What is VASP?
A VASP (Virtual Asset Service Provider) is any business that exchanges, transfers, or safekeeps crypto assets for customers - the FATF term that most licensing regimes are built on. If you touch customer crypto (exchange, custody, brokerage, some wallet models), you likely need a VASP registration or license somewhere.
What activities make you a VASP
The FATF definition covers five activities: exchange between virtual assets and fiat; exchange between virtual assets; transfer of virtual assets on behalf of customers; custody or administration of virtual assets; and participation in financial services related to an issuer's offer or sale. Pure software (non-custodial wallets, protocol development) generally falls outside - but the moment you control customer keys or route customer funds, you are in scope. Classify your model precisely before choosing a jurisdiction; the license type follows the activity list.
Where founders register - the practical map
EU: national VASP registrations are being replaced by the MiCA CASP license - passportable across all 27 states, with Estonia, Lithuania, and Malta as popular bases. El Salvador and offshore centres offer lighter regimes but weaker banking access. The trade-off is constant: lighter regulation means harder banking and fewer serious counterparties. Most exchange or brokerage startups targeting European users now plan directly for a MiCA CASP authorisation rather than a legacy registration that expires.
Cost and timeline reality
Budget three layers: licensing (application fees, capital requirements - MiCA CASP requires €50k–150k depending on services), compliance build-out (AML officer, policies, transaction monitoring - realistically €5k–15k monthly ongoing), and corporate structure (local entity, sometimes local directors and office). Timelines run 4–12 months for a full license. Founders underestimate the ongoing compliance cost far more often than the entry cost.
Frequently asked questions
Is a DeFi protocol a VASP?
Genuinely decentralised protocols without a controlling intermediary generally fall outside the FATF definition - but regulators look through the label. If a team controls upgrades, front-ends, or fee flows, several regulators treat that team as the service provider. The safe analysis starts from who controls customer assets and flows.
VASP registration vs CASP license - what is the difference?
VASP registration was the lighter, AML-focused national regime (pre-MiCA Europe and FATF-aligned countries). The MiCA CASP license is a full authorisation with capital, governance, and conduct requirements - and EU-wide passporting. Legacy VASP registrations in the EU are being phased out under MiCA transition periods.