VASP Licensing and Registration

What a VASP is

VASP (Virtual Asset Service Provider) — a "provider of services in the sphere of virtual assets." The term was introduced by the FATF (Financial Action Task Force) — the international body that sets standards for combating money laundering. A VASP is usually understood as a business that, as its activity, performs for clients at least one of the following:

• exchange between crypto and fiat (crypto ↔ money);
• exchange between different crypto assets (crypto ↔ crypto);
• transfer of virtual assets;
• storage/administration of assets or keys (custody);
• participation in providing financial services for the issuance/sale of crypto assets.

Registration vs licence — what's the difference

The line between "registration" and "licence" depends on the country and the type of services. The general logic: the closer a business is to holding other people's money/assets and to retail, the stricter the regime. A simple P2P "money changer" and a full-fledged custodial exchange are at opposite ends of the scale.

Where and for whom registration is required

There is no single global register — each jurisdiction builds its own regime, but the vector is common: no anonymous professional exchange desks remain. The general picture:

• EU. Transition to the unified MiCA regime (see below) — authorisation as a CASP.
• USA. Exchange desks register as an MSB (money services business) at the federal level and obtain licences in the states (for example, the "BitLicense" in New York).
• United Kingdom, Singapore, UAE, Hong Kong and others — their own VASP registration/licensing regimes with their respective regulators.
• "Light" jurisdictions. A number of countries offered simplified VASP registration; requirements are gradually tightening under pressure from the FATF.

MiCA in a nutshell

MiCA (Markets in Crypto-Assets) — a European Union regulation that creates uniform rules for the crypto-asset market across the whole of the EU. The main ideas a practitioner needs to understand:

1. The unified CASP status. In MiCA terminology a service provider is called a CASP (Crypto-Asset Service Provider) — essentially the European embodiment of a VASP. Authorisation from a national regulator is required.
2. "Passporting." Once authorised in one EU country, you can provide services across the whole Union — you don't need 27 separate licences.
3. Stablecoin regulation. Separate rules for "asset-referenced tokens" and "e-money tokens" — with requirements for reserves and transparency.
4. Client protection and transparency. Requirements for disclosure, segregation of client assets, conflict-of-interest management, and resilience.
5. AML on top of MiCA. MiCA does not abolish anti-money-laundering requirements — they apply in parallel, including the "Travel Rule" on transmitting sender/recipient data during transfers.

What this means for an exchange desk in practice

Translating the regulation into the language of an exchange business's daily work:

• KYC is mandatory. Identifying clients, screening against sanctions and PEP lists, retaining data.
• Transaction monitoring. Scoring addresses, detecting links to the darknet/mixers/sanctions (this is where AML analytics like AMLConsensus come in).
• An AML officer and policies. A designated accountable person, written procedures, staff training.
• Reporting of suspicious operations (SAR/STR) — a registered VASP is obliged to report them (the subject of a separate lesson).
• Travel Rule. For transfers between providers — transmitting data about the sender and recipient.
• Record keeping. Logs of operations and client data for the prescribed period.

A mini-checklist: "do I need VASP status"

• ☐ I exchange/transfer/store crypto for other people, not only for myself.
• ☐ I do this systematically and for a fee (a commission, a spread).
• ☐ Among my clients are residents of jurisdictions with a strict regime (the EU, the USA, etc.).
• ☐ I accept/pay out fiat and work with banks.
• ☐ I hold other people's keys/funds (custody).

Three or more "yes" answers — you are almost certainly in the VASP/CASP zone and need a regulatory status and full-fledged compliance. In that case the next step is a consultation with a lawyer for the specific jurisdiction and building AML procedures, not "let's try without."