VASP stands for Virtual Asset Service Provider. It is the label supervisors use for a business that handles crypto-assets on behalf of other people: running an exchange, holding customer wallets, moving tokens between addresses, or placing a new coin for its issuer.
The abbreviation is short but carries weight: once a company falls inside the definition, a whole layer of anti-money laundering obligations switches on. This page explains where the term came from, which activities it covers, who it leaves out, and how it relates to the European label CASP.
VASP meaning in plain language
The definition in one sentence
A virtual asset service provider is any individual or company that, as a business, exchanges, transfers, holds or helps sell somebody else’s virtual assets.
Two limits in that sentence do most of the work. As a business rules out one-off private deals. Somebody else’s rules out anyone who handles only their own holdings.
A third limit is easy to miss: the category only catches what other rules miss. A firm already regulated as a bank, payment institution or investment firm does not become a VASP on top of that — it keeps the status and supervisor it has. The label exists for businesses that would otherwise escape financial regulation altogether.
Where the VASP term comes from: the FATF standard
The term VASP was coined by the Financial Action Task Force, or FATF — the intergovernmental body that writes the global standards against money laundering and terrorist financing. Its recommendations are followed, directly or through regional partners, by some two hundred countries.
When digital assets began moving meaningful value across borders outside the banking system, the FATF extended its Recommendation 15 to cover them, creating a new class of obliged entity — the virtual asset service provider — alongside banks and payment institutions.
The FATF is not a legislature and issues no permissions. It publishes standards, then reviews how faithfully each country writes them into law; falling behind risks a listing that soon becomes a banking problem. That is why the same wording now appears worldwide.
The five activities that make a business a VASP
The VASP definition is built around a list of activities. Carrying out one of them, as a business and for another person, is enough.
| Activity | What it looks like in practice |
|---|---|
| Exchange between virtual assets and ordinary money | A platform where a customer swaps tokens for currency, or the other way round. |
| Exchange between one virtual asset and another | A swap service that converts one token into a different token on request. |
| Transfer of virtual assets | Moving assets from a customer’s address to one controlled by someone else. |
| Safekeeping and administration | Holding customer balances, or the private keys that give control over them. |
| Financial services around an issuance | Arranging, placing or promoting a token offering for the issuer. |
The list describes functions, not products. Calling itself a technology firm gets a company nowhere, and merely having tokens in the business model does not drag one in.
What counts as a virtual asset, and what does not
The companion definition is deliberately wide: a digital representation of value that can be traded or transferred digitally and used for payment or investment. Cryptocurrencies, utility tokens and stablecoins are all covered.
Three things stay outside. Digital representations of ordinary money, such as a bank or e-money balance, are regulated as money already. Instruments qualifying as securities have their own rules. And loyalty points or in-game items that cannot leave a closed system are excluded.
Digital collectibles are the awkward case. A one-of-a-kind item bought as a keepsake behaves like memorabilia; interchangeable units issued in series and bought hoping the price rises behave like an investment. What matters is how an item is used, not what it is called.
Who is a VASP and who is not
Most disputes about VASP status come down to three questions.
Is it a business, and is it done for someone else?
Someone buying, holding and later selling tokens with their own money is not serving anyone. Nor is a furniture shop that takes crypto at the till: there the tokens are payment for something else. There has to be a customer on the other side and enough regularity to count as commercial.
Does the label match what actually happens?
This is the test that catches people out. Calling a platform decentralised, non-custodial or merely an interface does not remove it from scope if someone actually controls how the service runs, earns fees from it or can switch it off. Conversely, a team of three genuinely holding customer keys is a VASP, however small the operation.
Which roles fall outside the category?
These roles normally do not qualify, though national law can be broader and the facts of a given set-up always decide:
- Private individuals trading or holding their own assets.
- Two individuals transferring assets directly, with no provider in the middle.
- Businesses that accept tokens as payment for unrelated goods and services.
- Miners and validators securing a network without handling customer balances.
- Wallet software developers and device makers who never hold keys or funds.
- Suppliers to the sector: analytics firms, auditors, agencies, hosting companies.
A company keeping cryptocurrency on its own balance sheet is in the same position: an owner, not a service provider. That line separates passive corporate treasury holdings in a private limited company from a regulated business, and the two follow different rules.
VASP obligations: the AML duties that come with the status
The status is not a badge but a set of AML duties, and they follow a recognisable pattern across jurisdictions:
- Permission first. The business must be licensed or registered before it starts, then answers to a named supervisor.
- Know your customer. Customers are identified at onboarding, the beneficial owners behind corporate clients are traced, and higher-risk relationships get closer scrutiny.
- Ongoing monitoring. Transactions are screened against the customer profile, and anything suspicious goes to the financial intelligence unit.
- The travel rule. Sender and recipient details must accompany transfers between providers, mirroring bank payments.
- Sanctions screening. Customers and counterparties are checked against restrictive measures lists continuously.
- Fit-and-proper checks. The people behind the company are assessed, and so is the origin of their money.
Operating without permission is no technicality: in most countries it is an offence, and banks tend to close accounts on discovery long before a supervisor reaches the file.
VASP vs CASP: two rulebooks for one idea
Inside the European Union the vocabulary has moved on. The Markets in Crypto-Assets Regulation, or MiCA, built a directly applicable regime around a renamed operator: the crypto-asset service provider, or CASP. The two labels overlap but are not interchangeable.
| Point of comparison | VASP | CASP |
|---|---|---|
| Source | A global standard, written into each country’s own law | A European regulation applying directly in every member state |
| Main purpose | Anti-money laundering supervision | Authorisation, consumer protection and prudential rules |
| Scope | The five activities listed by the FATF | A longer catalogue of crypto-asset services set out in the regulation |
| Territory | Permission is national and stops at the border | One authorisation passports across the union |
| Wording used | Virtual asset | Crypto-asset |
One distinction is often blurred. MiCA governs authorisation and conduct; the AML duties listed above come from the union’s separate anti-money laundering legislation and from the rules on transfers of funds, which carry the travel rule into crypto. A European CASP answers to two bodies of law, and its compliance function covers both.
Estonia illustrates the handover. Virtual currency service providers were once entered in a register kept by the Financial Intelligence Unit (Rahapesu Andmebüroo). Supervision passed to the Financial Supervision and Resolution Authority (Finantsinspektsioon), legacy entries did not convert automatically, and their transitional window has closed. Offering these services in Estonia now requires authorisation as a crypto-asset service provider.
Outside the union VASP is still the working term: national laws across Asia and the Americas use it, as do FATF evaluations.
Why the question reaches founders who run no exchange
Founders meet this question long before they meet a regulator: bank onboarding forms ask outright whether the applicant is a VASP, and so do software vendors, insurers and investors. A wrong answer can cost an account. The reliable approach is to describe the cryptocurrency business by function, not by name, compare that against the five activities, and keep the reasoning on file.
Frequently Asked Questions
No. The category is defined by activity, not by industry. A company can work with blockchain technology daily and still fall outside it, provided it never exchanges, transfers, stores or places customer assets.
An exchange is the best-known example, but only one of five activities. Custody, transfer and token-placement services fall under the same definition.
No. Trading for your own account, however actively, is not a service supplied to anyone else; the definition requires a customer on the other side.
Normally not. Firms authorised as banks, payment institutions or investment firms keep that status and supervisor, with crypto activity added to it.
No. The European framework applies and supervision has moved to Finantsinspektsioon. Existing entries were not converted automatically and their transitional period has ended.
