Where we work.
The United Kingdom, the European Union and a small number of established offshore regimes. The jurisdiction should follow the business model, not the other way round.
United Kingdom
The Financial Conduct Authority. Authorisation and variation of permission, senior manager approvals, change in control, and the Connect filings that carry them — for investment firms, payment and e-money institutions, crypto-asset firms under the new regime, and consumer credit firms that need full permission.
Cyprus
CySEC for investment firms and crypto-asset service providers; the Central Bank of Cyprus for payment and e-money institutions. Cyprus remains one of the most used routes into the EU for brokerage, with a regulator that knows the model well and expects the substance to match it.
Malta
The MFSA, a single regulator for investment services, payment and e-money institutions, and crypto-asset service providers under MiCA.
Across the EU
MiFID, payment services, e-money and MiCA authorisations all carry a passport into the other member states. Where a firm's model points to a home state other than Cyprus or Malta, we will say so at the start.
Offshore
Established offshore regimes where the licence is real and the regulator is engaged. We are selective: a licence that will not survive a bank's due diligence or a payment partner's onboarding is not worth having, and we will tell you so before you spend money on it.
Choosing between them
The right jurisdiction is the one whose licence the firm's customers, banks and partners will accept, whose capital and substance requirements it can meet, and whose regulator it can live with day to day. Cost and speed matter less than they first appear, and a licence chosen for either alone is often the one a firm later has to replace.