A VASP license is the authorization a crypto business needs to legally provide virtual asset services where it operates. This guide explains who needs a VASP license, how the term changed in the EU after MiCA, what regulators ask applicants to prove, and how the process works in the main jurisdictions. Last updated: October 6, 2026. This guide is general information, not legal advice. Requirements depend on your activities, customers, and jurisdiction, so confirm your position with qualified counsel.
Key Takeaways
- A VASP license is the authorization a business needs to legally provide virtual asset services, such as exchange, transfer, custody, or token sales support, in the country where it operates.
- "VASP" is a term from the Financial Action Task Force (FATF), not the name of one license. Every country issues its own instrument under its own name.
- In the EU, the MiCA CASP authorization has superseded national VASP regimes. Since July 1, 2026, serving EU clients without MiCA authorization breaches EU law.
- The United States has no "VASP license." Businesses register with FinCEN as money services businesses and obtain state licenses where required.
- Whether you need a VASP license depends on what you do, not what you call yourself. If you handle virtual assets for other people, assume you do.
What Is a VASP (Virtual Asset Service Provider)?
A virtual asset service provider is a business that carries out specified activities with or for other people's virtual assets. The FATF, the global anti-money laundering standard-setter, defines the term, and countries then write it into national law.
FATF treats a business as a VASP when it performs one or more of these activities for or on behalf of a customer:
- Exchange between virtual assets and fiat currencies
- Exchange between one or more forms of virtual assets
- Transfer of virtual assets
- Safekeeping or administration of virtual assets, or of instruments that enable control over them
- Participation in and provision of financial services related to an issuer's offer or sale of a virtual asset
Typical examples of a VASP are a crypto exchange, a custodial wallet provider, an OTC desk, a crypto ATM operator, and a firm that helps a token issuer sell to the public. A company does not need to describe itself as a crypto business to fall inside the definition.
What Is a VASP License and What Does It Permit?
A VASP license is shorthand for the license or registration that a regulator grants to a business providing virtual asset services. FATF Recommendation 15 requires countries to make sure VASPs are licensed or registered and supervised for anti-money laundering and counter-terrorist financing. Each country chooses the instrument, so no single document carries that name worldwide.
What a VASP license permits depends on its scope: named activities, approved virtual assets, and defined markets, with ongoing AML/CFT controls, reporting, and supervisory fees. A license in one country does not automatically let you serve customers in another, unless the regime provides passporting, as MiCA does within the EU.
Who Needs a VASP License?
Whether you need a VASP license depends on your activity, not your label. Regulators look at what a business does with virtual assets and for whom. FinCEN, the US financial crimes regulator, says a label "will not determine the regulatory application" and that whether a person is a money transmitter "is a matter of facts and circumstances" (FIN-2019-G001).
The cleanest test is custody and control. If you hold, move, or exchange virtual assets on behalf of other people, you probably need a VASP license or its local equivalent. That covers:
- Exchanges and brokers
- Custodial wallet providers
- OTC desks that trade or transfer for clients
- Platforms that move assets between customers
- Firms that help issuers sell tokens
Some businesses sit outside the definition, such as a merchant that accepts crypto for its own goods or a software provider that never controls customer assets. Regulators decide these cases one by one, and countries can reach different answers on the same facts.
VASP vs CASP: What Changed Under MiCA
In the EU, the CASP authorization under MiCA has superseded the national VASP license. MiCA, Regulation (EU) 2023/1114, created a single authorization for crypto-asset service providers (CASPs). Only authorized persons may provide crypto-asset services in the Union, and an authorized CASP can serve clients across the Union through establishment or cross-border services (Article 59). Credit institutions, investment firms, e-money institutions, and certain other regulated entities can provide these services through a notification procedure instead.
