A VASP is a regulated business that exchanges, transfers, or holds virtual assets and carries AML and counter-terrorist-financing duties, including the FATF Travel Rule. Crypto brings risks a traditional bank does not face the same way, so sizing up a VASP counterparty is its own discipline.
What is a VASP, in plain English?
A Virtual Asset Service Provider is a business that provides crypto services as a regulated activity: exchanging virtual assets for cash or for other assets, transferring them, holding or custodying them, or providing financial services around their issue and sale. Crypto exchanges, custodial wallet providers, and many brokers are VASPs. The FATF coined the term to bring these businesses inside the same AML and CFT expectations that apply to banks.
That means a VASP has to run real financial-crime controls: identify and verify its customers, monitor activity, screen against sanctions, and report suspicious activity. It also has to comply with the FATF Travel Rule, which requires that identifying information about the sender and the recipient travels alongside a transfer, just as it does in traditional wire payments.
The complication is that crypto carries risks a bank does not face in the same way. Value moves on public blockchains, wallets can be self-hosted and pseudonymous, and there are tools and venues built specifically to break the trail. So a VASP's AML program leans on blockchain analytics and wallet screening in ways that have no exact equivalent in fiat banking, and its risk depends heavily on where it is licensed and how mature its controls are.
The crypto-specific risks
Risk area | What it means | How VASPs manage it |
Tracing funds | Value moves on public chains, not through named accounts. | Blockchain analytics to follow flows and score wallets. |
Mixers and tumblers | Services designed to break the transaction trail. | Screening for exposure to mixing services. |
Unhosted wallets | Self-custodied wallets with no identified owner. | Risk scoring and, where required, extra checks on transfers. |
Travel Rule gaps | Adoption is patchy across counterparties and jurisdictions. | Assess each counterparty's ability to send and receive data. |
What it looks like in practice
In practice
A bank is deciding whether to open an account for a crypto exchange that wants to move customer settlement funds through it. On paper the exchange looks similar to another it already banks. But the diligence tells a different story.
One exchange is licensed in a jurisdiction with a mature crypto regime, uses established chain analytics, and can send and receive Travel Rule data. The other is registered in a light-touch jurisdiction, cannot demonstrate its analytics, and has significant flows to and from high-risk venues. Two VASPs that looked alike carry very different real risk, and the diligence is what surfaces the gap.
Why it matters to operators
For a bank or payments firm, a VASP is often a counterparty rather than a customer you built from scratch, which means you are inheriting the quality of its controls. If you bank a VASP with weak KYC or poor chain analytics, its exposure becomes your exposure. That is why VASP due diligence goes deeper than a normal corporate onboarding: you are effectively assessing another firm's entire AML program.
The uncomfortable part is that VASPs vary enormously. Regulatory maturity across the sector is uneven, so two providers offering the same services can sit in completely different risk tiers depending on their license, their tooling, and their jurisdiction. Judging a VASP counterparty means weighing all three, because the label alone tells you very little about the risk actually walking through the door.
What to watch
- Licensing and jurisdiction. Where a VASP is registered and how mature that regime is drives much of its real risk.
- Chain analytics. Whether it actually uses blockchain analytics, and which provider, tells you if it can see its own flows.
- Travel Rule capability. Can it send and receive the required sender and recipient data with its counterparties?
- Exposure to high-risk venues. Flows to and from mixers, no-KYC exchanges, or sanctioned addresses are a serious flag.
- Unhosted wallet handling. How it treats transfers to and from self-custodied wallets shows the depth of its controls.
Quick questions
What exactly counts as a VASP?
A business that exchanges, transfers, holds, or provides financial services around virtual assets as a regulated activity. Crypto exchanges, custodial wallet providers, and many brokers qualify; purely self-custodial software often does not.
What is the Travel Rule?
A FATF requirement that identifying information about the sender and recipient travels with a virtual asset transfer, mirroring the rule for traditional wire transfers. Patchy adoption across VASPs is one of the sector's persistent weaknesses.
Why are VASPs treated as higher risk?
Because crypto adds risks banks do not face the same way: pseudonymous public-chain transfers, mixers, unhosted wallets, and uneven regulation. These make tracing funds and identifying counterparties harder.
How do you assess a VASP counterparty?
Weigh its licensing and jurisdiction, its use of blockchain analytics, its Travel Rule capability, and its exposure to high-risk venues. Regulatory maturity varies sharply, so similar-looking VASPs can carry very different risk.
Are all VASPs regulated the same way?
No. Regimes differ widely by country, from strict licensing to light-touch registration. Jurisdiction is a major driver of a VASP's real risk, which is why it is a core part of any counterparty assessment.
What is an unhosted wallet in this context?
A self-custodied wallet controlled by an individual with no intermediary VASP behind it. Transfers to and from unhosted wallets have no counterparty firm to exchange information with, so they get extra scrutiny.
Go deeper
- FFIEC BSA/AML Examination Manual ↗ — The manual US examiners use to assess BSA and AML programs.
- FATF ↗ — The global standard-setter for AML, counter-terrorist-financing, and counter-proliferation. Recommendations, guidance, and jurisdiction lists.