A VASP is a business providing virtual-asset services for others, such as exchange, transfers, safekeeping or administration, and financial services related to an issuer’s offer or sale. Exchanges, payment services, and custodians are common examples. Licensing and AML duties depend on the activities and applicable law, including customer diligence, monitoring, records, reporting, and the travel rule where implemented. This hub maps each layer and links the guide that goes deep on it.
The page reads in the order most teams meet the problem. First what the term means and why regulators care now. Then the license that legalizes the business, the controls prepared during the application and maintained in operation, the travel rule in one paragraph, and the monitoring work that eats most of the week. A navigation table at the end lists every guide in the family, plus the neighboring families on this site that cover related jobs.
What a VASP Is
Common activities within VASP frameworks
VASP stands for virtual asset service provider. The term comes from the Financial Action Task Force, whose standards shape national AML frameworks. Common activities include exchange between virtual assets and fiat, exchange between virtual assets, transfers, safekeeping or administration, and financial services related to an issuer’s offer or sale. The Central Bank of Ireland’s published definition lists these five categories; applicable law determines whether a particular business falls within scope.
The test is what you do, not what you call yourself. A platform that lets customers swap bitcoin for euros is exchanging. A payment service that moves stablecoins between a buyer and a seller is transferring. A custodian that keeps keys for clients is safekeeping. Do any of these as a business and you are a VASP for regulatory purposes, which is why so many different companies woke up to the same rulebook.
Worth naming what the label does not cover: someone trading their own funds, or a pure software provider with no touch on customer assets. The line can get thin with some decentralized setups, and the borderline cases are exactly the ones worth reading the definition source for.
VASP and CASP: overlapping but distinct frameworks
In the European Union, MiCA, the markets in crypto assets regulation, uses the term crypto asset service provider, or CASP, for largely the same set of businesses. VASP is the international standard word; CASP is the EU legal word for its own licensing system. An exchange in Frankfurt is a VASP when regulators talk globally and a CASP on its license documents.
This hub uses VASP for the international AML discussion. VASP and CASP scopes overlap, but MiCA defines its own services, authorisation rules and obligations; the terms are not interchangeable in a legal assessment. The definition guide below explains the comparison.
Why VASPs Are Now Heavily Regulated
A licensed crypto business is no longer a novelty regulators are figuring out how to treat. Two forces moved the floor. In the European Union, MiCA turned scattered national registrations into one authorization system with real supervisory teeth. Globally, the FATF standards, including the travel rule and its 2025 implementation review, expect every jurisdiction to supervise VASPs the way banks are supervised, and the FATF grades countries that do not.
What that means in practice: compliance stopped being a differentiator and became the entry ticket. A business that cannot show a license, a written AML program, and monitoring records is not a smaller version of a compliant one. It is an illegal operator in most jurisdictions, and the enforcement actions of the past few years have treated it that way.
The compliance floor moved
The floor moved in a specific direction, worth understanding because it shapes every page in this family. Regulators stopped asking whether you check customers and started asking how you screen a deposit address. They ask how you explain a risk score to an examiner, and how you handle an alert at two in the morning. The virtual asset guidance the FATF maintains is the clearest statement of those expectations.
Where the term comes from
FATF revised its standards in October 2018 and June 2019 and issued virtual-asset guidance in June 2019, as the Financial Stability Board’s official timeline records. National treatment and implementation differed; some jurisdictions already applied AML obligations before those updates. The changes clarified the international framework rather than creating all regulation from nothing.
The Licensing Layer
Licensing is the gate everything else runs through. Where authorisation is required, operating without it can trigger enforcement and legal penalties; applicable law determines the requirements and consequences. The paths differ: the EU runs a single CASP authorization with passporting across member states, other jurisdictions run national systems with their own capital, staffing, and local presence demands.
Choosing where to apply is a business decision before it is a legal one. Which markets the license opens, what the application asks for, how long the review takes, and what the ongoing costs look like. The VASP license and registration guide walks the decision, the paperwork, and the Lithuania route that many applicants evaluate.
One license, many rulebooks
A common surprise for first time applicants: the license is the beginning of oversight, not the end of it. The authorization brings ongoing duties, reporting deadlines, and exams. Teams that treat the license as a finish line tend to meet their first exam unprepared.
Start with your jurisdiction
The practical first step is mapping where your customers are, because that decides which regulator you answer to and which rulebook your policies must satisfy. The guide below starts there too.
The Duties Layer
Applicable controls should be prepared before or during the licensing application and maintained after approval. FATF’s framework covers customer diligence, ongoing monitoring, record keeping, suspicious activity reporting and transfer-information requirements. The specific duties, thresholds and implementation dates depend on local law.
The list is short. The work is not, and the work lands unevenly. KYC is heavy at onboarding and light after. Monitoring is the opposite: quiet for weeks, then a queue of alerts that eats the day. Examiners probe all five, but the questions that separate prepared teams from surprised ones cluster around monitoring and record keeping: what did you see, what did you do about it, and can you show me.
