VASP vs MSB: what is the difference, and can one firm be both?

A VASP is a virtual asset service provider — the FATF category for a business that exchanges, transfers, safekeeps or issues virtual assets on behalf of others. An MSB is a money services business, a United States classification under the Bank Secrecy Act that covers money transmitters, currency dealers, cheque cashers, money-order issuers and prepaid access providers. They are not competing labels for the same thing, and they are not alternatives you choose between: they come from two different regulatory systems, and a single firm frequently sits inside both at the same time.

What exactly is a VASP?

The definition originates in FATF Recommendation 15 and its interpretive note. A VASP is any natural or legal person that, as a business, conducts one or more of these activities for or on behalf of another: exchange between virtual assets and fiat currencies; exchange between one or more forms of virtual assets; transfer of virtual assets; safekeeping or administration of virtual assets or instruments enabling control over them; and participation in and provision of financial services related to an issuer’s offer or sale of a virtual asset.

FATF is a standard-setter, not a regulator, so no firm is a VASP under FATF as such. The category becomes law when a jurisdiction adopts it — which is why registration and licensing regimes for VASPs differ so much country to country, and why the same firm can be a registered VASP in one jurisdiction, a licensed crypto-asset service provider in another and an MSB in a third, with one product line.

What exactly is an MSB?

An MSB is defined by the Bank Secrecy Act and FinCEN regulation, and the classification is activity-based. The categories are money transmitters, dealers in foreign exchange, cheque cashers, issuers or sellers of traveller’s cheques or money orders, prepaid access providers and sellers, and the US Postal Service. Money transmission is the widest, and it is the one that captures crypto activity: FinCEN has treated the exchange and transmission of convertible virtual currency as money transmission for years, which is why US crypto exchanges register as MSBs.

Being an MSB means registering with FinCEN within 180 days of first meeting the definition, maintaining a written AML programme with the required pillars, filing suspicious activity and currency transaction reports, and keeping records. It does not by itself authorise money transmission — that comes from state money transmitter licensing, which is a separate and far heavier exercise.

Where do the two perimeters actually differ?

The most useful way to see the difference is by what triggers each. MSB status is triggered by handling value transfer as a business, regardless of the form that value takes — dollars, a stablecoin or a prepaid balance. VASP status is triggered specifically by dealing in virtual assets, including activities an MSB regime might not naturally capture, such as pure custody of private keys or participation in a token issuance. Custody is the clearest divergence: safekeeping virtual assets for clients makes a firm a VASP under FATF, while a pure custodian that never transmits may fall outside money transmission in some US analyses.

The second real difference is vocabulary by jurisdiction. In the European Union the operative category is the crypto-asset service provider under MiCA, with an authorisation regime and passporting across member states. Several jurisdictions run explicit VASP registers. The United States does not use the term VASP in statute at all. When a counterparty asks whether you are a VASP, they are usually asking whether you are inside the FATF virtual-asset perimeter for Travel Rule purposes, not whether you hold a document with that word on it.

How does the Travel Rule apply to each?

It applies to both, from the same source. FATF Recommendation 16 — the Travel Rule — requires that originator and beneficiary information travel with a transfer, and its extension to virtual assets is what put VASPs inside scope. For virtual asset transfers FATF sets a threshold of US$/EUR 1,000, above which full originator and beneficiary details must be transmitted, though national implementations vary and some jurisdictions apply lower or no thresholds. For conventional funds transfers, the equivalent US rule has long applied at US$3,000.

For a stablecoin operator, this is the point where the two labels collapse into one obligation. Whether your regulator calls you a VASP or an MSB, you must be able to identify the originator and beneficiary, transmit that data to the receiving institution, screen both sides against sanctions lists, hold the transfer when a counterparty cannot receive the data, and retain the record. The blockchain provides none of that by itself. It provides an immutable record of addresses and amounts, which is a different thing from identity data attached to a payment.

The chain proves that value moved. It does not prove who sent it, who received it, or that either was screened. That gap is the entire compliance workload.

Can one firm be both a VASP and an MSB?

Yes, and most stablecoin payment businesses are. Consider a firm that lets a customer fund an account by bank transfer, converts the fiat to a stablecoin, sends it cross-border and converts it back at the far end. The fiat funding and payout are money transmission and foreign exchange dealing. The conversion is virtual-asset exchange. The transfer is a virtual-asset transfer. If the firm holds balances for customers, that is safekeeping. Under FATF terminology it is a VASP; under US law it is an MSB required to register with FinCEN and obtain state licences; under MiCA it would be a CASP; in Canada it registers with FINTRAC as a money services business dealing in virtual currency.

One entity, one product, four vocabularies. This is why the productive question at a compliance or vendor meeting is never “are you a VASP or an MSB”. It is: which activities do you perform, in which jurisdictions, for which customers — and can you evidence the same controls to whichever supervisor asks.

What does a single programme need to cover?

• An activity map: every service you provide, in every jurisdiction, with the regime that claims it and the registration or licence that follows. Keep it dated, because the perimeter moves.
• Customer due diligence proportionate to risk — KYC for individuals, KYB for entities including beneficial ownership, and enhanced measures for higher-risk relationships.
• Sanctions and PEP screening on both sides of a transfer, extended to wallet-address screening for virtual-asset activity rather than name screening alone.
• Transaction monitoring calibrated to on-chain behaviour as well as fiat typologies — mixers, high-risk exposure, structuring across addresses, unhosted-wallet patterns.
• Travel Rule capability: sending, receiving, validating and retaining originator and beneficiary data, plus a documented policy for counterparties that cannot receive it.
• Records that reconcile the on-chain record to your ledger and to the customer statement, retrievable within an examiner’s timetable and typically retained for five years.

None of that is duplicated work across the two labels. It is one control set described in two dialects. Firms that build it once, and map it to each regime, spend far less than firms that run parallel programmes because two regulators use different nouns.

Where do the edges still sit?

Three areas remain genuinely unsettled, and it is worth knowing which of your uncertainty is your own and which is the market’s. The first is decentralised finance. FATF guidance indicates that where a person or entity retains control or sufficient influence over a protocol, that person may be a VASP even if the software is described as autonomous — but jurisdictions have applied that reasoning inconsistently, and the treatment of governance-token holders and front-end operators varies widely.

The second is unhosted wallets. Transfers to and from self-custodied addresses fall outside the counterparty-to-counterparty structure the Travel Rule assumes, since there is no receiving institution to send data to. Jurisdictions have responded differently: some require additional risk mitigation and originator verification above a threshold, some require blockchain analytics to establish that the wallet is controlled by the customer, and some apply no incremental obligation at all. A firm operating across borders needs a documented policy per jurisdiction rather than one global rule.

The third is the treatment of payment stablecoins specifically. Federal US stablecoin legislation created a framework for issuance, reserves and redemption that is distinct from the virtual-asset regimes built around trading, and the question of how far payment-stablecoin activity should be regulated as payments rather than as crypto is still resolving. For most operators the safe reading is unchanged: assume both perimeters apply, evidence to the stricter one, and record the reasoning behind every classification judgement so that a later change in status is a filing exercise rather than a rebuild.

Where StableNet fits

StableNet is built on the assumption that a payment firm will be answering to both vocabularies at once. Compliance is carried by the payment rather than reconstructed around it: KYC, KYB, KYT, sanctions screening and Travel Rule originator and beneficiary data are attached to each transfer, and settlement in regulated stablecoins is reconciled against SWIFT MT and ISO 20022 messaging. Whether the supervisor asking calls you a VASP, an MSB or a CASP, the evidence they want is the same evidence — and it is produced as a by-product of the payment instead of a project after it.