White-label crypto banking: the software, the two licences and who holds what
How a crypto banking app works: an IBAN account, crypto wallets, conversion and a card, the two licences behind them, who holds the money and the coins, and SaaS, API or source code.
Crypto banking software is the platform behind an app that keeps a customer's money and crypto side by side: a euro account with an IBAN, crypto wallets, buying and selling between the two, and usually a card. White-label means the app, the ledger and the connections already exist and carry your brand. One thing matters before any comparison: the software is not the licence. In law the product is two regulated businesses, one for money and one for crypto, and each needs a licensed firm behind it, yours or a partner's.
This guide is general information, not legal advice: the details depend on your services and your market, so confirm them with a lawyer and the regulator before you apply. Every rule below was read in the law itself or on the regulator's own pages on 13 October 2026.
What a crypto banking app does
The customer sees five things.
One sign-up. An ID scan, a selfie and a sanctions check, done once.
A euro balance with an IBAN, for salary in and bills out.
Crypto balances. Bitcoin, ether and stablecoins, each with its own deposit address.
Buy, sell and swap, at a price shown before the customer confirms.
A card, virtual first, then physical.
It is not an exchange: there is no order book, and the price is the app's own quote. With shares added it becomes a super app, as in our guide to building an app like Revolut.
What sits between the app and the bank
Under the app is your platform: the ledger, identity checks, conversion, card decisions and the backoffice. Under that sit the licensed firms and providers: a partner bank or e-money institution for accounts, a card issuer and its processor, a custodian, and liquidity providers. They connect to the rails: SEPA, the card networks and the blockchains.
Take a customer who buys €100 of bitcoin from the euro balance.
The quote. The platform reads live prices from its liquidity providers, adds your margin and holds the rate while the customer confirms.
The ledger. One set of balanced entries: the euro balance falls by €100, the bitcoin balance rises at the quoted rate, and your margin goes to your revenue account.
The cover. The platform buys the same amount from a liquidity provider in the background.
The chain. Nothing moves on it. The bitcoin was already in custody, and coins leave only when the customer withdraws.
The two licences, side by side
Market | The money side | The crypto side |
|---|---|---|
EU | An e-money institution, a payment institution or a bank, yours or a partner's | Authorisation as a crypto-asset service provider under MiCA |
UK | An authorised e-money institution or a bank | Registration with the FCA today, then authorisation under the new regime, expected from 25 October 2027 |
UAE | A stored value facility licence from the Central Bank of the UAE | A licence from VARA in Dubai; other parts of the UAE have their own regulators |
The money side. A balance that customers top up and spend later is electronic money, and the E-Money Directive lets only authorised issuers issue it (Article 10). Accounts, transfers and card issuing are payment services under the Payment Services Directive, PSD2 (Annex I). Many brands start as the agent of a licensed institution, which stays fully liable for its agent (Article 20). See launching a neobank without a banking licence, and the EU and UK licence guides.
The crypto side. The Markets in Crypto-Assets Regulation, MiCA, lists the services (Article 3). A crypto banking app usually provides four:
custody, holding customers' coins or their keys;
exchange for funds, buying and selling at the firm's own price;
exchange for other crypto, the swaps;
transfer services, sending coins out of the app.
Custody and exchange sit in MiCA's middle capital class, with a minimum of €125,000 (Annex IV); see what a crypto exchange licence costs. The period that let older firms carry on under national rules ended on 1 July 2026 (Article 143). Only a firm can be authorised, never software, and no one else may use a name or marketing that suggests it is a provider (Article 59).
One firm or two. A bank can add crypto services by notifying its regulator at least 40 working days ahead (Article 60). An e-money institution cannot: by notification it may only hold and transfer the e-money tokens it issues. MiCA also provides for crypto providers that are themselves e-money, payment or credit institutions, and for those that use a licensed third party for payment services and tell clients so (Article 70).
Stablecoins sit on both sides. A stablecoin that tracks one currency, such as USDC, is an e-money token, and MiCA deems it electronic money (Article 48). In June 2025 the European Banking Authority advised national regulators to treat holding and sending e-money tokens for clients as payment services. Under its opinion of 12 February 2026, from 2 March 2026 the crypto firm holds a payment or e-money licence as well, or partners with a licensed payment provider. A firm whose application is pending may carry on meanwhile, without marketing the service or taking new clients for it.
The UK stacks the two in the same way: the FCA says firms authorised under the Electronic Money Regulations still need its new authorisation for crypto (see FCA cryptoasset registration). For the UAE, start with VARA, ADGM or DIFC.
Who holds the money, and who holds the coins
The money. An e-money institution safeguards it: kept apart from its own money, in a separate account at a bank or in secure, low-risk assets, or covered by insurance or a guarantee, and beyond its other creditors' reach (PSD2, Article 10). A crypto provider that is not a payment, e-money or credit institution places clients' money with a bank or a central bank by the end of the next business day (MiCA, Article 70).
