VASP and CASP both mean a business that deals in crypto for other people. The two terms come from different rulebooks. A VASP is defined by the Financial Action Task Force (FATF), the international body that sets anti-money-laundering standards. A CASP is defined by the EU’s Markets in Crypto-Assets Regulation (MiCA).
Neither word is a licence. Each describes a kind of business, and each tells a country what to require of it. This guide covers the position on 2 November 2026. For how MiCA works as a whole, see MiCA regulation explained.
What is a VASP?
VASP stands for virtual asset service provider. The FATF glossary defines it as:
“any natural or legal person who is not covered elsewhere under the Recommendations, and as a business conducts one or more of the following activities or operations for or on behalf of another natural or legal person”
Three parts of that definition decide who counts. The firm can be a person or a company. It must act as a business, not as a one-off. And it must act for or on behalf of someone else. The phrase “not covered elsewhere under the Recommendations” leaves out firms that another Recommendation already covers.
Which activities make a firm a VASP?
The glossary lists five:
- exchange between virtual assets and fiat currencies;
- exchange between one or more forms of virtual assets;
- transfer of virtual assets;
- safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets; and
- participation in and provision of financial services related to an issuer’s offer and/or sale of a virtual asset.
A footnote says that in this context, transfer means conducting a transaction on behalf of another person that moves a virtual asset from one address or account to another.
The glossary defines a virtual asset as a digital representation of value that can be digitally traded or transferred and used for payment or investment. It excludes digital representations of fiat currencies, securities and other financial assets that the Recommendations already cover.
Does the FATF license VASPs?
No. The FATF writes standards, and countries put them into law. Paragraph 3 of the interpretive note to Recommendation 15 says VASPs “should be required to be licensed or registered”. At a minimum that applies in the jurisdictions where they are created. Jurisdictions may also require it of VASPs that offer services to customers in, or operate from, their territory. Countries should also act against people who carry out VASP activities without the licence or registration.
For the information-sharing duty these firms carry, see the crypto Travel Rule. For the identity checks, see crypto exchange KYC.
What is a CASP?
CASP stands for crypto-asset service provider. MiCA defines it in Article 3(1)(15) as:
“a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis, and that is allowed to provide crypto-asset services in accordance with Article 59”
The last clause matters. In the EU, a firm is a CASP only once it is allowed to be one. A firm that offers the services without permission is not a CASP, it is an unauthorised provider.
Article 3(1)(16) lists ten crypto-asset services: custody and administration; operating a trading platform; exchanging crypto-assets for funds; exchanging them for other crypto-assets; executing orders for clients; placing; receiving and transmitting orders; advice; portfolio management; and transfer services for clients.
Article 59 allows two routes. A legal person or undertaking can be authorised as a CASP under Article 63. Or a credit institution, central securities depository, investment firm, market operator, electronic money institution, UCITS management company or alternative investment fund manager can provide the services after a notification under Article 60. The notification route for a credit institution is made to its home regulator at least 40 working days before first providing the services.
How do VASP and CASP differ?
They answer different questions. The FATF term says who must be watched for money laundering and terrorist financing. The MiCA term says who may serve clients in the EU and under which conduct rules. MiCA’s definition is also narrower in one way: it names the permission in the definition itself.
A firm can be both. A global exchange that serves EU clients through an authorised EU company is a CASP in the EU, and its other companies can be VASPs in the countries where they are registered or licensed.
What is the difference between registration and authorisation?
Each is permission to operate, but the words are not standardised across countries.
- Authorisation is the MiCA word. Under Article 59(6), the competent authority names the specific services a CASP may provide in its authorisation.
- Licence is the word used by the Monetary Authority of Singapore (MAS), Dubai’s Virtual Assets Regulatory Authority (VARA) and Hong Kong’s Securities and Futures Commission (SFC).
- Registration is used in Japan, Australia and, for now, the United Kingdom. Japan’s Payment Services Act says no person may provide a crypto-asset exchange service unless registered by the prime minister. AUSTRAC says it can refuse, suspend, cancel or impose conditions on a registration, and registration must be renewed every three years.
