Virtual Assets Services Provider (VASP) License

The VASP classification applies in jurisdictions that have implemented FATF recommendations directly: SVG, Panama, Georgia, BVI, Czech Republic, and others. EU member states have replaced this framework with the Markets in Crypto-Assets Regulation (MiCA) CASP (Crypto-Asset Service Provider) authorization regime from January 2026.

For businesses targeting EU markets or EU-based clients, CASP authorization under MiCA applies. For businesses targeting offshore, LATAM, MENA, or Asian markets, a VASP license in the relevant jurisdiction is the applicable route.

See CASP License and MiCA Compliance for the EU licensing pathway.

VASP license costs vary significantly by jurisdiction, driven by government fees, minimum capital requirements, and local substance obligations. The table below shows indicative VASP price ranges for the jurisdictions most frequently pursued by LegalBison’s clients.

All figures are indicative ranges based on publicly available regulatory data and LegalBison’s implementation experience. Exact costs depend on corporate structure, business model, and local agent fees. A scoped proposal with jurisdiction-specific pricing is available from the LegalBison client engagement team.

The optimal jurisdiction depends on target markets, capital position, regulatory timeline, and banking accessibility. The following outlines the most common routes LegalBison clients pursue.

SVG (St. Vincent and the Grenadines)

SVG operates one of the most accessible VASP registration regimes globally. No minimum capital applies, and the process typically completes within 4-8 weeks. SVG is widely used by exchanges targeting global retail markets with no EU or US client base. The jurisdiction imposes no substance requirement for the registration itself, though banking relationships for SVG-registered entities require careful structuring.

Panama

Panama’s framework involves a supervisory review but no minimum capital requirement. Panama’s geographic positioning and USD-based banking system make it a practical choice for LATAM-focused and North America-serving crypto businesses. The application process typically runs 3-6 months.

Georgia

Georgia has emerged as a fast, cost-accessible authorization market, particularly for exchanges seeking regulated status without the capital obligations of EU licensing. The National Bank of Georgia oversees the process. Typical timelines run 4-8 weeks, and no minimum capital applies. Compliance leads at growing exchanges increasingly cite Georgia as a practical first-regulated-market license before pursuing EU authorization.

BVI (British Virgin Islands)

The BVI VASP Act requires licensing for entities operating virtual asset services from BVI or targeting BVI residents. The BVI Financial Services Commission (FSC) supervises the process, which runs 4-8 months. BVI is frequently used in holding and operational structuring for multi-jurisdictional crypto groups, often alongside a trading-jurisdiction license elsewhere.

Czech Republic

The Czech crypto trade license process is fast (4-8 weeks), low-cost, and carries no capital requirement. For businesses that need a European entity footprint without full MiCA authorization obligations, the Czech route remains viable for specific activities. The applicable activity scope and transition timeline under the EU framework should be reviewed before selecting this route.

EU (CASP/MiCA)

EU-regulated operations require CASP authorization, not a VASP license. Full detail is on the CASP License page. CASP authorization under MiCA provides EU passporting across all 27 member states, which justifies the higher capital and compliance obligations for businesses with a genuine EU client base.

UK

UK crypto businesses must register with the Financial Conduct Authority (FCA) as a cryptoasset business under the Money Laundering Regulations. The UK process carries a high rejection rate and detailed AML program requirements. FCA registration is primarily relevant for businesses with direct UK retail exposure.

Explore other VASP-adjacent terminologies in one of our comprehensive blog post explaining the types of crypto licenses.

What businesses are legally required to have a VASP license?

Any business that offers virtual assets related services needs a license. The following business types are the most common license applicants.

Centralised Exchanges (CEX)

A centralised exchange matches buy and sell orders for crypto assets and typically holds client funds in custodial wallets during the trading process.

This custody element, even if only for the duration of settlement, brings the business squarely within VASP scope.

Crypto exchange licensing requirements apply in virtually every major jurisdiction.

Brokerages and OTC Desks

Firms that execute large-volume trades directly with counterparties, rather than through an order book, perform the exchange and transfer functions defined by FATF. OTC desks that settle in fiat also trigger fiat-on/off-ramp licensing requirements in some jurisdictions.

Custodial Wallets and Custody Providers

Any service that holds private keys on behalf of clients, whether a standalone custody product or a wallet integrated into an exchange, requires authorization. The safekeeping definition under FATF is explicit. Non-custodial wallets, where the user controls their own keys, sit outside this scope.

Crypto Payment Processors and Gateways

Businesses that enable merchants to accept crypto and settle in fiat, or that route crypto payments between parties, perform asset transfers on behalf of third parties. Most FATF-compliant jurisdictions treat this as a licensed activity.

On/off-ramp services specifically require attention to cross-border payment regulations alongside VASP licensing.

