VASP – Virtual Asset Service Provider

A VASP is a commercial service provider that exchanges, transfers or takes into custody virtual assets for third parties or assists in their initial sale. The Financial Action Task Force (FATF) coined the term to extend its anti-money-laundering and counter-terrorist-financing standards to crypto. National law turns these into binding licensing and due-diligence duties.

Behind the term stands the FATF, the intergovernmental body for standards against money laundering. In 2019, the task force expanded its Recommendation 15. That step brought providers of crypto services under anti-money laundering rules for the first time. These recommendations are soft law, however. Consequently, they become binding only once a state transposes them into its own law. Exactly at that point the labels diverge. Switzerland classifies the activities as those of a financial intermediary under the Anti-Money Laundering Act (AMLA). The EU, meanwhile, introduced CASP as its own legal term under MiCA.

The five activities that trigger VASP status

Whether a company counts as a VASP depends on the activity, not on the technology. The FATF's guidance on the risk-based approach names five categories in its version of October 2021. A single one suffices. The list covers the exchange of virtual assets for fiat money, exchanges between different virtual assets, and their transfer. Custody and administration of such assets also fall under it, as do instruments that grant control over them. Finally, the fifth category concerns financial services around the offer or sale of an asset by its issuer.

Yet not every contact with crypto assets triggers the status. The activity must be commercial and directed at third parties. Legal form does not matter either, because the FATF covers natural persons and legal entities alike. So anyone who merely holds or reallocates their own holdings is not a VASP.

What data a VASP must transmit with transfers

Besides identifying the contracting party, a VASP carries a second duty tied to transfers. The Travel Rule from Recommendation 16 requires details on the originator and the beneficiary to accompany the transfer. A threshold of USD 1,000 or EUR 1,000 applies. The check at the start of a business relationship happens once. This duty, however, arises with every single transfer above the threshold.

The FATF later revised this recommendation at its plenary in June 2025. For cross-border payments above the threshold, the standard requires the originator's name, address and date of birth. Between rule and enforcement, though, a gap remains. According to the FATF's Targeted Update, a majority of the assessed jurisdictions had enacted Travel Rule legislation. Yet only a minority of them had taken supervisory or enforcement action against VASPs (as of July 2024).

Does a VASP in Switzerland need a FINMA license

Swiss supervisory law does not use the term VASP. FINMA nevertheless clarified the point on 26 August 2019. Providers of blockchain-based payment services count as financial intermediaries under the Anti-Money Laundering Act. In the same communication, the supervisor named the crypto banks SEBA Crypto AG and Sygnum AG. Anyone providing such services commercially therefore needs affiliation with a recognized self-regulatory organization or a license from FINMA. Overall, three routes exist.

The ceiling of the FinTech license refers to accepted public deposits, crypto-based assets included. Still, in a bankruptcy, client assets enjoy neither a privilege nor the protection of deposit insurance. Anyone who wants to invest accepted funds or pay interest on them consequently falls outside this framework.

The identification duty applies from CHF 1,000

Whoever carries out the activities of a VASP in Switzerland faces low thresholds as a financial intermediary. Under Art. 51a of the FINMA Anti-Money Laundering Ordinance (GwV-FINMA), the intermediary must identify the contracting party. The duty applies as soon as a transaction in virtual currency reaches or exceeds CHF 1,000. Moreover, the ordinance aggregates several connected transactions within 30 days. For cash transactions the threshold sits comparatively high, namely at CHF 15,000. Customer identification therefore applies far earlier in crypto than at the bank counter.

Furthermore, the supervisor bases the Travel Rule on Art. 10 GwV-FINMA. It requires details on the originator and the beneficiary for payment orders. Unlike the FATF standard, this provision grants no exception for payments involving wallets of unsupervised providers. As long as an institution can neither receive nor send such details, a narrower rule applies. FINMA Guidance 02/2019 then permits dealings with external wallets only if those wallets belong to the institution's own clients. The institution must verify the client's power of disposal over the self-custodied wallet through suitable technical measures. A transfer to a third party's wallet remains possible, provided that the institution identifies that party like its own client. It must also establish the beneficial owner and carry out the same check beforehand.

Why the EU speaks of CASP and not VASP

With MiCA, the EU created its own legal term. Article 3(1)(15) of Regulation (EU) 2023/1114 defines the crypto-asset service provider. The term covers any undertaking whose business is the professional provision of crypto-asset services to clients. The following point lists ten such services. Among them are custody, operation of a trading platform, exchange, execution of orders, portfolio management and advice. This overlaps strongly with the FATF's VASP catalog, although the two are not identical. A company can thus be a VASP under FATF terminology and a CASP under Union law at the same time.

The real difference lies in the legal nature. VASP denotes a FATF standard that binds only through national legislation. CASP, meanwhile, is directly applicable Union law with its own licensing requirement, and a national authority decides on it. This requirement has applied EU-wide since 30 December 2024. Companies that previously operated lawfully under national law could keep working under transitional rules. Those rules ran until 1 July 2026 at the latest, or until a decision on their license. Individual member states such as Germany shortened this deadline nationally. In Switzerland, neither VASP nor CASP exists as a legal term, so the Anti-Money Laundering Act applies there.