What Is a VASP? Virtual Asset Service Providers Explained

A VASP, or virtual asset service provider, is any person or business that, as a business and on behalf of others, exchanges crypto for fiat, exchanges one crypto for another, transfers crypto, holds or administers it in custody, or provides financial services around a token issuance. The term comes from the Financial Action Task Force (FATF), the global standard-setter for anti-money-laundering rules, and it is why crypto exchanges must verify your identity, screen transactions and report suspicious activity.

This guide covers the FATF definition and its five activities, what counts and what does not, what VASPs must do, how the term maps onto the EU's CASP, the US money services business and the UK's registered cryptoasset business, and where DeFi fits.

The FATF definition of a VASP

The FATF added "virtual asset" and "virtual asset service provider" to the glossary of its Recommendations in October 2018, when it revised Recommendation 15 to cover crypto. Under the current text, a VASP is any natural or legal person not covered elsewhere in the Recommendations that, as a business, conducts one or more of these activities for or on behalf of another person:

1. Exchange between virtual assets and fiat currencies.
2. Exchange between one or more forms of virtual assets.
3. Transfer of virtual assets, meaning a transaction on behalf of someone else that moves a virtual asset from one address or account to another.
4. Safekeeping and/or administration of virtual assets or instruments enabling control over them.
5. Participation in and provision of financial services related to an issuer's offer and/or sale of a virtual asset.

A virtual asset is "a digital representation of value that can be digitally traded, or transferred, and can be used for payment or investment purposes". It excludes digital representations of fiat currencies, securities and other financial assets already covered elsewhere in the FATF Recommendations.

Two phrases do most of the work: "as a business" and "for or on behalf of another". An individual trading their own coins is not a VASP. A company that holds customers' coins or routes their trades usually is.

Examples: who is and is not a VASP

Businesses that typically fall inside the definition:

• Centralised exchanges and brokers, both crypto-to-fiat and crypto-to-crypto.
• Custodial wallet providers that hold keys for customers.
• Crypto ATM operators, peer-to-peer providers and firms issuing new tokens through ICOs, all of which the UK's Financial Conduct Authority (FCA) names among in-scope cryptoasset businesses.
• OTC desks that convert crypto to fiat or other assets for clients.

The FATF's 2021 updated guidance on virtual assets and VASPs lists those who generally are not VASPs: providers of unhosted wallets whose only role is developing or selling the software or hardware, merchants that simply accept crypto for goods and services, software developers who do not perform VASP functions, and individual users. It also says countries must look at the facts of each case.

What VASPs must do

The interpretive note to Recommendation 15 says countries should treat virtual assets as "property", "proceeds" or "funds" and apply the full AML framework to VASPs. In practice that means:

• Licensing or registration. VASPs "should be required to be licensed or registered", at a minimum in the jurisdiction where they are created. Countries may also require licensing where a VASP serves customers or operates from their territory, and should act against unlicensed operators.
• Fit-and-proper checks to keep criminals and their associates from owning or managing a VASP.
• Customer due diligence: verifying identity, understanding the customer's risk and applying enhanced due diligence where the risk is higher.
• The travel rule: passing originator and beneficiary information with transfers. See the crypto travel rule explained.
• Suspicious transaction reporting to the national financial intelligence unit (FIU) under Recommendation 20. See our guide to the suspicious activity report (SAR).
• Supervision by a competent authority with powers to inspect, fine and withdraw a licence.

VASPs also have to vet each other. Before sending travel-rule data, a VASP needs to know that the counterparty is a real, licensed business, which is a form of business verification. Vendors such as iDenfy's KYB solution automate company registry lookups and ownership checks for this kind of onboarding. For a fuller list of steps, see the crypto AML compliance guide for exchanges and VASPs.

VASP vs CASP vs MSB

"VASP" is the FATF's term. Each jurisdiction writes the standard into its own law with its own label, and the scopes do not match exactly.

EU CASP. The Markets in Crypto-Assets Regulation (MiCA) defines a CASP as a legal person or other undertaking whose business is providing one or more crypto-asset services to clients on a professional basis, and that is authorised under Article 59. Its list of ten services is wider than the FATF's: alongside custody, trading platforms, exchange and transfers, it includes order execution, placing, reception and transmission of orders, advice and portfolio management. Firms already operating under national law before 30 December 2024 could continue under a transitional regime until 1 July 2026 at the latest, or until their authorisation was granted or refused. See the CASP licence under MiCA and what MiCA is.

