The Short Answer
A VASP is a virtual asset service provider: a business that provides virtual-asset services for others, including exchange, transfers, safekeeping or administration, and financial services related to an issuer’s offer or sale. Centralised exchanges, payment services and custodians are common examples. Licensing, customer diligence, monitoring, records and transfer-information duties depend on the activities and applicable law. The VASP compliance hub collects the related guides.
The abbreviation spells out to virtual asset service provider, and the full phrase is the formal one. It comes from the Financial Action Task Force, the standard setting body whose recommendations shape anti money laundering law in most countries. FATF revised its standards in October 2018 and June 2019 and issued virtual-asset guidance in June 2019, as the FSB timeline records.
The loose phrase "crypto company" is worth separating from the term. Plenty of businesses touch crypto without being VASPs: a software vendor with no access to customer funds, a miner selling their own coins, a data provider. VASP is narrower and more precise. It attaches to activities done for others. The Central Bank of Ireland’s published VASP definition lists five categories, including issuer-related financial services; this page groups common exchange, transfer and custody examples without making them an exhaustive list.
What Makes You a VASP
The test is activity, not branding. Common services include exchange between virtual assets and fiat or other virtual assets, transfers, and safekeeping or administration for customers. Issuer-related financial services can also fall within VASP definitions. Applicable law decides scope; the examples below illustrate common service groups.
Centralized exchanges are the clearest case. Matching buyers and sellers, holding order books, converting bitcoin to euros: every core function sits inside the exchange and transfer prongs. If a platform lets one customer trade against another, it is very hard to argue it out of the definition.
Payment and remittance services are the second group. A service that lets a merchant accept stablecoins and receive fiat, or moves crypto between a payer in one country and a receiver in another, is transferring virtual assets. The crypto is traveling between people, which is the activity the definition points at, regardless of what the marketing calls the product.
Custodial wallet providers are the third. Holding keys, administering accounts, or recovering access for customers is safekeeping. The customer owns the assets; the provider controls movement, and that control is what the definition captures.
Borderline cases exist, and pretending they do not would be less than honest. Some decentralized setups claim no operator at all, and regulators have spent years working out when a frontend or a governance layer exercises enough control to count as a service provider. The direction of travel is clear: where a business controls customer funds or moves them for customers, regulators tend to find a VASP. If your setup is genuinely borderline, that is a question for the definition text and for counsel, not for a blog post.
Three common service groups side by side, not an exhaustive legal definition:
| Activity | What it looks like in practice | What triggers the status |
|---|---|---|
| Exchanging | Customers swap bitcoin for euros, or one coin for another | Any conversion business done for customers |
| Transferring | A payment rail moves crypto between a payer and a receiver | Assets moving between people, whatever the product is called |
| Safekeeping | A service holds keys, administers wallets, or recovers access | Controlling customer assets, even temporarily |
Two things this page will not do: name specific companies, in either direction, and call any list complete. Jurisdictions keep their own registers, and who is licensed where changes monthly. What travels well is the activity test, which is why this guide leans on it.
For the related licensing and compliance guides, see the VASP compliance hub.
VASP vs CASP: Two Rulebooks, Same Idea
CASP means crypto asset service provider, the EU's term under MiCA for almost the same set of businesses. VASP is the global standard word; CASP is what the EU rulebook and its license documents say. A firm in Frankfurt is both at once: a VASP in international guidance, a CASP on its authorization.
MiCA, the EU's markets in crypto assets regulation, took effect as a single rulebook with a dedicated authorization for crypto services. The regulation text defines the CASP and its activities, and the definitions track the FATF ones closely: exchange, transfer, custody, plus a longer tail of execution and advice services. The overlap is deliberate, because the point of both frameworks is the same set of businesses.
For a compliance team, the overlap does not remove differences in service scope, authorisation and legal obligations. MiCA has its own authorisation requirements, and national VASP rules may use different activity tests. The license and registration guide covers the licensing decision in the EU and elsewhere.
One practical asymmetry worth knowing: inside the EU, a CASP authorization passports across member states, which is why so many applicants evaluate EU jurisdictions first. Outside the EU, each rulebook stands alone. That fork in the road is where the licensing guide begins.
Why the Term Matters to You
The VASP label signals that a business may fall within a regulated framework. Determine which licensing, customer diligence, monitoring, record keeping and transfer-information duties apply under local law, including their effective dates. Do not assume an existing licence or a lack of written notice removes those requirements.
Many traditional institutions entering crypto discover the term precisely this way. A bank or a payments company launches a crypto feature, assumes its existing licenses cover it, and then learns that the crypto activity pulls a separate, specific rulebook. The gap between "we are already regulated" and "we are regulated for this" is where problems start.
Confirm whether the definition applies to your activities and identify the licensing or registration route. Prepare the required AML controls, staff, tools and evidence before or during the application, then maintain monitoring and records throughout operation. Each step has a guide in this family, and the VASP compliance hub holds the map.
Checking your own status is not a one time event either. Products drift: a custody feature ships, an OTC desk opens, a payout rail switches to stablecoins. Each change re-runs the activity test, and the honest habit is re-running it whenever the product does something new with other people's assets.
Checking Risk Before You Operate
Whatever the paperwork status, the first operational habit is the same: check who you are dealing with before funds move. On the BlockSec site, registering brings three free risk checks a month, each returning a five level risk grade for an address in seconds. It is the cheapest way to see what labels look like.
That habit scales up later into the monitoring duty described above, but it starts as a manual reflex: address in, grade out, decision recorded. When volume grows past what a person can check well, the checks move into the pipeline, and that transition has its own treatment in the transaction monitoring guide.
For the definition questions this page raised and did not settle, the primary sources are the two linked above: the FATF recommendations for the international term, and MiCA for the EU one. For everything operational that follows the label, the VASP hub is the map.