July 09, 2026
9 min read

MTL Compliance Checklist for Crypto Businesses

Stay compliant with U.S. state Money Transmitter Licensing (MTL) requirements using this practical checklist for crypto businesses. Learn the key licensing, AML, reporting, cybersecurity, and ongoing compliance obligations needed to operate confidently across multiple states

Ian Hart
MTL compliance checklist feature image showing a digital checklist, shield icon, crypto coins, and compliance dashboard for crypto businesses.

Getting an MTL is a major project. It is not something you do on a whim, and it is not something a crypto startup should leave until the last minute. State money transmitter licensing requires planning, documentation, legal review, compliance resources, financial preparation, and ongoing monitoring after approval.

For the full background before using this checklist, read our state money transmitter licensing guide for crypto businesses.

For crypto businesses, the process can feel overwhelming because every state may have different expectations. Some states focus heavily on financial condition and surety bonds. Others pay close attention to AML controls, cybersecurity, consumer protection, ownership structure, or crypto-specific risks. A structured checklist helps you turn a confusing process into a clear roadmap.

This checklist is designed to help you prepare for and navigate the MTL process in a practical, phased way.

Phase 1: Preparation

Preparation is the most important phase. A weak application usually creates delays later. Before you submit anything, make sure you understand your business model, customer locations, licensing exposure, and required documents.

1.1. Determine Which States You Need

What it is: Decide which states you will apply in.

Action: Based on your business model, decide on your initial states. Many crypto businesses start with commercially important states such as New York, California, and Texas, but the right order depends on your customer base, launch strategy, and budget.

If you need help deciding the launch order, our guide to the top states for crypto MTLs explains why New York, California, Texas, Florida and Washington are common early priorities.

Tip: Don't try to do all 50 states at once unless you have the resources to manage it. A phased approach is usually more practical.

You should also map where your users are located, where you plan to advertise, where you have existing customers, and where your product may trigger money transmission rules. If your platform handles fiat deposits, crypto custody, crypto exchange, stablecoin transfers, or hosted wallets, licensing analysis becomes especially important.

1.2. Build Your Team

What it is: Assemble the people who will help you.

Action: Hire a lawyer who specialises in crypto compliance and state money transmitter licensing. Consider a compliance consultant, a finance professional, a cybersecurity expert, and an internal project manager.

Tip: This is not a DIY project. Expert help is essential.

Your team should understand both federal and state compliance. FinCEN registration, AML obligations, state MTL requirements, surety bonds, background checks, and regulator questions are all connected. Having the right team early can prevent expensive mistakes.

That difference is explained more clearly in our MTL vs MSB guide for crypto businesses.

1.3. Prepare Your Documents

What it is: Gather the necessary documents.

Action: Prepare the following:

Business Plan: A comprehensive plan for your business, including products, customers, transaction flows, revenue model, custody structure, technology systems, risk controls, and launch states.

Financial Statements: Audited or reviewed financial statements, depending on the state and business stage. Regulators want to see financial strength and the ability to protect customer funds.

AML Program: A written AML policy that covers customer due diligence, KYC, sanctions screening, transaction monitoring, suspicious activity escalation, recordkeeping, staff training, and independent testing.

Background Checks: Personal background checks for owners, directors, officers, key employees, and control persons.

Cybersecurity Policies: Written policies covering access controls, data protection, incident response, vendor management, and system security.

Complaint Handling Procedures: A clear process for receiving, tracking, investigating, and resolving customer complaints.

Transaction Flow Diagrams: Visual explanations of how fiat, crypto, customer data, and custody arrangements move through your platform.

This document package becomes the foundation for your applications. The more complete it is, the easier it becomes to respond to state regulators.

Phase 2: The Application

Once your preparation is complete, you can begin the application phase. This is where accuracy matters. Regulators will compare your forms, policies, financial documents, ownership disclosures, and business plan. Inconsistent answers can create delays.

2.1. Complete the Application Form

What it is: Fill out the application for your chosen state.

Action: The form will be long and detailed. Take your time. Be accurate. Make sure your ownership information, business activities, executive details, financial numbers, and compliance descriptions are consistent across all documents.

Tip: Many states have different forms and checklists. Don't mix them up.

Some states use NMLS, while others may have their own process. Even when applications are submitted through NMLS, each state may still require state-specific documents, fees, and follow-up responses.

2.2. Pay the Application Fee

What it is: Pay the non-refundable application fee.

Action: Include the required payment with your application.

Tip: The fee varies by state. It can be expensive, especially when applying in multiple states at the same time.

Remember that application fees are only one part of the cost. You may also need to pay legal fees, NMLS fees, background check fees, bond premiums, audit fees, renewal fees, and internal compliance costs.

2.3. Submit Your Application

What it is: Send your application to the state regulator.

Action: Submit the form and all supporting documents.

Tip: Keep a copy for your records.

