Understanding VASP Licensing

What is VASP licensing?

A virtual asset service provider, or VASP, is a business that carries out certain virtual-asset activities for other people. These can include exchanging cryptoassets, transferring them or controlling the cryptographic keys needed to access them.

“VASP licensing” is often used as shorthand for regulatory permission to operate a cryptoasset business. However, it is not a single international licence. Depending on the jurisdiction and activity, a provider may need anti-money laundering registration, full financial-services authorisation, several permissions, or membership of a recognised supervisory organisation.

The distinction matters. Registration focused on financial-crime controls does not necessarily involve the same capital, custody or conduct requirements as broader authorisation. Neither guarantees that customer assets are safe or that losses will be compensated.

Which activities make a business a VASP?

The Financial Action Task Force, or FATF, establishes international standards for combating money laundering and terrorist financing. Its VASP definition covers businesses conducting specified activities for or on behalf of another person:

• Exchange between virtual assets and fiat currencies.
• Exchange between different virtual assets.
• Transfers of virtual assets.
• Safekeeping or administration of virtual assets, or instruments enabling control over them.
• Participation in, and provision of financial services related to, an issuer’s offer or sale of virtual assets.

FATF standards guide national legislation; FATF does not issue licences. Local definitions, exclusions and additional obligations determine whether a particular business requires permission.

Function matters more than branding

A business calling itself a software company may still perform regulated custody if it can control customers’ assets. Conversely, publishing software or providing a genuinely non-custodial wallet does not automatically make its developer a VASP.

The practical questions include who can authorise transfers, who controls keys, whether someone operates the service as a business, and whether the service acts for customers.

Likewise, describing a platform as decentralised does not settle its status. Owners or operators retaining control or sufficient influence may fall within applicable rules. The treatment of decentralised arrangements remains jurisdiction-dependent.

Assets also matter. Tokenised securities, stablecoins and other tokens can trigger different frameworks. Under FATF terminology, digital representations of financial assets already covered elsewhere in its recommendations are not automatically treated as virtual assets.

Registration, licensing and authorisation

These terms are not internationally interchangeable.

Registration may primarily bring a business within anti-money laundering and counter-terrorist financing supervision. It can involve substantive checks of ownership, management and controls, but does not necessarily confer broader financial-services permissions.

Licensing or authorisation may additionally cover governance, financial resources, safeguarding, custody, operational resilience, disclosures and complaints handling. The actual obligations depend on the legal regime, not the label alone.

Activity-specific permissions limit what the entity may do. Permission to exchange assets does not automatically permit custody, lending, derivatives trading or stablecoin issuance.

A provider can therefore be properly registered for one service while lacking permission for another. Regulatory checks should focus on the legal entity, permitted activities and customer location—not simply whether a website displays a licence number.

How the main jurisdictions differ

European Union: MiCA uses the term CASP

The EU’s Markets in Crypto-assets Regulation, or MiCA, uses crypto-asset service provider, abbreviated to CASP, rather than VASP. Its scope includes services such as custody, exchange, operating trading platforms, executing orders and providing advice on cryptoassets.

An authorised CASP can generally provide its authorised services across the EU through MiCA’s cross-border notification procedures. Certain already-regulated financial institutions can provide specified services through a separate notification route, subject to applicable conditions.

MiCA does not cover every token. Cryptoassets qualifying as financial instruments fall under other financial-services legislation. Stablecoin issuance has distinct requirements, and authorisation to provide cryptoasset services does not itself authorise issuance.

Legacy national registrations and transitional arrangements must not be confused with MiCA authorisation. Check the relevant national authority and European Securities and Markets Authority registers, particularly where transitional provisions may apply.

United Kingdom: AML registration is not blanket approval

The UK framework includes Financial Conduct Authority registration for specified cryptoasset exchange and custodian wallet businesses under the Money Laundering Regulations. That registration concerns financial-crime supervision; it is not a general endorsement of the business or its products.

Other activities may require separate authorisation, including services involving regulated investments. Cryptoasset promotions also have their own rules, which can affect overseas businesses marketing to UK consumers.

Do not assume that registration makes cryptoasset holdings eligible for Financial Services Compensation Scheme protection. UK cryptoasset regulation is evolving, so check the FCA for the permissions, commencement dates and transitional rules applicable to the service concerned.

United States: federal and state requirements overlap

The US does not have one comprehensive federal VASP licence. A business accepting and transmitting convertible virtual currency may be a money transmitter under Financial Crimes Enforcement Network rules, requiring money services business registration and an anti-money laundering programme unless an exclusion or exemption applies.

FinCEN registration is not equivalent to state licensing. State money-transmission requirements can apply separately, and New York has a specific virtual-currency licensing framework alongside relevant banking charter routes.

Securities, commodities and derivatives rules may also apply depending on the assets and activities. A provider must analyse the complete service rather than treating money services business registration as permission for everything it offers.

