VASP Licensing Guide: Operating Legally in Crypto

You built a great exchange. You have users, liquidity, and a slick interface. But if you haven't secured the right VASP license or registration, you are operating on borrowed time. The days of "move fast and break things" in crypto are over. Regulators are no longer just watching; they are enforcing.

A Virtual Asset Service Provider (VASP) is any business that exchanges virtual assets for fiat currency, exchanges one virtual asset for another, transfers assets, provides custody, or facilitates trading. If your platform touches these activities, you fall under strict anti-money laundering (AML) and counter-terrorist financing (CFT) rules. This isn't about bureaucracy for its own sake. It’s about proving you aren’t a playground for illicit finance.

The Global Reality: No Single License Fits All

Here is the hard truth: there is no such thing as a global crypto license. A VASP license in Singapore does not let you operate in New York. A UK registration doesn’t automatically cover Dubai. The Financial Action Task Force (FATF) sets the baseline standards, requiring jurisdictions to regulate VASPs, but each country implements them differently.

As of late 2025, FATF data showed that while 96 out of 117 surveyed jurisdictions required VASPs to be licensed or registered, only 76 had actually issued licenses. This gap highlights a critical point: having rules on paper is different from having an operational regulator. If you launch without checking the specific local requirements, you risk fines, shutdowns, or being blacklisted by banks.

Mapping Your Activities Before You Apply

Don’t start with the application form. Start with an activity map. What exactly do you do? Do you hold private keys for users? That’s custody. Do you match buy and sell orders? That’s an exchange service. Do you offer staking rewards? That might be considered interest-bearing debt or a security depending on where you live.

Your legal classification depends on three factors:

• Asset Type: Is it a utility token, a stablecoin, or a security? The SEC views some tokens as securities, which triggers broker-dealer rules, not just money-transmitter rules.
• Custody Model: Do you control the keys? If yes, you need robust safeguarding controls. If no, you might still need registration for facilitating transfers.
• Jurisdictional Reach: Where are your customers? Where are your servers? Where are your employees? Some countries claim jurisdiction based on marketing alone.

If you skip this step, you’ll likely apply for the wrong license type. For example, applying for a simple AML registration when you actually need a full prudential banking-style authorization will cost you months in rework.

Key Jurisdictions: What You Need to Know

Let’s look at how major markets handle VASP licensing. This isn’t exhaustive, but it covers the most common targets for crypto businesses.

The European Union: MiCA Changes Everything

The Markets in Crypto-Assets Regulation (MiCA) went into full effect across the EU on July 1, 2026. If you serve EU clients, you need a CASP (Crypto-Asset Service Provider) authorization. Unlike previous AML registrations, MiCA requires prudential safeguards. You must hold capital equal to the higher of a fixed minimum or 25% of your annual fixed overheads. Plus, you cannot use client assets for your own account. If you don’t have a MiCA license, you must stop serving EU customers immediately.

The United States: The Layered Nightmare

In the US, you register with FinCEN as a Money Services Business (MSB). But that’s just the federal layer. You also need state money transmitter licenses. Each state has different bonding requirements, net worth thresholds, and application processes. If you operate in California, New York, and Texas, you’re effectively running three different regulatory projects. And don’t forget the SEC. If your token is deemed a security, you might need a broker-dealer license too.

The UK: Moving Beyond Simple Registration

The UK is shifting gears. Previously, you just needed FCA registration for AML purposes. Now, under the new FSMA regulations effective in 2026, many crypto activities require full authorization. This means stricter governance, capital requirements, and conduct standards. If you’re already registered, check if you need to upgrade. Don’t assume your old registration covers new products like lending or derivatives.

The Technical Core: Compliance Isn’t Just Paperwork

Getting the license is half the battle. Keeping it requires operational excellence. Regulators want to see that your systems work.

The Travel Rule

The FATF “Travel Rule” requires that when you send crypto to another VASP, you must share customer information-name, address, account number-with the receiving provider. This sounds simple, but technical implementation is messy. Not all blockchains support metadata easily. You need tools that can extract, format, and transmit this data securely. If you send funds to an unhosted wallet (a personal cold wallet), you still need to verify the owner’s identity. Failure here is a top reason for regulatory penalties.

Custody and Key Management

If you hold customer funds, you need segregation. Your hot wallets should be insured. Your cold storage needs multi-signature approvals. Regulators will audit your key management policies. They want to know who holds the keys, where they are stored, and what happens if a key holder leaves the company. Document your procedures. Prove you tested them.

Transaction Monitoring

You need real-time screening against sanctions lists (like OFAC in the US or UN lists globally). You also need blockchain analytics to flag suspicious patterns, like mixing services or darknet market addresses. Manual review isn’t enough. You need automated alerts that feed into a case management system. Keep records. If a regulator asks why you flagged a transaction, you need a clear audit trail.

Costs and Timelines: Budget Realistically

How much does this cost? It varies wildly. In Hong Kong, application fees are published (e.g., HK$4,740 per activity), but that’s small compared to the cost of hiring compliance staff, legal counsel, and tech vendors. In the US, state licensing costs can run into hundreds of thousands of dollars due to bonding and legal fees.

Timeline-wise, expect 6-18 months. Pre-application meetings are crucial. Use them to clarify ambiguities. Don’t submit a generic business plan. Tailor it to the regulator’s specific concerns. Show them you understand their local risks.

Common Pitfalls to Avoid

Many startups fail because they underestimate the ongoing burden. Here are the big mistakes:

• Assuming One License Covers All: A payment license in Singapore doesn’t cover securities trading. Check every product line.
• Ignoring Offshore Exposure: Just because your customers are outside your home country doesn’t mean you’re safe. Singapore now requires licenses even for providers serving only foreign clients.
• Weak Wind-Down Plans: Regulators want to know how you’ll exit if things go wrong. Have a clear plan for returning customer assets.
• Banking Access Issues: Banks are wary of crypto firms. Having a license helps, but you still need strong relationships and transparent reporting to keep your accounts open.

Next Steps: Building Your Compliance Roadmap

Ready to move forward? Here’s your checklist:

1. Audit Your Products: List every service you offer. Classify each asset type.
2. Select Target Markets: Prioritize 2-3 jurisdictions. Don’t try to conquer the world at once.
3. Hire Local Experts: Get legal counsel in each target jurisdiction. Don’t rely solely on generalist crypto lawyers.
4. Build Tech Stack: Implement KYC/AML tools, blockchain analytics, and travel-rule solutions before applying.
5. Engage Regulators Early: Request pre-application meetings. Ask questions. Show good faith.
6. Prepare Documentation: Draft policies for AML, cybersecurity, complaints, and business continuity.

Operating legally isn’t a checkbox exercise. It’s a competitive advantage. Licensed platforms attract institutional investors and trusted partners. Unlicensed ones face constant threat of shutdown. Invest in compliance early, and it pays off in stability and growth.