What Is a VASP? Definition, Requirements, and AML Obligations

A crypto company can describe itself as a wallet, an exchange, a payment platform, a broker, a DeFi interface, or an infrastructure provider. None of those words decide how it is regulated. The question a supervisor asks is narrower: what does the business do for its customers? That is what the term Virtual Asset Service Provider was built to answer. FATF uses VASP as a global functional classification — a way of describing an activity, not a licence any regulator issues. Local regulators translate it into their categories, which is why one business can be a VASP under FATF standards, a CASP in the EU, and a money transmitter in parts of the US at once.

FATF's Seventh Targeted Update, published on 16 July 2026, shows global VASP regulation shifting away from simply adopting rules and toward licensing, supervision, enforcement, and the identification of providers operating without authorization.

What Is a Virtual Asset Service Provider (VASP)?

FATF Definition of a VASP

FATF defines a VASP as any natural or legal person not covered elsewhere in the Recommendations who, as a business, conducts one or more covered virtual-asset activities for or on behalf of another person. Four elements carry the test: a person, acting as a business, performing a covered activity, for someone else. Fail any one and the definition generally does not apply, however crypto-native the business looks.

A Virtual Asset Service Provider is defined by the financial activity it performs, not by the label a crypto company uses for itself.

Why “As a Business” and “On Behalf of Another” Matter

These two qualifiers decide most classification questions. Own-account activity does not become a VASP service simply because it involves crypto: a company trading its treasury serves no one. The analysis changes once the business performs a regulated-type function for other people — holding their assets, converting their funds, or moving value at their instruction.

Under FATF standards, the VASP test focuses on whether a person conducts covered virtual-asset activities as a business for or on behalf of another person.

FATF Definition vs. Local Legal Classification

FATF is a standard-setter, not a regulator: it does not license crypto companies, supervise them, or impose obligations directly. Binding duties arise through national or regional law — the licensing regime, the AML statute, and the supervisory rules of each jurisdiction where a business operates.

FATF defines the international VASP standard, but whether a company must obtain a particular licence or registration depends on the law of the jurisdictions in which it operates.

Which Activities Can Make a Business a VASP?

FATF sets out five categories of covered activity. Performing only one of them, as a business and for another person, brings a company within the definition.

Exchange Between Crypto and Fiat

Converting virtual assets into government-issued currency or the reverse. This covers exchanges, brokers, and conversion services, including those presenting the function as a feature of a larger product rather than a standalone exchange.

Exchange Between Virtual Assets

Crypto-to-crypto conversion on behalf of customers. The absence of fiat anywhere in the flow does not remove the activity from scope, which surprises businesses that assume fiat triggers regulation.

Transfer of Virtual Assets

Moving virtual assets between addresses or accounts on behalf of another person. The defining feature is acting on someone else's instruction rather than publishing software they use themselves.

Custody and Administration

Holding or controlling virtual assets, private keys, or any instrument enabling control over customer assets. Control is the operative concept: a service that can move customer assets without the customer's independent action is usually exercising it.

Financial Services Related to Token Issuance

Participating in, or providing financial services connected to, an issuer's offer or sale of virtual assets. This covers placement, underwriting-type roles, and comparable services around a token offering, assessed by function rather than label.

Which Crypto Businesses Commonly Qualify as VASPs?

• Centralized exchange — usually yes: exchange, custody, and transfer for customers.
• Custodial wallet — usually yes: it controls customer assets or their keys.
• Crypto broker — usually yes: it exchanges virtual assets for clients.
• OTC desk — often yes: exchange and transfer for customers.
• Crypto payment processor — often yes, since transfer or exchange is usually part of settling a payment.
• Crypto ATM operator — depends on the model, since exchange may not be provided by the operator itself.
• Non-custodial software wallet — not automatically: supplying software is not a covered activity.
• Blockchain analytics provider — generally no on analytics alone: it neither moves nor holds customer assets.
• Miner or validator — not automatically: consensus participation is not a VASP service.
• Own-account trader — no on its trading alone: it is not acting for another person.

This is a FATF-level functional guide, not a substitute for classification under local law.