The FATF itself says “licensed or registered”, so both count as meeting its standard. In the UK the position is changing. Today, cryptoasset businesses register with the FCA under the Money Laundering Regulations, which is an anti-money-laundering regime. The FCA says a separate regime under the Financial Services and Markets Act is expected to come into force on 25 October 2027, with firms able to apply for authorisation now.
Two warnings follow. First, check which word a firm uses and what it means locally, because “registered” in one country is not “authorised” in another. Second, no register entry is an endorsement. The SFC states that it “does not guarantee the performance or creditworthiness” of any licensed platform. ESMA states that the white papers in its register have not been reviewed or approved by any competent authority.
Who needs to be a VASP or a CASP?
Any firm that does the listed activities as a business, for other people, in a country that requires it. The test is the activity, not the brand or the website.
- EU. Article 59(1) says a person shall not provide crypto-asset services within the Union unless authorised under Article 63 or entitled under Article 60. Article 2(2) excludes, among others, firms that provide the services only for their own parent or subsidiaries, central banks and public international organisations.
- Reverse solicitation. Article 61 lets a third-country firm serve a client in the EU who approaches it at their own exclusive initiative. Where the firm solicits clients or prospective clients in the Union, by any means of communication, the service is not treated as the client’s own exclusive initiative.
- Japan. Article 63-2 of the Payment Services Act: no person may provide a crypto-asset exchange service unless registered.
- Australia. AUSTRAC says a business must be registered before it can provide virtual asset services, and that it is illegal to provide them without registration.
- Dubai. VARA says applicants holding in-principle approval are prohibited from starting operations, carrying out any virtual asset activity, or serving clients until they hold a full VASP licence.
- Hong Kong. The SFC says an applicant that is not deemed to be licensed should not start its business or actively market its services to Hong Kong investors.
How does the local term vary by country?
The activity is similar, and the name and rulebook change. The widget below covers eight jurisdictions.
The year on each tile is when the current regime took effect: MiCA applied from 30 December 2024, and the UK’s cryptoasset registration followed Regulations in force on 10 January 2020. The Payment Services Act 2019 came into operation on 28 January 2020, and VARA was established in March 2022 under Law No. 4 of 2022. The SFC’s licensing regime for trading platforms took effect on 1 June 2023. In Australia, registered digital currency exchange providers became registered virtual asset service providers on 31 March 2026, and Brazil’s resolutions took effect on 2 February 2026. We did not confirm a date for Japan’s crypto-asset chapter, so its tile shows an en dash. CAESP is our abbreviation of Japan’s crypto-asset exchange service provider.
Which activities does each regime name?
Regimes differ most in the activities they name. The card punches a hole for an activity named when the legal or regulator text read for this guide names it. A missing mark means the text does not name it, not that the activity is banned. Brokerage counts intermediary and arranging services: the UK’s arranging of exchanges, Japan’s intermediary, brokerage or agency services, Singapore’s facilitating of trades, Australia’s arrangements for exchanges, Dubai’s broker-dealer licence and MiCA’s reception and transmission of orders. Dubai’s exchange services count as both exchange and trading platform. For Brazil only custody and brokerage are confirmed, because the BCB names the classes intermediary, custodian and virtual asset broker and we read no further detail.
MiCA names all eight. The FATF standard and the UK’s registration name four, Japan three, and Hong Kong’s trading platform licence one, because the licence is for operating a trading platform.
European Union
The term is CASP, and ten services are listed. Authorisation from one Member State lets a CASP provide services throughout the Union under Article 59(7), through establishment or cross-border services. Article 65 requires a CASP that intends to serve more than one Member State to tell its home authority which ones. The full rules are in the MiCA guide linked above.
