VASP license requirements by country: comparing the US, EU, UK, Singapore and UAE

VASP licensing requirements differ by country because each jurisdiction implements FATF's Recommendation 15 through its own domestic legal framework, and those frameworks vary in what they call the licence, which regulator issues it, what activities trigger it, and how much capital or reserve backing they require. There is no harmonised global VASP licence. For a firm operating — or planning to operate — across borders, understanding how the major regimes actually differ, rather than assuming a licence obtained in one country transfers to another, is the difference between a manageable expansion plan and a compliance failure discovered after the fact.

United States: money transmission, not a distinct VASP category

The US has no separate "VASP" licence. Virtual asset exchange and transfer activity is regulated as money transmission at the state level — requiring a money transmitter licence in nearly every state served — combined with federal MSB registration with FinCEN under the Bank Secrecy Act. This means a US-facing digital asset business runs a state-by-state licensing programme, commonly taking nine to eighteen months for broad coverage, rather than a single national VASP application. The activity still falls inside the FATF VASP definition and carries the same Travel Rule and AML obligations — the US simply regulates it through its existing money-transmission framework rather than a purpose-built crypto licence.

European Union: CASP authorisation under MiCA

The EU created a dedicated licence category — Crypto-Asset Service Provider (CASP) — under MiCA, which took full effect at the end of 2024. A CASP authorisation, once granted by a competent authority in one member state, is designed to passport across the EU single market, which is a materially different structure from the US patchwork: one authorisation covering multiple countries, rather than a separate filing per state. MiCA also sets specific prudential and governance requirements — capital thresholds that scale with the services offered, custody segregation rules, and conduct-of-business standards — that go beyond a pure AML/CFT programme.

United Kingdom: FCA registration under the Money Laundering Regulations

UK-based crypto-asset businesses register with the Financial Conduct Authority under the Money Laundering Regulations, a regime the FCA has applied with a notably high rejection and withdrawal rate compared with many other jurisdictions' initial approval cycles — applicants have consistently reported the FCA's AML programme scrutiny as more demanding in practice than the headline requirements suggest on paper. Registration is distinct from the UK's broader, evolving financial promotions and market-conduct regime for crypto-assets, which applies on top of the AML registration rather than replacing it — a firm can be AML-registered and still need to separately satisfy marketing and consumer-protection rules before serving UK retail customers.

Singapore and the UAE: dedicated digital-asset licensing regimes

Singapore regulates digital payment token services under the Payment Services Act, administered by the Monetary Authority of Singapore, with licence tiers that scale by transaction volume and the specific services offered. The UAE runs multiple parallel regimes depending on which emirate and free zone a firm operates in — including Dubai's VARA (Virtual Assets Regulatory Authority) and separate frameworks in the Abu Dhabi Global Market — meaning "UAE licensing" is itself not a single process but a choice between several distinct regulators with different scopes, a nuance that catches out firms assuming UAE means one application.

Five jurisdictions, five different answers to the same FATF standard — the same underlying activity can be money transmission in one country, a passportable EU-wide authorisation in another, and a choice between multiple regulators within a single country in a third.

How should a firm plan a multi-jurisdiction VASP footprint?

• Map target jurisdictions to their actual regulatory category first — money transmission, CASP, FCA registration, or a named digital-asset licence — since the category determines the entire process, timeline and cost structure that follows.
• Do not assume passporting or equivalence exists between regimes outside a defined bloc; an EU CASP authorisation passports within the EU, but confers no standing in the US, UK, Singapore or UAE.
• Budget capital and reserve requirements separately per regime — some scale with volume, some are fixed minimums, and treating them as roughly equivalent across jurisdictions routinely underestimates the true multi-country cost.
• Sequence jurisdictions by commercial priority and realistic timeline rather than attempting all of them simultaneously — fit-and-proper and AML programme review in each jurisdiction consumes real compliance-team bandwidth that does not scale infinitely in parallel.
• Build the underlying AML/CFT and Travel Rule infrastructure once, to the highest common standard across target jurisdictions, so the same operational programme can be presented to each regulator rather than rebuilt per country.

Where StableNet fits

StableNet's compliance layer — KYC, KYB, KYT, sanctions and PEP screening, and Travel Rule data exchange attached to every transaction — is built once and travels with a payment regardless of which jurisdiction's VASP or money-transmission regime it needs to satisfy. For an institution expanding across the regimes compared here, that means the operational evidence each regulator wants to see does not need to be reassembled from scratch in every new country.