VASP Licensing: Global Requirements for Virtual Asset Service Providers in 2026

Any company that holds, exchanges, or transfers cryptocurrency on behalf of users is almost certainly a virtual asset service provider (VASP). That classification triggers licensing requirements, but which requirements depend entirely on where the business operates and where its users live. The result is a compliance maze: capital minimums range from EUR 50,000 in the EU to millions of dollars across US states, approval timelines span three months to two years, and the Travel Rule threshold for sharing customer data varies from zero euros to $3,000 depending on jurisdiction.

For crypto businesses in 2026, the question is no longer whether regulation is coming. As of July 2026, 91 of 109 surveyed jurisdictions have passed Travel Rule legislation according to the FATF's Seventh Targeted Update, up from 65 just two years earlier. The question is how to navigate a patchwork of regimes that often conflict with one another.

What Makes a Business a VASP?

The Financial Action Task Force (FATF) defines a VASP as any entity that conducts exchange between virtual assets and fiat currencies, exchange between virtual assets, transfer of virtual assets, safekeeping or administration of virtual assets, or participation in financial services related to virtual asset issuance or sale. Most jurisdictions have adopted this definition with local variations.

The definition is deliberately broad. An exchange that converts Bitcoin to dollars is a VASP. A custodial wallet that holds user funds is a VASP. A payment processor routing stablecoin settlements is almost certainly a VASP. Even an OTC desk facilitating large trades between institutions qualifies. What typically falls outside the definition: software developers who build non-custodial wallets where users retain full control of their own keys, mining and validation operations, and blockchain analytics providers.

The FATF Travel Rule: Global Baseline

The Travel Rule (FATF Recommendation 16, renamed to "Payment Transparency" in June 2025) requires VASPs to collect and share originator and beneficiary information for qualifying transfers. The FATF baseline threshold is USD/EUR 1,000: above this amount, full identifying data must accompany the transaction.

Required data fields include the originator's full name, account number or wallet identifier, and either a physical address, national ID number, or date and place of birth. Beneficiary data mirrors these requirements. For cross-border transfers above $1,000, the June 2025 revision added that firms should include the originator's address and date of birth.

Implementation Status

The FATF's Seventh Targeted Update, published July 16, 2026, found that 83% of surveyed jurisdictions (91 of 109) have enacted Travel Rule legislation. Among the 69 "materially important" markets handling approximately 97% of global virtual asset volume, the figure reaches 94%.

The sunrise problem: VASPs in compliant jurisdictions must still transact with counterparties in regions that have not implemented the Travel Rule. Those counterparties have no legal obligation to share data, creating a gap the FATF acknowledges remains "unsolved." Interoperability between competing Travel Rule protocols (TRP, TRISA, Sygna Bridge, TRUST Network) adds another layer of friction.

Despite legislative progress, enforcement lags behind: 60% of jurisdictions with Travel Rule laws have not yet issued a single supervisory finding or enforcement action related to compliance. Four jurisdictions: Argentina, Cambodia, Colombia, and Vietnam: have no Travel Rule framework at all.

European Union: MiCA

The Markets in Crypto-Assets Regulation (MiCA) established the world's first comprehensive crypto licensing framework. The full Crypto-Asset Service Provider (CASP) authorization regime became applicable on December 30, 2024, with a maximum grandfathering period that expired on July 1, 2026.

As of late July 2026, approximately 320 firms hold CASP authorizations across 26 EU/EEA countries, according to ESMA's official register. The Netherlands, Germany, and Malta lead in licensed firms. A single MiCA authorization passports across all 27 EU member states plus the broader EEA: a market of roughly 450 million people.

Capital Requirements

MiCA defines three tiers of minimum own funds based on the services provided. CASPs must hold the higher of the tier minimum or one quarter of the previous year's fixed overheads.

If a CASP holds permissions across multiple classes, the highest applicable threshold applies. In practice, the statutory 25-business-day completeness check and 40-business-day review timeline stretches to 8 to 12 months for most applicants, with two to three rounds of regulator clarification on AML/KYC procedures and governance documentation.

United States: The State-by-State Patchwork

The US has no single federal crypto license. Instead, businesses face a layered system: federal registration with FinCEN as a Money Services Business (MSB), plus individual money transmitter licenses in most states.

Federal Requirements

FinCEN registration is mandatory for all crypto businesses operating as money transmitters under the Bank Secrecy Act. Registration requires filing Form 107 within 180 days of establishment, with biennial renewal. Operating without registration is a federal crime carrying up to $250,000 in fines and five years in prison. BSA compliance obligations include a designated compliance officer, written AML policies, employee training, independent audit, and risk-based customer due diligence.

