What Is a VASP? Virtual Asset Service Provider Explained
de LCX Team ·
Introduction
Before you trust a crypto platform with your money, there’s one question worth asking: Is it a regulated VASP?
The term gets used a lot in the crypto world, but few platforms actually explain what it means or why it should matter to you. With billions of dollars flowing through crypto platforms daily, understanding who is accountable for your assets and under what legal framework, is one of the most important pieces of due diligence any user can do. This guide breaks it down clearly.
What Is a VASP?
VASP stands for Virtual Asset Service Provider. It’s the regulatory term, defined by the global Financial Action Task Force (FATF) for any business that provides services involving the exchange, transfer, custody, or issuance of crypto-assets (virtual assets).
In plain terms: if a platform lets you buy, sell, hold, or send crypto, it’s a VASP.
The FATF introduced this terminology as part of its Recommendation 15, updated in 2019, to bring crypto businesses under the same anti-money laundering and counter-terrorism financing (AML/CFT) obligations that have long applied to banks and traditional financial institutions. The goal was simple: close the regulatory gaps that bad actors had been exploiting in the largely unregulated crypto space.
Examples include:
- Crypto exchanges (spot trading platforms)
- Crypto custodians (holding assets on your behalf)
- Crypto wallet providers
- Crypto brokers and OTC desks
It’s worth noting that the FATF definition is intentionally broad. Even a decentralised application or a peer-to-peer trading platform may qualify as a VASP if it facilitates the exchange or transfer of virtual assets as a business, regardless of whether a human operator is visibly in control. This breadth reflects regulators’ intent to capture the full spectrum of crypto activity, not just centralised exchanges.
VASP vs CASP – What Changed With MiCA?
Under the EU’s Markets in Crypto-Assets Regulation (MiCA), the term used is now CASP, Crypto-Asset Service Provider. Same concept, significantly stronger legal framework.
MiCA, which came into force in 2023, represents the most comprehensive crypto regulatory framework in the world to date. It moves beyond the FATF’s baseline AML focus and establishes a full licensing and conduct regime, closer in spirit to how securities or banking regulation works. The regulation has been rolled out in stages: CASP provisions formally apply since 30 December 2024, with transitional periods running into 2026 to allow existing platforms operating under national regimes time to obtain full MiCA authorisation. This phased approach means that right now, some platforms in the EU are operating under transitional arrangements — making it more important than ever to verify whether a platform holds, or has applied for, full MiCA authorisation rather than relying on a legacy national licence.
MiCA raised the bar considerably:
- Mandatory licensing from a national financial authority – platforms cannot operate in the EU without authorisation from a recognised competent authority, subject to national transitional arrangements.
- Strict governance and internal control requirements – firms must demonstrate robust internal oversight, not just submit paperwork
- Consumer protection and complaints handling obligations – users have enforceable rights, including formal complaint mechanisms
- Prudential safeguards – capital requirements and client asset segregation protect users even if a platform becomes insolvent
- Full AML/CFT compliance including the Travel Rule – crypto transfers are tracked with the same rigour as international bank wires
- Transparent fee disclosure and fair marketing standards – no hidden charges, no misleading promotions
One of the landmark features of MiCA is its “passporting” mechanism: a CASP licensed in one EU member state can offer services across the entire EU without needing separate authorisation in each country. This creates a unified regulatory market while maintaining high standards.
LCX AG has applied for MiCA authorisation with the FMA (Liechtenstein Financial Market Authority).
What Does a Regulated VASP Actually Have to Do?
A licensed VASP/CASP isn’t just registered on a list. It has active, ongoing obligations — obligations that require real resources, real expertise, and ongoing scrutiny from regulators. Here is what that looks like in practice:
KYC & AML
Verify every client’s identity, monitor transactions, and screen against sanctions lists. This means collecting government-issued ID, proof of address, and in some cases source-of-funds documentation. It also means ongoing transaction monitoring, not a one-time check at sign-up. If a user’s behaviour changes or matches known patterns of illicit activity, the platform is required to investigate and, where necessary, report.
Travel Rule Compliance
On transfers above the applicable regulatory threshold, share originator and beneficiary data securely with the counterparty platform, just like a bank wire. The Travel Rule, originally a FATF requirement and now embedded in MiCA, means that when you send crypto from one regulated platform to another, both platforms must exchange identifying information about the sender and recipient. This creates accountability across the entire transfer chain and is one of the most technically complex compliance obligations in the industry.
Asset Segregation
Client funds are kept separate from company funds. If the platform fails, your assets are yours. This is a fundamental safeguard that unregulated platforms routinely skip. Asset segregation means a platform cannot use client deposits to fund its own operations, investments, or liabilities. In the event of insolvency, segregated client assets sit outside the general creditor pool, meaning you have a much stronger legal claim to recovery.
