pick our regulators by accident. Dubai (VARA) and Europe (Lithuania, MiCA) were chosen because, between them, they cover the institutional clients we want to serve, on terms that are transparent and supervised. The era of regulatory arbitrage is closing. We are comfortable with that, because we did not build TX24 to arbitrage a regulator. We built it to be one of the venues that the next phase of the institutional market can underwrite without footnotes.