Crypto exchanges and OTC desks

Key facts (as of 29 October 2026)

• Card treatment: card-absent crypto exchanges, wallet providers and on-ramps (MCC 6051/6012, special condition code 7) are Visa Tier 2 high-integrity-risk merchants.
• EU: since 1 July 2026, any entity providing crypto-asset services to EU clients without a MiCA licence "will be in breach of EU law and must cease offering such services" (ESMA, 17 April 2026). ESMA's interim CASP register file (last updated 22 October 2026, read 29 October) had 387 entries covering 384 distinct firms (ESMA register).
• UK: the FCA's authorisation gateway for cryptoasset firms opened on 30 September 2026 and closes on 28 February 2027; the regime starts on 25 October 2027.
• Hacks: the FATF describes the US$1.46bn theft from Bybit, attributed to DPRK actors, as the largest single virtual-asset theft in history. Only 3.8% had been recovered when the FATF reported in June 2025.
• Standards: FATF Recommendation 15 requires virtual asset service providers to be licensed or registered and to apply the full set of preventive measures, including the Travel Rule.
• Sanctions: OFAC has designated exchanges whose transactions were largely illicit. Its 21 September 2021 case concerned an exchange where over 40% of known transaction history was associated with illicit actors (OFAC guidance).

Exchange versus OTC desk

private.law describes OTC in practice as mostly fiat-to-USDT or USDC conversion and back, for cross-border contracts, foreign revenue, treasury diversification or private liquidity.

How an OTC trade settles

sequenceDiagram
    participant C as Client treasury
    participant D as Licensed OTC desk
    participant B as Banks
    C->>D: KYB pack, source of funds, wallet addresses
    D-->>C: Onboarding approved
    C->>D: Request for quote (size, token, chain)
    D-->>C: Firm quote, valid for a short window
    C->>D: Accept
    alt Client sells stablecoins
        C->>D: Send USDT or USDC on agreed chain
        D->>D: Screen wallet, Travel Rule check
        D->>B: Fiat wire to client account
    else Client buys stablecoins
        C->>B: Fiat wire to desk account
        B-->>D: Funds received
        D->>C: Send stablecoins to whitelisted address
    end
    D-->>C: Settlement statement with hashes

Who sends first is a commercial term. Larger desks often expect the client to send first; escrow and delivery-versus-payment arrangements reduce that risk.

Licensing by jurisdiction

OTC is not unlawful in itself. Regulators including the SFC, MAS, the FCA, EU national authorities under MiCA, FinCEN and US state regulators permit it on two conditions, per private.law: the operator holds the right licence for regular activity, and the client can document the source of the fiat and the history of the wallets.

NoteESMA reminds consumers that MiCA protections "only apply to the specific authorised legal entity in the EU – not to other companies of the same group, and not to non-EU entities". Businesses should contract with the authorised entity by name.

Why they are high-risk to banks

• Financial-crime exposure. The FATF's June 2025 update reported that most on-chain illicit activity now involves stablecoins. Its July 2026 update described a Cambodian conglomerate that laundered about US$4bn between 2021 and 2025 and then launched its own freeze-resistant token.
• Source-of-funds complexity. Fiat proceeds must reconcile with wallet histories.
• Operational and hack risk. Large hot-wallet losses can make a venue insolvent overnight.
• Sanctions risk. OFAC liability is strict. Its guidance recommends geolocation and IP blocking, historic lookbacks when new addresses are listed, and fuzzy name matching.
• Regulatory churn. MiCA's transitional period ended on 1 July 2026. ESMA then told authorised firms on 8 October 2026 to stop services in non-compliant stablecoins, with 8 January 2027 as the outer deadline (CryptoSlate). Coinbase set a three-day deadline for EU users to convert USDT, PYUSD and USD1 (CryptoSlate, 27 October 2026).

WarningFor a business using an exchange or OTC desk as an off-ramp, the venue's licence and banking relationships become part of your own risk. If the venue loses its bank, your conversion route stops with it.

NoteA licensed desk that issues a settlement statement, with counterparty, amount, rate, wallet addresses and transaction hashes, gives the receiving bank what it needs. P2P trades with no KYC trail, by contrast, "pass bank review poorly" (private.law).

Due-diligence checklist for choosing a desk

Illustrative example: exiting USDT in the EU

Illustrative example. The business and quotes are invented.

A Lithuanian PSP receives USDT from Latin American partners. After ESMA's October 2026 opinion on non-compliant stablecoins, its EU CASP says it will stop USDT services in January. The PSP asks partners to send USDC where possible. For partners who can only send USDT on Tron, it opens a second route with a desk outside the EU that is licensed where it operates, receiving USDT there and converting to USD before the funds enter the EU group. It takes legal advice on whether that structure is compliant, and documents each leg for its bank.

Timeline

Q/A

Are exchange balances safe?

They are claims on the venue. Under MiCA, custodial CASPs must segregate client assets and are liable for losses they cause. Outside such regimes, protection varies.

Do OTC desks need to apply the Travel Rule?

Yes, where they are VASPs or CASPs. In the EU the rule applies with no minimum threshold.

Can a non-EU desk serve an EU business?

ESMA says not, outside narrow reverse solicitation, including in a business-to-business context.

How do I know an exchange is licensed?

Check the regulator's own register, not the exchange's website. ESMA maintains an interim MiCA register.

Why do desks want to know where my funds came from?

They carry AML and sanctions duties and must explain the flows to their own banks.

Are P2P platforms an alternative?

They are harder to document. private.law notes they pass bank review poorly.

Sources

• private.law, OTC: https://wiki.private.law/en/otc
• private.law, MiCA: https://wiki.private.law/en/mica-eu
• ESMA, statement on the end of MiCA transitional periods (17 April 2026): https://www.esma.europa.eu/sites/default/files/2026-04/ESMA75-113276571-1679_Statement_on_the_end_of_transitional_periods_under_MiCA.pdf
• FCA, gateway to regulated crypto opens (30 September 2026): https://www.fca.org.uk/news/press-releases/fca-opens-gateway-regulated-crypto
• FATF, targeted update on virtual assets and VASPs (June 2025): https://www.fatf-gafi.org/en/publications/Fatfrecommendations/targeted-update-virtual-assets-vasps-2025.html
• FATF, targeted update (July 2026): https://www.fatf-gafi.org/en/news/targeted-updated-va-vasps-2026.html
• OFAC, sanctions compliance guidance for the virtual currency industry: https://ofac.treasury.gov/media/913571/download?inline
• Visa, Visa Integrity Risk Program guide (6 April 2023): https://www.visa.cl/content/dam/VCOM/regional/lac/SPA/chile/Documents/visa-integrity-risk-program-chile.pdf
• CryptoSlate (27 October 2026): https://cryptoslate.com/coinbase-sets-3-day-mica-deadline-for-usdt-paypal-and-trump-linked-stablecoins/
• ESMA, MiCA page and interim register: https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/markets-crypto-assets-regulation-mica
• FBI IC3, PSA on the Bybit theft (26 February 2025): https://www.ic3.gov/PSA/2025/PSA250226