What is a VASP? The term regulators use for crypto firms

A VASP is a virtual asset service provider. That is the official name for a business that buys, sells, moves or stores crypto for other people, rather than for itself. Exchanges, custodians and brokers all count. Regulators use the term to decide which firms must follow the same anti-money-laundering rules as banks.

That label matters more than it sounds. In most countries, the moment a company becomes a VASP it has to register with a regulator, run identity checks on its users, and report anything that looks suspicious. A private person swapping their own coins does not. Whether the service is offered to others, for profit, is the line that counts.

What makes a business a VASP

A business becomes a VASP if it provides any one of five crypto services for other people. Ireland's central bank, which registers these firms under European anti-money-laundering law, lists them in plain terms. Converting crypto into regular money, or regular money into crypto. Swapping one coin for another. Moving crypto between wallets for someone else. Holding crypto, or the private keys to it, as a custodian. And taking part in the sale of a new token. Do any of these as a business, and the rules apply.

One phrase does the quiet work in that list: 'for other people'. Trade your own coins from your own wallet and no license is needed. The rule targets the firm in the middle, not the person at the keyboard. It helps to picture a money-transfer shop. Send your own cash to a relative abroad and you need no permit. Move other people's money for a fee and you do.

Smaller operations are caught too. Britain's FCA counts crypto cash machines, peer-to-peer services that match buyers and sellers, and firms issuing a brand-new token through an initial coin offering. A custodian is caught not only for holding coins but for safeguarding the private keys a customer uses to control them. The common thread is handling value, or the means to move it, on someone else's behalf.

Where the VASP label came from

VASP is not a marketing word. It was coined by the Financial Action Task Force (FATF), the inter-government body that writes the world's anti-money-laundering standards. In 2019 the FATF updated those standards to cover virtual asset service providers and told member countries to register or license them. The worry was specific. Crypto could carry value across borders without a bank in the path, and the FATF wanted the checks that apply to banks to reach the firms moving it.

Out of that came the rule most traders have met without knowing its name. Often called the travel rule, it makes a VASP collect and pass on details about who is sending and receiving a transfer above a set size, much as a bank does with a wire. It is why an exchange asks where a withdrawal is going. Tedious, perhaps. But that is the anti-money-laundering design working as intended.

VASP, CASP and a patchwork of labels

The same crypto firm can be called different things in different places, because each region wrote its own version of the rules. In the European Union the legal term is not VASP but CASP, short for crypto-asset service provider. Under the EU's MiCA regulation, which Luxembourg's financial regulator says became applicable to these firms on 30 December 2024, a CASP is defined in Article 3 as a business whose work is providing crypto-asset services to clients on a professional basis. Same idea. Different label.

There is a real gap behind the wording, though. A CASP authorization is a full market license that works across the EU, where the older national VASP registration was mostly an anti-money-laundering sign-up. The United Kingdom, for its part, uses neither word on its forms. The Financial Conduct Authority makes crypto firms register under the Money Laundering Regulations if they run an exchange or act as a custodian wallet provider, holding coins or the keys for customers. The activity is the same. The paperwork is local.

How Dubai licenses virtual asset firms

Dubai built one of the most detailed VASP regimes anywhere, run by a dedicated regulator, VARA. The Virtual Assets Regulatory Authority lists eight separate activities a firm can be licensed for, from running an exchange to custody, broker-dealer work, lending and borrowing, and advising clients. A firm can bundle several of these under a single license. Custody is the exception.

VARA requires any company that holds client crypto to be a separate legal entity with its own standalone license, so that customer coins sit apart from the rest of the business. For someone in the region, that is the practical point. A VARA-licensed exchange and a VARA-licensed custodian can belong to the same group and still be two different companies, by design.

What a license does, and does not, promise

A VASP license tells you a firm has passed anti-money-laundering checks. It does not tell you your money is safe if the firm fails. Registration mostly confirms that a company checks identities, screens for sanctions, and has named staff responsible for compliance. It says nothing about whether the firm is solvent, whether its reserves are real, or whether you would be repaid in a collapse. A license is a floor, not a seal of approval.

Checking is still worth the minute it takes. Most regulators keep a public list of the firms they have cleared. VARA publishes a licenses-and-register page, and the FCA runs a register of the cryptoasset businesses it has approved in the UK. If a platform asking for your money does not appear on the relevant list, that is a reason to stop and find out why before sending anything.

What to watch

The labels are still shifting. The EU's move from national VASP registration to full CASP authorization runs through a transition period, and firms with older registrations have to requalify. One edge stays unsettled: fully automated, decentralized services with no company behind them do not sit easily in a definition built around a business serving clients, and regulators have not agreed how to treat them. Other regions keep writing their own versions, so a company that is legal in one market may not be cleared in yours. The habit that protects you is dull but reliable. Check the local register before you move money, not after.