The VASP AML guide covers the full set and where the hours actually go. On whether transaction screening itself is a legal must for VASPs, the short is KYT required piece answers directly. And for the question that tends to follow, which tools carry which duty, the VASP compliance tools shortlist evaluates seats against the duty stack itself.
Five areas in the compliance framework
These five areas form a useful framework across jurisdictions, but they do not become legally applicable everywhere at the same moment. Local implementation determines the scope, timing and required measures. A guide organised by duties helps teams map their controls without treating international standards as a single global law.
Where teams feel the pressure
Two pressure points show up in almost every compliance team's account: alert queues dominated by false positives, and exam questions about how risk scores were derived. Both have dedicated treatment in this family, in the monitoring guide and the false positive playbook.
Travel Rule in One Paragraph
The travel rule is FATF Recommendation 16: when a VASP sends a virtual asset transfer to another VASP, it must collect and pass along information about the originator and the beneficiary. Name, account, and more, kept available. The point is to stop crypto transfers from being anonymous wire transfers. The full rule, what exactly must travel, the thresholds, and why cross border implementation is genuinely hard, are covered in the travel rule guide.
A neighboring topic that is not part of this family: sanctions list screening, the OFAC side of compliance, is its own subject with its own treatment elsewhere on this site.
What R.16 asks you to pass along
The information package sounds simple and is: who sent it, from which account, who receives it, to which account. The difficulty is never the fields. It is finding the VASP on the other end, exchanging data in a format both sides read, and handling the cases where the other side is a self hosted wallet rather than a regulated firm. Those edges are where the guide spends its pages.
Monitoring: Where the Work Lands
If the duties are a job list, monitoring is the full time position on it. Screening runs at onboarding and at every deposit and withdrawal; monitoring watches behavior in between and after, because risk attached to an address changes with new activity. A customer who passed every check at onboarding can receive tainted funds a month later, and the monitoring program is what notices.
Day to day, monitoring means a queue: alerts raised by risk signals, triaged by a person, closed with a reason or escalated. How to wire the checks into a deposit and withdrawal flow, what the signals mean, and how to run the queue without drowning in it are the subject of the transaction monitoring guide. It also covers how to leave records an examiner accepts. That guide is the most operational page in this family.
The neighboring wallet screening family covers the same discipline from the self custody and signing side of wallet risk, for teams whose exposure is what their users sign rather than what they route.
Monitoring is the daily workload
It is worth setting expectations honestly: monitoring is where compliance headcount goes. The alert queue never finishes; it renews. Teams that budget for that reality design triage rules and routing early, and the false positive guide below exists because that single problem decides whether the queue is a control or a bottleneck.
Adjacent families on this site
Two neighbors handle related problems. The KYT family goes deeper into transaction screening workflows and API integration. The AML family holds the broader anti money laundering library, from risk score explainability to tooling selection for small VASPs. And a boundary note: transaction ordering attacks and MEV are a market risk topic, not a compliance one, and live outside this hub.
Phalcon Compliance
On the tooling side, this site’s compliance line is Phalcon Compliance: address and transaction screening through the KYA and KYT capabilities. The label library covers more than 600 million labeled addresses, updated around the clock, with over 200 risk signals across 17 risk indicator categories (per BlockSec). Screening responses through the API come back in under 100 milliseconds, which is what a deposit pipeline needs at peak.
The two screening capabilities split the work. KYA screens the address at onboarding and deposit review; KYT screens the transaction. Results and audit logs support a consistent onchain record, with five risk levels: No Risk, Low, Medium, High and Critical. The risk engines support rules for 27+ jurisdictions (per BlockSec), separately from report-template coverage. STR report drafts are currently available for Hong Kong and Singapore; the institution reviews them, decides whether reporting is required, and submits them under applicable rules.
What the engine covers
Phalcon Compliance supports the onchain parts of a broader compliance workflow: address and transaction screening, monitoring alerts, audit logs, exports and STR report drafting. These features help teams assemble screening evidence; they do not complete identity KYC, the institution’s AML programme or regulatory reporting obligations. The institution adds the necessary identity, review and approval evidence.
How pricing is shaped
Pricing starts with a free tier: registering on the BlockSec site brings three free risk checks a month. Past that, credit packages can be bought as needed, or a team can move to a monthly subscription as screening becomes routine. The API sits on the Scale and Enterprise plans, and that gate is worth confirming before any integration work starts.
Honest limits
Three limits belong in an honest description. Screening lowers risk; it does not remove it, and a clean result today is a statement about today. The tool provides ratings and evidence; the decisions and the written policy around them remain the operator's work. And checking identity documents, KYC in the strict sense, is not what this engine does; it screens addresses and transactions, and expects the identity side to run beside it. The full product details are on the Phalcon Compliance page.
Explore the VASP Family
Every guide below holds one position in the map above.
Cross family, for related jobs: the AML family holds selection and risk scoring guides, including pricing guidance for small VASPs. The KYT family holds the monitoring and necessity deep dives plus API tutorials. The wallet screening family covers wallet risk from the signing side.
Where you start depends on your day. Defining your status, start with the definition guide. Applying, start with licensing. Already licensed and staffing the compliance function, start with VASP AML and the monitoring guide.
