Defining What Is a VASP License Based on Country and Who Needs One

VASP stands for Virtual Asset Service Provider, and the license attached to that designation is not a routine administrative formality. It is the operational authorisation that determines whether a crypto business can legally serve clients in a given jurisdiction.

Compliance teams and founders who do not understand what the VASP definition actually covers risk misclassifying their own business model from the outset.

What Does VASP Mean Under International Standards?

The VASP definition originates from FATF, the Financial Action Task Force, the inter-governmental body that sets global standards for anti-money laundering (AML) and counter-terrorism financing (CTF).

According to FATF, a VASP is any individual or business entity that conducts one or more of the following activities on behalf of another person:

• Exchange between virtual assets and fiat currencies
• Exchange between one or more forms of virtual assets
• Transfer of virtual assets
• Safekeeping and/or administration of virtual assets (custody)
• Participation in and provision of financial services related to the offer and/or sale of virtual assets

The operative phrase across the entire definition is on behalf of another person. Once a company handles digital assets belonging to a third party, not its own, VASP classification almost certainly applies.

How Do Jurisdictions Translate the FATF Standard?

FATF sets standards, not law. Each country translates those standards into domestic regulation, and the results vary considerably.

Estonia was among the first European countries to establish a formal VASP licensing regime. The Estonian Financial Intelligence Unit (FIU) manages the registration process, which includes strict AML requirements, director background checks, and minimum capital thresholds.

Lithuania takes a comparable approach and remains one of the more active EU entry points for crypto companies seeking VASP registration ahead of the full MiCA transition.

Poland operates a VASP registration system through its Ministry of Finance, with requirements that are lighter than Estonia's in some respects, but still demand verifiable AML compliance and a documented compliance program.

The Cayman Islands and BVI offer regulatory frameworks designed for digital asset companies operating across borders, with licensing structures that differ from the authorisation-based models prevalent in Europe.

Each jurisdiction has its own activity thresholds, capital requirements, and compliance standards. There is no single VASP structure that fits every business model.

What Is the Difference Between a VASP and a CASP?

This question comes up regularly, and it deserves a precise answer.

CASP, or Crypto Asset Service Provider, is the term introduced by the EU's MiCA (Markets in Crypto-Assets) regulation, which came into full effect in late 2024. MiCA effectively replaces the VASP frameworks that member states previously operated under, replacing them with a unified authorisation system that applies across the entire bloc.

The practical implication: companies that previously held VASP licenses in Lithuania or Estonia need to understand how their existing status maps onto, or transitions into, the MiCA CASP framework. That transition carries deadlines that cannot be ignored.

Outside the European Union, VASP remains the active regulatory term. In jurisdictions including the UAE, Singapore, Hong Kong, and most offshore markets, a "VASP license" is still the operative concept and the standard language regulators use.

Who Is Required to Hold a VASP License?

The answer depends on three factors: the business model, the jurisdiction of operation, and where clients are located.

As a general framework, VASP licensing is required by:

Crypto exchanges, both centralised and semi-decentralised, that process user transactions and hold assets on their behalf.

Custodial wallet providers, companies that hold private keys on behalf of users, as distinct from those that simply provide an interface.

Crypto payment platforms, particularly those that execute crypto-to-fiat conversions or move assets between wallets at user instruction.

OTC desks, operations that facilitate direct transactions between buyers and sellers at meaningful volume.

Digital asset remittance platforms, services that use crypto as the rail for cross-border value transfer.

What does not automatically require a VASP license: open-source protocol developers who do not manage user assets, crypto education platforms, and market analysts who do not execute transactions on behalf of clients.

What Happens If a Company Operates Without a VASP License?

Consequences vary by jurisdiction, but the trajectory is clear: regulators worldwide are becoming more active in enforcing VASP requirements against companies operating without authorisation.

In recent years, authorities in the EU, the United States, the UAE, and Southeast Asia have issued cease-and-desist orders, levied significant fines, and in more serious cases pursued criminal action against unlicensed operators. The fact that a company operates from outside the jurisdiction where its clients are based does not reliably shield it from regulatory liability.

What Does the VASP Application Process Involve?

The process varies, but most jurisdictions require:

• Formation of a legal entity in the target jurisdiction
• A documented, verifiable AML/KYC program
• Appointment of an AML Compliance Officer or MLRO (Money Laundering Reporting Officer)
• Minimum paid-up capital
• A fit-and-proper assessment for directors and significant shareholders
• Submission of documents to the relevant regulatory authority
• In some cases, involvement of an independent auditor to verify system compliance

Authorization timelines range from a few weeks in jurisdictions with streamlined processes to 12 months or more in markets with more demanding requirements, such as Bahrain or Malta.

Which Jurisdictions Are Relevant for Non-Resident Operators?

The majority of companies seeking a VASP license are not citizens of, or resident in, the jurisdiction where they are applying. This is the norm, not the exception.

Jurisdictions including Estonia, Lithuania, Poland, Panama, and the Cayman Islands have historically accepted foreign applicants, provided the company structure, local team where required, and compliance program meet local requirements. Some jurisdictions require a local director or MLRO; others do not.

Choosing a jurisdiction is not simply a matter of finding the path of least resistance. The factors that actually determine the right choice include: where the company's target markets are, whether the license from that jurisdiction carries international recognition, banking accessibility from that jurisdiction, and the long-term operational cost of maintaining compliance.

LegalBison works with teams and founders who need a clear picture of this regulatory landscape, including which jurisdiction best suits their specific business model and expansion plans, from initial analysis through application and post-licensing support.

LegalBison.com is a global boutique legal and business services firm specialising in regulatory architecture for FinTech and digital asset projects. The firm operates across more than 50 jurisdictions, with offices in Poland, Estonia, Bahrain, Malaysia, Costa Rica, and Panama.