CASP stands for crypto-asset service provider: a company whose business is providing crypto services to other people. If a firm lets you swap euros for Bitcoin, holds your tokens in a wallet it controls, or advises you on which digital assets to buy, it is acting as a crypto-asset service provider.
The label is not marketing language. It is a legal status used across the European Union, with a fixed list of activities behind it, a licence requirement and a regulator watching everyone who holds it. This guide explains the term in plain English: where it came from, which companies it covers, who falls outside it, and how it compares with labels used abroad.
In one sentence
A CASP is a business authorised under MiCA to supply crypto-asset services — exchange, custody, brokerage, advice or transfers — to clients on a professional basis.
CASP Meaning and Where the Term Came From
Before the EU adopted a single rulebook, every member state handled crypto companies its own way: registration bolted onto anti-money-laundering law here, a bespoke permit there, almost no supervision elsewhere. A business that was legitimate in one country could be shut out of the next.
The Markets in Crypto-Assets Regulation, universally called MiCA, was written to end that fragmentation. It introduced “crypto-asset service provider” as the official name for the firms that stand between users and the blockchain. The definition itself sits in Article 3 of the published text of the regulation.
The Three Conditions Behind the Definition
Stripped of the drafting, the definition sets three conditions, all of which must be met at once:
- It is a legal person or comparable undertaking. A company, in other words — not a private individual acting on their own behalf.
- It provides crypto-asset services to clients as an occupation or business. The service is offered to other people, not performed for its own account.
- It holds an authorisation to do so. The licence spells out exactly which services the firm is cleared to carry out.
The third point is the one newcomers miss. CASP is not a description of what a company does — it is a status the company holds. A firm carrying out crypto-asset services without a MiCA licence is not an unlicensed CASP; it is simply operating unlawfully.
One boundary is worth drawing early. The rulebook has two halves: rules for those who create and offer tokens, and rules for those who provide services around them. CASP belongs to the second half: creating a token does not make you one; running the platform where it trades does.
What Counts as a Crypto-Asset Service
Ten activities make up the regulated list. Perform any one of them for clients on a professional basis and the CASP licence requirement is triggered.
| Regulated activity | What it looks like in practice |
|---|---|
| Custody and administration | Holding crypto for clients and controlling the keys. |
| Operating a trading platform | Running a venue where third-party orders meet. |
| Exchange for funds | Swapping crypto for ordinary currency and back. |
| Exchange for other crypto-assets | Swapping one token for another. |
| Execution of orders | Concluding deals for a client on agreed terms. |
| Placing of crypto-assets | Marketing crypto-assets to buyers on behalf of the offeror. |
| Reception and transmission of orders | Passing a client’s order to another firm. |
| Advice | Recommending what a client should buy or sell. |
| Portfolio management | Deciding trades for a client under a mandate. |
| Transfer services | Moving crypto between addresses for a client. |
Most consumer-facing brands combine several of these at once. A typical exchange app runs a trading venue, converts crypto into currency, holds balances in custody and moves assets between wallets — four regulated activities in one product. Because permissions are granted service by service, two crypto companies carrying the same label may do very different things.
Who Is Not a Crypto-Asset Service Provider
What falls outside the list matters just as much. None of the following, on its own, turns a business into a regulated provider:
- Trading your own money. Buying, holding and selling for yourself is not a service to clients.
- Self-custody. Keeping your own keys in a wallet you alone control involves no provider at all.
- Publishing software. Releasing open-source code differs from running the business built on top of it.
- Accepting crypto as payment for goods or services you sell yourself.
- Group-internal arrangements serving a parent or subsidiary, not outside clients.
- Genuinely decentralised setups with no intermediary — though few survive that test once a front end or an admin key is involved.
The professional-basis test
Occasional, private, unpaid help does not make you a provider. Repeated, organised, commercial activity does — regardless of how the business describes itself, whether it charges a visible fee, or where its website is hosted.
What a CASP Licence Actually Involves
Authorisation is granted by the competent authority of the member state where the crypto company is established. Once issued, the CASP licence covers the whole European Economic Area, with no fresh approval needed country by country — the arrangement called passporting. Single-market access is the real prize behind the status.
The licence is not a one-off formality. An authorised provider carries continuing duties: hold client assets separately from its own, describe services and charges honestly, publish risk warnings, handle complaints, manage conflicts of interest, keep its systems secure and maintain anti-money-laundering controls. Supervisors can inspect it, demand information and, ultimately, withdraw the licence.
Every authorisation appears in a public register kept by ESMA, and anyone can search it before handing money to a platform. Banks and investment firms may add certain crypto-asset services to their existing permissions by notification under MiCA. Transitional arrangements for firms under older national registrations have expired.
Scope of this page
This entry covers what the term means, not how the licence is obtained. Requirements and procedures sit on our MiCA licensing page.
CASP vs VASP and Other Global Labels
The idea behind the CASP category is not uniquely European. Most significant jurisdictions regulate crypto firms that handle other people’s assets; only the words differ.
The most widely used alternative is VASP, short for virtual asset service provider. It comes from the Financial Action Task Force, which sets anti-money-laundering standards, and has been written into national law in dozens of countries. A VASP covers broadly the same ground: exchanging, transferring and safekeeping virtual assets for others.
| Term | Where it is used | Scope in brief |
|---|---|---|
| CASP | EU and EEA | Ten crypto-asset services under a single authorisation |
| VASP | International standard, widely copied | Exchange, transfer and safekeeping of virtual assets |
| Cryptoasset business | United Kingdom | Financial-crime registration, with full authorisation phasing in |
| Money services business | United States | Money transmission, which captures many crypto operators |
| Digital payment token service | Singapore | Token exchange, transfer and custody |
| Crypto-asset exchange service | Japan | Exchange, brokerage and custody of crypto-assets |
| Virtual asset service provider | Australia | The FATF term adopted directly, replacing an earlier local label |
| Digital asset service provider | France, legacy national regime | Superseded by the EU framework |
The differences run deeper than vocabulary. VASP regimes grow out of anti-money-laundering law and stop at registration and monitoring. The CASP framework is a full financial-services regime, covering conduct, disclosure, client-asset protection and prudential standards on top of financial-crime controls. A firm registered as a VASP abroad is therefore not automatically equivalent to a MiCA-authorised provider.
Why the Status Matters for Users and Crypto Firms
For users of crypto platforms
Checking whether a platform holds a CASP licence, and for which activities, is the fastest way to tell a supervised business from an anonymous website. A licensed provider must keep your assets separate from its own, describe fees and risks honestly, and answer to a regulator when it does not.
For founders of a crypto company
The status shapes everything else about a crypto company: which activities you may offer, who supervises you, which obligations apply from day one, and which markets you can reach. Working out early whether a planned product lands inside the list is far cheaper than discovering it afterwards. Where a model sits close to the line, the answer turns on whether client assets or orders pass through your hands.
Frequently Asked Questions
Crypto-asset service provider. The acronym comes from EU crypto legislation, where it is the formal name for a company supplying crypto-asset services professionally.
No. An exchange is one kind of crypto-asset service provider. The category also covers custody providers, brokers, advisers, portfolio managers and transfer services.
Not as a legal status. Elsewhere the equivalent firms are usually called VASPs or a local variant. The activities look similar; the obligations do not.
No. The definition requires crypto-asset services supplied to clients on a professional basis. Managing your own holdings does not make you one, however large the trades.
In principle, yes. A provider authorised in one member state may serve clients across the European Economic Area without applying again in each country, within the scope of its licence.
Consult the EU-level public register, and that of the national supervisor where the firm is established. Claims on a company’s own website prove nothing.
