What Is a VASP? Virtual Asset Service Provider Rules

Question from BitcoinTalk: “What is a VASP and do I need to register as one?”

Short answer: VASP stands for Virtual Asset Service Provider. It’s the regulatory category for crypto exchanges, wallet providers, custodians, and other crypto businesses. Countries following FATF guidelines require VASPs to register, implement KYC/AML, and report transactions.

Where the Term Comes From

The term comes from the Financial Action Task Force (FATF), the global money-laundering watchdog. In 2019 the FATF extended its recommendations to cover “virtual assets” and named the businesses that handle them “Virtual Asset Service Providers.” Since then, most major jurisdictions have built their licensing regimes around the FATF definition — which is why you see the label from Singapore to the UAE to the EU, even though the underlying national rules differ.

Who Is a VASP

Under FATF guidelines, a VASP includes any business that:

• Exchanges crypto for fiat currency
• Exchanges one crypto for another
• Transfers crypto on behalf of customers
• Safekeeps or administers crypto
• Provides crypto financial services

A few notes on the edges:

• Miners and validators are generally not VASPs — they secure the network but don’t provide services to customers.
• Non-custodial software that never holds customer funds is a grey area; regulators increasingly look at who controls the software and whether they’re in the business of providing services.
• DeFi front-ends can be treated as VASPs if a central team operates them. This is one reason some DeFi projects have added geographic blocks.

Countries Requiring VASP Registration

The important detail is the variety. Australia and India use registration-style systems where a business signs up and self-reports. Singapore, Japan, and Dubai license firms with ongoing supervision. The EU’s MiCA creates a single CASP license recognized across all member states — so a license in one country works across the whole bloc. The US is the outlier: no federal license exists, so a business may need 50 separate state registrations plus a FinCEN MSB registration.

What VASP Registration Involves

1. Corporate registration — Legal entity in the country
2. AML/KYC program — Written policies and procedures
3. Travel Rule compliance — Share transaction info
4. Capital requirements — €125K+ in the EU
5. Reporting obligations — Suspicious transaction reports
6. Audits — Regular audits of compliance

The application process typically runs 6-12 months (sometimes longer) and requires a dedicated compliance officer, documented policies, and often a local director. How to Stay Compliant When Trading P2P is a good starting point for understanding the operational realities.

The Travel Rule in Practice

The Travel Rule is the obligation that often surprises new VASPs. When a customer sends crypto, the sending and receiving service providers must share identifying information about both parties. In practice this means VASPs need to either join a Travel Rule information-sharing network or build their own system for exchanging customer data. Crypto Travel Rule explains the privacy trade-offs.

What This Means for Regular Users

If you’re an individual crypto user:

• You’re not a VASP — Individuals holding or transferring their own crypto don’t need registration
• Exchanges you use must be registered — Using unregistered VASPs may be risky
• You may be blocked — Many VASPs block users from non-cooperative jurisdictions
• KYC requirements are here to stay — Registration and KYC go hand in hand

How to Check Whether an Exchange Is a Registered VASP

1. Find the exchange’s “Regulatory” or “Licenses” page — reputable firms list every license
2. Cross-check with the regulator’s own register (e.g., AUSTRAC, FCA, MAS, VARA)
3. Search for enforcement actions or license revocations
4. Be skeptical of exchanges that can’t point to any registration at all

Verdict

VASP registration is for businesses, not individuals. It’s the regulatory framework that allows crypto businesses to operate legally. When choosing an exchange, check if it’s registered as a VASP in your jurisdiction.

Related: What Is KYC? | Crypto Travel Rule | How to Stay Compliant When Trading P2P

Why VASP Registration Should Matter to Users

VASP status is a technical, compliance-heavy concept, but it has very practical consequences for everyday crypto users. When you choose an exchange, the single most meaningful signal of its legitimacy is whether it holds a VASP registration, licence, or equivalent authorisation in a credible jurisdiction. A registered and supervised firm has undergone a documented application, maintains an AML/KYC programme, segregates customer funds in many cases, and can be held accountable by a regulator — all of which is more than you can say for an anonymous offshore platform.

This is why the first check you should perform before depositing money anywhere is structural, not cosmetic. Find the exchange’s regulatory page, confirm each licence against the relevant regulator’s public register, and look for any enforcement actions or revocations. A platform that cannot point to a single registration is either operating illegally in your country or deliberately avoiding oversight, and neither is a good sign for the safety of funds held with it.

On the business side, the landscape is only becoming more demanding. The EU’s MiCA now makes a single CASP licence passportable across the entire bloc, which is a genuine breakthrough for compliant firms, while the US remains fragmented across dozens of state regulators. Wherever you operate, expect the Travel Rule, KYC obligations, capital requirements, and reporting duties to keep expanding rather than shrinking. For both founders and users, the direction of travel is unambiguous: in 2026 and beyond, being registered is not a competitive advantage — it is simply the entry ticket to operating legitimately in crypto at all.

Related reading: What Is KYC? · Crypto Travel Rule · How to Stay Compliant When Trading P2P