The transition is over. Providers that operated under national law before December 30, 2024 could continue until July 1, 2026 at the latest, or until their application was decided, and member states could shorten that period (Article 143(3)). ESMA's statement of April 17, 2026 says that after July 1, 2026, any entity providing crypto-asset services to EU clients without MiCA authorization is in breach of EU law and must stop. | Dimension | VASP (FATF concept) | CASP (MiCA) | | :---- | :---- | :---- | | Legal basis | FATF Recommendation 15, applied through national law | Regulation (EU) 2023/1114 | | Geography | Worldwide, with each country setting its own rules | European Union | | What it covers | The five FATF activities | The crypto-asset services defined in MiCA | | Passporting | Generally none; separate approval per country | One authorization valid across the Union | | Status in 2026 | Still the global concept and the basis of regimes outside the EU | Required for dedicated crypto providers serving EU clients since July 1, 2026 |
For the regulation itself, see our MiCA readiness page and the explainer on MiCA crypto rules. Authorized CASPs also fall under the EU's digital operational resilience rules in Regulation (EU) 2022/2554, which we cover in what DORA is and DORA compliance strategies.
Core Requirements for a VASP License
Most regimes ask for the same core proofs, including a business plan, governance arrangements, and security controls, although thresholds and names differ by country.
Fit-and-Proper Checks
Regulators vet the people behind the business: ultimate beneficial owners, directors, and senior managers. Expect to show identity, relevant experience, financial standing, and clean criminal records.
AML/CFT Framework and Compliance Officer
Applicants need written AML/CFT policies, a documented risk assessment, customer due diligence procedures, and a qualified compliance officer, often called an MLRO. These controls are the center of any VASP license application.
Local Substance
Many regimes want real presence. MiCA requires a CASP to be a legal person with a registered office in a Member State, its place of effective management in the Union, and at least one director resident in the Union (Article 59).
Minimum Capital
MiCA ties minimum capital to the services you offer: €50,000 for services such as order execution, transfers, or advice, €125,000 if you add custody or exchange, and €150,000 for operating a trading platform, or one quarter of the previous year's fixed overheads if that is higher (Article 67).
Travel Rule Tooling
Providers must send and receive sender and recipient information with virtual asset transfers. The EU applies the rule through Regulation (EU) 2023/1113, and the US rule in 31 CFR 1010.410 covers transmittals of $3,000 or more.
VASP License Rules by Jurisdiction in 2026
Indicative, verified as of 2026-10 against each regulator's own pages. Names, thresholds, and fees change, so confirm with the regulator before you apply.
Jurisdiction
Regulator
Real name of the instrument
Published figure
Note
European Union
National competent authorities
CASP authorization under MiCA
25 working days to check completeness; 40 working days to decide
Valid across the Union
United Kingdom
FCA
MLR cryptoasset registration today; FSMA authorization from October 25, 2027
None published
MLR registration covers AML/CTF only
United States
FinCEN and state regulators
MSB registration (Form 107), state licenses, New York BitLicense
Register within 180 days of establishment
No federal "VASP license"
Dubai, UAE
VARA
Virtual Asset Service Provider Licence
None published
Eight licensed activities
Abu Dhabi, UAE
ADGM FSRA
Financial Services Permission
None published
Accepted Virtual Assets only
Switzerland
FINMA
Banking, FinTech, or other license by activity, plus SRO membership
FinTech license: deposits up to CHF 100 million
No license named "VASP"
Singapore
MAS
Payment Services Act license for digital payment token services
Application fee from S$1,000 (standard) or S$1,500 (major)
Separate regime for overseas-only firms
European Union
The instrument is the CASP authorization under MiCA, granted by a national competent authority. The authority must acknowledge an application within five working days, check completeness within 25 working days, and decide within 40 working days of receiving a complete application (Article 63). The authorization is valid across the Union.
United Kingdom
The FCA currently registers cryptoasset businesses under the Money Laundering Regulations, for AML/CTF supervision only (FCA). A new regime under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 starts on October 25, 2027, and the FCA is already accepting applications (FCA).
United States
There is no federal VASP license. Businesses that meet FinCEN's money transmitter definition register as money services businesses on FinCEN Form 107 within 180 days of establishment (FinCEN), and may also need state money transmitter licenses. New York requires a BitLicense for anyone engaging in "Virtual Currency Business Activity" (NYDFS).
