Overview
What Is a VASP License?
A Virtual Asset Service Provider (VASP) license is a regulatory authorization that permits a company to legally provide crypto-related financial services. The term "VASP" was introduced by the Financial Action Task Force (FATF) in 2019 through its updated Recommendation 15, which extended anti-money laundering (AML) and counter-terrorist financing (CFT) obligations to cryptocurrency businesses globally.
Under the FATF definition, a VASP is any natural or legal person that conducts one or more of the following activities as a business: exchange between virtual assets and fiat currencies; exchange between one or more forms of virtual assets; transfer of virtual assets; safekeeping and/or administration of virtual assets; and participation in and provision of financial services related to an issuer's offer and/or sale of a virtual asset.
Following FATF's guidance, 80+ jurisdictions have enacted domestic VASP legislation — from full licensing regimes (Singapore MAS, UAE VARA, Switzerland FINMA) to lighter-touch registration frameworks (Poland, Seychelles). The EU's MiCA regulation, effective December 2024, unified VASP rules across all 27 EU member states under the "CASP" (Crypto-Asset Service Provider) framework.
Failing to obtain the required VASP license exposes operators to criminal liability, asset seizure, and permanent market exclusion in the relevant jurisdiction. For established crypto businesses, unlicensed operations increasingly result in banking access being denied even in non-target markets.
Who Needs This License
Business Types That Require VASP Authorization
The following business models universally require VASP licensing or equivalent registration in any FATF-compliant jurisdiction where they operate or market their services:
Business Type
Centralized Crypto Exchange (CEX)
Order-book or AMM trading between fiat and crypto or crypto-to-crypto. Core VASP activity in all jurisdictions.
Business Type
Crypto Custodian / Wallet Provider
Any entity holding private keys on behalf of users. Requires custody-specific authorization in many jurisdictions.
Business Type
OTC Crypto Broker / Desk
Bilateral price negotiation for block crypto trades. VASP + potential broker-dealer license depending on jurisdiction.
Business Type
Crypto Payment Processor
Accepting crypto on behalf of merchants and converting to fiat. Often requires both VASP and EMI licensing.
Business Type
Crypto Transfer / Remittance Service
Moving crypto between wallets on behalf of third parties. Travel rule compliance required alongside VASP license.
Business Type
Token Issuance / IEO Platform
Platforms facilitating initial exchange offerings or token sales may require VASP and securities licensing.
Note on DeFi and DEXs: Purely non-custodial, decentralized protocols are generally not classified as VASPs under current FATF guidance. However, DEX front-ends operated by identifiable companies, DEX aggregators with custody elements, and protocols with admin keys that control user funds are increasingly subject to VASP scrutiny in the US, EU, and Singapore.
Key Requirements
Common VASP License Requirements Across Jurisdictions
While specific requirements vary significantly by jurisdiction, the following elements are universally required or near-universally required across major VASP licensing regimes:
AML/CFT Program
Comprehensive AML/KYC Policy
Written AML policy, KYC procedures, transaction monitoring, suspicious activity reporting protocols, and record-keeping requirements.
Corporate Structure
Local Legal Entity Required
Most jurisdictions require a locally incorporated company or branch. Some (Seychelles, Bahamas) permit foreign-owned entities.
Fit & Proper
Director & Shareholder Vetting
Criminal background checks, financial integrity assessments, and professional competency requirements for key controllers.
Compliance Officer
Dedicated MLRO / Compliance Lead
Named Money Laundering Reporting Officer (MLRO) with relevant qualifications. Often must be resident in the licensing jurisdiction.
Capital Requirements
Min. Capital: $0 – $5M+
Poland and Slovakia: no minimum. Seychelles: $50K. Lithuania/Estonia: €100–125K. Singapore: S$250K. Switzerland: CHF 300K+.
IT Security
Penetration Testing & Cybersecurity
IT security framework documentation, penetration test results, wallet security protocols, and hot/cold wallet storage policies.
Travel Rule
FATF Travel Rule Compliance
Originator and beneficiary information must be transmitted for crypto transfers above threshold. Technical solution required.
Business Plan
3-Year Financial Projections
Detailed business plan including target markets, revenue model, client onboarding projections, and 3-year financial forecast.
