What is a VASP (Virtual Asset Service Provider)?
A VASP is any business that carries out one or more of five virtual-asset activities for or on behalf of customers, as defined in the FATF Recommendations: exchange between virtual assets and fiat currencies; exchange between different virtual assets; transfer of virtual assets; safekeeping or administration of virtual assets or of instruments enabling control over them; and participation in financial services related to an issuer’s offer or sale of a virtual asset. The concept comes from anti-money-laundering standard-setting, not securities law: it tells you who must apply AML controls, not how a token is classified.
Who falls within the definition
Crypto exchanges, brokers, custodial wallet providers, OTC desks and certain payment models sit at the core of the definition. Publishers of pure self-custody software, who never obtain control over customer assets, generally remain outside it — control is the decisive criterion, and it is assessed on facts, not on how the service describes itself.
VASP versus CASP under MiCA
The EU carried the concept into legislation through the CASP category of MiCA. CASP is a licensing regime with conduct, prudential and custody obligations; VASP is an AML label. One exchange can be both at once: CASP for its EU authorisation, VASP for its FATF-derived duties. Many jurisdictions outside the EU continue to use VASP in their national statutes.
The legal dimension
FATF standards require VASPs to be licensed or registered, to run know-your-customer procedures and to file suspicious transaction reports. The Travel Rule obliges them to transmit originator and beneficiary information alongside transfers, including transfers between exchanges. Registration in one country does not authorise service in another: each target market’s regime needs its own analysis before onboarding users there.
Turkish context
Turkish law uses the term “kripto varlık hizmet sağlayıcı” (crypto-asset service provider). Law No. 7518, amending the Capital Markets Law, subjected trading platforms and custody providers to SPK authorisation, and these businesses have been MASAK obliged parties since 2021 — identity verification, suspicious transaction reporting and record-keeping. We examined the licensing conditions in detail in our article on Turkey’s crypto licence requirements.
Do: map your business model against the five FATF activity categories and run a separate registration analysis for every target market. Don’t: rely on a “we only provide software” defence while you hold de facto control over customer assets.
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro call