Licences by country

The two tests

Apple 3.1.5(iii) — an app may facilitate cryptocurrency transactions "only in countries or regions where the app has appropriate licensing and permissions to provide a cryptocurrency exchange." Every storefront you leave enabled is a claim that you are licensed there.

Google Play has enforced its crypto exchange and wallet policy since 29 October 2025. Play asks for the licence per country, through the Financial features declaration, and narrows or removes an app whose targeting outruns its evidence.

Neither test is about your build. They are about your markets.

Roughly what is asked for where

Check the current policy text before you rely on any of this; lists change and this one is a shape, not a citation.

Recording them: the attestation console

Admin → System → Compliance → Licence Attestations. One row per (module, country): the entity that holds the licence, the regulator, the licence number and the expiry.

Nine modules are behind it — spot trading, futures, ecosystem wallets, P2P, staking, token offerings, copy trading, Merchant payments and AI Investment. Wallet, markets, account, support, the blog, market news, the help centre, the store, NFTs, the support assistant, the bot console and the affiliate programme are not, because a licence to offer financial services has nothing to say about them.

The table does nothing until you switch enforcement on

Recording rows changes nothing by itself. The gate is the switch Enforce Licence Attestations (Mobile App) (attestationEnforcement) under Admin → System → Platform Settings, tab Features, group Verification, and it ships off. While it is off, the table plays no part in what the app shows or accepts: the nine modules follow the same addon, licence, switch and KYC rules as every other module, and the rows you have recorded only feed the country lists described below.

It applies to the app only. The website is never gated by it, whatever the table holds.

Fill in the countries for every module you offer before you turn it on: with it on and a module's rows empty, that module is closed to every app user. Its tile stays on Home, locked, and when tapped says the module is not offered in the customer's country — or, if the platform does not know their country, asks them to add it to their profile or complete identity verification.

With enforcement on, four things follow from the table:

• A regulated module reaches only residents of a country in it. Residence comes from approved KYC, falling back to the profile — deliberately not from an IP address, which a VPN changes. A customer whose country is not known to the platform at all is refused for that reason, not for a licensing one, and the app tells them so.
• An empty table reaches nobody. Default-deny is the point, and it is the expensive direction: turning enforcement on before you fill the table in closes every regulated module to every app user until you record the rows or turn it off again.
• Expiry is enforced the day it lapses. No grace period.
• A change reaches a customer at their next sign-in. The app asks for the module list once per session and keeps the answer, so somebody signed in while you record a row does not see the module appear under them.

The console also emits your Apple storefront list and your Play country targeting list from the same rows, so the three cannot drift apart. Use them when you configure availability in App Store Connect and Play Console — see Country targeting.

On-chain staking carries a second country gate

The console above is the only country gate for every module in its table but one. If your server runs the on-chain staking product, the Staking addon adds a block list of its own, and nothing in the attestation console can see it, raise it or clear it. The build is the same either way — stakingMode on the server decides which product your customers get, so check the server before you decide what a market is allowed.

That list is not a table you fill in. It is derived from the chain activation, the declaration an operator signs before a chain may take a customer's coins. Two rules decide markets:

• Singapore is blocked on every activation, whatever is declared, and the block cannot be removed.
• An activation that declares no licence also blocks the United States, the United Kingdom, Hong Kong, the UAE, Japan and South Korea, and those blocks are non-removable too while that declaration stands. Declaring a licence, and naming the regulator, is what lifts them.

The rest of the derivation — AE refused outright, HK needing the SFC attestation and refusing the Lido venue, the prescribed UK warning, the US contested-state warning — is in Chains & validators.

Three things follow for a publisher:

• The list is per activation, and there is one activation per chain and network. An install staking on two chains has two block lists, and which one a customer meets depends on the pool they staked into. There is no single blocked list to print in your app's text or your store listing; read it back from the activation.
• It is enforced at the stake, not at the browse. A blocked customer sees the pools and is refused when they stake: "On-chain staking is not available in your country (XX) under this platform's declaration." Country resolution is the same as above — approved KYC first, falling back to the profile, never an IP address.
• It is not a store-targeting rule. It changes who may stake inside your build, not where the build may be listed. App Store Connect and Play Console still take the lists the attestation console emits.

The fixed-rate staking product has a third list again, and that one is a setting rather than a declaration: it ships blocking the United States, the United Kingdom, the EU-27, Singapore and Hong Kong, and an operator may only shrink it after accepting a versioned risk statement in the admin console. A fresh install therefore refuses fixed-rate staking to most of the markets in the table above, without anyone switching anything on.

The module that needs more than a licence

Futures and token offerings are also caught by Apple 3.1.5(iv), which asks what kind of institution you are rather than where you are licensed. See Before you buy.