Top Jurisdictions
VASP License Jurisdiction Comparison 2025
The choice of jurisdiction dramatically affects your licensing timeline, capital requirements, tax obligations, and market access. The table below compares the eight most popular jurisdictions for VASP licensing:
| Jurisdiction | Regulator | Timeline | Min. Capital | Tax | Best For |
|---|---|---|---|---|---|
| Lithuania | FCIS | 2–4 months | €125,000 | 15% | EU passport, fast EU entry |
| Estonia | FIU | 3–6 months | €100,000 | 20% | EU passport, established framework |
| Poland | KNF | 4–8 weeks | None | 19% | Fastest EU entry, lowest cost |
| UAE (VARA) | VARA | 6–12 months | $400,000 | 0% | MENA hub, institutional credibility |
| Singapore (MAS) | MAS | 6–18 months | S$250,000 | 17% | Asia hub, institutional clients |
| Switzerland (FINMA) | FINMA | 6–12 months | CHF 300,000 | 8.5% | Prestige, banking relationships |
| Bahamas (SCB) | SCB | 3–6 months | $250,000 | 0% | Offshore, tax-free, credible |
| Seychelles (FSA) | FSA | 2–4 months | $50,000 | 0% | Fast offshore, lowest capital |
Application Process
How to Apply for a VASP License
The VASP licensing process follows broadly similar stages across jurisdictions, though timelines and specifics vary significantly. Here is the standard five-step process:
1
Jurisdiction Selection & Corporate Structuring
Choose the licensing jurisdiction based on your target markets, budget, and timeline. Incorporate a local legal entity (or branch). Appoint directors who meet fit-and-proper requirements. Open a local bank account for minimum capital deposit.
Timeline: 2–6 weeks
2
Policy & Documentation Preparation
Draft your AML/CFT policy, KYC/KYB procedures, transaction monitoring framework, and compliance manual. Prepare the business plan, financial projections, IT security documentation, and travel rule compliance solution. Gather fit-and-proper evidence for all key persons.
Timeline: 4–12 weeks
3
Application Submission
Submit the complete application package to the regulator. Pay government application fees (typically €500–$50,000 depending on jurisdiction). Some regulators require pre-application meetings or preliminary approval stages before formal submission.
Timeline: 1–2 weeks
4
Regulatory Review & Q&A
The regulator reviews your application and typically issues Requests for Information (RFIs) requiring additional documents or clarifications. Response quality and speed significantly affect overall timeline. Regulators in Singapore and Switzerland may conduct in-person interviews with key persons.
Timeline: 4 weeks – 12 months
5
License Grant & Ongoing Compliance
Upon approval, the license is issued and the company is registered in the VASP register. Ongoing obligations include annual reporting, periodic AML audits, regulatory fee payments, and compliance with evolving FATF and local AML requirements. Most licenses require annual renewal.
Ongoing: annual renewal
Cost Overview
VASP License Cost Breakdown by Jurisdiction
VASP licensing costs consist of four main components: government fees, legal/consulting fees, minimum capital (not a cost — held in the company), and ongoing compliance costs. The table below shows typical ranges by jurisdiction and activity type:
| Cost Component | Poland / Slovakia | Lithuania / Estonia | UAE VARA | Singapore MAS |
|---|---|---|---|---|
| Government / Application Fees | €500–€2,000 | €2,000–€5,000 | $15,000–$30,000 | S$5,000–S$10,000 |
| Legal & Consulting Fees | €5,000–€15,000 | €15,000–€30,000 | $30,000–$80,000 | S$50,000–S$150,000 |
| Incorporation & Setup | €1,000–€3,000 | €3,000–€8,000 | $5,000–$15,000 | S$3,000–S$8,000 |
| Min. Capital (held in company) | None | €100K–€125K | $400,000 | S$250,000 |
| Annual Compliance (ongoing) | €3,000–€8,000 | €8,000–€20,000 | $20,000–$50,000 | S$30,000–S$80,000 |
| Total First-Year Cost (ex-capital) | ~€10,000–€25,000 | ~€25,000–€60,000 | ~$70,000–$175,000 | ~S$80,000–S$250,000 |
◆ GLOBAL VASP LICENSING LANDSCAPE
Key Metrics Across Jurisdictions (2026)
145
FATF Member Jurisdictions with VASP Rules
8–16 weeks
Average Approval Timeline (Switzerland: 10 weeks)
CHF 50,000–250,000
Initial Capital Requirements (Jurisdiction-Dependent)
CHF 8,000–45,000
Annual License Fees Range
34
Tier 1/2 Jurisdictions with Streamlined VASP Pathways
6
Core Compliance Pillars Required Universally
◆ REGULATORY APPROACH COMPARISON
Prudential vs. Activity-Based Licensing Models
Prudential Regulation (Switzerland, Liechtenstein)
Capital Minimum
CHF 100,000–250,000
Approval Timeline
8–10 weeks
Ongoing Supervision
Full balance-sheet audits annually
Scope
All VASP activities (exchange, custody, staking)
Regulator
FINMA / FMA
Best For
Multi-service platforms, high-volume operators
Activity-Based Registration (Malta, Singapore, Hong Kong)
Capital Minimum
EUR 50,000–150,000 (activity-specific)
Approval Timeline
12–16 weeks
Ongoing Supervision
Risk-based compliance reports quarterly
Scope
Single or bundled activities (select services)
Regulator
MFSA / MAS / SFC
Best For
Specialized niche operators, P2P platforms
FAQ
VASP License — Frequently Asked Questions
Any business that exchanges crypto for fiat or other crypto, provides custody of digital assets, facilitates crypto transfers on behalf of clients, or operates a crypto brokerage typically requires a VASP license in any FATF-compliant jurisdiction where it operates. This includes centralized exchanges (CEXs), custodians, OTC desks, crypto payment processors, and certain DEX operators that exercise control over user funds. Non-custodial software developers and miners are generally excluded.