United Arab Emirates
In Dubai, anyone carrying out regulated virtual asset activities in or from the emirate must apply to VARA for a Virtual Asset Service Provider Licence. VARA lists eight licensed activities: advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement, and issuance in Category 1 (VARA). In Abu Dhabi, the ADGM Financial Services Regulatory Authority grants a Financial Services Permission and limits regulated activity to Accepted Virtual Assets (ADGM guidance).
Switzerland
Switzerland has no license called a VASP license. FINMA applies its existing licenses to the activity: a banking license if you accept deposits from more than twenty clients, a FinTech license for deposits up to CHF 100 million or collective custody of crypto-based assets, and membership of a self-regulatory organization where the Anti-Money Laundering Act applies (FINMA).
Singapore
Digital payment token services need a license under the Payment Services Act, either as a standard or a major payment institution. MAS application fees start at S$1,000 and S$1,500 respectively (MAS). Since June 30, 2025, firms serving only customers outside Singapore need a license under the Financial Services and Markets Act, and MAS has said it will grant these only in extremely limited circumstances (MAS).
Other Regimes
Other FATF-based regimes use their own names, such as registration, authorization, or permission. Check that a regime has not been replaced before you rely on an older guide.
How Do You Get a VASP License?
You get a VASP license by matching your activities to the regulator's definitions, building the required entity and controls, and submitting a complete application. For the wider startup path, see our guide to how to start a crypto business.
- Map your activities. List what you do with virtual assets and for whom, then test each activity against the target regime's definitions.
- Choose the jurisdiction. Weigh target markets, passporting, banking access, and the substance you can sustain.
- Set up the entity. Incorporate and staff it to the regime's substance rules, including directors and a compliance officer.
- Prepare the dossier. Assemble the business plan, governance chart, AML/CFT framework, risk assessment, security documents, and financials.
- Show your technology. Be ready to demonstrate transaction monitoring, Travel Rule messaging, and segregation of client assets.
- Submit and respond. The authority may ask follow-up questions or request interviews.
- Stay compliant. After approval, reporting, audits, and staff training continue for as long as you hold the VASP license.
How Much Does a VASP License Cost and How Long Does It Take?
The cost and timeline of a VASP license vary too much for one honest figure, so plan from components and published clocks.
The main cost components are regulator fees (MAS application fees start at S$1,000 or S$1,500, plus per-service amounts), regulatory capital (under MiCA, €50,000, €125,000, or €150,000 depending on services), advisers and staff, technology and audits, and ongoing supervision. Third-party price lists circulate widely and rarely say what they include, so treat any single total with caution.
On timing, regulators publish processing clocks, not total project times. Under MiCA the authority has 25 working days to check completeness and 40 working days to decide on a complete application. The longest part is usually preparing the entity and dossier, which is in your hands.
What Happens If You Operate Without a VASP License?
Operating without a required VASP license exposes the business to enforcement and cuts it off from banks and partners. In the EU, ESMA expects national authorities to take action against unauthorized provision of crypto-asset services after July 1, 2026. Dubai's VARA publishes a list of unlicensed VASPs.
The commercial effects arrive earlier: banks and payment partners ask for your license before onboarding. Our guide to crypto-friendly banks explains what underwriters look for.
Do You Need Your Own VASP License or Can You Use a Licensed Partner?
Some businesses can operate through a licensed partner, but the regulator decides based on who controls the assets and who serves the customer. Under MiCA, ESMA notes that CASPs may not outsource or delegate certain services, namely custody, to entities that are not authorized CASPs themselves. It also says MiCA protections apply to the specific authorized legal entity, not to other companies in the same group.
Before you build on a partner's VASP license, confirm which legal entity provides each service and what it is authorized to do.
How a VASP License Interacts With Your Tech Stack
Regulators judge a VASP license application partly on whether your systems can do what your policies promise. Applicants are typically asked to show:
- Transaction monitoring and sanctions screening
- Travel Rule messaging for transfers
- Segregation of client assets and key management
- Incident response and audit trails
- Regulatory reporting
In the EU, CASPs must also meet the ICT risk rules in DORA. Build these capabilities before you apply, because regulators ask to see them working.
