Key Takeaways
- A VASP is defined by activity, not by label. Any business that exchanges, transfers, holds, or issues virtual assets on behalf of others falls under the definition, even if it describes itself as a technology platform.
- Licensing is now the default in major markets. Regulatory grace periods have closed. In the European Union, the Markets in Crypto-Assets (MiCA) transitional window concluded on July 1, 2026, requiring firms serving EU clients to hold full Crypto-Asset Service Provider (CASP) authorization.
- Capital and operational rules diverge across regimes. Thresholds vary widely by jurisdiction, from tiered capital minimums in the EU (€50,000 to €150,000) to Hong Kong’s capital requirements (HKD 5 million paid-up plus HKD 3 million liquid buffer).
- The Travel Rule is part of the license, not an extra. Over 83% of FATF-surveyed jurisdictions enforce Travel Rule compliance laws, making real-time counterparty data exchange an essential licensing prerequisite rather than an optional add-on.
- Infrastructure is reviewed alongside paperwork. Regulators evaluate live technology stacks alongside written policies, requiring operational proof of key management, segregated custody, Know Your Transaction (KYT) screening, and immutable audit logs.
A virtual asset service provider (VASP) is any commercial entity that exchanges, transfers, safeguards, or issues virtual assets on behalf of customers. That legal definition dictates whether a crypto exchange, institutional custodian, cross-border payment app, or over-the-counter (OTC) trading desk can operate legitimately in major financial markets.
Operating without an appropriate license is no longer a legal gray area. With the EU’s MiCA transitional phase concluded and regulatory authorities across Singapore, Hong Kong, and the Middle East actively auditing technical infrastructure alongside corporate filings, obtaining and maintaining a VASP license has become a core operational priority.
This guide outlines the Financial Action Task Force (FATF) definition, activities triggering regulatory perimeter scope,comparisons of primary licensing jurisdictions, and the technical criteria regulators expect before granting approval.
What Is a VASP? FATF Definition and Legal Scope
The VASP classification was established by the Financial Action Task Force (FATF) in 2019 under its revised Recommendation 15. Under this global AML/CFT standard, a VASP is defined as any natural or legal person that, as a commercial business on behalf of another party, conducts one or more of five core activities:
- Exchange between virtual assets and fiat currencies, such as a centralized exchange or a crypto on-ramp.
- Exchange between one or more forms of virtual assets, such as crypto-to-crypto trading.
- Transfer of virtual assets from one address or account to another on a customer’s behalf.
- Safekeeping or administration of virtual assets, or instruments that control them, such as custody.
- Participation in financial services related to an issuer’s offer or sale of a virtual asset.
The regulatory perimeter is evaluated on a functional basis: supervisory bodies assess actual control over customer funds and operational touchpoints rather than corporate marketing terminology. A merchant payment processor converting stablecoins to fiat qualifies as a VASP. Conversely, pure software vendors that license turnkey exchange or wallet technology without touching customer keys or funds generally sit outside direct licensing perimeters.
National legislation incorporates the FATF definition through local statutory classifications:
- European Union: Crypto-Asset Service Provider (CASP) under MiCA.
ChainUp - Singapore: Digital Payment Token (DPT) service provider under the Payment Services Act (PSA), alongside the Financial Services and Markets Act (FSMA) regime for offshore-focused Digital Token Service Providers (DTSPs).
- Hong Kong: Virtual Asset Trading Platform (VATP) operator licensed under the Securities and Futures Commission (SFC).
- Dubai: Virtual Asset Service Provider licensed under the Virtual Assets Regulatory Authority (VARA).
Which Crypto Businesses Need a VASP License?
Most commercial entities that hold, broker, or transmit customer digital assets require regulatory authorization in their operating markets. Common categories include:
- Centralized exchanges (CEX) and Brokerages: Spot, margin, and derivatives platforms that aggregate order books, match trades, or execute client orders.
- Institutional Custodians and Wallet Providers: Entities controlling private keys or offering custodial hot, warm, or cold storage infrastructures.
- Over-the-Counter (OTC) Desks: Principal or agency desks executing large-block digital asset trades for institutional counterparties.
- Payment Gateways and Remittance Networks: Cross-border settlement platforms that accept, convert, or clear stablecoins or crypto for enterprise merchants.
- Token Launchpads and Underwriting Platforms: Entities orchestrating primary token distributions or initial offerings.
While non-custodial software and self-hosted wallet development remain largely exempt from licensing, cross-border enforcement has expanded. An increasing number of regulatory bodies now apply their licensing perimeters extraterritorially to offshore platforms that systematically solicit or service domestic retail or institutional residents.
