VASP (Virtual Asset Service Provider)

What Is a VASP?

A virtual asset service provider (VASP) is a business that, on behalf of its customers, exchanges, transfers, holds or administers virtual assets, or provides financial services connected to issuing them. The term comes from the FATF, which added definitions of "virtual asset" and "virtual asset service provider" to its Glossary in 2018 so that crypto businesses would be covered by the same AML and counter-terrorist financing standards as banks and money transmitters.

Under the FATF definition, a VASP is any natural or legal person, not otherwise covered by the Recommendations, that as a business conducts one or more of these activities for or on behalf of another person:

1. Exchange between virtual assets and fiat currencies.
2. Exchange between one or more forms of virtual assets.
3. Transfer of virtual assets.
4. Safekeeping or administration of virtual assets, or of instruments that enable control over them.
5. Participation in and provision of financial services related to an issuer's offer or sale of a virtual asset.

In practice this captures centralized exchanges, brokers, custodial wallet providers, many crypto ATM operators and some token issuance platforms. The test is functional: the label a business gives itself, or the technology it uses, does not decide whether it is a VASP.

Different jurisdictions use their own terms. The European Union refers to crypto-asset service providers (CASPs), while the United States applies its money services business framework to many of the same activities.

Why VASPs Matter

Virtual assets can move across borders in minutes and without a bank in the middle. VASPs are the main points where those transfers meet the regulated financial system and where customer identity can be established. That makes them the natural control point for preventing laundering, terrorist financing, fraud and sanctions evasion in the crypto economy.

For other financial institutions, VASPs are also customers and counterparties. A bank that opens accounts for an exchange, or a VASP that sends funds to another VASP, takes on risk that depends heavily on the counterparty's own controls.

Screening and Due Diligence on VASPs

Licensing and registration

The first question is whether the VASP is licensed or registered where it operates and where it serves customers. Many jurisdictions publish registers of authorized firms. Unregistered operation in a market that requires registration is a significant red flag.

Counterparty due diligence

When a VASP sends or receives funds to or from another VASP, it is generally expected to assess that counterparty before transacting, in a way that resembles correspondent banking due diligence. Typical points include:

• Ownership, management and beneficial owners, including sanctions and PEP screening.
• The AML program: policies, KYC standards, transaction monitoring and sanctions controls.
• Travel Rule capability and the ability to protect personal data received.
• The jurisdictions served and any exposure to high-risk or sanctioned countries.
• Adverse media relating to hacks, fraud or enforcement action.

Ongoing screening

Screening does not end at onboarding. Counterparty VASPs, their owners and the wallet addresses they use should be rescreened as sanctions lists and risk information change.

Red Flags

• A VASP with no identifiable license, physical presence or responsible management.
• Weak or no KYC, for example allowing large withdrawals without identity verification.
• Marketing aimed at users in sanctioned jurisdictions or offering ways around geographic restrictions.
• Heavy exposure to mixers, darknet markets or addresses linked to ransomware.
• Refusal or inability to exchange Travel Rule information.
• Frequent changes of corporate name, domain or registered jurisdiction.

Regulatory Expectations

FATF Recommendation 15 and its Interpretive Note require countries to license or register VASPs, supervise them for AML and counter-terrorist financing, and apply the full range of preventive measures to them, including customer due diligence, record keeping, suspicious transaction reporting and targeted financial sanctions. The Interpretive Note also applies the requirements of Recommendation 16 to virtual asset transfers, commonly called the Travel Rule.

In the European Union, the Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114) introduced authorization for CASPs, and Regulation (EU) 2023/1113 requires originator and beneficiary information to accompany crypto-asset transfers. In the United Kingdom, cryptoasset exchange providers and custodian wallet providers must be registered with the Financial Conduct Authority under the Money Laundering Regulations 2017. In the United States, FinCEN guidance treats many convertible virtual currency businesses as money transmitters, and OFAC sanctions obligations apply to virtual currency activity.

Common Challenges

• Uneven global implementation: some jurisdictions still have no effective VASP regime, which complicates counterparty assessment.
• Unhosted wallets: transfers to and from self-custody wallets lack a regulated counterparty, so risk assessment relies on the wallet itself and the customer's explanation.
• Identifying the counterparty: working out which VASP controls a destination address is not always straightforward.
• Decentralized services: whether a protocol or its developers count as a VASP depends on the degree of control or influence exercised, which requires case-by-case analysis.

How on8.ai Helps

SmartSanction screens the companies, owners and crypto wallet addresses involved in VASP relationships against sanctions, PEP and risk sources, and its ownership and relationship graph supports KYB on corporate counterparties. See crypto wallet screening and Travel Rule for how screening fits these workflows.

Related Terms

• Travel Rule
• Blockchain Analytics
• Money Services Business (MSB)
• Correspondent Banking
• KYB (Know Your Business)
• FATF (Financial Action Task Force)