Crypto Advertising Compliance in 2026: Licences, Certifications and Ad Platform Rules by Region

Verified against primary sources on 30 July 2026. This area moves monthly. Every requirement below links to the regulator or platform that publishes it — confirm the current wording there before you commit budget, and treat the tables as a starting map rather than legal advice.

Crypto Advertising Has Two Compliance Layers, Not One

Crypto is now the most heavily gated advertising category on the open internet, and most teams misread why. They assume there is a single approval to win — a switch inside an ad account that flips from off to on. There are actually two entirely separate gates, controlled by two entirely different institutions, and clearing one grants you nothing at the other.

Layer one is the licence. A financial regulator in a specific jurisdiction authorises you to offer virtual asset services to people in that jurisdiction. VARA in Dubai, a MiCA CASP authorisation in the European Union, FCA registration in the UK, FinCEN registration plus state money transmitter licences in the United States. This layer has nothing to do with advertising. It is about whether your business is legally permitted to exist in that market.

Layer two is the certification. Google, Meta, TikTok, X, the App Store and Google Play each run their own approval process, and each one is essentially a proxy for layer one. The platforms are not making independent judgements about crypto risk. They are asking a single question — can you show us the regulator's paperwork for the exact country you want to target — and refusing inventory to anyone who cannot.

Then there is a third layer that almost nobody plans for until an ad gets pulled: what your creative is allowed to say once both gates are open. VARA mandates specific loss language. The FCA imposes a cooling-off period. MiCA requires a statement that no EU authority reviewed your marketing. That layer is enforced by the regulator, not the platform, and the penalties are materially worse.

The practical consequence runs through everything below: there is no global crypto ad approval, and there will not be one. Market entry is a per-country compliance project with a lead time measured in months, not a campaign setting. Growth teams that treat it as the former ship on schedule. Teams that treat it as the latter discover the problem the week the budget was supposed to go live.

Google Ads Crypto Certification: The Licence Required in Every Approved Country

Google's Cryptocurrencies and related products policy is the closest thing the industry has to a canonical map, because Google names the specific regulator and instrument it will accept in each market. Cryptocurrency exchanges and software wallets can only be promoted if you have applied for and received certification, and you apply separately for every country you intend to target.

This is the table to build your market-entry roadmap from.

Two things this table does not say, and both matter more than anything it does say.

First, countries absent from the list are generally not eligible at all for exchange and software wallet ads, regardless of how well regulated you are locally. Confirm eligibility inside your own account before you plan a launch, because the list changes and regional availability can differ from what a policy page implies.

Second, a licence in one member state no longer stretches across the EU under legacy rules. MiCA became the operative requirement for EU targeting on 23 April 2025, and the national transition arrangements have been closing one by one. Germany's ran to 30 December 2025. France's ended on 30 June 2026, and from 1 July 2026 Google stopped accepting the AMF DASP registration entirely — French targeting now requires a MiCA CASP authorisation like everywhere else in the bloc. If your EU access still rests on a legacy national registration, that access has an expiry date.

What Google Prohibits Regardless of Your Licence

Certification is permission to advertise a specific category of product. It is not a blanket clearance for everything your company does. A fully licensed, fully certified exchange still cannot advertise several things — and the most common cause of disapproval after certification is a landing page that promotes a prohibited product alongside a permitted one.

Read the prohibited column against your own product surface honestly. If your exchange also offers a lending product, a non-custodial wallet, or a signals feed, those need to be firewalled out of every certified campaign's ad copy, sitelinks and destination pages — not merely left out of the headline.

Regional Marketing Rules: What You Can Actually Say

Here is the layer that catches experienced advertisers. Once both gates are open, the regulator governs the content of the promotion itself, and its rules bind you whether or not the ad platform noticed. Enforcement here means fines and licence conditions, not a rejected ad.

The pattern across every mature regime is the same, and it is worth internalising as a creative brief rather than a checklist: you may describe what your product is, and you may not suggest what it will do for someone's money. Regulators have converged on banning guaranteed returns, urgency, ease-of-wealth framing, and unqualified past performance. Build your messaging system around proof — licences, reserves, audits, security architecture, fee transparency — and it will clear review in every jurisdiction at once. Build it around upside and you will be rewriting it market by market forever.