Issuance-Related Services (ICOs, IEOs, Launchpads)

Platforms that facilitate the offer or sale of a virtual asset on behalf of an issuer, including token launchpads, IEO platforms, and certain token issuance services, fall within VASP scope under the FATF framework.

The licensing requirement applies to the intermediary, not only the issuer.

Crypto P2P Platforms

Peer-to-peer platforms that match buyers and sellers and facilitate settlement, even without taking custody themselves, may be classified as VASPs depending on the jurisdiction and the level of control the platform exerts over the transaction flow.

Where the platform holds escrow during the transaction, the custody argument becomes stronger.

Crypto Casinos and Gaming Platforms

Online gaming and gambling operators that accept, hold, or pay out in crypto assets are subject to VASP requirements in a growing number of jurisdictions, independently of any gaming license they may hold. The VASP obligation attaches to the crypto-handling function, not the gambling activity.

GameFi and play-to-earn platforms sit in the same regulatory space, with additional complexity where in-game assets have real-world value and are transferable on-chain.

Banking Institutions Offering Crypto Asset Services

Traditional banks and electronic money institutions (EMIs) entering the crypto space are not automatically exempt by virtue of their existing authorization. In most jurisdictions, offering crypto exchange, custody, or transfer services requires either a separate VASP authorization or an extension of the existing license scope.

This applies equally to neobanks and FinTech payment providers expanding into digital asset products.

Who does not need a VASP license

• Pure software developers building non-custodial tools;
• Self-custody wallet providers where users retain control of private keys;
• Blockchain infrastructure providers that do not handle client assets.

Such business models are generally outside VASP scope. The line is custody and control, not proximity to crypto.

Why do you need a VASP License?

Regulatory compliance is not the only reason to obtain a license. It is the most immediate, but it is not the most commercially important.

Banking and on/off-ramping

This is the practical bottleneck for most operators. Tier-1 banks and major payment processors (Stripe, Checkout.com, and their equivalents) will not open accounts for, or process payments, on behalf of unlicensed crypto businesses.

A valid VASP license is a prerequisite, not a differentiator. Without it, off-ramping client funds to fiat is virtually impossible.

Enforcement exposure

Operating without a required license exposes founders and the entity to cease-and-desist orders, asset freezes, substantial fines, and in some jurisdictions, criminal liability.

Regulators in the EU, UAE, Singapore, and the UK have all pursued unlicensed operators aggressively in recent years.

Institutional capital and client trust

Venture funds performing due diligence on crypto businesses require regulatory standing as a baseline.

High-net-worth clients and institutional counterparties operate under their own compliance obligations and cannot engage with unregulated entities.

A license signals that the business has been audited, that AML/CTF frameworks are in place, and that management meets fit-and-proper standards.

Market access and geographic expansion

Certain jurisdictions restrict crypto services to licensed entities only, by law. Others do not prohibit unlicensed activity explicitly but make it commercially non-viable through banking restrictions.

For businesses with cross-border ambitions, the licensing question is also a market access question.

• A CASP license issued under MiCA, for example, opens 27 EU member states from a single authorization;
• A Cayman Islands VASP registration carries international recognition that facilitates relationships with global prime brokers and custodians. Jurisdiction selection is not only about compliance cost. It determines the markets you can serve.

Request advice from a specialist for free

Requirements vary by jurisdiction but follow a common structure derived from FATF standards. The following describes the standard obligations LegalBison prepares clients to meet.

1. Company Formation. Most jurisdictions require the applicant to be a locally incorporated entity. LegalBison’s licensed Corporate Service Provider infrastructure handles company formation in the relevant jurisdiction as part of the process.
2. Minimum Capital. Capital requirements range from zero (SVG, Georgia, Panama, Czech Republic) to meaningful reserves (BVI, UK, EU). Where capital requirements apply, documentation proving paid-up capital must accompany the application.
3. Fit and Proper Assessment. Directors and ultimate beneficial owners (UBOs) are subject to background checks, criminal record requirements, and in many jurisdictions, a formal fit-and-proper declaration. Prior financial sanctions or criminal convictions in relevant categories are typically disqualifying.
4. AML/KYC Program. A written AML/KYC policy covering customer due diligence, enhanced due diligence triggers, record-keeping, and suspicious activity reporting is required across all regulated VASP jurisdictions. LegalBison’s compliance team designs and documents AML programs to regulator-specification standards.
5. Travel Rule Compliance. FATF Recommendation 16 (the Travel Rule) requires VASPs to collect and transmit originator and beneficiary information for virtual asset transfers above a defined threshold. Technology solutions for Travel Rule compliance (such as Notabene or Sygna) are required as part of the application in regulated jurisdictions.
6. Transaction Monitoring. An operational transaction monitoring system capable of flagging suspicious patterns and generating regulatory reports is a standard requirement in full authorization regimes.
7. MLRO Appointment. A qualified Money Laundering Reporting Officer (MLRO) must be appointed for most authorization regimes. LegalBison’s talent sourcing function assists clients in identifying qualified MLROs where the client does not have one in-house.
8. Local Substance. Physical presence requirements vary. SVG and Georgia impose minimal or no substance requirements. BVI requires local agent representation. EU CASP authorization under MiCA requires genuine substance in the licensing member state, including local staff and decision-making capacity.

