A VASP is not "any crypto company". The FATF's test is the activity, done "as a business" and "for or on behalf of another" person. A person who holds crypto in a self hosted wallet and sends it to a friend is not one: peer to peer transfers are "not explicitly subject to AML/CFT controls" under the FATF Standards (Updated Guidance on Virtual Assets and VASPs, October 2021, para 37).
Neither is the code: "A DeFi application (i.e. the software program) is not a VASP", although the people who own, operate or control it may be (para 67). Each market turns this activity test into its own permission.
What is a virtual asset service provider (VASP)?
Picture a coffee chain (illustrative) that lets customers pay in Bitcoin through a payment app. The chain only accepts crypto for its coffee, so it is not a VASP; the app that takes the Bitcoin and pays the chain is one. The FATF says it in the same terms: "A service that facilitates companies accepting VA as payment would, however, be a VASP" (para 84).
The FATF Recommendations, the global regulatory standards for AML, define virtual asset service providers by activity. The Glossary defines a VASP as "any natural or legal person who is not covered elsewhere under the Recommendations, and as a business conducts one or more of the following activities or operations for or on behalf of another natural or legal person" (FATF Recommendations, June 2026, pp. 140 to 141). The definition matters because Recommendation 15 puts VASPs under the same preventive measures as banks: "Recommendations 10 to 21 apply to VASPs" (Interpretive Note to Recommendation 15, para 7).
Which five activities make a business a VASP?
Each of the five, with examples:
- Exchange between virtual assets and fiat currencies. An exchange or broker app that sells Bitcoin for dollars or euros.
- Exchange between one or more forms of virtual assets. A swap service that turns one token into another for its customers.
- Transfer of virtual assets. A service that moves a virtual asset "from one virtual asset address or account to another" for someone else (Glossary, footnote 112), such as a remittance app that settles in stablecoins.
- Safekeeping or administration of virtual assets, or of instruments enabling control over them. A custodial wallet that holds customers' private keys.
- Financial services related to an issuer's offer or sale of a virtual asset. A firm that runs or underwrites a token sale for an issuer.
One activity is enough. What does not count is infrastructure: running the network, offering cloud computing or "creating, validating, and broadcasting blocks of transactions" does not make a business a VASP, even when run as a business (2021 guidance, para 83), and neither do makers of hardware wallets that hold no customer assets.
What counts as a virtual asset?
A virtual asset is "a digital representation of value that can be digitally traded, or transferred, and can be used for payment or investment purposes" (Glossary). Three things fall outside it:
- Central bank digital currencies. They are digital fiat, so "these are not VAs" (para 17).
- Securities and other financial assets already covered. A tokenized bond stays a bond, under securities rules.
- Most NFTs. Non fungible tokens are "generally not considered to be VAs", unless they are "used for payment or investment purposes in practice" (para 53).
A stablecoin is covered either way, "as either a VA or a financial asset" (para 54), so the activity test still applies to a business that exchanges or holds it.
What does a VASP have to do?
The first obligation is a permission: "At a minimum, VASPs should be required to be licensed or registered in the jurisdiction(s) where they are created" (INR.15, para 3). The rest are a bank's preventive measures, adapted:
- Customer due diligence (CDD), the know your customer (KYC) measures, for business relationships and for occasional transactions above USD/EUR 1,000 (INR.15, para 7(a)).
- The travel rule, under which the originating VASP obtains, holds and sends originator and beneficiary information with each transfer; thresholds vary, 3,000 dollars in the US (31 CFR 1010.410(f)).
- Monitoring of transactions and wallets, the work know your transaction (KYT) describes, with sanctions screening and suspicious transaction reports to the FIU.
- Records kept "for at least five years" (Recommendation 11).
The national label differs. In the EU the permission is a MiCA authorization as a crypto asset service provider; in the US a VASP that transmits value is usually a money transmitter registered with FinCEN, a status FinCEN calls "a matter of facts and circumstances" (FIN-2019-G001).
How does one VASP check another before a transfer?