Meta, TikTok, X, the App Store and Google Play

Google is the most documented gate, not the only one. Each remaining platform runs its own process, and the differences are large enough that a single global creative set will fail somewhere.

Do not overlook the store layer. For an exchange, the app is usually the conversion destination, and a store-level geo restriction quietly invalidates the paid campaign pointing at it. I have seen more crypto budget wasted on ads driving to a store listing unavailable in the target country than on any creative mistake. If you are running app campaigns, the store and the ad platform have to be cleared in the same country at the same time — the mechanics of doing that are covered in the Google App Campaigns playbook for crypto apps.

Getting Certified: What Actually Moves an Application Forward

Applications fail on preventable detail far more often than on substance. From February 2026 Google began rolling out an in-account route for these applications, alongside the existing Help Centre form — certifications for crypto exchanges and software wallets, hardware wallets, coin trusts and complex speculative financial products can now be applied for under the Policy and Account section of the Google Ads account, released incrementally rather than to everyone at once. Existing certifications and pending applications were unaffected by that rollout.

What separates an approval from a rejection:

• One application per country, sequenced by revenue. Do not submit everywhere simultaneously. Rank markets by realistic contribution, apply to the top two or three, learn what reviewers push back on, then scale the pattern.
• Name the licence on the website, not just in the form. Reviewers check the destination. The entity name on your licence, the regulator, the licence number and the jurisdictions you serve should be visible on the site and consistent with the application. Mismatched legal entity names are the most common silent rejection.
• Match the corporate entity to the licence holder. If the Google Ads account, the billing entity, the website owner and the licence holder are four different companies, expect to explain the relationship with documentation.
• Clean the destination page before you apply. Remove or gate prohibited products, return claims, and unqualified performance figures. A single lending or signals promotion in the footer can sink the application.
• Plan for weeks, not days. Multi-week review is normal, and a resubmission resets the clock. Certification lead time belongs in the launch plan alongside creative and tracking, and enforcement now generally comes with at least seven days' warning before suspension rather than an immediate shutdown — use that window, do not rely on it.

One caution on the paperwork: verification requirements have been tightening, and various third-party verification steps involving corporate registration and proof of address have been widely reported. Confirm what is currently being asked of you in your own account rather than working from any secondhand account of the process, including this one.

Growing in Markets Where You Cannot Buy Ads

The uncomfortable strategic reality is that for most crypto businesses, a meaningful share of the addressable market is either fully closed to paid acquisition or gated behind a licence you do not yet hold. Singapore restricts you to owned channels. Mainland China is closed. Any country not on the platform's approved list is effectively closed. And in markets where you are certified, cost per funded user is punishing because every certified competitor is bidding the same narrow set of auctions.

That reprices the whole growth stack. The channels that do not depend on a certification gate become the primary engine rather than support:

• Organic search and AI-assistant visibility. When someone asks an AI assistant which exchange to use in their country, you are either cited or invisible, and no licence is required to be the best answer. This is the single highest-leverage channel in restricted markets and it compounds.
• Comparison, review and listing surfaces. Aggregators, data sites and regional review platforms reach exactly the high-intent audience paid media cannot, though note that in the UK an approved promotion may still be required depending on how the placement is framed.
• Owned channels, used properly. Where the regulator confines you to your own website, app and official social accounts — as MAS does — those assets stop being brochures and become the acquisition funnel. Content depth, onboarding clarity and conversion rate carry the entire load.
• Product-led referral loops. In-app referral compounds without buying inventory. Check the rules first: the FCA bans referral incentives that induce investment, so a mechanic that is fine in Dubai can be unlawful in London.
• Licensed-status PR. A new licence is genuinely newsworthy, earns links in a category where links are hard to earn, and directly feeds the trust signals that move conversion. It is the rare compliance milestone that is also a marketing asset.
• Community. A moderated Telegram or Discord, and KOL partnerships that respect disclosure rules, lower blended acquisition cost over time in a way paid media structurally cannot.