• Dubai (VARA): The VARA regulatory framework has matured into one of the most complete crypto regulatory regimes globally. Dubai offers strong banking access, a commercially sophisticated environment, and growing institutional credibility. Best suited for businesses targeting MENA and institutional clients, or those building toward a major fundraise;
• EU (MiCA/CASP): The MiCA regulation creates a passportable authorization across all EU member states from a single licensing jurisdiction. Lithuania and Poland are both active MiCA authorization markets. Timeline is longer, as MiCA applications are thorough, but the output is a license recognized across 27 countries;
• Singapore (MAS): The Monetary Authority of Singapore runs a stringent licensing process with high substance requirements. Singapore is the benchmark jurisdiction for Asian market access and is the preferred domicile for businesses with APAC ambitions.

• Canada (MSB): FINTRAC-regulated, no fees, no minimum capital, Foreign MSB option for non-Canadian entities, North American credibility;
• Georgia: NBG VASP framework (2023), broadest activity scope in its class (including ICOs), with a low licensing fee and 3–4 month timeline. Crypto-friendly jurisdiction with Eurasian positioning;
• Cayman Islands: Preferred for funds and custody providers with a global client base. Strong legal infrastructure, no capital gains tax, and broad international recognition.

• BVI: The fastest route to a VASP registration for businesses that need speed and flexibility. BVI is appropriate as a starting jurisdiction for pre-revenue projects, often combined with a licensing roadmap to a Tier 1 jurisdiction as the business scales and banking requirements tighten;
• Seychelles: Comparable to BVI in terms of speed and cost. The Seychelles Financial Services Authority has processed a significant volume of crypto registrations. Appropriate for specific business models, particularly those with non-EU, non-US client bases, but the jurisdiction carries less banking recognition than Cayman or EU-licensed entities.

LegalBison is a global boutique legal and business services firm and licensed Corporate Service Provider specializing in crypto licensing, FinTech regulation, and cross-border corporate structuring. The firm advises exchanges, custodians, OTC desks, payment processors, and token issuers across the world.

The firm’s approach to VASP licensing covers the full cycle:

• Business model analysis and jurisdiction selection. Before any application is filed, LegalBison maps the client’s activities against the regulatory frameworks of candidate jurisdictions, including Lithuania, Panama, SVG, Georgia, and BVI, identifying the optimal path based on timeline, cost, banking viability, and market access objectives.
• Entity setup and corporate structuring. The legal entity and ownership structure must be designed to pass a fit-and-proper review. LegalBison handles incorporation, directorship arrangements, and beneficial ownership documentation.
• Substance and operational infrastructure. Local office, resident director, and qualified MLRO requirements are coordinated through the firm’s established network in each jurisdiction.
• AML/CTF and compliance framework build-out. Application packages require substantive compliance documentation. LegalBison builds or audits the AML/CTF program, including Travel Rule provider selection and KYC/AML software integration.
• Application preparation and regulator communication. The firm prepares the full application package and manages regulator correspondence through the review period. Average review periods run 3 to 9 months, depending on the jurisdiction; LegalBison sets realistic expectations and manages the timeline.
• Post-licensing compliance. A VASP license is not a one-time exercise. Ongoing obligations include annual audits, regulatory reporting, capital adequacy monitoring, and framework updates as regulations evolve. In several jurisdictions, the regulator conducts periodic supervisory reviews and can revoke authorization for compliance failures. LegalBison supports clients through the full operational lifecycle, including annual compliance reviews, regulatory change monitoring, and coordination with local MLROs and auditors as the business scales.

For EU-focused operators, the MiCA regulation introduces a parallel authorization track under the CASP framework, with its own grandfathering timelines and passporting implications. LegalBison advises on both VASP and CASP licensing pathways, including how existing VASP registrations interact with MiCA transition provisions across member states.

LegalBison’s network spans over 50 jurisdictions across Europe, the Middle East, Asia, Latin America, and the Caribbean. The firm’s cross-border corporate structuring capability means that licensing is designed in coordination with the wider group structure, not in isolation. Tax positioning, substance planning, and banking strategy are addressed as part of the same engagement, not as afterthoughts once the license is in hand.