Navigating the Rise of Crypto Cards: Legal Regulations and Implications

This article has been written jointly by the teams at TLP Advisors and OL Consulting.

Key Takeaways:

The rise of crypto payment cards, such as Revolut’s virtual card, enables users to seamlessly spend cryptocurrencies on everyday purchases, converting crypto to fiat at the point of sale.
In the UK, the FCA requires crypto service providers to comply with AML and CFT standards, with additional authorisations needed under the Payment Services Regulations.
The EU regulates crypto cards under MiCA and TTFR for licensing and AML compliance, while PSD2 applies to payment services, ensuring robust oversight of retail payments involving crypto.
The Central Bank of UAE’s PTSR, effective June 2025, will govern crypto card schemes using stablecoins, while fiat-based services will continue under existing payment regulations.
The Monetary Authority of Singapore requires crypto card providers to obtain licences under the PSA, with specific compliance obligations based on the services offered, including AML and conduct requirements.
South Korea applies multiple regulatory standards, including AML requirements and licensing for electronic financial services, with recent amendments restricting certain crypto transactions on domestic cards, emphasising a more cautious regulatory stance on crypto card payments.

1. INTRODUCTION

Revolut has recently introduced a new feature on its app – a virtual card allowing users to make cryptocurrency payments.[i] This innovation opens up the possibility for users to purchase everyday items like a morning coffee, a bus ticket, a book from their reading list, or even high-end gadgets, all using their crypto assets. The virtual card supports over 180 cryptocurrencies, offering a seamless experience for users who want to integrate digital currencies into their daily lives.

One of the standout aspects of this new offering is that Revolut claims no exchange fees are involved. When users make a payment, Revolut handles the currency conversion process in the background, ensuring the merchant receives fiat currency while the user pays in cryptocurrency. This means that users can pay any merchant, regardless of whether the business accepts crypto. Revolut aims to position itself at the forefront of the evolving digital finance landscape by eliminating exchange fees and simplifying the payment process.

In this article, we examine the laws that would apply to crypto card schemes offered in different jurisdictions. Ultimately, the question of which legal framework applies to a particular product is incredibly nuanced and dependent on its exact nature.

2. EXPLORING THE GROWING TREND OF CRYPTO PAYMENT SOLUTIONS

While Revolut’s virtual card is exciting, it is not unprecedented. As far back as 2019, Mastercard partnered with Tap Global to launch a cold storage wallet in the form of a card, which enabled users to directly exchange cryptocurrencies into fiat currency. This allowed them to make payments at any merchant that accepted Mastercard or even withdraw cash from ATMs.[ii]

Coinbase offers a similar service through its Visa debit card, which enables users to pay merchants directly with cryptocurrencies. In addition, Coinbase’s card provides rewards in the form of cryptocurrencies, adding an incentive for users to adopt the service.[iii]

Another significant player in this space is HQ.xyz, which has been developing a self-custody wallet for businesses paired with an associated debit corporate card. HQ.xyz allows users to make payments directly in fiat currency, converting stablecoins like USDC and USDT during the process.[iv]

While Revolut’s approach, with its virtual card and no exchange fees, is gaining attention, it is part of a broader trend where payment companies are increasingly integrating crypto into mainstream commerce. These developments are making it easier for consumers to spend crypto in their daily lives, expanding the possibilities for both individuals and businesses.

3. UNITED KINGDOM

In the United Kingdom (“UK“), the Financial Conduct Authority (“FCA“) oversees the regulation of cryptocurrencies. The FCA ensures that crypto asset providers adhere to stringent anti-money laundering (“AML“) and countering terrorism financing (“CFT“) regulations. To operate legally, all entities providing such services must register with the FCA and demonstrate compliance with these standards.

In addition, the provision of payment services in the UK falls under the Payment Services Regulations, 2017 (“PSRs“).[v] The PSRs govern a broad range of financial activities, including executing payments and issuing payment instruments. Under these regulations, any entity offering payment services, including those involving cryptocurrency, must obtain proper authorisation or registration with the FCA.

Payment services within the scope of the PSRs include, but are not limited to:

(a) Enabling cash to be placed on or withdrawn from a payment account;

(b) Executing payment transactions such as direct debits, card payments, and credit transfers;

(d) Money remittance and payment initiation services.