The full-funnel version of this argument — how to sequence these channels and what to measure — sits in the crypto exchange user growth playbook, and the conversion mechanics behind it in how to build a crypto marketing funnel that actually converts.

Building a Compliance Operating System

Teams that handle this well are not the ones with the best lawyers. They are the ones who turned compliance into infrastructure instead of a review meeting. Four components do most of the work:

A claims matrix

One row per claim you want to make, with columns for the evidence source, the jurisdictions where it is permitted, and the mandatory qualifier in each. Every headline, description and landing page hero must map to an approved row. This single document removes most creative rework, because writers stop inventing claims that compliance will later delete.

A jurisdiction matrix

One row per market, with columns for licence held, platform certifications held, prohibited products, mandatory disclaimers, cooling-off requirements and referral rules. Anyone launching a campaign checks one row. Without this, tribal knowledge lives in one person's head and leaves when they do.

Hard geo-gating

Location targeting is a setting, and settings drift. Enforce exclusions at the account level, restrict presence-based targeting rather than interest-based, and block traffic from uncertified markets at the landing page as a second layer. Spill into a market where you hold no certification is a compliance event, not a wasted click.

A named approval path with an audit trail

Every asset that reaches an ad account should have a recorded approver and a timestamp. In the UK this is a legal requirement rather than good practice, and under VARA the licensed VASP must have approved marketing carried out on its behalf — which explicitly includes what your agency and your affiliates publish. Affiliate and KOL content is the most common blind spot in the entire stack, because it is the content you did not write and did not see.

The Dates Already on the Calendar

Compliance roadmaps should be built against known deadlines rather than reacting to them.

How Crypto Advertisers Actually Get Suspended

Almost none of it is exotic. In rough order of frequency:

• Geo-targeting spill into a country where no certification is held, usually via interest-based location settings or an uncapped display placement.
• A prohibited product on the landing page — a lending product, a non-custodial wallet, a signals feed — sitting alongside the certified exchange.
• Return and performance claims in copy, creative overlays, or a testimonial the team did not think of as a claim.
• A missing or buried risk disclaimer where the regulator required it to be prominent. Present in the footer is not prominent.
• Affiliate and KOL content published without approval or disclosure, which the licensed entity is nonetheless answerable for.
• Entity mismatch between the licence holder, the billing entity and the site owner, surfacing during a routine re-verification.
• A lapsed or superseded licence, most commonly a legacy national registration that a transition deadline quietly retired.

Every item on that list is a process failure rather than a judgement call, which is the encouraging part: all of it is preventable with the matrices and the approval path described above.

The Bottom Line

Crypto advertising in 2026 rewards operational discipline over creative firepower. The licence determines which markets exist for you. The platform certification determines which of those markets you can buy in. The regulator's marketing rules determine what you are permitted to say once you are there. And in the markets closed to paid media entirely, organic visibility, product and community are not a fallback — they are the whole strategy.

Teams that map the three layers before planning the budget ship on time and rarely get suspended. Teams that plan the budget first spend the launch quarter in a certification queue.

If you are working through market entry, certification sequencing, or growth in a market where paid media is closed, that is the work I do with crypto exchanges from Dubai, Singapore and London. Get in touch and we can look at your specific jurisdiction set.

Primary Sources

Bookmark these rather than any summary, including this one. They are the documents that actually bind you, and they are updated without announcement.

• Google Ads — Cryptocurrencies and related products policy, the country and licence map
• Google Ads — Financial products and services policy update, February 2026
• Google Ads — certification process update, February 2026
• Google Ads — France cryptocurrency advertising update, July 2026
• Google Play — Cryptocurrency Exchanges and Software Wallets policy
• Meta — Cryptocurrency Products and Services advertising standard
• VARA Rulebooks and the Virtual Assets Regulatory Authority, for the Dubai marketing regulations and guidance
• FCA PS23/6 — financial promotion rules for cryptoassets
• MAS — guidelines on licensing for digital token service providers
• ASIC — implementation roadmap for the digital assets framework

This article is a marketing operations reference, not legal advice. Verify every requirement with the relevant regulator or platform, and take qualified legal counsel before entering a regulated market.