What Is VASP Licensing? Who Needs a Crypto License in 2026

VASP licensing is one of the first steps a crypto business must take before accepting customers. However, its requirements and even terminology vary significantly between countries.

While there is no single global “VASP license,” VASP is a Financial Action Task Force classification used by governments to implement their own regulatory systems. The EU now typically uses “crypto-asset service provider,” or CASP. The US focuses on money-transmitter rules, and Dubai still explicitly issues VASP licenses.

Related: MPC Wallet: Is Crypto Finally Moving Beyond Seed Phrases?

What Is VASP Licensing?

In general, VASP licensing is a type of regulatory authorization for businesses that provide virtual asset services.

The Financial Action Task Force defines Virtual Asset Service Providers as businesses that engage in one or more of these activities:

• Exchange of crypto and fiat
• Exchange of one virtual asset for another
• Transfer of virtual assets
• Safeguarding or administering virtual assets
• Providing certain financial services related to the issuance or sale of virtual assets

The FATF recommends that countries regulate VASPs for anti-money-laundering and counter-terrorist-financing purposes.

However, the FATF does not issue licenses. Instead, national regulators are responsible for identifying companies needing authorization and naming it. This is why the VASP licensing can mean obtaining a MiCA CASP authorization in the EU, VARA VASP license in Dubai, or SFC virtual-asset license in Hong Kong.

Who Needs a VASP License in 2026?

The simple test is whether a company provides crypto-related financial services for customers rather than simply using cryptocurrency for its own purposes.

Businesses that fall within VASP licensing requirements usually include:

• Crypto exchanges: Platforms that exchange fiat for crypto or one cryptocurrency for another are one of the clearest examples.
• Crypto brokers and dealers: Businesses that execute or arrange crypto purchases and sales for customers may require authorization.
• Custodians: A company holding private keys or otherwise controlling crypto on behalf of clients will generally face custody regulation.
• Crypto transfer and payment providers: Businesses transferring digital assets between customers, wallets, or jurisdictions may fall within money-transfer or VASP rules.
• Certain lending and investment platforms: Jurisdictions such as Dubai explicitly regulate virtual-asset lending, borrowing, management, and investment services.
• Some token and issuance businesses: Providing financial services connected with issuing or selling virtual assets can also enter the regulatory perimeter.

The exact answer is dependent on the activity and jurisdiction. A product requiring VASP licensing in Dubai may be regulated under a differently named license in Europe or Singapore.

Do Crypto Wallets Need VASP Licensing?

Not every wallet provider is automatically a VASP.

The crucial distinction is normally control.

A custodial wallet provider that holds users’ private keys or has the ability to transfer customers’ assets is much more likely to require authorization.

A company that merely publishes self-custody wallet software, without controlling user assets or intermediating transactions, may fall outside traditional VASP definitions.

However, calling software “non-custodial” does not automatically remove regulatory obligations. Regulators increasingly examine whether the product actually functions such that the operator controls transactions, charges for financial intermediation, or exercises meaningful influence over customer activity. The FATF explicitly favors a functional approach rather than relying on labels or technology.

Read More: Top 5 DEX Wallets in 2026: Which Crypto Wallet Is Best for DeFi and Swaps?

Do DeFi Projects Need a VASP License?

DeFi creates one of the most difficult areas of VASP licensing.

A genuinely decentralized protocol with no intermediary may be treated differently from a conventional crypto company. However, attaching a “DeFi” label to a product does not make its operators invisible to regulators.

Authorities can examine whether an identifiable company or group controls the front end, manages customer relationships, receives fees, administers keys, can alter the protocol, or otherwise facilitates regulated financial activity.

The legal treatment also varies sharply by jurisdiction.

How Does VASP Licensing Work in the European Union?

Under MiCA, the regulated entity is normally a Crypto-Asset Service Provider (CASP) rather than a VASP.

MiCA requires authorization for:

• Crypto custody
• Operation of trading platforms
• Exchange of crypto assets for fiat or other crypto assets
• Execution of orders and settlement
• Portfolio management
• Receiving or transmitting orders

The EU’s final transitional period expired on July 1, 2026.

That date matters. Legacy providers that had been operating under national rules could previously continue temporarily under MiCA’s transition arrangements. By July 1, unauthorized CASPs were required to stop providing crypto-asset services in the EU unless another MiCA provision allowed them to operate.

A MiCA-authorized CASP can benefit from a much more unified European framework rather than obtaining a completely separate crypto license in every member state.

So while businesses may still search for ”EU VASP licensing,” the actual authorization they generally need in 2026 is a MiCA CASP authorization.

How Does Crypto Licensing Work in the United States?

The US does not have one federal license called a VASP license.

