What Is a Virtual Asset Service Provider (VASP)? A Compliance Guide

Virtual Asset Service Provider — commonly abbreviated as VASP — is the term used in international financial regulation, particularly under the FATF framework, to describe businesses that provide services involving virtual assets on behalf of customers. Understanding what a VASP is matters for cryptocurrency companies with international operations or those seeking to understand how global AML standards apply to their business.

The FATF Definition of a VASP

The Financial Action Task Force defines a VASP as any natural or legal person that conducts one or more of the following activities or operations for or on behalf of another natural or legal person: exchange between virtual assets and fiat currencies, exchange between one or more forms of virtual assets, transfer of virtual assets, safekeeping or administration of virtual assets or instruments enabling control over virtual assets, and participation in and provision of financial services related to an issuer's offer or sale of virtual assets.

This definition is intentionally broad and covers most centralized cryptocurrency exchanges, crypto-to-fiat exchanges, custodial wallet providers, and certain token issuers.

VASP vs MSB: How They Relate

In the United States, the term used by FinCEN is Money Services Business rather than VASP. Crypto businesses that FinCEN classifies as money transmitters are the U.S. equivalent of what FATF calls VASPs.

The distinction matters for international operations. A U.S. crypto company is both a VASP under FATF standards and an MSB under U.S. law. When operating internationally, companies need to understand both the FATF VASP framework and the specific national implementations of that framework in each country where they operate.

FATF Recommendations for VASPs

FATF's Recommendation 15 specifically addresses VASPs. Under this recommendation, countries are required to apply the full FATF Recommendations to VASPs — including AML/CFT obligations, Travel Rule requirements, and licensing or registration requirements.

FATF's Recommendation 16 — the Travel Rule — specifically extends information-sharing requirements to virtual asset transfers, requiring VASPs to collect and transmit originator and beneficiary information for covered transfers.

How Different Countries Regulate VASPs

Each country implements FATF's VASP framework through its own national regulation. In the United States, VASPs are regulated under the BSA as MSBs. In the EU, the Markets in Crypto-Assets (MiCA) regulation creates a comprehensive framework for crypto asset service providers. The UK, Singapore, Japan, and other major financial centers each have their own VASP regulatory frameworks.

For crypto companies with international operations, understanding the specific VASP regulations of each relevant jurisdiction — not just the FATF standards — is essential. For a broader overview of AML compliance for crypto, see our dedicated guide.

Frequently Asked Questions

Is every crypto company a VASP?

Not every crypto-related business qualifies as a VASP under FATF's definition. Software developers, hardware wallet manufacturers, and entities that provide services to VASPs without themselves conducting virtual asset transactions for customers may not be VASPs. The analysis depends on the specific nature of the business's activities.

How does VASP regulation differ from traditional financial institution regulation?

VASP regulation applies the same fundamental AML/CFT principles — KYC, transaction monitoring, suspicious activity reporting, and sanctions screening — to virtual asset businesses. What differs is the implementation, particularly the use of blockchain analytics for on-chain risk assessment and the specific mechanics of Travel Rule compliance in a pseudonymous transaction environment.

How ComplyOne Helps

ComplyOne helps cryptocurrency companies navigate both U.S. BSA/MSB requirements and international VASP frameworks — building compliant programs that address both domestic and cross-border compliance obligations — through advisory services, compliance technology, or both.

Talk to the ComplyOne team to get started.

The information in this article is for general educational purposes and does not constitute legal or regulatory advice. Consult a qualified compliance professional for guidance specific to your situation.