Poland and Slovakia offer the lowest-cost VASP-equivalent registrations in Europe — no minimum capital requirement, government fees under €2,000, and total licensing costs typically under €15,000. Seychelles FSA requires only $50,000 minimum capital and total costs around $25,000–$50,000 including consulting. These lightweight options are best suited to early-stage operators or businesses serving markets that accept these licenses. For EU market access, Lithuania at €125K capital remains the most cost-effective full EU-passportable option.
No single VASP license covers global operations. VASP licenses are jurisdiction-specific authorizations. The EU's MiCA CASP authorization comes closest to a multi-country passport — it permits operation across all 27 EU member states. For global operations beyond the EU, businesses typically use geo-blocking (restricting access to users in unlicensed jurisdictions) combined with a multi-license strategy, maintaining licenses in key target regions such as EU, UAE, Singapore, and optionally an offshore license for other markets.
Timelines range from 4–8 weeks (Poland VASP registration) to 6–18 months (Singapore MAS full licensing). Key factors affecting timeline: jurisdiction selection, completeness of initial application, regulator workload, quality of AML policies, and whether directors require additional background checks. Lithuania and Estonia typically complete in 2–4 months with a well-prepared application. UAE VARA takes 6–12 months. Singapore MAS averages 12–18 months. Allow 4–12 additional weeks for document preparation before submission.
Core documents across all jurisdictions include: (1) AML/CFT policy and KYC/KYB procedures, (2) Business plan with financial projections, (3) Fit-and-proper declarations and CVs for directors and shareholders owning 10%+, (4) Corporate documents — articles of incorporation, ownership structure chart, (5) IT security framework and penetration testing results, (6) Compliance officer/MLRO appointment letter and CV, (7) Travel rule compliance solution documentation, and (8) Source of funds for initial capital. Some jurisdictions additionally require PI insurance, external audit commitments, or local office lease agreements.
Annual maintenance costs typically range from CHF 5,000 to CHF 15,000 depending on your jurisdiction and business model, covering regulatory compliance, reporting obligations, and administrative fees. Switzerland's FINMA charges an annual supervision fee based on your company's revenue and risk profile, while other jurisdictions may have flat fees or tiered structures. You should also budget for compliance software, legal counsel, and internal audit functions, which can add another CHF 20,000 to CHF 50,000 annually for mid-sized operations.
Yes, most jurisdictions require you to maintain a dedicated bank account and demonstrate banking relationships before and during the licensing process. Swiss authorities and FATF-compliant regulators expect VASP operators to have established banking partnerships, which can be challenging as many traditional banks remain hesitant to serve crypto businesses. We recommend securing banking relationships 3-4 months before applying, as this is often a bottleneck in the licensing timeline.
Operating without a valid license exposes you to significant fines (typically CHF 50,000 to CHF 500,000+), criminal liability, asset freezes, and forced business closure depending on your jurisdiction. Your customers' funds may be at legal risk, and you could face personal director liability in many European countries. We strongly recommend implementing renewal reminders at least six months before expiration and beginning the renewal process three months in advance.
VASP licensing itself doesn't create additional tax liability, but it subjects your business to enhanced reporting requirements including beneficial ownership disclosure, transaction reporting, and customer KYC documentation that tax authorities will scrutinize. Switzerland requires VASPs to report suspicious transactions to MROS (Money Laundering Reporting Office), and most EU jurisdictions mandate quarterly tax filings based on transaction volumes. You should engage a crypto-specialized tax advisor early, as improper tax treatment can result in penalties ranging from 20-100% of unpaid taxes.
Operating in the EU with a non-EU VASP license is legally risky and increasingly restricted under MiCA (Markets in Crypto-Assets Regulation) which came into full effect in 2024. Some countries accept licenses from FATF-equivalent jurisdictions (like Switzerland or Liechtenstein) with additional documentation, but most EU regulators require local licensing. If you're licensed outside the EU and want to serve EU customers, you'll likely need to obtain a separate EU license or use a licensed local partner.
Regulators expect VASPs to deploy AML/KYC software, transaction monitoring systems, and record-keeping platforms meeting FATF Travel Rule standards before license approval. Industry-standard systems cost between CHF 15,000 and CHF 100,000 annually depending on transaction volume and feature complexity, with vendors like Chainalysis, TRM Labs, and Elliptic being common choices. Additionally, you need internal audit trails, customer risk assessment tools, and suspicious activity report generation capabilities built into your operations.
VASP licenses are narrower in scope, allowing you to custody and trade cryptocurrencies but not accept fiat deposits or issue credit products as traditional banks do. Bank licenses require substantially higher capital requirements (typically CHF 10+ million versus CHF 250,000-2 million for VASPs), longer approval timelines (2-4 years versus 6-12 months), and more extensive regulatory oversight. A VASP license is appropriate if you focus on crypto trading and custody, while banking services require traditional banking licenses with separate regulatory frameworks.
Related Pages