What counts as a VASP
The FATF's glossary defines a VASP as any natural or legal person, not covered elsewhere under the Recommendations, that as a business conducts one or more of five activities for or on behalf of another person:
- Exchange between virtual assets and fiat currencies
- Exchange between one or more forms of virtual assets
- Transfer of virtual assets
- Safekeeping or administration of virtual assets, or of instruments enabling control over them
- Participation in, and provision of, financial services related to an issuer's offer or sale of a virtual asset
What a virtual asset is
A virtual asset, in the same glossary, is a digital representation of value that can be digitally traded or transferred, and can be used for payment or investment purposes. Digital representations of fiat currencies, securities and other financial assets are left out, because other parts of the Recommendations already cover them.
What the FATF asks of VASPs
The FATF added binding measures on virtual assets to its standards in June 2019. Countries are to understand the risks of the sector, license or register its providers and supervise them as they supervise other financial institutions.
VASPs apply the same preventive measures as financial institutions: customer due diligence, record keeping and suspicious transaction reports. On transfers, they obtain, hold and transmit originator and beneficiary information, which is the Travel Rule.
VASP is a standard-setter's word, and each country chooses its own. The EU's MiCA regulation speaks of crypto-asset service providers, and some other jurisdictions kept the FATF's word for their own licence, so what a VASP licence allows depends on who issued it.
VASP or CASP?
- CASP
- Crypto-asset service provider, the EU's legal term under MiCA: an authorisation with capital and conduct rules, valid across the EU. A VASP is the FATF's category, defined for anti-money laundering purposes.
- Virtual asset or crypto-asset?
- The FATF says virtual asset and MiCA says crypto-asset. The definitions overlap but are not the same text, so a token is classified under each regime separately.
Where a VASP shows up in a platform
Modules that do the work
- Custody & walletsWallets on every major chain, with MPC custody from leading providers or your own keys.
- KYC / AMLIdentity checks, screening and ongoing monitoring, with the verification provider you choose.
- Compliance reportingTransaction monitoring, the Travel Rule and regulatory reports, ready for your regulator.
Platforms that need it
Guides that go deeper
- VARA, ADGM or DIFC: where to license a crypto business in the UAEWho licenses crypto in the UAE: VARA in Dubai, the DFSA in DIFC, the FSRA in ADGM, the Capital Market Authority elsewhere, and the Central Bank when tokens are used to pay.
- VARA licence for a crypto exchange in DubaiWhat Dubai's virtual assets regulator asks of a crypto exchange: the two-stage licence, the rulebooks, capital and fees as VARA publishes them, local staff and the Travel Rule.
- FCA cryptoasset registration: what UK crypto firms needWhat FCA registration under the Money Laundering Regulations asks of a UK crypto business, how crypto promotions are controlled, and what changes on 25 October 2027.
Where it is written
The laws and standards this page's facts come from.
- FATF Glossary: virtual asset, and virtual asset service providers
- FATF, Virtual assets
- FATF, History of the FATF
General information, not legal advice: what applies to you depends on your services and your market.