Who Is Not Automatically a VASP?

Individuals Acting on Their Own Behalf

Holding, investing in, or transferring your own virtual assets is not VASP activity, whatever the volume. The missing element is service provision: no other person is being acted for.

Software and Infrastructure Providers

Publishing code, running nodes, or supplying infrastructure does not by itself create VASP status. Classification changes where the provider in practice controls assets, executes transfers, or operates a service rather than supplying tools users operate themselves.

A software provider, miner, validator, or self-custody tool is not automatically a VASP merely because it operates in the crypto ecosystem.

Miners and Validators

Consensus activity — producing blocks, validating transactions, earning rewards — is not a covered service. Where a mining or staking business separately offers custody, exchange, or pooled services to third parties, those are assessed on their own terms.

Non-Custodial Services

A non-custodial label describes architecture, not a regulatory exemption. What matters is function and degree of control: if a service can determine whether and how customer assets move, the label will not settle the question.

Non-custodial design does not automatically place a business outside the regulatory perimeter; the actual function and level of control still matter.

How to Determine Whether Your Business Is a VASP

Question 1 — Are You Performing a Covered Virtual-Asset Activity?

Work through the five categories: exchange between crypto and fiat, exchange between virtual assets, transfer, custody or administration, and issuer-related financial services. If none describes what you do, the FATF VASP test may not apply.

Question 2 — Are You Doing It as a Business?

The activity has to be commercial rather than personal or incidental. Occasional activity for your purposes differs from an ongoing offering made available to customers, priced separately or not.

Question 3 — Are You Acting for or on Behalf of Another Person?

This distinction resolves most borderline cases. A business trading, converting, or moving its assets is not providing a service; the same operations at a customer's instruction generally are.

Question 4 — Does an Identifiable Person Control or Operate the Service?

This matters most for non-custodial models, DeFi front-ends, and protocol interfaces. Where an identifiable person operates, controls, or materially influences the service, the absence of a traditional corporate structure does not end the analysis.

Question 5 — What Does Local Law Call This Activity?

Once the functional test is answered, the legal one begins: which jurisdiction applies, what licence it requires, which exemptions exist, and what else attaches. Two businesses with identical functions can face very different requirements depending on where they operate and whom they serve.

Determining that a business fits the FATF VASP definition is the beginning of the legal analysis; the next step is determining how the relevant jurisdiction classifies and regulates that activity.

What AML Requirements Generally Apply to VASPs?

FATF applies the relevant preventive AML/CFT measures to VASPs, while exact requirements depend on national implementation. What follows maps the obligation categories, not any single country's rules.

Licensing or Registration

FATF expects jurisdictions to license or register VASPs and to supervise them for AML/CFT purposes. The form varies widely: some regimes operate a full authorization process, others a lighter registration, and a growing number prohibit VASP activity entirely. FATF defines the international VASP standard, but binding licensing and AML obligations arise through national or regional law.

Customer Due Diligence

Identifying and verifying customers, establishing beneficial ownership where applicable, assessing customer risk, and applying enhanced due diligence to higher-risk relationships. Requirements are risk-based and threshold-dependent, so not every transaction everywhere demands full KYC.

Ongoing Transaction Monitoring

Customer due diligence answers who the customer is; monitoring answers what they are doing now. A correctly verified customer can still receive proceeds of crime, act as a mule, or change behavior months after onboarding, which is what crypto transaction monitoring exists to surface while it remains actionable.

Suspicious Activity Reporting

Where suspicion arises, VASPs are generally required to report it to the relevant financial intelligence unit. The mechanics differ by regime — SAR in the United States, STR in many others — as do triggers, deadlines, and tipping-off rules, so local requirements govern.

Sanctions Controls

VASPs are expected to screen against the sanctions regimes that apply to them and act on matches. Which lists apply depends on incorporation, licensing, customer base, and settlement currency; no single national list binds every VASP worldwide.

Recordkeeping and Internal Controls

Customer and transaction records, documented risk decisions, compliance governance with clear accountability, staff training, and independent review where required. Supervisors examine these first, because they show whether the rest of the framework actually operates.

