VASP (Virtual Asset Service Provider) is the FATF term for a business that, on behalf of customers, exchanges virtual assets for fiat or other virtual assets, transfers them, safekeeps or administers them, or provides financial services around a token issuer's offer or sale. The test is the activity: centralised exchanges, brokers, custodial wallet providers and OTC desks qualify, while genuinely non-custodial software generally does not. VASPs carry bank-level AML duties plus the Travel Rule on transfers between VASPs. In the EU, MiCA's CASP authorisation replaced national VASP registrations after a transitional period that ended on 1 July 2026 at the latest. A VASP registration now holds value only where it remains the operative licence.
What counts as a VASP under FATF rules
The test is the activity, not the technology or the label. A centralised exchange, a crypto broker, a custodial wallet provider and an OTC desk all qualify. Software developers who never control customer funds, and genuinely non-custodial wallet software, generally fall outside. A DeFi protocol can still be treated as a VASP where identifiable owners or operators keep control or influence over the arrangement.
VASP AML requirements and the Travel Rule
VASPs carry the same obligations as banks: customer due diligence, transaction monitoring, sanctions screening and suspicious activity reporting. The Travel Rule adds a crypto-specific duty: originator and beneficiary information must accompany a transfer between VASPs. FATF sets a de minimis threshold of USD/EUR 1,000, but the EU's Transfer of Funds Regulation, applicable since 30 December 2024, applies a zero threshold to all crypto-asset transfers.
Implementation is uneven. FATF's targeted update of 16 July 2026 found that 83% of surveyed jurisdictions have passed Travel Rule legislation, up from 73% a year earlier, and reported that most identified on-chain illicit activity now involves stablecoins. A VASP sending a €400 USDT transfer to a counterparty in a jurisdiction without Travel Rule legislation still has to collect the data and decide whether the receiving firm can protect it.
VASP vs CASP
In the EU, national VASP registrations have been replaced by MiCA. A CASP (crypto-asset service provider) authorisation brings prudential rules, conduct rules and an EU-wide passport that VASP registrations never had. The transitional period ended on 1 July 2026 at the latest, and earlier in countries such as the Netherlands and Sweden; since then a firm without CASP authorisation cannot serve EU clients, and a pending application does not count. MiCA minimum capital is €50,000, €125,000 or €150,000 depending on the services, with trading platforms in the highest class.
Outside the EU, "VASP" remains the regulatory term in many regimes, including Dubai's VARA regime and the Cayman Islands' VASP Act.
What buyers check in a VASP
A VASP registration acquired today has value only where the jurisdiction still issues it as the operative licence, or as a customer book and compliance stack that can be migrated under a CASP. Buyers test the scope of services actually registered, Travel Rule integration, blockchain analytics coverage, banking partners and any regulatory findings, and confirm whether the regulator must approve the change in control before completion.