US MSB. FinCEN's 2019 guidance treats crypto exchangers and hosted wallet providers as money transmitters, a type of money services business. Under 31 CFR 1022.380, an MSB must register with FinCEN within 180 days of being established and renew every two calendar years, whether or not it holds a state licence. FinCEN registration is not a licence; state money transmitter licences are a separate layer. See our guide to the money transmitter licence for crypto.

UK. Cryptoasset businesses must register with the FCA under the Money Laundering Regulations before carrying on in-scope services. The FCA stresses that registration covers AML supervision only and is not an endorsement, and that customers are unlikely to have access to the Financial Ombudsman Service or the FSCS. The FCA says a new authorisation regime under the Financial Services and Markets Act is expected to come into force on 25 October 2027.

Is DeFi a VASP?

The software itself is not. The FATF's 2021 guidance says a DeFi application "is not a VASP under the FATF standards", because the standards do not apply to underlying software or technology. But it goes on: "creators, owners and operators or some other persons who maintain control or sufficient influence in the DeFi arrangements, even if those arrangements seem decentralized, may fall under the FATF definition of a VASP where they are providing or actively facilitating VASP services." Signs of an owner or operator include control over assets or protocol parameters, an ongoing business relationship with users, and profiting from the service.

MiCA takes a similar line in recital 22: services provided "in a fully decentralised manner without any intermediary" fall outside the regulation, but services performed partly in a decentralised way still count. FinCEN's 2019 guidance says that when decentralised applications perform money transmission, the money transmitter definition can apply to the application, its owners and operators, or both.

The test in all three is control, not labels. For how this plays out in practice, see KYC in DeFi explained.

What it means for users

• Why you are asked for ID. If a platform holds your crypto or converts it for you, it is almost certainly a VASP somewhere and is legally required to verify you, monitor your transactions and report suspicions.
• Check registration yourself. Regulators publish registers of authorised or registered firms. Registration is not a guarantee of safety, but an unregistered platform serving your country is a warning sign.
• Self-custody is different. Using your own wallet makes you an individual user, not a VASP. See non-custodial wallets.

JewelSwap's DeFi apps are non-custodial and do not run KYC themselves; users connect their own wallets.

Frequently asked questions

What does VASP stand for?

VASP stands for virtual asset service provider. It is the FATF's term for a business that exchanges, transfers, holds or administers crypto on behalf of others, or provides financial services around a token issuance.

What are the five VASP activities?

Exchange between virtual assets and fiat, exchange between virtual assets, transfer of virtual assets, safekeeping or administration of virtual assets, and participation in financial services related to an issuer's offer or sale of a virtual asset.

What is the difference between a VASP and a CASP?

VASP is the global FATF term. CASP is the EU term under MiCA, which defines ten crypto-asset services, including advice and portfolio management, and requires authorisation. Most VASPs serving EU customers need to be authorised as CASPs.

Is a crypto exchange a VASP?

Yes. A centralised exchange that converts crypto to fiat or between crypto assets for customers is a VASP under the FATF definition and must be licensed or registered where national law requires it.

Are DeFi protocols VASPs?

The software is not, according to FATF's 2021 guidance. But people who maintain control or sufficient influence over a DeFi arrangement may be treated as VASPs if they provide or actively facilitate VASP services.

Is a self-custody wallet provider a VASP?

Generally not. The FATF says providers of unhosted wallets whose only role is developing or selling the software or hardware are not usually VASPs, and neither are individual users.

Keep reading

• The CASP licence under MiCA
• Money transmitter licence for crypto
• The crypto travel rule explained
• Crypto AML compliance guide for exchanges and VASPs
• KYC in DeFi explained

This article is educational and is not legal advice. Definitions are from the FATF Recommendations (updated October 2025) and the FATF Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs (October 2021); EU references are to Regulation (EU) 2023/1114 (MiCA); US references are to FinCEN guidance FIN-2019-G001 and 31 CFR 1022.380; UK references are to the FCA's cryptoasset AML/CTF regime page. All were checked on 9 October 2026.