VASP

VASP is the term that ended the argument about whether crypto-asset businesses are financial institutions. In 2019 the FATF, the intergovernmental body that sets global anti-money-laundering standards, amended its Recommendation 15 and defined the virtual asset service provider: any natural or legal person who, as a business, conducts one or more of five activities for or on behalf of customers.

The five are worth reading precisely, because one is enough to qualify. Exchange between virtual assets and fiat currencies; exchange between one or more forms of virtual assets; transfer of virtual assets, meaning conducting a transaction that moves a virtual asset from one address or account to another; safekeeping or administration of virtual assets or of instruments enabling control over them; and participation in or provision of financial services related to an issuer’s offer or sale of a virtual asset. Exchanges, custodians, brokers, off-ramp providers, and many wallet businesses land squarely in the definition. What it deliberately excludes is software: publishing code or running infrastructure without controlling customer assets is not, by itself, a VASP activity.

Status carries the standard AML package. A VASP must be licensed or registered where it operates, run customer due diligence and sanctions screening, report suspicious activity, and comply with the Travel Rule, exchanging originator and beneficiary information with counterparty institutions on transfers. The FATF’s periodic targeted updates track how unevenly countries have implemented all this, which is the origin of the sunrise problem in cross-border transfers.

Implementation remains the standard’s weak flank. The FATF’s targeted updates report, year after year, that a substantial share of assessed jurisdictions have yet to license VASPs or enforce the Travel Rule against them, which keeps the regulatory perimeter porous at exactly the borders where transfers cross. The direction of the assessments is nonetheless consistent: fewer gaps each cycle, and rising pressure on the jurisdictions that lag.

Jurisdictions translate the concept into their own categories. The EU’s MiCA regulates the crypto-asset service provider (CASP), a broader authorization covering ten services with conduct and prudential rules attached. The US reaches similar activity through FinCEN money services business registration and state money transmitter licensing. The labels differ; the direction is one way. For institutions evaluating stablecoin settlement counterparties, VASP status is the baseline diligence question: it determines whether the entity on the other side of a transfer is inside the regulated perimeter, and whether the identity data the law requires can actually flow.