In relation to cryptocurrencies, particularly virtual cards, while they do not fall explicitly under the ambit of PSRs,[vi] transactions or remittance services that involve both fiat currency (or e-money) and cryptocurrencies may still be subject to regulation under the PSRs. For instance, if cryptocurrency is utilised as an intermediary to facilitate the conversion of one fiat currency into another—such as pounds sterling to Bitcoin to US dollars—the remittance service remains a regulated payment service under the PSRs. Thus, the involvement of cryptocurrency in the transaction does not exempt it from being classified as a regulated service.

The FCA’s draft guidance on crypto-assets[vii] clarifies that while the PSRs cover the fiat currency aspects of a remittance transaction, they do not apply to the use of cryptocurrencies as intermediaries in the process. As a result, it is essential to assess the overall nature of the services being provided to determine whether they fall under the scope of regulated payment services.

4. EUROPEAN UNION

The Market in Crypto-Assets Regulation (“MiCA“) governs the issuance or trading of cryptocurrencies. Under the MiCA, any entity that exchanges a cryptocurrency for another or for legal tender is considered a crypto-asset service provider,[viii] and crypto-asset service providers are subject to licensing requirements, AML provisions, and other regulations.

The Regulation on Traceability of Transfers of Funds (“TTFR“) is applicable parallel to the MiCA and requires payer and payee’s information to accompany certain cryptocurrency transfers.[ix] However, TTFR does not apply to transfers involving fiat currency (or e-money) or fiat-referenced cryptocurrencies if conducted via payment cards or an e-money instrument. This exemption is valid only when these instruments are used exclusively for payment of goods or services, their identifying number accompanies all related transfers.[x]

Retail payments in the EU are covered by the second Payment Services Directive, which applies to anyone offering card, internet, or mobile payment services. A payment institution licence from the relevant member state’s authority is required to issue a payment instrument, like a card, or execute payment transactions between the buyer and merchant using such a card.[xi]

5. UNITED ARAB EMIRATES

In the United Arab Emirates (“UAE“), the regulation of cryptocurrencies and crypto asset services is overseen by multiple regulatory authorities, with the Central Bank of the UAE (“CBUAE“) overseeing regulations for mainland UAE. Entities involved in virtual asset activities must comply with the CBUAE’s Payment Token Services Regulations (“PTSR”), which specifically governs the issuance, facilitation, and management of payment tokens, which is how the CBUAE refers to stablecoins.[xii] These services include enabling payments to merchants or facilitating the exchange of payment tokens for goods or services. As a result, entities offering cryptocurrency card schemes involving payment tokens will need to comply with the licensing and operational requirements of the PTSR when it takes full effect in June 2025.

With the introduction of the PTSR, it is important to distinguish between different types of digital assets in the UAE regulatory landscape. The Retail Payment Services and Card Schemes Regulation (“RPSCS”) and Stored Value Facilities Regulation (“SVFR”) remain relevant for services involving crypto-assets that are not stablecoins, but once the PTSR comes into full effect, they no longer apply to payment tokens.

If a card or e-wallet holds and processes fiat currency or traditional e-money, it will still be regulated under the RPSCS or SVFR. However, if the card or virtual device is used exclusively for payment tokens, the PTSR will govern those services instead.

6. SINGAPORE

In Singapore, the Monetary Authority of Singapore oversees the implementation of the Payment Services Act 2019 (“PSA”), which currently governs cryptocurrency-related activities and other types of payment services. These services include enabling payments to merchants, facilitating the exchange of payment tokens for goods or services and domestic and cross-border money transfer services.

Entities providing crypto card schemes must obtain a licence under the PSA corresponding to the types of payment services conducted. The scope of the required licence may differ, depending on the specific functions of the crypto card and the relevant business model. To illustrate, Revolut, which offers credit card schemes in Singapore with crypto-related functions, is licensed for six (6) types of payment services under the PSA (account issuance service, domestic money transfer service, cross-border money transfer service, merchant acquisition service, e-money issuance service and digital payment token service). On the other hand, Crypto.com, which offers its crypto card in Singapore, is only licensed for four (4) payment services (all of the foregoing except merchant acquisition service and digital payment token service).

Licensed entities will need to ensure compliance with the applicable conduct of business requirements, AML/CFT laws, and other regulatory requirements.

7. SOUTH KOREA

In South Korea, companies seeking to issue payment cards utilising cryptocurrencies must comply with various laws and regulations:

Under the Electronic Financial Transactions Act, any entity intending to issue and manage e-money must obtain authorisation from the Financial Services Commission (“FSC”). Therefore, companies wishing to issue cryptocurrency payment cards need to be licensed as electronic financial businesses by the FSC.