Travel Rule

The Travel Rule requires originator and beneficiary information to accompany qualifying virtual-asset transfers between providers. FATF reported in July 2026 that 83% of relevant surveyed jurisdictions had passed Travel Rule legislation, up from 73% a year earlier, though supervision and enforcement remain uneven.

The Travel Rule is one part of VASP compliance, not the entire VASP AML framework. For thresholds and messaging mechanics, see how the FATF Crypto Travel Rule applies to VASPs.

What Changed in FATF's 2026 VASP Update?

Regulation Is Moving From Adoption to Effectiveness

Writing a law, publishing a risk assessment, and creating a licensing framework no longer count as implementation on their own. FATF increasingly examines whether licences function in practice, whether unlicensed providers are identified, whether supervision happens, and whether risk assessments translate into controls.

Travel Rule Adoption Increased, but Enforcement Still Lags

The headline figure is 83% of relevant surveyed jurisdictions with legislation passed. The gap has moved downstream: almost half of those with legislation in force have not yet taken any related supervisory or enforcement action.

Offshore VASPs, Stablecoins, Unhosted Wallets and DeFi Are Now Major Implementation Issues

These four are where implementation is hardest, for different reasons — jurisdictional reach offshore, issuer dependencies for stablecoins, counterparty identification for unhosted wallets, and the control question for DeFi. For the full picture, see the FATF Seventh Targeted Update and Recommendation 15.

VASP, CASP, and MSB — What Is the Difference?

VASP — FATF

A global functional term describing an activity, setting an international baseline jurisdictions are expected to implement. It is not the name of a licence anyone issues, and no business can apply to become a VASP.

VASP is not a universal license name used by every jurisdiction.

CASP — European Union

The EU regulates crypto-asset services through MiCA authorization as a Crypto-Asset Service Provider. The maximum transitional period expired on 1 July 2026, so providers without authorization — and outside the separate category of financial entities under Article 60 — can no longer rely on national grandfathering to offer in-scope services. For the authorization process, see MiCA requirements for Crypto-Asset Service Providers.

MSB / Money Transmitter — United States

VASP is not the operative federal classification in the United States. FinCEN works through its Bank Secrecy Act categories — administrator, exchanger, user of convertible virtual currency — and a crypto business may qualify as a money transmitter and money services business depending on its activity and any applicable exceptions. For how those and state licensing interact, see US crypto AML and money-transmitter requirements.

The EU uses the MiCA category Crypto-Asset Service Provider, while the United States applies its Bank Secrecy Act and money-transmitter classifications.

How Does VASP Classification Apply to DeFi?

Software Is Not Automatically a VASP

A protocol or the software implementing it is not a VASP under FATF standards simply because it enables virtual-asset transactions. The analysis targets persons, not code.

Control or Sufficient Influence Matters

Where an identifiable person operates, controls, profits from, or materially influences a covered financial service, a VASP analysis can arise even if the arrangement is called decentralized. The label does not substitute for assessing who actually exercises control.

Local Rules Can Go Beyond the FATF Baseline

Jurisdictions can and do regulate beyond the FATF baseline, so no universal conclusion holds across markets. FATF's 2026 data shows most jurisdictions have not yet identified a DeFi arrangement in their territory that would qualify as a VASP, which makes broad claims in either direction unsafe.

What Does FATF's Offshore VASP Focus Mean for VASPs?

FATF singled out offshore VASPs in 2026 as one of the harder implementation problems. This changes nothing about the classification test itself — the same five activities apply wherever a provider is incorporated. The difficulties arise around supervision, cross-border service, counterparty relationships, and regulatory arbitrage — including nested arrangements where offshore providers access licensed platforms while posing as retail users. For the exposure side, see how to assess offshore VASP exposure.

VASP vs Counterparty VASP — Two Different Compliance Questions

Two questions get confused regularly, and they belong to different workflows. The first is classification: are we a VASP, and what does that require? The second is due diligence: is the company on the other side legitimate, licensed, and acceptable?

The first is answered once and revisited when the business model changes. The second is answered for every material counterparty and revisited whenever their status changes — see how to perform counterparty VASP due diligence.

