Since 1 July 2026, a fintech that wants to run its own crypto payment rails in the EU needs an authorisation first. ESMA confirmed in April that the transitional period for national registrations ended on that date across all 27 member states, with no extensions. A June press report counted about 210 authorised firms against more than 1,200 that had held national registrations, so most had not converted by then.
Buying a provider’s API or white-labelling its product shifts the licensed work to someone else. For a regulated fintech, the accountability stays where it was but the decision that needs to be made is which layers of the rail you will own, and which duties to keep.
Disclosure: Xchange360 sells white-label gateway, custody and exchange products. This guide ranks no providers.
Three models in plain terms
| Model | What you do | What the provider does |
| Build | Hold the licences and run custody, conversion, compliance and the ledger | Supplies infrastructure, if you use vendors |
| Buy (API integration) | Own the customer interface and the product, and integrate the provider’s API | Runs conversion, custody and settlement under its own licences |
| White-label | Brand and distribute the provider’s product | Runs the product, the rails, compliance and settlement under your brand |
Our guide to white-label payment gateways covers the third model in more depth, and our embedded payments guide covers why platforms embed rails at all.
Six layers, and who owns each
| Layer | Build | Buy | White-label |
| Customer interface and brand | You | You | You, on the provider’s product |
| Ledger and reconciliation | You | Shared | Provider |
| Compliance: KYC, sanctions screening, Travel Rule | You | Shared | Provider, with your own obligations intact |
| Conversion and liquidity | You | Provider | Provider |
| Custody and settlement | You | Provider | Provider |
| Licensed perimeter | You | Partly the provider | Partly the provider |
Many fintechs will want to own the first two layers whichever model they choose. The licensed perimeter is where the models differ most, and the answer depends on facts a table can’t hold: which activities run under whose licence, in which markets.
What building requires
Providing crypto-asset services in the EU needs authorisation as a crypto-asset service provider. Article 63 of MiCA sets the regulator’s clock: acknowledge the application within five working days, check it for completeness within 25, and decide within 40 working days of a complete application, with one suspension of up to 20 working days for questions. The clock starts at a complete file, so the time spent preparing one sits outside it.
Capital is the other statutory number. ESMA’s Annex IV table sets €50,000 for services such as transfer, execution and advice, €125,000 for custody and administration and for exchanging crypto-assets for funds or other crypto-assets, and €150,000 for operating a trading platform. The highest applicable class governs, per ESMA’s Q&A, and ongoing prudential safeguards must equal the higher of that minimum or a quarter of the previous year’s fixed overheads under Article 67.
Authorisation brings further duties. DORA applies to payment institutions and to authorised crypto-asset service providers, which brings ICT risk management duties and a register of third-party arrangements. Transfers also carry Travel Rule data, covered in our Travel Rule guide. Other markets run their own clocks: the UK’s cryptoasset regime starts on 25 October 2027, and Treasury’s proposal treats 18 January 2027 as the expected effective date for the GENIUS Act’s payment stablecoin rules.
Vendor and agency blogs add time and cost estimates, and they disagree. Cobo puts a custom build at 12 to 18 months and white-label at four to eight weeks. Errna puts a build at 18 to 36 months and white-label at one to three months. TokenMinds, writing about banks, gives 18 to 36 months for a build and 90 to 180 days for white-label. The ranges come from commercial blogs and differ widely, so the statutory figures above are the ones worth planning around.
What you keep when you buy or white-label
- Accountability. DORA’s Article 28 says a financial entity remains fully responsible for its obligations when it relies on ICT services from a third party. The same article requires an assessment of ICT concentration risk and documented exit strategies for arrangements supporting critical or important functions. A fintech that isn’t one of the financial entities listed in DORA’s Article 2, which include payment institutions and crypto-asset service providers, sits outside its direct scope, and its question becomes which regime covers the activity its partner performs for it.
- Whose licence the activity runs under. That is a fact about the structure, and the label “white-label” doesn’t settle it. Ask the provider in writing which of your activities run under its licence and which run under yours, then have counsel confirm.
- Exposure to the provider’s ownership. Several of the rails you can buy now belong to larger companies: Stripe owns Bridge, as our processors guide tracks, and Mastercard completed its acquisition of BVNK on 3 August 2026. Circle’s CPN Managed Payments lets fintechs offer stablecoin settlement without holding digital assets, which adds a network-run option. A provider’s roadmap can follow its parent’s priorities, so ask what happens to your contract on a change of control.
- Your customer data and brand. Know who holds the data, who sees the end customer, and what it takes to move both.
Choosing
| Your situation | Leans toward |
| Crypto is a feature of a product you already run | Buy through an API |
| You need a branded product live in your channels with little engineering | White-label |
| Crypto rails are your core product and you can fund authorisation and a compliance team | Build, or build selectively |
| You serve one or two markets now and more later | Buy or white-label first, since each market adds its own licensing clock |
| You need control of custody or pricing | Build, or buy with contractual controls |
| You can’t accept one provider’s ownership risk | Build the layers you must own and buy the rest from more than one provider |
Ask six questions before deciding:
- Is crypto your core product, or a feature of it?
- Whose licence does each activity run under, and in which markets?
- Whose spread and pricing applies, and what lands net? Our guide to the real cost of crypto payments shows how spread hides in headline fees.
- Which layers must you control? Customer data and the ledger are the usual candidates, and custody for some.
- What is the exit? Data portability and switching time, and whether a second provider is possible.
- What happens if the provider changes owner?
One path is to start by buying or white-labelling and bring layers in-house when volume or product needs justify it. Keeping the integration points replaceable makes that path cheaper.
Checking a provider
- Authorisation that lists the services you’ll use. A MiCA authorisation names the services it covers, so check that custody, exchange or transfer is on it if you use them. Our MiCA CASP guide covers the EU position.
- Ownership and roadmap. Who owns it, and who has partnerships that shape its priorities?
- Exit and data terms. What do you get if you leave?
- Compliance coverage. Screening and Travel Rule coverage, and who carries each.
- Settlement currencies and cut-offs.
- Fee and spread transparency.
Build, buy and white-label each fit a different set of situations. What separates them is which layers you control and which duties stay with you, and the licensing answer comes from your structure and your markets, confirmed by counsel.
For how Xchange360’s white-label products work, see White-Label Gateway and Fintechs: add crypto rails under your brand.
This article is general information, not legal advice.
Recommended reading
- What Is a White-Label Payment Gateway? — the white-label model covered in more depth.
- Embedded Payments & Finance: Crypto Inside Your Product — why platforms embed rails at all.
- Best Crypto Payment Processors for Business — more on Bridge’s ownership under Stripe.
- The Crypto Travel Rule in 2026 — the data that has to travel with a transfer.
- The Real Cost of Crypto Payments: On-Ramp, Off-Ramp and the Hidden Spread — how spread hides in headline fees.
- MiCA CASP Authorisation: What Payment & OTC Firms Need for EU Go-Live — the EU authorisation position in full.