Kazakhstan, Japan and South Korea now use Apple and Google app stores to ban unlicensed crypto exchanges. Why app-store crypto regulation is quietly winning.
App Store Crypto Regulation Is Quietly Winning
On October 20, 2026, the Astana International Financial Centre (AIFC) Court did something a decade of angry warning letters never pulled off: it made Coinbase disappear. The court ordered Apple and Google to geo-block Coinbase and five other unlicensed exchanges — BingX, Bitcoin.com, HTX, BitMart and WEEX — from their app stores in Kazakhstan. No website takedown, no banking ban, no chasing VPNs. Just a quiet instruction to two American companies, and the world's "borderless" asset class slammed into a wall it can't route around.
Key Takeaways
- App-store enforcement is now the default tool for crypto regulation — Japan, South Korea and Kazakhstan all use Apple and Google to ban unlicensed exchanges.
- It works where website blocks failed, because mobile is the retail default and app stores kill the update pipeline, so access rots away over time.
- The real story is onshoring, not banning: Kazakhstan pairs its blocks with tax exemptions, a Tether tenge-stablecoin deal and a $60 million tokenization pilot.
- Winners are licensed exchanges and the app stores themselves; losers are offshore derivatives venues and retail access to the long tail of tokens.
- For traders, access risk is now a real, portable risk — spread funds across licensed venues and treat self-custody as strategy, not ideology.
Why does app-store enforcement work when website blocks fail?
Answer: because it attacks distribution, not access. For a decade, regulators reached for the website block and lost every time. A VPN costs three dollars a month and takes ninety seconds to install, so a blocked domain was an inconvenience, not a wall. Banking bans were sharper but leaky — money found rails through third-party payment processors, P2P markets and stablecoins. The app store is different. It sits at the exact point where most retail users actually touch crypto, and it is run by two companies that regulators can reach with a court order.
Apple and Google are not offshore. They have offices, legal entities, compliance teams and a demonstrated aversion to being sanctioned in any major market. When Japan's Financial Services Agency asked them to pull Bybit, MEXC, KuCoin, LBank and Bitget from Japanese app stores in February 2025, Apple complied within days. South Korea went further: in January 2026 Google began requiring proof of Virtual Asset Service Provider (VASP) registration before allowing any crypto exchange app in its Korean store, and 29 apps vanished. Now Kazakhstan is simply copying a playbook that is already working.
The elegant part is the attrition. A removed app keeps working for anyone who already installed it. But apps need updates, and phones get replaced. No updates means the app slowly breaks against changing APIs and security requirements. So the block doesn't need to be airtight — it just needs to make the user base decay. Korea understood this perfectly: it's a long-term strangle, not an instant shutdown.
Who wins and who loses when the app store becomes the regulator?
The winners are easy to spot. Licensed exchanges get something money can't buy: a regulatory moat. When the state forces competitors out of the app store, the compliant survivors inherit the users, the liquidity and the pricing power. Kazakhstan's regulated market has already grown more than 30-fold in three years, topping $10 billion, and the regulator openly framed the court order as protecting licensed firms that "carry AML and customer due-diligence costs" from free-riding offshore rivals. That is the quiet thesis of every one of these actions: license or leave.
Apple and Google are the less obvious winners, and the more troubling ones. They have become de facto financial regulators with zero accountability to any voter, parliament or consumer-protection agency. They enforce sovereign policy at the distribution layer, and they get paid for the privilege of deciding what finance looks like on a billion screens. A company's app-review team can delist an exchange faster than a legislature can pass a law — and no one elected them.
The losers are the offshore derivatives exchanges whose entire model was built on evading exactly this. Bybit, the second-largest venue by volume, has now retreated from Japan entirely after the app-store squeeze. Bitget followed the same script. These platforms didn't fail on technology or liquidity; they failed on geography. And the end user loses too: retail traders in tightening jurisdictions lose access to the long tail of tokens and high-leverage products that only offshore venues list. South Korea's financial intelligence unit already conceded that users with assets on blocked platforms "may face withdrawal difficulties." Read that sentence twice. The state knows people's money is stuck, and it's treating that as acceptable collateral damage.
Has this happened before, and what's actually different now?
Yes — and no. China's 2017 crackdown is the obvious historical parallel: website blocks, banking restrictions and a ban on fiat ramps, all designed to starve the industry. The result was not the death of crypto but its dispersal. Exchanges fled to Seychelles, Dubai, Malta and anywhere else that would take them, and the industry entered its offshore era — Binance, OKX, Bybit, MEXC and a dozen others running global books from jurisdictions with thin oversight.