Picture an exchange (illustrative) about to send a customer's withdrawal to an exchange it has never dealt with. Before the data goes, the sender has to know the receiver: a VASP needs to "conduct due diligence on their counterparty VASP before they transmit the required information to avoid dealing with illicit actors or sanctioned actors unknowingly" (2021 guidance, para 196). This counterparty check is often called know your VASP. The FATF describes three phases: decide whether the transfer goes to another VASP or to an unhosted wallet, identify the counterparty VASP, then assess whether it is an eligible counterparty to send customer data to (para 197).
The check runs on the receiving VASP itself, including whether it can be expected to keep the data confidential. FATF's guidance lets it be done once per counterparty rather than "for every individual VA transfer", and redone "periodically or when risk emerges", such as after adverse media or a suspicious history, so the record sits on the counterparty, not on each payment. On the customer side, what a VASP switches on first is a check of both the wallet and the person behind it.
VASP, CASP or MSB: what is the difference?
Table 1. Three names for overlapping businesses (as of October 2026).
| Term | Whose term | Legal text | Activities | License or registration | AML rules |
|---|---|---|---|---|---|
| VASP | FATF | Glossary; Recommendation 15 and its interpretive note | The five activities above | Licensed or registered where created, at a minimum | Recommendations 10 to 21 |
| CASP | European Union | MiCA Art 3(1)(15) and (16) | Ten crypto asset services, from custody to portfolio management | Authorization under MiCA Art 59 | Financial institution under Directive (EU) 2015/849 since Regulation (EU) 2023/1113, Art 38 |
| MSB (money transmitter) | United States | 31 CFR 1010.100(ff)(5); FIN-2019-G001 | Accepting and transmitting value, convertible virtual currency included | FinCEN registration and state licenses | Bank Secrecy Act: AML program, CTR, SAR, travel rule |
The three overlap without matching. A crypto custodian is a VASP in FATF terms, needs a MiCA authorization to serve EU clients and may be a money transmitter in the US.
One EU name causes confusion: 6AMLD, Directive (EU) 2018/1673, is criminal law and sets no duties for firms, VASPs included.
What changed for VASPs in 2026?
- June 2026. The FATF's update of its Recommendations kept the VASP definition and Recommendation 15 as quoted above.
- 30 June 2026. In the UK, a crypto transfer to a business outside the UK carries the full originator and beneficiary information from the equivalent of £800, the sum S.I. 2026/621 wrote into regulation 64C(4) of the Money Laundering Regulations 2017.
- 1 July 2026. The longest MiCA transition ended: crypto asset service providers that had run under national law could continue only until that day or until their authorization decision (Art 143(3)).
Before the first transfer to an exchange it has never dealt with, a VASP has one call to make: whether the counterparty file shows a license or registration and a receiver that can keep travel rule data confidential.
Related terms
- Travel rule. The duty to send originator and beneficiary information with a transfer.
- Know your transaction (KYT). Monitoring of transactions and wallets for risk.
- Customer due diligence. The measures that identify a customer and the purpose of the relationship.
- CASP. The EU's crypto asset service provider, authorized under MiCA.
- MiCA. The EU regulation that authorizes crypto asset service providers and governs token issuers.
- Money services business. The US category that covers money transmitters, crypto businesses included.
How this entry was checked. Quotations come from the FATF Recommendations of June 2026 (Recommendation 15, its interpretive note and the Glossary, read in the PDF because the FATF website refuses automated reads), FATF's Updated Guidance on Virtual Assets and VASPs (October 2021), MiCA, Regulation (EU) 2023/1113, FinCEN's FIN-2019-G001, 31 CFR 1010.410(f) and UK MLR regulation 64C. Barbaros Sercan (Customer Success Specialist, complead) wrote the entry; Ufuk Gürdaş, Compliance Specialist, matched every quotation and paragraph number to those texts. The definition follows the FATF Glossary, and the coffee chain and the exchange are illustrative. Last reviewed: 30 October 2026.