The Act on Reporting and Using Specified Financial Transaction Information (Special Financial Transactions Act) defines virtual asset service providers as entities engaged in the sale, purchase, exchange, transfer, storage, management, or brokerage of virtual assets. Companies issuing cryptocurrency payment cards fall under this category and are required to register with the Financial Intelligence Unit and comply with AML obligations.

The Specialised Credit Finance Business Act regulates matters related to the issuance of credit cards and other specialised credit finance businesses. If a company intends to issue cryptocurrency payment cards in the form of credit cards, it must obtain approval under this law.

On 30 June 2023, the National Assembly passed the Act on the Protection of Virtual Asset Users, which focuses on safeguarding users in the virtual asset market and regulating unfair trading practices. This legislation came into effect in July 2024.

In addition, the FSC announced a proposed amendment to the Enforcement Decree of the Specialised Credit Finance Business Act on 4 January 2024. This amendment aims to include virtual assets as prohibited items in card transactions. The amendment seeks to restrict the purchase of virtual assets through domestic card companies, thereby tightening control over cryptocurrency transactions.

Furthermore, on 25 October 2024, the Ministry of Economy and Finance unveiled plans to implement regulations governing cross-border transactions involving virtual assets, set to take effect in the latter half of 2025. Under these new regulations, companies conducting international transactions using virtual assets must register with the authorities in advance and report monthly transaction details to the Bank of Korea.

(We have covered South Korea in detail in our latest article – [link].[xiii])

8. CONCLUSION

The rise of crypto payment cards represents a significant step in integrating digital assets into everyday commerce. However, the regulatory landscape for these products remains highly jurisdiction-specific and complex. From the FCA’s stringent AML and CFT requirements in the UK to the UAE’s forthcoming PTSR and the multifaceted compliance frameworks in the EU, Singapore, and South Korea, businesses offering crypto cards must navigate diverse and evolving legal standards. As crypto adoption grows, harmonising innovation with regulatory compliance will be crucial to fostering trust and scalability in the global digital payments ecosystem.

***

TLP Advisors is a dynamic and forward-thinking consulting, strategy and law firm specialising in providing cutting-edge solutions to our diverse clientele. With our roots deeply embedded in financial services, gaming, web3, and emerging tech, we offer unparalleled knowledge and support tailored to these rapidly evolving sectors’ unique challenges and opportunities.

TLP Advisors has consistently been the firm of choice for L1 chains, DeFi protocols, gaming companies, fintech and payment companies, foundations, funds, and investors. We have built a reputation for excellence through frequent collaborations with regulators, funds, and technology incubators. Our deep understanding of the intricate regulatory landscapes and industry dynamics allows us to provide strategic guidance and innovative solutions that empower our clients to navigate complex challenges and seize emerging opportunities.

www.techlawpolicy.com

***

[i] Rosie Leheup-Ffoulkes, Discover daily spending, paid with crypto, Revolut (23 August 2024) https://www.revolut.com/blog/post/crypto-card-uk/.

[ii] Company announcement: TAP, TransactPay (07 November 2019), https://transactpay.com/news/company-announcement-tap/.

[iii] Coinbase Card, https://www.coinbase.com/card.

[iv] Self-custodial Visa Corporate Card, Headquarters, https://www.hq.xyz/payments#corporate-card.

[v] The Payment Services Regulations 2017, No. 752.

[vi] PSRs currently cover only certain “funds”, which have been defined as Section 2, “funds” means banknotes and coins, scriptural money and electronic money. As such, cryptocurrency does not explicitly fall under the scope of PSRs.

[vii] FG23/3: Finalised non-handbook g

uidance on cryptoasset financial promotions, Financial Conduct Authority (02 November 2023).

[viii] Article 3(1), point (16) of Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in cryptoassets.

[ix] Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 on information accompanying transfers of funds and certain crypto-assets. This Regulation implements the Financial Action Task Force’s Travel Rule,

[x] Article 2(3) of Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 on information accompanying transfers of funds and certain cryptoassets.

[xi] Article 11 of Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market.

[xii] Payment Token Services Regulation, available at: https://rulebook.centralbank.ae/en/rulebook/payment-token-services-regulation

[xiii] Soham Panchamiya, et.al, Seoul Sees All – South Korea’s Next Level of Oversight Over Virtual Assets, TLP Advisors (18 November 2024), https://techlawpolicy.com/2024/11/seoul-sees-all-south-koreas-next-level-of-oversight-over-virtual-assets/.