Virtual Asset Service Provider (VASP)
A virtual asset service provider, or VASP, is the FATF category for a business that exchanges, transfers, safekeeps or administers virtual assets for other people, or provides financial services around their issuance. It is an international standard-setter’s term, not a license.
Also called: virtual asset service providers
What the category covers
FATF defines a virtual asset service provider by activity rather than by technology or corporate form, and defines it as a residual category: a person not already covered elsewhere in the Recommendations who, as a business, does one of five things for someone else. Those are exchanging virtual assets for fiat currency, exchanging one virtual asset for another, transferring virtual assets, safekeeping or administering virtual assets or the instruments that give control of them, and participating in or providing financial services connected to an issuer’s offer or sale of a virtual asset — the limb that reaches token-sale service providers.
Two things follow. Because the test is conduct, a firm cannot leave the category by changing what it calls itself. And because the standard is an anti-money-laundering one, the obligations attached to it are AML obligations — customer identification, record-keeping, reporting, and the Travel Rule — rather than prudential or market-conduct ones.
VASP and CASP are not the same label
FATF writes standards; countries write law, and they do not copy the standard word for word. Some adopt a registration regime with the activity list largely intact. Some fold crypto businesses into existing money transmission or exchange licensing. Some draw the scope more narrowly, others more widely, and the term used locally may not be VASP at all.
The EU’s equivalent differs in kind, not only in spelling. A crypto-asset service provider under MiCA is an authorization category with ten enumerated services of its own, and its own conduct, disclosure and prudential requirements, sitting alongside AML law rather than replacing it. The two lists overlap without matching — MiCA reaches advice and portfolio management on crypto-assets, which are not FATF activities at all — so a firm outside one can be inside the other, and CASP is not a rename of VASP.
In practice
FATF sets a standard; countries write the law, and they translate the VASP category differently — the EU’s version under MiCA is a crypto-asset service provider, or CASP, an authorization covering ten services from a different instrument, including advice and portfolio management, which FATF’s list does not reach. Establish whose definition is being applied before answering whether a business is caught by it.
Example
A firm runs a swap interface and holds no keys. Under one country’s implementation it sits outside the registration regime because it never has custody or control. Under another it is caught by the transfer limb regardless. Nothing about the firm changed between the two answers — only the definition being applied did.
Commonly confused with
| Term | How it differs |
|---|---|
| Crypto-Asset Service Provider | CASP is the EU’s authorization category under MiCA, with its own service list and market-conduct duties; VASP is FATF’s AML activity category and confers no authorization anywhere. |
| Money Services Business | MSB is a US federal registration category under the Bank Secrecy Act; VASP is an international standard-setter’s category, and a firm can fall in one without falling in the other. |
See also
- Crypto-Asset Service ProviderThe authorization category under the EU’s Markets in Crypto-Assets Regulation for firms providing crypto services — custody, exchange, transfer, trading platforms and advice. A crypto-asset service provider is authorized by one member state’s regulator and can then passport across the EU.
- MiCAMiCA, the Markets in Crypto-Assets Regulation, is the EU law governing the offer of crypto-assets, their admission to trading, and the provision of crypto-asset services, with one set of rules applying directly across every member state. Service providers are authorized once and can then passport through the bloc.
- Travel RuleThe travel rule requires the firm sending a transfer to pass identifying information about the originator and the beneficiary to the firm receiving it, so that the data travels with the money. It began as a banking wire rule and now reaches virtual asset transfers as well.
- FATFThe Financial Action Task Force, or FATF, is the intergovernmental body that sets the international standards for anti-money-laundering and counter-terrorist financing, assesses countries against them, and maintains the lists — informally the grey list and the black list — that drive country risk ratings across the industry.
- Crypto CustodyCrypto custody is holding someone else’s crypto-assets, or the means of access to them, in a way that lets you move them. The test is control in fact — who could move the balance without the customer’s cooperation — not how the service describes itself in its terms.