How SimplifyLabs Helps
SimplifyLabs is a technology provider, not a law firm, and we do not obtain licenses on a client's behalf. We build the infrastructure regulators expect to see, including AML and transaction monitoring controls, reporting, and asset segregation, and we work with regulatory partners such as SBSB Fintech Lawyers. For an EU launch, see a MiCA-ready crypto launch. For the product itself, see our crypto exchange platform and crypto banking solutions.
Frequently Asked Questions
What does VASP stand for?
VASP stands for virtual asset service provider, the FATF's term for a business that exchanges, transfers, safeguards, or helps issue virtual assets for others. Countries use the term in their laws, but the license or registration each one issues has its own name.
Is a VASP license the same as a MiCA license?
No. A VASP license is the global FATF concept, implemented differently in each country. In the EU, MiCA's CASP authorization has superseded national VASP regimes and is valid across the Union. If you serve EU clients, the CASP authorization is the instrument that counts since July 1, 2026.
Do I need a VASP license for a non-custodial product?
Not automatically. Regulators look at what the business does, not the label. A non-custodial product that never controls customer assets or transfers may fall outside the definition, but one that exchanges assets, routes transfers, or controls keys for customers can be in scope.
How long does a VASP license take?
There is no single answer. Regulators publish review clocks, such as MiCA's 25 working days to check completeness and 40 working days to decide on a complete application, but the total time also includes preparing the entity and dossier and answering follow-up questions.
Which country is easiest for a VASP license?
Easiest is the wrong question. A VASP license that is quick to obtain but not accepted by banks, partners, or the markets you serve costs more later. Compare the regulator's standing, passporting, banking access, substance requirements, and your target customers.
Does the US issue VASP licenses?
No. The United States does not issue a license called a VASP license. Businesses that meet FinCEN's money transmitter definition register as money services businesses and may need state money transmitter licenses, and New York requires a BitLicense for virtual currency business activity.
What is the Travel Rule and does it apply to me?
The Travel Rule requires VASPs to collect and pass on identifying information about the sender and recipient of a virtual asset transfer. If you qualify as a VASP, it very likely applies. The EU applies it through Regulation (EU) 2023/1113, and the US rule in 31 CFR 1010.410 covers transmittals of $3,000 or more.
Is VASP software free or paid?
VASP in this guide is a regulatory category, not a software product. Some unrelated software tools share the name, but a VASP license is an authorization from a regulator and is not something you buy or download. Compliance software, such as transaction monitoring, is a separate purchase.
Is this guide legal advice?
No. This guide is general information about licensing rules as of October 2026 and does not consider your facts. Requirements change and depend on your activities, customers, and jurisdiction, so confirm your position with a qualified lawyer in each country you plan to serve.
Sources
- FATF: Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers (October 2021). https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Guidance-rba-virtual-assets-2021.html
- FATF: The FATF Recommendations. https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html
- EUR-Lex: Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R1114
- ESMA: MiCA Interactive Single Rulebook, Articles 59, 63, 67 and 143. https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-59-authorisation
- ESMA: Statement on the End of Transitional Periods under MiCA (April 17, 2026). https://www.esma.europa.eu/sites/default/files/2026-04/ESMA75-113276571-1679_Statement_on_the_end_of_transitional_periods_under_MiCA.pdf
- FCA: Cryptoasset AML/CTF regime and new cryptoasset regime. https://www.fca.org.uk/firms/new-regime-cryptoasset-regulation
- FinCEN: Guidance FIN-2019-G001 and MSB registration. https://www.fincen.gov/money-services-business-msb-registration
- NYDFS: Virtual currency businesses (BitLicense). https://www.dfs.ny.gov/virtual_currency_businesses
- VARA and ADGM: Licensed virtual asset activities and ADGM virtual asset guidance. https://www.vara.ae/en/faq/
- FINMA and MAS: FinTech licensing and Payment Services Act licensing. https://www.finma.ch/en/authorisation/fintech/
