What Is a VASP, and How Is Crypto Licensed?

Almost every rule that touches crypto intermediaries — anti-money-laundering checks, the Travel Rule, licensing regimes — hinges on a single concept: the VASP, or virtual asset service provider. If you want to understand how crypto is regulated, understanding what a VASP is and how VASPs are licensed is the natural starting point.

This article explains the definition, the activities it covers, where it comes from, and why licensing looks so different from one country to the next. It is general information, not legal or financial advice; rules vary by jurisdiction and change over time.

What a VASP is

A VASP is, in the words of the Financial Action Task Force (FATF), a natural or legal person who, as a business, conducts one or more covered virtual-asset activities on behalf of customers. Two elements are doing the heavy lifting here: it must be a business activity, and it must be carried out for other people. Someone simply managing their own crypto is generally not a VASP; a company that runs an exchange or holds customers’ assets typically is.

Common real-world examples include crypto exchanges, custodial wallet providers, and certain crypto brokers and transfer services. Whether a specific business qualifies depends on how its jurisdiction has implemented the FATF definition, which can capture some models and exclude others.

The five covered activities

FATF defines a VASP by reference to five categories of covered activity. A business that performs one or more of these for customers generally falls within scope:

• Exchange between virtual assets and fiat currencies — converting crypto to or from government money.
• Exchange between one or more forms of virtual assets — swapping one crypto for another.
• Transfer of virtual assets — moving crypto from one person or address to another on a customer’s behalf.
• Safekeeping or administration of virtual assets — custody, including holding the instruments that enable control of assets.
• Participation in and provision of financial services related to an issuer’s offer or sale of a virtual asset — certain activities around issuance and fundraising.

This activity-based approach is deliberate. Rather than naming particular company types, it focuses on what a business actually does, so that new models can still be captured.

Where the concept comes from: FATF Recommendation 15

The VASP concept was cemented when FATF substantially revised Recommendation 15 in 2019 to bring virtual assets and VASPs into the global anti-money-laundering and counter-terrorist-financing framework. Recommendation 15 requires countries and financial institutions to identify and manage the risks arising from new technologies, including crypto.

As with all FATF standards, Recommendation 15 is not itself law. FATF sets the standard, and member countries — and jurisdictions with materially important VASP activity — are expected to implement it through their own legislation and regulators. That is why the concept is globally recognized while the specifics differ everywhere.

Licensing and registration

A core expectation under the FATF framework is that VASPs should be licensed or registered. FATF guidance indicates that VASPs should be licensed or registered in the jurisdiction where they are created, and that countries should take steps to prevent unlicensed or unregistered VASPs from operating. In practice, this means a firm usually cannot simply launch a crypto service and ignore the local regulator.

Once licensed or registered, VASPs are generally expected to meet AML/CFT obligations comparable to those of traditional financial institutions, including:

• Customer due diligence — identifying and verifying customers.
• Transaction monitoring — watching for suspicious activity.
• Suspicious activity reporting — notifying authorities where required.
• Record-keeping — retaining information for set periods.

Why the definition is activity-based

A deliberate feature of the FATF approach is that it defines a VASP by what a business does, not by what it calls itself. This matters because crypto business models evolve quickly, and a definition tied to specific labels or technologies would quickly fall out of date. By focusing on covered activities carried out as a business for customers, the standard aims to capture new entrants that perform the same economic functions as an exchange or custodian, even if they use novel structures. The trade-off is uncertainty at the edges: two services that look similar on the surface can end up classified differently depending on who controls funds and how the service is provided. This is why careful, fact-specific analysis, rather than the marketing label a project chooses, ultimately determines whether a business is treated as a VASP.

Why licensing varies so much

There is no single global crypto license. Because each country implements the FATF standard through its own laws, licensing regimes vary widely in scope, cost, documentation, and the authority responsible. Some jurisdictions have built detailed, dedicated frameworks; others fold crypto into existing financial or money-services rules; and some are still developing their approach.

Regional frameworks add another layer. In the European Union, the Markets in Crypto-Assets Regulation creates an authorization regime whose approval can be passported across member states, so a firm authorized in one EU country can serve the whole bloc. Elsewhere, a firm may need to obtain separate approvals in every market it enters. For a firm operating internationally, this means navigating multiple, sometimes overlapping, regimes at once.

DeFi, custody, and the grey areas

The activity-based definition is broad, but applying it to real businesses is not always straightforward. Purely peer-to-peer software, where users transact directly without an intermediary holding funds or executing trades for them, can be harder to classify than a centralized exchange. FATF guidance has explored how the definition might apply to decentralized arrangements, focusing on whether any person or entity exercises control or provides a covered service as a business. Outcomes depend heavily on the specific facts and on how each jurisdiction interprets them. A key practical dividing line is custody: a service that holds or controls customers’ assets, or the keys to them, is far more likely to be treated as a VASP than one that never touches customer funds. The distinction between holding assets for others and letting users retain control mirrors the broader difference between custodial and non-custodial models.

What licensing typically involves

While the specifics vary by country, applying for VASP authorization or registration commonly requires a firm to demonstrate a number of things. Typical expectations include:

• Fit-and-proper checks on owners, directors, and key staff.
• An AML/CFT program covering customer due diligence, monitoring, and reporting.
• Governance and risk controls, including record-keeping and, in some regimes, safeguarding of client assets.
• Financial and operational resilience requirements, which are more demanding in some jurisdictions than others.

Because these requirements are set nationally, the cost, timeline, and difficulty of obtaining approval differ dramatically. Some jurisdictions have become known for detailed, demanding regimes, while others are lighter or still developing rules. This variation is one reason firms sometimes choose where to base themselves partly on the regulatory environment.

How VASP status connects to other rules

Defining a firm as a VASP is the trigger that switches on a chain of obligations. Because VASPs are inside the AML framework, they are expected to identify their customers and monitor activity, which is the domain of KYC and AML in crypto. VASP status is also what makes the crypto Travel Rule apply, since that rule governs how VASPs share sender and recipient information when transferring assets. In regions with dedicated regimes, VASP-type activities are folded into broader frameworks; in the EU, for example, many of these firms fall under the authorization system described in our explainer on MiCA, the EU crypto regulation. In this sense, the VASP definition is the foundation on which much of crypto compliance is built.

How this fits the wider regulatory map

The VASP concept is deliberately global, but its real-world effect depends entirely on national implementation. Some countries have built comprehensive crypto regimes, others rely on existing money-services or financial laws, and a few are still catching up. To see how these national choices compare, our overview of how crypto is regulated by jurisdiction places VASP licensing in a broader context. The common thread is that FATF sets the direction while each country decides the destination.

The takeaway

A VASP is a business that performs covered crypto activities for customers, a concept created by FATF and implemented, unevenly, around the world. VASPs are generally expected to be licensed or registered and to follow anti-money-laundering rules, but the exact requirements depend heavily on jurisdiction, and there is no universal license. Because these regimes are still maturing and changing, treat this as an educational overview and rely on official sources and qualified advisers for any specific situation. This is general information, not legal advice.

Sources

• Virtual Assets — Financial Action Task Force (FATF)
• Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs — Financial Action Task Force (FATF)
• The FATF Recommendations — Financial Action Task Force (FATF)