Switzerland: permissions follow the business model

Switzerland regulates activities rather than offering one universal VASP licence. Depending on its structure, a cryptoasset business may need affiliation with a recognised anti-money laundering self-regulatory organisation or supervision under another applicable regime.

Banking, FinTech, securities-firm, collective-investment or distributed-ledger trading-facility requirements may become relevant. The Swiss Financial Market Supervisory Authority, FINMA, supervises the applicable licence categories.

Customer-asset arrangements are particularly important: whether assets are individually attributable, available for the provider’s use or repayable as deposits can affect the analysis. A Swiss commercial registration or anti-money laundering affiliation should not be presented as a banking licence.

United Arab Emirates: identify the relevant regulator

The UAE has several regulatory jurisdictions. Dubai’s Virtual Assets Regulatory Authority regulates relevant virtual-asset activities in Dubai outside the Dubai International Financial Centre. The DIFC has its own financial regulator, as does Abu Dhabi Global Market.

Relevant federal securities and central-bank frameworks may apply elsewhere or to particular activities. Payment-token services, for example, can require a different analysis from operating a virtual-asset exchange.

A commercial free-zone licence is not necessarily financial regulatory permission. Verify the entity’s location, regulator, authorised activities and whether its approval permits live operations rather than only preparatory work.

Singapore: payment-service permissions and other regimes

Singapore regulates digital payment token services under the Payment Services Act, with the Monetary Authority of Singapore overseeing the relevant licensing framework. The regime addresses financial-crime risks and includes additional customer-protection and operational requirements where applicable.

Tokens constituting capital-markets products may instead, or additionally, engage securities legislation. Separate rules can also affect Singapore-based providers serving customers outside Singapore.

Check MAS records for the entity’s precise status and permitted services. A payment institution licence is not a banking licence and does not make digital payment tokens insured deposits.

What an application usually involves

Requirements differ, but regulators commonly assess a similar set of questions.

Ownership, management and governance

Applicants generally identify beneficial owners, explain sources of funding and demonstrate that directors and senior managers are suitable. Regulators may expect genuine local management, clear reporting lines and sufficient staff to oversee outsourced functions.

A detailed business plan should explain customers, products, asset types, transaction flows and revenue sources. Generic policy documents are not a substitute for controls that match the actual operation.

Financial-crime controls

A credible programme normally includes customer identification, beneficial-ownership checks, sanctions screening, transaction monitoring and suspicious-activity reporting. Higher-risk relationships require appropriate enhanced checks.

Blockchain analytics can help identify exposure to suspicious addresses, but it does not replace customer due diligence or an investigation process. Providers need documented procedures for escalating alerts and deciding whether to restrict transactions.

Custody and operational resilience

Where custody is offered, supervisors may examine key generation, access controls, transaction approval, backups and recovery. They may also assess customer-asset segregation, reconciliation, incident reporting and outsourcing.

Operational segregation and legal protection are different. Recording customer balances separately does not, by itself, establish that customers can recover their assets if the provider becomes insolvent.

Capital and liquidity requirements vary. Applicants should distinguish regulatory minimums from the resources needed to maintain operations and wind down safely.

How the Travel Rule works

The FATF Travel Rule requires countries to implement measures under which covered providers obtain and transmit specified originator and beneficiary information for virtual-asset transfers.

For example, when a customer sends assets from one regulated exchange to another, the sending provider may need to identify the receiving provider and securely transmit required customer information alongside the transfer process.

This information is not normally meant to be published on a public blockchain. Providers need secure data exchange, counterparty checks and procedures for missing or inconsistent information.

Thresholds, required fields and treatment of transfers involving self-hosted wallets vary. A self-hosted wallet is not itself a VASP, but transactions involving one may still require checks by the regulated provider.

What customers and counterparties should check

Before relying on a licensing claim:

• Match the entity: compare the contractual company name with the regulator’s register.
• Check the scope: confirm that the relevant custody, exchange or transfer service is permitted.
• Check restrictions: look for conditions, warnings or limits on customer types.
• Check geography: establish whether the entity may serve customers in the relevant jurisdiction.
• Read the asset terms: understand ownership, segregation, withdrawal rights and insolvency treatment.
• Verify protection claims: distinguish deposit insurance from private insurance or contractual promises.

Use the regulator’s register directly rather than relying on a certificate or link supplied by the provider. Group companies can hold different permissions, and a licence held by one affiliate does not automatically cover another.

The practical takeaway

VASP regulation is best understood as a mapping exercise: identify the asset, activity, legal entity and jurisdictions involved, then determine the applicable permissions and ongoing obligations.

Licensing can establish meaningful standards and supervisory accountability. It does not eliminate market, fraud, custody or insolvency risk. Businesses should assess the regulatory perimeter before launching or expanding, while customers should verify what a permission actually covers.