What is a VASP? Virtual Asset Service Providers and their obligations

A VASP, or Virtual Asset Service Provider, is any natural or legal person that, as a business, conducts one or more virtual-asset activities on behalf of another party. In practice, the question “what is a VASP” is answered by looking at function rather than form: if a firm exchanges, transfers, safeguards or issues virtual assets such as stablecoins for customers, it is almost certainly a Virtual Asset Service Provider and falls within the scope of anti-money-laundering and counter-terrorist-financing regulation.

What does VASP stand for?

VASP stands for Virtual Asset Service Provider. The full form is used interchangeably with the acronym in regulation and industry practice, and both refer to the same thing: a business that provides virtual-asset services to other parties. A related term, virtual asset, means a digital representation of value that can be traded or transferred and used for payment or investment — which includes stablecoins such as USDC and USDT, and excludes digital representations of fiat currency issued by a central bank, which are treated separately as central bank digital currencies.

What activities make a business a VASP

A Virtual Asset Service Provider is identified by the services it offers rather than the technology it uses. A business generally becomes a VASP when it performs any of the following as a commercial activity for or on behalf of others.

• Exchange between virtual assets and fiat currencies, such as converting a stablecoin to dollars or euros.
• Exchange between one or more forms of virtual assets.
• Transfer of virtual assets from one address or account to another.
• Safekeeping or custody of virtual assets, or of the instruments that enable control over them.
• Participation in and provision of financial services relating to the issuance or sale of a virtual asset, including stablecoin issuance.

How FATF defines a Virtual Asset Service Provider

The term originates with the Financial Action Task Force, the FATF, the global standard-setter for anti-money-laundering and counter-terrorist-financing measures. FATF defines a VASP functionally so that the obligation attaches to the activity, not to a particular corporate structure or product name. This matters because a firm cannot avoid the designation simply by describing itself as a technology provider; if it conducts a covered virtual-asset activity for customers, the VASP obligations apply.

A VASP is defined by what it does, not by what it calls itself — once a firm exchanges, transfers, custodies or issues virtual assets for others, the full weight of financial-crime obligations follows.

What obligations VASPs carry

Because a Virtual Asset Service Provider sits in the same risk position as a traditional financial institution, it is expected to operate a comparable compliance programme. The principal obligations include the following.

• Registration or licensing with the relevant national authority before offering services.
• Customer due diligence through KYC for individuals and KYB for business clients, including verification of beneficial ownership.
• Ongoing transaction monitoring, often described as KYT, to detect unusual or suspicious on-chain and off-chain activity.
• Sanctions screening of customers and counterparties against applicable watchlists.
• Compliance with the Travel Rule, which requires originator and beneficiary information to accompany qualifying transfers between obliged entities.
• Recordkeeping and reporting, including the filing of suspicious activity or transaction reports to financial intelligence units.

How VASPs relate to MSBs and banks

The VASP category overlaps with established financial designations. Many money services businesses, or MSBs, that handle stablecoins are also VASPs, and a single firm may hold both registrations depending on its jurisdiction and product mix. Banks that custody, issue or settle in virtual assets can likewise take on VASP-equivalent duties for those lines of business. The practical consequence is that virtual-asset firms and regulated financial institutions are increasingly held to a single, consistent standard of due diligence, monitoring and reporting.

VASP vs MSB: what is the difference?

The two designations answer different questions, which is why a firm can hold both. MSB — money service business — is a category defined in national law, most familiarly by FinCEN in the United States and under the PCMLTFA in Canada, and it turns on activities such as money transmission, currency exchange and dealing in instruments. VASP is a FATF-derived category that turns on virtual-asset activity specifically. A remittance operator that moves only fiat is an MSB but not a VASP; a custodial stablecoin exchange may be a VASP and, depending on jurisdiction, also registered as an MSB.

• Origin: MSB comes from national money-transmission law; VASP comes from the FATF standards and the national rules that implement them.
• Trigger: MSB status follows fiat money transmission and related services; VASP status follows exchange, transfer, custody or issuance of virtual assets.
• Overlap: a firm doing both — for example converting fiat to stablecoin and remitting it — will commonly fall into both categories at once.
• Obligations: in practice the AML programme requirements converge, which is why supervisors increasingly expect one consistent standard across both.

Which businesses are generally not VASPs?

The boundary matters, and it is jurisdiction-specific, so any firm near the line should take local advice rather than rely on a general rule. Broadly, the designation attaches where a business acts for or on behalf of a customer. Purely self-directed activity, and the provision of software that never takes control of a customer’s assets, have generally been treated as outside the definition — though several jurisdictions have narrowed that reading, and the direction of travel is toward wider rather than narrower scope.

• An individual buying or holding stablecoins for their own account, rather than as a business for others.
• A pure software or infrastructure vendor that never has custody or control of customer assets — a position increasingly tested by regulators.
• A business that merely accepts stablecoins as payment for its own goods and services, rather than providing virtual-asset services to others.
• Central bank digital currencies, which sit outside the virtual-asset definition and under their own regimes.

How to operationalise VASP compliance

Meeting these obligations is less about any single control and more about connecting them into one auditable flow. Identity verification, sanctions screening, transaction monitoring and Travel Rule data exchange should travel with each settlement rather than sitting in disconnected systems. Firms that treat compliance as an attribute of the payment itself — captured, checked and recorded as value moves — find it far easier to demonstrate to supervisors that every transfer was screened and documented.

StableNet is built for precisely this model, attaching Travel Rule, KYC, KYB, KYT and sanctions-screening data to stablecoin settlement so that banks, MSBs and fintechs can meet their Virtual Asset Service Provider obligations without bolting compliance on after the fact.