VASP license: what it is and where to get one.

It is the registration or licence a virtual asset service provider needs before it exchanges, transfers or safeguards virtual assets for clients. The term comes from FATF Recommendation 15, which asks countries to license or register VASPs, at a minimum where they are created, and to supervise them for anti-money-laundering. Each country writes the actual rules: a registration in the BVI or Georgia, a licence in Dubai or Hong Kong, and in the EU a CASP authorisation under MiCA.

Any business that, for clients, exchanges virtual assets for money or for other virtual assets, transfers them, keeps them or the keys that control them, or provides financial services around a token issue. Exchanges, brokers, OTC desks, custodial wallets and crypto payment processors are in scope. Developers and providers of unhosted wallets who never control client assets usually are not, though national law can reach further than the FATF definition.

No. VASP is the FATF term used in national anti-money-laundering laws; CASP authorisation is the MiCA licence of the EU. Since the last MiCA transitional periods ended on 1 July 2026, a national VASP registration no longer allows crypto services to EU clients: only an authorised CASP, or a financial firm already licensed under other EU law (a bank, investment firm, e-money institution, fund manager, central securities depository or market operator) that has notified under Article 60, may provide them; a non-EU firm may serve an EU client only at that client's own exclusive initiative (Article 61). A VASP status outside the EU gives no EU access, and a CASP authorisation gives no status outside the EU and the EEA. The MiCA license page covers the authorisation itself.

Outside the EU most financial centres now run a VASP regime; the twelve compared above are Dubai (VARA), Hong Kong (SFC), the Cayman Islands, the British Virgin Islands, Bermuda, the Bahamas, Seychelles, Saint Vincent and the Grenadines, El Salvador, Georgia, Nigeria and Kenya. In its July 2026 update the FATF found that 91 of 109 responding jurisdictions had passed Travel Rule laws and that 76 of 130 had licensed or registered at least one VASP in practice.

Official fees vary widely. To apply: KYD 1,000 for a Cayman registration, US$5,000-10,000 in the BVI, AED 40,000-100,000 in Dubai for the first activity (half the lower fee for each further one). Each year: US$7,500-25,000 in the BVI, BMD 15,000-450,000 in Bermuda, AED 80,000-200,000 per activity in Dubai. Capital runs from no fixed figure in the BVI or Cayman to HK$5 million paid up in Hong Kong and up to ₦2 billion in Nigeria. Add the substance the regulator expects: directors, a compliance officer and, in many places, an office. We quote our own fee after the free assessment, once the country and the service list are fixed.

In practice about 2-4 months in El Salvador and Saint Vincent, 4-6 months in the BVI, Cayman, Bermuda or the Bahamas, 4-9 months in Dubai and 9-12 months or more in Hong Kong. Only some laws set a clock: the CNAD in El Salvador decides within 20 business days of the definitive file, after two pre-registration reviews with no deadline; Kenya's regulators within 30 days of a complete file, though no licence has been issued yet; Georgia's central bank within 60 days, extendable twice. The FSA in Seychelles gives a range of 3 months to 2 years.

Generally not. A VASP registration or licence covers the country that issued it, and serving clients elsewhere needs that country's permission or a structure that keeps the regulated activity at home. Some regimes also reach foreign firms that actively market to their residents, El Salvador among them. Inside the EU, MiCA is the exception: one CASP authorisation passports to every EU and EEA state.

Lithuania closed its national transition on 31 December 2025: former VASPs had to stop or hold a CASP licence, the register entries were deleted on 2 January 2026, and the Bank of Lithuania now licenses CASPs. Poland still keeps its register of virtual currency activities, but since 1 July 2026 an entry gives no right to provide crypto-asset services, and Poland has not designated a MiCA authority for CASPs: the President vetoed three bills and all three override votes failed, the last on 4 September 2026. Until a law passes, the working route is a CASP authorisation from another member state, passported into Poland.

Usually not for software that never controls client assets: the FATF definition turns on who exchanges, transfers or holds assets for others. But a person who controls or has sufficient influence over a DeFi arrangement can be a VASP under FATF guidance, and national laws differ. We map the actual flows of your product before choosing a country.

Buying saves the incorporation step, not the review. In most regimes a change of control or of directors needs the regulator's prior approval, and the new owners pass the same fit and proper checks as a new applicant. We check the target's licence scope, compliance history and open findings before any signing.