Global VASP Licensing Regimes 2026 Comparison
The following table compares the primary jurisdictions for institutional exchange, payments, and custody deployment:
| Jurisdiction | Supervisory Authority & License Type | Minimum Capital Requirements | Cross-Border Passporting | 2026 Regulatory Status |
| European Union | National Competent Authority (NCA) / MiCA CASP Authorization | Tiered: €50,000, €125,000, or €150,000 (based on service scope) | Pan-EEA passporting across 30 European member states | Grandfathering and transitional windows fully closed on July 1, 2026; single ESMA public register active |
| Singapore | Monetary Authority of Singapore (MAS) / Major Payment Institution (MPI) License | SGD 250,000 base paid-up capital | Territorial authorization (Singapore only) | Strict asset segregation, independent trust custody, and mandatory FSMA DTSP regime in force |
| Hong Kong | Securities and Futures Commission (SFC) / VATP License | HKD 5 million paid-up capital plus HKD 3 million liquid capital reserve | Territorial authorization (Hong Kong only) | Regulated retail trading access permitted with suitability checks and 98% cold storage mandate |
| Dubai | Virtual Assets Regulatory Authority (VARA) / VASP License | Specific to each regulated activity (e.g., Advisory, Brokerage, Custody) | Dubai mainland and free zones (excludes DIFC, which is governed by the DFSA) | Activity-specific licensing framework; separate operational rulebooks per business vertical |
| United States | FinCEN Federal MSB Registration + State Money Transmitter Licenses (e.g., NY BitLicense) | Variable state-by-state bonding and capital standards | Fragmented 50-state framework | Federal payment stablecoin frameworks established under the GENIUS Act alongside ongoing state supervision |
How Does the VASP Licensing Process Work
Applications follow a broadly similar sequence across jurisdictions, though timelines and documentation differ.
- Define the activity scope. Map each service to the regulated activities in the target jurisdiction. Scope determines capital, the license type, and which rules apply.
- Establish local substance. Most regimes require a local entity, a physical office, and resident directors or responsible officers.
- Build the compliance framework. Prepare AML/CFT policies, a risk assessment, KYC procedures, sanctions screening, transaction monitoring, and Travel Rule processes.
- Prepare technology and custody documentation. Regulators review wallet architecture, key management, segregation of client assets, cybersecurity controls, and business continuity plans.
- Capitalize the entity. Deposit minimum capital and, where required, liquid reserves or professional indemnity cover.
- Submit and respond. Applications go through rounds of regulator questions, often including system walkthroughs and on-site inspections.
- Maintain the license. Ongoing obligations include audits, regulatory reporting, change notifications, and periodic inspections.
What Do Regulators Expect From a Licensed VASP
Licensing reviews have shifted from policy documents toward working systems. Regulators now ask applicants to demonstrate that controls run in production.
AML/CFT and Customer Due Diligence (CDD)
Platforms must run dynamic, risk-based onboarding workflows, automated PEP and sanctions screening against global databases (OFAC, UN, EU), and tiered enhanced due diligence (EDD) for high-net-worth or higher-risk entities.
Real-Time Transaction Monitoring and Know Your Transaction (KYT)
VASPs must monitor inbound and outbound on-chain flows in real time. Modern KYT systems score wallet addresses, trace indirect transaction hops, and flag connections to illicit counterparties, sanctioned entities, mixing protocols, or darknet markets before settlements complete.
Travel Rule Compliance
The Travel Rule requires VASPs to exchange originator and beneficiary information for qualifying transfers. FATF’s July 2026 update found that 83% of surveyed jurisdictions have Travel Rule laws in force, up from 73% a year earlier. Thresholds vary: Singapore applies it from SGD 1,500, while the EU applies it to transfers between providers regardless of amount.
Custody and Asset Segregation
Client assets must be held separately from company assets, with documented key management, approval workflows, and reconciliation. Most regulators expect the majority of client assets in cold or offline storage.
Governance and Audit Trails
Fit-and-proper directors, a named compliance officer, independent audits, and complete records of transactions and administrative actions are standard requirements. Audit trails must be retrievable on request during inspections.
Building a Licensing-Ready Digital Asset Stack
As regulatory authorities move beyond reviewing policy manuals, successful VASP licensing hinges on proving that custody, transaction monitoring, and compliance systems perform reliably in production.
To bridge internal operations with supervisory expectations, many institutions rely on modular infrastructure providers rather than building in-house. ChainUp provides institutional-grade digital asset technology engineered to support regulated entities across major licensing regimes. Its white-label exchange and brokerage engines integrate directly with ChainUp Custody, combining MPC-based key protection and automated policy approvals with Trustformer KYT for on-chain risk scoring and Travel Rule compliance.
Request a demo with ChainUp to explore institutional-grade infrastructure built for licensing readiness.
Frequently Asked Questions
What does VASP stand for
VASP stands for virtual asset service provider. The term was defined by FATF in 2019 and is used in anti-money laundering laws worldwide.
Is a VASP license the same as a MiCA license
No. MiCA uses the term crypto-asset service provider (CASP) and grants authorization that passports across the EU and EEA. A VASP license is a national authorization outside that framework. Since July 1, 2026, national VASP registrations no longer allow firms to serve EU clients.
Do non-custodial wallets need a VASP license
Generally no. Providers of non-custodial software that never control customer assets usually fall outside the definition. Some jurisdictions apply additional tests, so the business model needs a legal review in each market.
How long does it take to get a VASP license
Timelines depend on the jurisdiction and the completeness of the application. Most major regimes take several months to more than a year, including rounds of regulator questions and system reviews.
What is the difference between VASP registration and licensing
Registration usually covers AML/CFT obligations only. Licensing adds capital, governance, custody, conduct, and technology requirements, and involves deeper regulator review.
