What is a virtual asset service provider (VASP)?

"VASP" is the load-bearing term of global crypto regulation. When the Financial Action Task Force extended its anti-money-laundering standards to crypto in 2019, it needed a definition of who those standards bind — and VASP is that definition. National regimes translate it into their own registration categories, but the FATF term is the common denominator regulators, banks and compliance teams use.

Whether a business is a VASP is therefore not a label choice but a legal trigger: falling inside the definition brings registration, AML program, screening and Travel Rule obligations.

FATF defines a VASP as any natural or legal person conducting one or more of five activities as a business, for or on behalf of another person:

The FATF standards, as implemented nationally, put VASPs under the same core regime as other financial institutions: registration or licensing with the national authority (money-services-business registration with FinCEN in the US, CASP authorization under MiCA in the EU, FCA registration in the UK, and equivalents elsewhere), a risk-based AML program with customer due diligence and suspicious-activity reporting, sanctions compliance, and the Travel Rule — transmitting originator and beneficiary information alongside transfers above the threshold.

Sanctions screening runs through several of those obligations at once: onboarding checks on customers, counterparty checks on transfers, and jurisdiction controls on where the service is offered.

The boundaries are where the definition is contested. Purely self-hosted wallet software — where the user alone controls keys — generally falls outside the definition, because no one is acting on behalf of another. For DeFi, FATF guidance looks through the "decentralized" label to control and profit: where identifiable parties maintain control or sufficient influence over a protocol or its front-end as a business, those parties may qualify as VASPs even if the contracts are automated.

In practice many DeFi front-end operators adopt VASP-style controls — screening connecting wallets, geofencing restricted jurisdictions — both to manage sanctions exposure and to stay ahead of the regulatory direction of travel.