What's different now is twofold. First, the choke point is better. Banks and websites were porous; the app store is the one layer of the stack almost every retail user has to pass through, and it is controlled by exactly two parties. Second, the state has learned to pair the stick with a carrot. China only had the stick, so it pushed the industry away. Kazakhstan is running the opposite experiment: block the unlicensed, then hand the licensed a tax exemption for private crypto holders, a memorandum with Tether to study a tenge stablecoin, a central bank weighing up to $350 million from gold and foreign-exchange reserves for crypto exposure, and a $60 million tokenization pilot in the planned smart city of Alatau. That's not a ban. That's a capture operation.
Where is app store crypto regulation heading in the next one to three years?
Expect the playbook to spread until "license or die" is the default state of the industry. Google has already shown the template in Korea by making VASP registration a listing requirement, and there's no reason Apple and Google won't build crypto-licensing checks directly into App Review worldwide. The end state looks less like one global crypto market and more like two hundred national markets, each with its own list of permitted venues, glued together by stablecoins and arbitrage.
That fragmentation has consequences. Price spreads between onshore and offshore venues — Korea's so-called "kimchi premium" is only the most famous example — stop being anomalies and become permanent features. Decentralized exchanges and self-custody become the escape hatch, which means they're next on the enforcement list. Uniswap was briefly pulled from Apple's store in 2023, and it's only a matter of time before a regulator asks for the bigger DeFi apps by name. The fight will shift from "can the state block an exchange" to "can the state block a protocol" — and the app store is where that fight will be fought.
There's also a deeper irony worth sitting with. Crypto was supposed to disintermediate gatekeepers — to remove the intermediaries who stand between you and your money. Instead it has minted two new gatekeepers, Apple and Google, who are more centralized, less accountable and harder to route around than any bank ever was. The "permissionless" revolution is being quietly domesticated at the one layer its founders forgot to defend.
What does this mean for traders, strategically?
Not price predictions — nobody should pretend to know where any token trades next month. But access risk is now a real, portable risk that most portfolios are not priced for. The practical implications are concrete. First, diversify across venues and pay attention to which exchanges hold which licenses where — that licensing map is now the single best roadmap for where liquidity will concentrate over the next three years. Second, don't leave meaningful funds parked on an unlicensed platform in a jurisdiction that is actively tightening; withdrawal friction is real and rising, and "I'll move it later" is how people get frozen out mid-enforcement. Third, take self-custody seriously as a strategic posture, not a philosophical badge. A wallet can't be delisted from an app store. Fourth, expect wider and stickier onshore-offshore spreads, which reshapes hedging and arbitrage for anyone moving size across borders.
The compliant venues are about to get the best trade in crypto: a competitor's forced exit is a moat you didn't have to dig. Watch which exchanges are quietly collecting licenses in Japan, Korea, Kazakhstan, Hong Kong and the Gulf. That's where the next decade's liquidity is going to live.
The question nobody is asking
Everyone is debating whether crypto should be regulated, and how much. The better question is who is actually doing the regulating. Right now, in the jurisdictions that matter most for retail flow, the answer is increasingly: Apple and Google, executing sovereign policy through a private app-review process, insulated from elections, appeals and public scrutiny. They delist faster than a parliament legislates, and they answer to no voter on earth. Crypto spent fifteen years arguing it didn't need permission. It turns out the permission layer was never the blockchain — it was the home screen.
DYOR: Kazakhstan's Astana Financial Services Authority publishes its decisions and licensed-firm register at afsa.aifc.kz (https://afsa.aifc.kz/). Japan's Financial Services Agency maintains its registered-exchange list at fsa.go.jp (https://www.fsa.go.jp/en/). Tether's announcement of its tenge-stablecoin memorandum with the National Bank of Kazakhstan is at tether.io (https://tether.io/).
FAQ
Why did Kazakhstan block Coinbase's app? The AIFC Court ruled on September 15, 2026 (announced October 20) that Coinbase and five other platforms were offering digital-asset services in Kazakhstan without a license. The order directs Apple and Google to geo-block the apps rather than relying on website blocks, which users can evade with a VPN.
Can users still access blocked exchanges with a VPN? Partially. A VPN gets around a website block, but app-store geo-blocking is harder to sidestep because sideloading or using regional app stores is higher friction for ordinary users, and blocked apps stop receiving updates, so they degrade over time. The tactic is attrition, not an airtight wall.
Are Apple and Google becoming crypto's real regulators? In practice, yes. When a state can't reach an offshore exchange directly, it reaches Apple and Google instead, and they enforce the policy through app removal. They have no democratic mandate, yet they now decide what financial apps are visible to hundreds of millions of users.
Who benefits from app-store crypto enforcement? Licensed exchanges gain a regulatory moat and pricing power; states gain tax revenue, AML visibility and "innovation hub" status; and Apple and Google consolidate control over distribution. Offshore high-leverage venues and retail access to the long tail of tokens lose out.
What should a trader do if their exchange gets blocked? Treat withdrawal friction as a live risk: don't park large balances on unlicensed platforms in tightening jurisdictions, diversify across venues that hold local licenses, and use self-custody wallets for assets you're not actively trading.