Governance
A qualified management team, internal controls, conflict of interest policies, and regular audits. Regulators don’t just check the paperwork once, they assess whether the people running the business are competent and fit to do so. This includes background checks on key executives, requirements for risk management functions, and independent audits of financial accounts and compliance programmes.
Transparency
Published fee schedules, white papers where required, and clear client disclosures. Under MiCA, platforms offering crypto-assets to the public must publish detailed white papers meeting specific legal requirements. Fee structures must be disclosed upfront, not buried in terms and conditions. Marketing materials must be fair, clear, and not misleading.
Taken together, these obligations represent a significant operational commitment. Meeting them requires dedicated compliance teams, legal counsel, technology investment, and ongoing engagement with regulators. This is not something a fly-by-night platform can fake its way through.
Why It Matters Which VASP You Use
An unregulated platform has no oversight. No mandatory KYC. No asset segregation. No complaints process. If something goes wrong, a hack, an insolvency, a fraud – you have very limited recourse.
The history of the crypto industry is unfortunately full of examples that illustrate this risk. When unregulated platforms have collapsed, users have often found themselves as unsecured creditors with little legal standing and no deposit protection. Funds commingled with company assets. No audits. No regulator to escalate to. No transparency about what had been done with client money.
LCX – registered TT service provider under TVTG (FATF category VASP), FMA-supervised, MiCA CASP authorisation applied for. Your identity is verified. Your assets are safeguarded separately. You have a right to complain. And every transaction is monitored to protect you from fraud and illicit exposure.
The difference isn’t just legal. It’s practical.
Practically speaking, using a regulated platform means:
- You can complain. There is a formal process, and the regulator can intervene.
- Your assets are protected. Segregation requirements mean your crypto isn’t being used to fund the platform’s activities.
- The platform has been vetted. Licensing involves scrutiny that self-declaration cannot replicate.
- You are not exposed to dirty funds. AML monitoring protects you from inadvertently receiving funds linked to illicit activity, which can create legal complications of your own.
- There is accountability. Regulated firms can face fines, licence suspensions, or criminal referrals if they breach their obligations. That accountability shapes behaviour.
How to Check If a Platform Is Regulated
Before depositing funds anywhere, do a quick check:
- Look for a licence number or regulatory status on the platform’s website – reputable regulated firms display this prominently, not buried in fine print
- Check the national regulator’s public register (e.g., FMA Liechtenstein for LCX) – most regulators maintain searchable online databases of licensed firms
- Check ESMA’s MiCA register is live across the EU – the European Securities and Markets Authority will maintain a centralised register of all authorised CASPs under MiCA
- Ask: Does the platform require KYC? Does it have a clear complaints process? Is it transparent about fees and risks?
A few additional checks worth doing:
- Read the terms and conditions – look specifically for how client assets are held and what happens in an insolvency scenario
- Look for independent audits or proof of reserves – some regulated platforms publish third-party attestations of their reserve holdings
- Check for regulatory warnings – most financial regulators publish lists of firms operating without authorisation in their jurisdiction; search your regulator’s warning list before depositing
If a platform can’t answer these questions clearly, that’s your answer.
A Note on the Travel Rule – Why It Matters More Than You Think
The Travel Rule deserves special attention because it is frequently misunderstood as a bureaucratic inconvenience. In reality, it is one of the most important protections in the crypto compliance framework.
When you withdraw crypto from a regulated platform to another platform, the Travel Rule requires the sending platform to pass your identifying information to the receiving platform and vice versa. This mirrors what happens in traditional banking with SWIFT transfers.
For users, this has two important implications. First, it means that regulated platforms may ask you to confirm the ownership of external wallets before allowing withdrawals. This is not surveillance, it is a compliance requirement designed to prevent funds from flowing to sanctioned parties or criminal enterprises. Second, it means that if you are receiving funds from another regulated platform, that platform has already performed its own KYC on the sender. The chain of accountability extends across the entire transfer.
Platforms that do not comply with the Travel Rule are either unregulated, or operating in breach of their regulatory obligations. Both are red flags.
Closing
The crypto space has grown up. Regulation is not a barrier to innovation, it’s the baseline for trust. A regulated VASP means accountability, transparency, and real protections for real users.
The frameworks now in place, FATF’s global standards, MiCA’s EU-wide regime, and the national licensing frameworks of jurisdictions like Liechtenstein represent years of regulatory development designed to make crypto safer for everyday users without sacrificing the openness and accessibility that make it valuable.
Choosing where to place your assets is a decision worth making carefully. A regulated platform is not a guarantee against all risk; crypto assets remain volatile and trading carries real risk of loss but it is a meaningful layer of protection that unregulated alternatives simply cannot offer.