The coins. A custodian keeps clients' crypto apart from its own, on the blockchain and in law, so that its creditors have no claim on it. It keeps a register of each client's positions, and it is liable for losses from incidents attributable to it, up to the market value of what was lost. It may pass custody only to another authorised provider (Article 75).
Neither is a deposit. MiCA makes token white papers warn that deposit guarantee schemes do not cover the token (Articles 6 and 51). The FCA tells consumers that the Financial Services Compensation Scheme does not protect money at a non-bank payment provider that fails; safeguarding does.
For the build, that means one ledger with a separate account for each legal pot, reconciled daily against its bank or its blockchain.
What "earn" can and cannot be
Euro e-money: no interest, and no other benefit tied to how long the balance is held (E-Money Directive, Article 12; UK Electronic Money Regulations, regulation 45).
E-money tokens: the same, for the app as well as the issuer. Under MiCA, crypto-asset service providers "shall not grant interest when providing crypto-asset services related to e-money tokens" (Article 50). Any benefit tied to the time a token is held counts.
Other crypto: staking as a service. MiCA does not prohibit staking. The European Commission, in an answer published by ESMA, treats staking for clients as ancillary to custody, so the provider needs the custody authorisation (Q&A 2067). A provider may not stake clients' coins for its own account, even with their consent (Q&A 2607).
Lending. MiCA leaves lending and borrowing of crypto to national law (recital 94).
Savings that pay interest on euros sit with a partner bank.
Moving coins in and out: the Travel Rule
A deposit from an outside address, or a withdrawal to one, is a transfer under the EU's Transfer of Funds Regulation. Since 30 December 2024, the sending provider attaches the sender's and the recipient's details, whatever the amount (Article 14). Above €1,000 to or from a self-hosted address, the provider also assesses whether its own customer owns or controls that address (Articles 14 and 16).
Three ways to get the software
"White label" names two different things. The European Banking Authority uses it for a licensed institution offering its products under a partner's brand. Vendors use it for software you run. That gives three routes, which our guide to white-label, SaaS or custom compares in depth.
Banking-as-a-service | SaaS platform | White-label with source code | |
|---|---|---|---|
Who runs the software | The provider | The vendor | You, on your infrastructure |
Who holds the licences | The provider and its partners | You, or the partners you bring | You, or the partners you bring |
Provider contracts | The provider's | Yours or the vendor's, by contract | Yours |
The keys | The provider or its custodian | Your custodian, or you | Your custodian, or you |
The code | The provider's | The vendor's | Yours |
Suits | The quickest start, within the provider's product | A quick start with no team to run software | Ownership, with a team to run it |
Four questions sort the offers. Which legal entity provides the account, the crypto and the card, and is it on the regulators' registers today? Who controls the keys? In whose name are the provider contracts? What leaves with you if you go? ESMA reminds consumers that MiCA's protections apply only to the specific authorised legal entity.
Launch order and common mistakes
Choose the market and the route for each side, then start the partner conversations: their approvals, not the software, usually set the launch date. Accounts and the ledger come first, then crypto, then the card, which a licensed issuer provides, often a BIN sponsor. If it spends a crypto balance, Visa requires conversion to fiat before the money reaches the cardholder's account, and its approval of the programme (Visa Core Rules, 1.4.4.6); see building a crypto card app.
The mistakes repeat:
Calling e-money a bank account. It is safeguarded, not a deposit.
Assuming one licence covers both sides. An e-money licence does not cover bitcoin, and a crypto authorisation alone does not cover stablecoin payments.
Every stablecoin in every market. ESMA expects EU providers to stop exchange services that offer e-money tokens whose issuer is not authorised in the EU.
What this means for your platform
A crypto banking app is our white-label super app with the parts you choose: the banking app's accounts and cards, and the crypto card app's wallets. It is assembled from modules already in production:
Accounts and IBANs: named IBANs on SEPA through partners such as ClearBank, Modulr, Solaris or Swan, or your own licence.
Custody and wallets: deposit addresses per customer and chain, with withdrawal approvals, on Fireblocks, BitGo or Copper, or on your own keys.
FX: buy, sell and swap at quoted rates with your margins, with liquidity from providers such as B2C2, Wintermute or Kraken.
Card issuing: virtual and physical cards on processors such as Marqeta, Thredd or Nium, under the BIN sponsor you choose.
The ledger: one double-entry book for money and crypto, reconciled daily against banks, card processors and blockchains.
KYC and AML and compliance reporting: identity checks, screening, monitoring and Travel Rule messaging.
The backoffice: roles, two-person approval and an audit log.
Paynoramic never holds your customers' money or crypto: the platform runs on your infrastructure, under your licences or your partners', and each provider signs its contract with you; we help you get it. The software takes about 30 days on a ready platform and 2 to 3 months for a custom assembly. Partner onboarding, licences and the card programme run alongside and usually set the launch date. You own the source code from the day of handover.
Staking, lending and savings that pay interest are not modules in the library; where your licence allows them, they are built to order. We are not lawyers: your counsel decides the licences, and we configure the platform to match. Tell us your market, and we will show you the platform against its rules.
