A virtual asset service provider (VASP) is a business that conducts professional crypto activities such as exchanging, transferring, or safeguarding digital assets on behalf of customers. Think of the virtual asset service provider definition as a regulated intermediary in crypto: exchanges, custodians, and payment processors are typical examples.
In most frameworks, VASP status depends on the activity, not the brand. If a company holds customers’ private keys, moves funds between wallets, or runs an exchange between crypto and fiat (or crypto-to-crypto), it is usually treated as a VASP and must meet local compliance rules.
Key activities of a VASP
Common activities that qualify a firm as a VASP include:
- Exchange services. Buying or selling crypto for fiat or for other crypto pairs; running order books, OTC desks, or brokers.
- Transfer services. Moving assets between wallets for customers (including payment processing, merchant settlements, and mass payouts).
- Safekeeping and administration. Custodial wallets, vaults, or other services where the provider controls customers’ keys.
- Issuance-related services. Participation in or facilitation of financial services connected to an offer or sale of a virtual asset.
- Other covered operations. Depending on the jurisdiction, staking-as-a-service, hosted wallet providers, kiosk/ATM operators, or certain DeFi front ends can fall in scope.
Compliance and regulation
VASP requirements are set by local law, but they generally align to FATF guidance. Core obligations typically include:
- Customer due diligence. KYC/KYB at onboarding and ongoing screening (sanctions, PEP, adverse media).
- Transaction monitoring. On-chain and off-chain surveillance, risk scoring, and alerts for unusual activity.
- Travel rule. Exchanging originator/beneficiary information for qualifying VASP-to-VASP transfers.
- Record-keeping and reporting. Retaining logs, responding to law-enforcement requests, and filing suspicious activity reports where required.
- Governance and controls. Policies, risk assessments, audits, staff training, and information security measures.
Regimes vary by country, so a VASP virtual asset service provider must register or seek licensing where it operates and align controls to those specific rules.
Examples of services
- Centralized exchanges and brokers that list trading pairs and handle deposits/withdrawals.
- Crypto payment processors that accept customer payments in digital assets and settle to a merchant wallet or convert to fiat.
- Custodial wallet providers that manage private keys, segregate hot/warm/cold storage, and sign transactions for clients.
- OTC and treasury desks supporting block trades, liquidity, and institutional settlement.
- Enterprise payout services enabling bulk disbursements with on-chain proofs and internal reconciliation.
Understanding whether your activity fits the VASP definition helps you pick the right operating model and compliance setup. Some firms also combine roles – for example, a payment processor with integrated custody and exchange.