How to register as a VASP: the licensing process, step by step

Registering as a VASP means applying to the specific national or regional regulator that has implemented FATF's Recommendation 15 in your target jurisdiction, after building the AML/CFT compliance programme that registration depends on — the programme has to exist before the application, not after it is filed. There is no single global VASP registration; each jurisdiction that has adopted the FATF standard runs its own regime, with its own regulator, application, and specific documentary requirements, though the substantive expectations — a working compliance programme, Travel Rule capability, and fit-and-proper principals — are broadly consistent across most of them. This guide walks the process in the order most applicants actually meet it.

Which regulator do you actually register with?

This is the first and most consequential decision, because it determines every subsequent step. In the United States, virtual asset exchange and transfer activity is generally regulated as money transmission at the state level, with FinCEN MSB registration at the federal level — there is no separate "VASP" category in US statute, even though the activity falls inside the FATF VASP definition. In the EU, the equivalent regime is licensing as a Crypto-Asset Service Provider (CASP) under MiCA. In the UK, firms register with the Financial Conduct Authority under the Money Laundering Regulations. Singapore, the UAE, and a growing number of jurisdictions run their own named VASP licensing regimes directly. The practical first step is identifying which of these regimes actually applies to where your customers and operations sit — a firm serving customers in multiple jurisdictions needs to run this analysis for each one separately.

What has to exist before you file the application?

• A documented, risk-based AML/CFT programme covering your actual products, customer types and jurisdictions — regulators consistently flag generic, templated programmes as a primary cause of application delay or rejection.
• Written KYC and KYB procedures, including identity verification, beneficial ownership identification for corporate customers, and enhanced due diligence triggers for higher-risk customers.
• Sanctions and PEP screening covering both traditional customer data and, critically, wallet-address screening — most modern VASP regimes expect on-chain exposure to be screened, not just the named account holder.
• A named compliance officer with genuine authority and a documented reporting line, plus evidence that staff training has actually been delivered, not merely drafted as a policy.
• A working Travel Rule mechanism — most jurisdictions now expect an applicant to demonstrate how originator and beneficiary information will be collected and exchanged with counterparty VASPs above the applicable threshold, not merely assert an intention to build one later.

What does the fit-and-proper review actually check?

Nearly every VASP regime requires background checks on directors, beneficial owners above a defined ownership threshold, and the named compliance officer — checking for relevant criminal history, prior regulatory sanctions, and financial probity. This step is frequently the slowest part of the whole process, not because any one check is complex, but because it depends on documentation and disclosures from multiple individuals simultaneously, each potentially in a different country with different document formats and processing times. Applicants who leave fit-and-proper documentation until late in the process routinely find it becomes the critical-path bottleneck that delays the entire registration.

The application itself is rarely what takes months. What takes months is proving the compliance programme, the Travel Rule mechanism and every named individual's background all hold up to the regulator's standard — the application is just the point where that evidence gets read.

What happens after the application is submitted?

Most regulators run an active review rather than a passive filing process: expect deficiency letters requesting clarification or additional evidence, particularly around the AML programme's specificity and the Travel Rule mechanism's actual functionality rather than its description. Timelines vary widely by jurisdiction and by the completeness of the initial filing, ranging from a few months in some jurisdictions with lighter-touch regimes to considerably longer where the regulator runs a more intensive supervisory review. Registration is also rarely a one-time event — most regimes impose ongoing reporting obligations, periodic reassessment, and in several jurisdictions a defined renewal cycle, so registration is the start of a supervisory relationship rather than the end of a process.

Does registering in one country cover operations in another?

No. VASP registration is jurisdiction-specific, and a licence or registration obtained in one country carries no automatic recognition elsewhere, even between jurisdictions with broadly similar FATF-aligned frameworks. A firm operating across the US, EU and UK, for example, needs to run three largely independent registration processes — FinCEN and state money transmitter licensing, MiCA CASP authorisation, and FCA registration — each with its own application, its own fit-and-proper review, and its own ongoing supervisory obligations. Treating multi-jurisdiction VASP registration as a single project rather than several parallel ones is one of the most common planning mistakes firms make when scaling internationally.

Where StableNet fits

StableNet is built for exactly the operational core a VASP registration exists to test: KYC, KYB, KYT, sanctions and PEP screening, and Travel Rule originator/beneficiary data exchange attached to every transaction, with the audit trail regulators expect a compliance programme to actually produce, not merely describe. For a firm preparing a VASP application, that is the working infrastructure the fit-and-proper and programme-adequacy review is looking to confirm exists.