CASP and VASP are two regulatory labels for businesses that provide services in crypto-assets, such as running exchanges, holding customers' coins or transferring them. A virtual asset service provider (VASP) is the term created by the Financial Action Task Force (FATF) for its global anti-money laundering standards. A crypto-asset service provider (CASP) is the term used in the European Union's Markets in Crypto-Assets Regulation (MiCA), a full licensing regime.
The two labels cover much the same businesses but serve different purposes. "VASP" defines who must apply anti-money laundering and counter-terrorist financing controls, and countries write it into their own laws in different ways. "CASP" defines who needs an EU authorisation to provide crypto services at all, with rules on capital, governance and investor protection. A firm in the EU is usually both: a CASP under MiCA and a VASP for AML purposes.
CASP vs VASP in plain terms
Think of a restaurant. Food-safety inspectors care whether the kitchen is clean, whatever the menu or the owner's finances. The licensing office cares about much more: whether the owner is fit to run a business, has enough money, follows fire rules and treats customers fairly. The same restaurant answers to both.
The VASP label is like the food-safety rulebook: a worldwide standard about one issue, stopping dirty money. The CASP label is like the full business licence for one region, the EU, covering how the firm is run from top to bottom. One business can carry both badges at once.
Origins of the two terms
FATF added the term "virtual asset service provider" to its glossary in October 2018 and amended Recommendation 15 so that countries must license or register VASPs and supervise them for anti-money laundering (AML) compliance. An interpretive note in June 2019 extended the FATF Travel Rule to virtual-asset transfers, requiring originator and beneficiary data to travel with them. National laws then used the term or close variants, for example the digital asset service provider (DASP) regime in France.
The EU adopted MiCA as Regulation (EU) 2023/1114. Its rules for CASPs have applied since 30 December 2024, and the transitional period for firms already operating under national regimes ended no later than 1 July 2026. Alongside it, the recast Transfer of Funds Regulation (EU) 2023/1113 applies the travel rule to crypto-asset transfers made by CASPs.
Side-by-side comparison
| Feature | VASP | CASP |
|---|---|---|
| Source | FATF Recommendations (global standard) | EU MiCA Regulation 2023/1114 |
| Legal force | Applies once each country writes it into law | Directly applicable in all EU member states |
| Main purpose | AML and counter-terrorist financing | Authorisation, conduct, prudential and investor-protection rules |
| Activities covered | Exchange between virtual assets and fiat, exchange between virtual assets, transfer, safekeeping and administration, and services for an issuer's offer | Ten listed services, including custody, operating a trading platform, exchange for funds or other crypto-assets, executing and transmitting orders, placing, advice, portfolio management and transfers |
| Capital | Set by national law, if at all | Minimum of €50,000, €125,000 or €150,000 depending on services |
| Cross-border reach | Registration is national | One authorisation can be passported across the European Economic Area |
Key practical differences
The biggest difference is scope of regulation. A VASP registration in many countries was little more than an AML sign-up: the firm showed it had a compliance officer, Know Your Customer (KYC) procedures and suspicious-activity reporting. A CASP authorisation also covers management fitness, conflicts of interest, complaints handling, safeguarding of client assets, outsourcing and, for trading platforms, rules against market manipulation.
The second difference is passporting. A CASP authorised in one member state can serve clients across the European Economic Area after a notification, whereas national VASP registrations never travelled. The third concerns what counts as a crypto-asset. MiCA has separate rules for issuers of asset-referenced tokens and e-money tokens, the EU's two categories of stablecoin, and it excludes unique non-fungible tokens and assets that are already financial instruments. The FATF definition is broader in principle and can catch some tokens MiCA leaves out.
Which businesses are caught
Under both regimes the usual examples are cryptocurrency exchanges, brokers, crypto custody providers and operators of a custodial wallet. Providers of non-custodial wallet software, who never control users' keys, generally fall outside both definitions, as do fully decentralised protocols with no identifiable operator, though FATF has warned that "decentralised" labels do not exempt people who in fact control a service. Transfers between a regulated firm and an unhosted wallet still trigger record-keeping and checks on the regulated side.
Outside the EU, other jurisdictions use their own terms within the FATF framework. In the United States, crypto exchangers are generally treated as money transmitters, needing federal registration and state licences such as a money transmitter license or New York's BitLicense. Differences between regimes create room for regulatory arbitrage, which both FATF and the EU have tried to narrow.