Create a central application tracker. Include each state, submission date, responsible person, fee paid, documents submitted, regulator contact, follow-up questions, deadlines, and status. This is especially important if you are applying in several states at once.

Phase 3: The Review

After submission, the regulator will review your application. This stage can take months. The speed depends on the state, application quality, regulator workload, and complexity of your crypto business model.

3.1. Wait for Questions

What it is: The regulator will review your application.

Action: Be prepared for questions. They may ask for more information about your custody model, AML controls, financial condition, cybersecurity program, consumer disclosures, ownership structure, banking partners, or transaction monitoring.

Tip: Respond to questions quickly and thoroughly.

A short or unclear answer can lead to more questions. A strong response should be accurate, organised, and supported by documents when needed. Assign one internal owner to coordinate regulator responses so nothing is missed.

3.2. Post Your Surety Bond

What it is: You will need to post a surety bond.

Action: Work with a bonding company to get the bond.

Tip: The bond is an insurance policy for your customers.

The required bond amount varies by state and may depend on transaction volume, business activity, or statutory formulas. Start this process early because bonding companies may review your financial condition before issuing the bond.

3.3. Satisfy Any Additional Requirements

What it is: The regulator may have specific requests.

Action: Be flexible. Do what they ask, but keep your legal team involved so responses are accurate and consistent.

Tip: This is part of the process.

Additional requirements may include updated financial statements, revised policies, more detailed transaction diagrams, proof of bank accounts, proof of capitalization, background clarification, or changes to customer disclosures.

Phase 4: Post-Licensing

Getting the license is a major milestone, but it is not the end of the journey. A licensed money transmitter must maintain compliance year after year.

4.1. Maintain Your License

What it is: You must keep your license active.

Action: File annual reports. Pay your fees. Submit renewals on time. Keep your company information, ownership details, control persons, addresses, and business activities up to date.

Tip: Don't forget about a state once you have the license.

Create a compliance calendar with renewal dates, report deadlines, bond renewal dates, audit deadlines, and examination windows. Missing a deadline can create penalties or licensing issues.

4.2. Stay Compliant with State Rules

What it is: Follow the ongoing rules of the state.

Action: Ensure your AML program, cybersecurity program, complaint process, disclosures, financial records, and transaction monitoring remain aligned with state requirements.

Tip: State rules can change. Stay updated.

You should also review product changes before launch. If you add staking, stablecoins, new wallet services, new tokens, or new payment flows, your licensing obligations may change.

4.3. Prepare for State Audits

What it is: The regulator may audit or examine you.

Action: Keep your records clean and organised.

Tip: An audit is not only a risk. It can also help you improve.

Regulators may review your customer files, transaction records, AML alerts, complaint logs, financial statements, cybersecurity controls, policies, board minutes, training records, and suspicious activity escalation process.

Real-World Scenario: Using the Checklist

You are a new crypto startup. You use this checklist to plan your MTL journey.

Preparation: You decide to apply in NY, CA, and TX. You hire a lawyer, appoint a compliance lead, build an AML program, prepare financial statements, and map your transaction flows.

For New York-specific preparation, review our New York BitLicense guide before building your application file.

Application: You complete the applications, pay the fees, upload documents, and create a state-by-state tracker.

Review: You wait 6 months. Regulators ask questions about custody, transaction monitoring, customer disclosures, and financial condition. You respond quickly with organised documents.

Post-Licensing: You get your licenses. You file reports, renew bonds, update records, prepare for examinations, and review new products before launch.

This structured approach helps reduce panic, improve application quality, and keep your team aligned.

Conclusion

The MTL process is complex, but a good checklist makes it manageable. Following a structured, phased approach is the best way to succeed. Start with state selection, build the right team, prepare strong documents, submit accurate applications, respond carefully to regulators, and maintain compliance after approval.

For crypto businesses, licensing is not just a legal task. It is a market access strategy. The businesses that prepare early are usually in a better position to launch, scale, raise capital, and build trust with banks, customers, regulators, and partners.

A strong state licensing plan starts with the federal basics. The MSB Registration And FinCEN Basics For Crypto Startups course helps founders and compliance teams understand MSB registration, FinCEN expectations, AML program requirements and reporting duties before scaling into state-level approvals.

If your team still needs the federal foundation first, the MSB Registration And FinCEN Basics For Crypto Startups course covers FinCEN registration, AML program basics and reporting duties.

FAQs

Q1: What is the first step in getting an MTL?

A1: Determining which states you need to apply in based on your business model, customer locations, and launch plan.

Q2: What documents do I need for an MTL application?

A2: You usually need a business plan, financial statements, AML program, ownership details, background checks, cybersecurity policies, and transaction flow documents.

Q3: How long does it take to get an MTL?

A3: It varies by state, but it typically takes several months. More complex states or incomplete applications can take longer.

Q4: What do I do after I get my MTL?

A4: You need to maintain the license, file reports, renew on time, update regulators when required, stay compliant, and prepare for audits.