What Happens If a Business Operates as a VASP Without the Required Authorization?

Regulatory Enforcement

Depending on the jurisdiction, consequences can include a warning, a fine, a cease-and-desist order, refusal of a licence application, or revocation of an existing one. Supervisors increasingly treat operating without authorization as a failing separate from any underlying AML weakness.

Forced Wind-Down or Loss of Market Access

This has become concrete as transition regimes expire. A provider that cannot obtain authorization may have to stop serving a market entirely and execute an orderly wind-down, including offboarding clients and transferring their assets.

Banking and Counterparty Risk

Commercial consequences often arrive before regulatory ones. An unlicensed or weakly supervised provider can lose its bank, payment partners, and institutional counterparties, because those firms run their own due diligence and act on it.

Criminal Liability Where Applicable

In some jurisdictions and for some conduct criminal liability is available, but it depends on the jurisdiction and the conduct and does not follow automatically from a classification or registration failure.

Conclusion

VASP is an activity-based FATF classification, not a universal license name. Working out what applies means moving through a sequence: identify the activity, determine whether it is performed as a business for others, identify the local legal category, determine the licensing requirement, and implement the applicable AML controls.

A business should not assume it is outside the regulatory perimeter because it calls itself a wallet, protocol, fintech, payment platform, or software company. Classification follows function, not branding.

FAQ

What Is a VASP?

A Virtual Asset Service Provider is any natural or legal person who, as a business, conducts covered virtual-asset activities for or on behalf of another person: exchange between virtual assets and fiat, exchange between virtual assets, transfer, custody or administration, and financial services tied to an issuer's offer or sale.

What Does VASP Stand For?

VASP stands for Virtual Asset Service Provider. The term comes from FATF, the global standard-setter for anti-money laundering, and describes a category of activity rather than a licence or company type. Jurisdictions implementing FATF standards often use their own terminology for it.

Which Businesses Are Considered VASPs?

Typically exchanges, custodians, brokers, transfer services, certain payment providers, and certain issuer-related financial services. The classification is activity-based rather than sector-based, so two companies describing themselves identically can land on opposite sides of the line depending on what they actually do for customers.

Is Every Crypto Business a VASP?

No. Software development, blockchain analytics, mining, validation, and own-account trading are not covered activities in themselves. A business falls within the definition only where it performs one of the five covered activities, as a business, for or on behalf of another person — and many crypto companies never do.

Is a Non-Custodial Wallet Provider a VASP?

Not automatically. Supplying software that lets users hold and transact their assets is not a covered activity. The answer depends on the actual service and degree of control: if the provider can determine whether or how customer assets move, the analysis changes.

Are DeFi Protocols VASPs?

Protocol software itself is not automatically a VASP under FATF standards. Identifiable persons who operate, control, or exercise sufficient influence over a covered financial service may come into scope, depending on the function and how the jurisdiction has implemented the standards.

What AML Requirements Apply to VASPs?

At a high level: licensing or registration, risk-based AML/CFT controls, customer due diligence, ongoing transaction monitoring, suspicious activity reporting, recordkeeping, the Travel Rule, and applicable sanctions controls. The specifics — thresholds, timelines, supervisory expectations — are set by each jurisdiction, not by FATF.

What Is the Difference Between VASP and CASP?

VASP is FATF's global functional term. CASP is the legal category created by the EU's MiCA regulation for Crypto-Asset Service Providers. The two overlap substantially but are not interchangeable in every legal context: MiCA defines its own in-scope services, exemptions, and authorization requirements.

Is a VASP the Same as an MSB in the United States?

No. VASP is FATF terminology with no operative status in US federal law. FinCEN applies Bank Secrecy Act categories — administrator, exchanger, user — and a crypto business may qualify as a money transmitter or MSB depending on its activity and any applicable exceptions.

Does FATF Directly Regulate VASPs?

No. FATF sets global standards and assesses how jurisdictions implement them. It does not license, supervise, or sanction individual crypto businesses. Binding obligations arise through the national or regional law, licensing regime, and supervisory rules of the places where a company operates.