What Is VASP?

FATF's Definition and Its Scope

The Financial Action Task Force defines a Virtual Asset Service Provider as any natural or legal person who is not covered elsewhere under the FATF Recommendations and as a business conducts one or more of the following activities or operations for or on behalf of another natural or legal person: exchange between virtual assets and fiat currencies; exchange between one or more forms of virtual assets; transfer of virtual assets; safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets; and participation in and provision of financial services related to an issuer's offer and/or sale of a virtual asset.

The 'for or on behalf of another person' qualifier is critical: FATF's VASP definition targets service providers that conduct these activities on behalf of customers, not individuals managing their own personal crypto holdings. A person who buys Bitcoin for their own portfolio is not a VASP. A company that buys Bitcoin on behalf of customers, exchanges it, or holds it in custody for customers is a VASP. This distinction matters for crypto payment gateways: because they accept crypto from customers and transmit it (or its fiat equivalent) to merchants, they clearly fall within the VASP definition.

Which Businesses Are VASPs — and Which Are Not

VASP Obligations Under FATF Recommendations

Countries that have implemented FATF's VASP standards — the majority of FATF member states — impose AML/CFT obligations on VASPs equivalent to those applied to traditional financial institutions. Core VASP obligations include: registering with or obtaining a license from a national competent authority; implementing a risk-based AML/CFT program; conducting customer due diligence; maintaining transaction records for at least five years; filing suspicious transaction reports with the national financial intelligence unit; and complying with the Travel Rule for VA transfers between VASPs above the applicable threshold.

The Travel Rule's application to VASPs created the most significant new compliance burden: VASPs must now identify counterparty VASPs in every qualifying transfer and exchange originator and beneficiary information before or alongside the transfer. This requires VASPs to build or access Travel Rule messaging infrastructure — TRISA, TRP, or commercial alternatives — that simply did not exist in the traditional financial system and required purpose-built development.

VASP Registration Across Key Jurisdictions

The global VASP regulatory landscape is fragmented: each jurisdiction has implemented FATF's VASP standards differently in terms of registration requirements, licensing thresholds, and ongoing obligations. The practical implication for a crypto payment gateway serving international merchants is that compliance requirements may differ significantly between the gateway's home jurisdiction and each country where merchants operate.

Compliance Note: This glossary entry is provided for general educational purposes only and does not constitute financial, investment, legal, or tax advice. Industry terminology may vary across jurisdictions and providers; definitions herein may not directly reflect the specific features, terms, or specifications of Finassets' services. For details on Finassets' offerings, please refer to official product documentation or contact our team directly.