FinCEN generally treats businesses that accept and transmit convertible virtual currency, or operate as certain crypto exchangers or administrators, as money transmitters and therefore Money Services Businesses.

With limited exceptions, an MSB must register with FinCEN and comply with Bank Secrecy Act requirements such as AML programs, recordkeeping, reporting, and transaction monitoring.

Registration with FinCEN is only part of the picture.

Depending on how the business operates, state money-transmitter licenses can also be required. Securities, commodities, banking, and other rules may apply as well.

Related: EU vs. Crypto: ECB Warns Stablecoins Could Drain Deposits Despite Europe’s MiCA

So, the simple act of registering as an MSB does not create a universal US crypto license.

For companies comparing VASP licensing jurisdictions, the US can be particularly complicated because federal and state obligations can overlap.

VASP Licensing in Dubai

Dubai offers one of the clearest examples of a jurisdiction still using the VASP terminology directly.

Any firm seeking to conduct regulated virtual-asset activities in or from Dubai, excluding the Dubai International Financial Centre, generally needs authorization from the Virtual Assets Regulatory Authority.

VARA licenses activities including:

• Advisory services
• Broker-dealer services
• Custody
• Exchange services
• Lending and borrowing
• Management and investment services
• Transfer and settlement
• Certain virtual-asset issuance

Companies can obtain authorization for multiple activities, although custody has specific segregation requirements.

Importantly, an in-principle approval does not permit a company to start serving customers. Full VASP licensing must be completed before regulated operations begin.

What About Hong Kong and Singapore?

Hong Kong still uses the VASP concept in its regulatory framework.

Centralized virtual-asset trading platforms operating in Hong Kong or actively marketing to Hong Kong investors must be licensed by the Securities and Futures Commission. Depending on the assets and services involved, platforms can fall under both securities legislation and the Anti-Money Laundering and Counter-Terrorist Financing Ordinance.

Singapore uses different terminology.

Companies providing regulated digital-payment-token services can require a payment-services license from the Monetary Authority of Singapore. Major Payment Institutions such as Ripple, Crypto.com, Paxos, and others currently hold authorization that includes Digital Payment Token Service.

What Does a VASP Licensing Application Usually Require?

Requirements vary, but regulators commonly examine the same core areas.

Applicants should expect to provide information about ownership, beneficial owners, directors, senior management, business operations, customer types, technology, and financial resources.

AML and sanctions controls are central. Businesses typically need policies covering customer identification, transaction monitoring, suspicious-activity reporting, sanctions screening, recordkeeping, and risk assessment.

Regulators may also examine:

• Cybersecurity and wallet controls
• Custody arrangements
• Segregation of customer assets
• Governance and internal controls
• Compliance staffing
• Outsourcing
• Business continuity
• Complaints procedures
• Market conduct
• Capital requirements

The licensing process is therefore much more than registering a company and paying a fee.

Read More: U.S. vs. Europe: Who Is Winning the Race to Regulate Crypto?

Can a Crypto Company Operate Without a VASP License?

Sometimes, but only if its activities genuinely fall outside the relevant regulatory perimeter or qualify for an exemption.

Using crypto for the company’s own account, developing software without providing a regulated financial service, or offering certain non-custodial technology may not automatically require VASP licensing.

Operating an exchange, holding customer assets, transmitting crypto, or offering other regulated services without required authorization is very different.

Location also does not solve the problem automatically. Many regulators consider whether a foreign company actively markets to or serves customers inside their jurisdiction. A company incorporated offshore can therefore still trigger local licensing requirements.

How to Know Which Crypto License You Need

Start with the activity rather than the company description.

Ask whether the business:

1. Exchanges crypto or fiat for customers.
2. Holds or controls customer assets.
3. Transfers virtual assets on behalf of users.
4. Operates a trading venue.
5. Arranges or executes customer transactions.
6. Provides crypto lending, investment, or advisory services.
7. Issues or distributes virtual assets as a financial service.

Then identify every jurisdiction where the company operates or actively serves customers.

Final Thoughts

VASP licensing is not one international license that lets a crypto company operate everywhere.

VASP is primarily a global regulatory classification. Individual jurisdictions have turned this concept into different licensing systems.

In 2026, the EU operates under MiCA CASP authorization, Dubai explicitly requires VARA VASP licenses, Hong Kong regulates virtual-asset trading platforms through the SFC, Singapore licenses digital-payment-token services, and the US uses a combination of federal MSB rules and other state and federal requirements.

The crucial question is therefore not “Do I call myself a VASP?”

It is “What financial service am I actually providing, and where am I providing it?”

That is what ultimately determines whether VASP licensing or another crypto authorization is required.