VASP (Virtual Asset Service Provider)

A Virtual Asset Service Provider (VASP) is the Financial Action Task Force's umbrella term for any business that, as a commercial activity, exchanges, transfers, safeguards, or administers virtual assets on behalf of another person. The category was defined by FATF to make clear which crypto businesses fall inside the regulated perimeter and therefore inherit anti-money-laundering duties. If a firm acts as a custodial intermediary between users and their coins, it is almost certainly a VASP somewhere. For sovereign Bitcoiners, the VASP definition matters less for what it regulates than for what it does not: the individual holding their own keys.

Who counts as a VASP

FATF's definition covers five activities performed for or on behalf of another person: exchanging virtual assets for fiat, exchanging one virtual asset for another, transferring virtual assets, safekeeping or administering them (custody), and providing financial services related to their issuance or sale. Typical VASPs therefore include centralized cryptocurrency exchanges, custodial wallet providers, over-the-counter trading desks, and crypto-to-fiat brokers. Once classified as a VASP, a business must register or obtain a license with its national regulator, run KYC and customer due diligence, monitor transactions, screen against sanctions lists, and comply with the Travel Rule when moving assets for clients. In the EU, the equivalent licensed category under MiCA is the Crypto-Asset Service Provider (CASP), and national implementations vary in detail while following the same FATF template.

The boundary with self-custody

The defining test is custody and control on behalf of others. A person running a node, holding coins in a hardware wallet, or using non-custodial software where users hold their own keys is generally not a VASP, because no third party controls the funds. FATF's own guidance has repeatedly wrestled with edge cases — non-custodial software developers, multisig co-signers who cannot move funds alone, miners, and node operators — and the prevailing interpretation in most jurisdictions is that writing software or validating transactions, without controlling customer assets, does not make you a service provider. This distinction is why decentralized, key-holding tools sit outside most of the regulated perimeter, and it is a recurring theme in digital-sovereignty design: the more of the stack you operate yourself, the fewer intermediaries stand between you and your money.

Why miners and node runners should care

Solo mining to your own wallet, running a full node, and practicing self-custody keep you on the individual side of the VASP line in most frameworks, because you never take custody of anyone else's assets. The picture changes the moment you hold funds for other people — operating a custodial pool that keeps member balances, running an exchange desk out of your shop, or providing hosted wallets. The practical lesson is architectural: designs that never touch other people's keys avoid the entire compliance apparatus, which is one reason the Bitcoin ecosystem keeps evolving toward non-custodial defaults, from wallets to Lightning to mining payout schemes.

The bigger picture

The VASP framework is, in effect, a map of where trusted third parties still exist in the virtual-asset economy — and regulation concentrates exactly where custody concentrates. Every layer you self-host removes you from that map: your keys, your node, your mining. That is not a loophole; it is the design intent of a peer-to-peer cash system working as advertised.

Two nuances round out the picture. First, VASP status is activity-based, not entity-based: a hardware shop that also brokers coin-for-cash trades can be a VASP for that activity alone, while its retail business stays outside the perimeter. Second, the perimeter keeps being tested at the edges — regulators continue to debate how non-custodial Lightning service operators, coinjoin coordinators, and DeFi front-ends should be treated, and outcomes differ by country. The stable core, though, has held for years: custody of other people's assets is the trigger. If you can unilaterally move a customer's funds, expect obligations; if you never could, most frameworks leave you alone.

This is educational content, not legal advice; obligations differ by jurisdiction and change over time. For related terms, see the FATF Travel Rule and MiCA (Markets in Crypto-Assets).