VASPs offer services such as … [1]

  • Exchange between virtual (crypto) assets and fiat currencies
  • Exchange between one or more forms of virtual (crypto) assets
  • Transfer of virtual assets
  • Safekeeping and/or administration of virtual (crypto) assets or instruments enabling control over virtual (crypto) assets
  • Participation in and provision of financial services related to an issuer’s offer and/or sale of a virtual (crypto) asset

Definition of a Virtual Asset Service Provider

The definition above is the one presented by the Financial Action Task Force (FATF), the global money laundering and terrorist financing watchdog. [2] Although this definition is not legally binding, most countries have accepted it and used it when drafting laws. [3] [4] That said, the definition may differ depending on the jurisdiction. Practical examples of VASPs are crypto exchanges, custodial wallet providers, but also individuals and companies that send or invest in cryptocurrencies on someone’s behalf as a business. If you send or stake some cryptocurrencies on behalf of one of your friends incidentally, you will not qualify as a VASP. [5]

In the event that your business runs a fully equipped crypto exchange, the assessment is rather easy. However, the guidelines from the FATF become a bit hazy when it concerns less outright cases. For example, if you run a DeFi protocol, it does not automatically mean that you qualify as a VASP. The key is that you a) control crypto assets and b) you do so on behalf of another person or entity. Even though most true DeFi believers won’t like it, this definition does include platforms that run fully automated non-custodial smart contracts. If these contracts perform any of the services mentioned above, the operator will qualify as VASP. [6] However, this may seem very straightforward, but figuring out who the operator of a fully automated non-custodial smart contract is, is often not so easy.

Furthermore, the last bullet point above, “participation in and provision of financial services related to an issuer’s offer and/or sale of a virtual (crypto) asset”, also knows a bit of nuance. This service relates to the offering or sale of virtual (crypto) assets. In other words, initial coin offerings (ICOs) and similar services. However, if your business just creates a new cryptocurrency, but doesn’t issue or offer it to the public, you will not qualify as a VASP. [7] The key here is to look closely at the term in question “Crypto Asset SERVICE PROVIDER”. In other words, if you don’t provide a service (to others) you will not meet the definition. The same applies if you have a business that internally swaps fiat money for cryptocurrencies. If these transactions are to remain within the business (ie. there are not performed on someone else behalf) your business will not qualify as a VASP. [8]

Virtual Asset Service Providers and the law

Determining if a person or business qualifies as a VASP is important because it exposes that person or business to a range of laws that apply to VASPs. Below you can find some examples.

  • VASPs in the EU have to comply with their Member State’s implementation of the Anti-Money Laundering Directive and obtain registration with the designated authority of the Member State in which the VASP is located. [9]
  • VASPs in the Cayman Island are subject to a registration requirement with the Cayman Islands Monetary Authority (CIMA) and in the future will be required to obtain a license from CIMA under the VASP Act. [10]
  • VASPs in Hong Kong will be (the law has not been implemented yet) required to obtain a licence from the Hong Kong Securities and Futures Commission (SFC) under the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Bill 2022. [11] [12]

Virtual Asset Service Providers under MiCA (EU)

The EU’s Market in Crypto-Assets (MiCA) Regulation has a broader definition as compared to the above. Currently, the most common definition of a VASP (MiCA uses CASP) is a person or company that on a professional basis provides services for others that involve: [13]

  • Exchanging fiat currencies for cryptocurrencies and vice versa (or)
  • Providing custodian wallet services

This definition leaves a lot of room. Just think about any decentralized exchange (DEX) that doesn’t provide a custodian wallet and doesn’t allow you to swap for fiat currencies. All these DEXs are “out of scope” of this definition. The EU was well aware of this when they wrote the AMLD5. In recital 9 (recitals explain the thought/intention of the law) you can read that the EU has thought about this, but perhaps didn’t have an answer at the time (AMLD5 was finalized in 2018). [14]

To address this gap, The EU made sure to widen the definition of a VASP under the new MiCA Regulation. In Article 3 of the provisional text you can read: [15]

‘crypto-asset service provider’ means any person whose occupation or business is the provision of one or more crypto-asset services to third parties on a professional basis;

‘crypto-asset service’ means any of the services and activities listed below relating to any crypto-asset:

(a) the custody and administration of crypto-assets on behalf of third parties;
(b) the operation of a trading platform for crypto-assets;
(c) the exchange of crypto-assets for fiat currency that is legal tender;
(d) the exchange of crypto-assets for other crypto-assets;
(e) the execution of orders for crypto-assets on behalf of third parties;
(f) placing of crypto-assets;
(g) the reception and transmission of orders for crypto-assets on behalf of third parties
(h) providing advice on crypto-assets;

As you can see, the definition of a VASP is much broader as compared to the old one in the AMLD5. However, MiCA does exclude providers that are “fully decentralized”, but there is a lot of debate about what “fully decentralized” means or that it even exists. [16] For example, a DEX might claim be to “fully decentralized” but the founders still hold more than have of the governance tokens, is it really?

SOURCES

  1. Financial Action Task Force | Updated Guidance For A Risk-Based Approach, Virtual Assets and Virtual Asset Service Providers
  2. Financial Action Task Force | About
  3. Norton Rose & Fullbright LLP | New FATF guidance released on virtual assets and virtual asset service providers | Authors: Andrew James Lom, Kim Caine & Rachael Browndorf
  4. Arthur Cox LLP | AML Update: Crypto-Assets – VASPs must register with Central Bank
  5. Idem.
  6. Norton Rose & Fullbright LLP | New FATF guidance released on virtual assets and virtual asset service providers | Authors: Andrew James Lom, Kim Caine & Rachael Browndorf
  7. Idem.
  8. Idem.
  9. European Commission | Strengthened EU rules to prevent money laundering and terrorism financing | Author: Věra Jourová
  10. Cayman Islands Monetary Authority | VASP Registration/Notification Requirements
  11. Mayer Brown LLP | New Regulatory Regime for Virtual Asset Service Providers in Hong Kong – Are You Ready? | Authros: Alan H. Linning, Wei Na Sim & Charlene C. L. Wong
  12. Legislative Council of Hong Kong | Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Bill 2022 
  13. AMLD, 5th Amendment, (EU) 2018/843, Article 1 (c) g & h.
  14. AMLD, 5th Amendment, (EU) 2018/843, Recital 9
  15. Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on Markets in Crypto-assets, and amending Directive (EU) 2019/1937, Article 3 (8) & (9)
  16. Dirk Zetzsche, Ross Buckley, Douglas Arner, Maurits van Ek, Remaining regulatory challenges in digital finance and crypto-assets after MiCA (Policy Department for Economic, Scientific and Quality of Life Policies at the request of the Committee on Economic and Monetary Affairs (ECON), 2023).