United Kingdom
The FCA says cryptoasset businesses must register before starting in-scope services. It names two: a cryptoasset exchange provider, covering exchanging cryptoassets for money, running cryptoasset ATMs and issuing new cryptoassets, and a custodian wallet provider, which safeguards cryptoassets or private keys for customers. A separate FSMA regime follows. Parliament made the Cryptoassets Regulations 2026 on 4 February 2026, and the FCA published final rules on 30 June 2026.
Singapore
MAS licenses payment service providers under the Payment Services Act 2019 in three classes: money-changing, standard payment institution and major payment institution. The crypto-specific service is the digital payment token service. MAS lists five activities under it: buying or selling DPTs, providing a platform to exchange DPTs, transmitting them, providing custodian wallet services, and actively facilitating buying or selling without holding the money or tokens.
Dubai
VARA is the competent entity for virtual assets across Dubai, including free zones and special development zones but excluding the Dubai International Financial Centre. Its register lists licensed VASPs and those holding in-principle approval, and each entry names the licensed activities, such as exchange services or broker-dealer services.
Hong Kong
The SFC uses the term virtual asset trading platform, and its lists say which operators are licensed.
Japan
The Payment Services Act defines crypto-asset exchange services as carrying out any of four acts in the course of trade: buying, selling or exchanging crypto-assets; intermediary, brokerage or agency services for those acts; management of users’ money in connection with them; and management of crypto-assets on behalf of another person. A crypto-asset exchange service provider is a person registered under Article 63-2.
Australia
AUSTRAC says a business is likely to be a VASP if, while carrying on a business, it exchanges virtual assets for money or for other virtual assets, or arranges such exchanges; provides a virtual asset safekeeping service; accepts instructions to transfer virtual assets for customers or makes transferred assets available to them; or provides financial services connected to an offer or sale of a virtual asset where it takes part in that offer or sale.
Brazil
The BCB regulated the authorisation and provision of virtual asset services and created the category of Virtual Asset Service Providers. Resolution BCB 520 governs the services and the incorporation and operation of these firms. Resolution BCB 519 sets the authorisation rules. Both took effect on 2 February 2026. The BCB says services may be provided by institutions it has already authorised and by VASPs created only for this purpose, classified as intermediary, custodian and virtual asset broker.
How do you check a firm in an official register?
Find the firm’s exact legal entity name, then search the register of the regulator in the country it claims. The brand name is often not the licensed company.
What a register can and cannot tell you
- Match the entity. MiCA protections attach to the authorised legal entity, as covered in MiCA regulation explained. The same logic applies elsewhere: a register entry names a company, not a brand.
- Read the status. ESMA says a withdrawn authorisation stays in its register with the date of withdrawal. VARA lists in-principle approvals beside licences. The SFC publishes applicants beside licensed operators and says applicants are not licensed.
- Read the scope. Article 59(6) requires an EU authorisation to specify the services the CASP may provide. VARA lists the licensed activities on each entry.
- Allow for delay. ESMA says information reported by authorities or appearing in national registers will not be shown at once.
- Check the warning lists. ESMA also publishes a non-exhaustive register of entities that provide crypto-asset services in breach of Article 59 or 61. MAS has an Investor Alert List.
- Do not treat a listing as approval of quality. See the SFC and ESMA statements above.
Common questions
Is a VASP the same as a crypto exchange?
No. An exchange is one kind of VASP. The FATF definition also covers firms that only transfer virtual assets, safeguard or administer them, or take part in an issuer’s offer or sale.
Is a CASP the same as a MiCA licence?
Nearly. A CASP is a firm that is allowed to provide the services under Article 59, which means holding an Article 63 authorisation or having made an Article 60 notification as an eligible financial firm.
Does a licence in one country cover another?
Only where the law says so. Inside the EU, a CASP authorised in one Member State may provide services throughout the Union under Article 59(7). Outside it, each regulator in this guide describes its own territory, and the FATF note allows a country to require registration from firms that serve its customers.
Can an individual be a VASP?
Under the FATF definition, yes, a natural person can be one. Under MiCA, a CASP is a legal person or other undertaking.