State Licensing

Most states require a separate money transmitter license. Montana is the only state with no money transmitter statute. A handful of states provide exemptions for certain crypto activities: New Hampshire, Wyoming, Utah, Hawaii, Texas (non-stablecoin crypto), and South Carolina each carve out some virtual currency operations, though fiat-on-ramps and custody services typically still trigger licensing even in those states.

Surety bond requirements range from $10,000 in smaller states to $7 million in California (volume-based). Net worth requirements range from $25,000 (Alabama) to $1,000,000. Processing timelines run 6 to 18 months per state. New York's BitLicense, required in addition to a standard MTL, costs approximately $2.1 million in direct expenses and takes 18 or more months. California's Digital Financial Assets Law went live on July 1, 2026, adding a dedicated digital-asset licensing regime on top of the existing MTL framework.

Federal legislation is catching up: The GENIUS Act, signed into law on July 18, 2025, created the first federal licensing framework for payment stablecoin issuers. The CLARITY Act, which would establish a broader federal market structure framework, passed the House in July 2025 and advanced through the Senate Banking Committee in May 2026 but has not yet become law.

OCC National Trust Bank Charters

The Office of the Comptroller of the Currency has been actively granting national trust bank charters to crypto firms. In December 2025, the OCC conditionally approved five applications simultaneously, including Circle and Ripple. By mid-2026, eleven companies had filed for or received OCC charter approvals in an 83-day span: Circle, Ripple, BitGo, Paxos, Fidelity Digital Assets, Bridge, Crypto.com, Protego, Morgan Stanley, Payoneer, and Zerohash. The OCC received 14 de novo charter applications in 2025 alone, nearly equaling the total from the previous four years.

United Kingdom: From Registration to Full Authorization

The UK is transitioning from a narrow AML registration regime to comprehensive regulation under the Financial Services and Markets Act. Currently, 44 firms hold FCA crypto registration. The historical approval rate was under 15%, though it improved to roughly 45% in the year to April 2026. Recent approvals include BlackRock and Standard Chartered.

The FCA published five final policy statements (PS26/9 through PS26/13) on June 30, 2026, establishing the new FSMA-based authorization regime. The authorization application window opens September 30, 2026 and closes February 28, 2027. The mandatory regime goes live on October 25, 2027. Existing AML-registered firms will not be automatically converted: each must apply separately for FSMA authorization.

Capital requirements under the new regime use a K-factor approach. Stablecoin issuers face a permanent minimum requirement of GBP 350,000, plus risk-sensitive K-factor calculations. Preparation costs for full FSMA authorization run GBP 40,000 to 150,000 or more, depending on complexity.

Singapore: Payment Services Act

Singapore's Monetary Authority (MAS) regulates digital payment token (DPT) services under the Payment Services Act. As of July 2026, 38 firms hold active Major Payment Institution (MPI) licenses for DPT services.

Capital requirements differ by license tier: Standard Payment Institutions require SGD 100,000 in base capital (monthly DPT volume under SGD 3 million), while MPIs require SGD 250,000 (SGD 500,000 for most DPT-specific services). The Financial Services and Markets Act (FSMA) added a Digital Token Service Provider (DTSP) license on June 30, 2025, covering Singapore-based entities serving overseas customers. MAS has stated it will "only grant a DTSP licence under extremely limited circumstances."

UAE: VARA in Dubai

Dubai's Virtual Assets Regulatory Authority (VARA), established in March 2022, regulates seven categories of virtual asset activity. As of June 2026, VARA had issued 50 licenses, though only 39 were fully operational at the end of 2025.

Capital requirements vary significantly by activity. Exchange services require the most capital at AED 5,000,000 (approximately $1.36 million), while advisory services start at AED 500,000 ($136,000). Capital is cumulative across multiple activity categories, and VARA requires physical office presence in Dubai. Additionally, VASPs must maintain expense-based capital of at least 1.2x monthly operational expenses in liquid assets.

Asia-Pacific: Japan and Hong Kong

Japan

Japan requires FSA registration for all crypto-asset exchange and custody services. As of April 2026, 28 exchanges are registered. The statutory minimum capital is JPY 10 million (approximately $70,000), though the FSA typically expects significantly higher capitalization. In July 2025, Japan's Diet passed legislation reclassifying crypto-assets as "specified cryptoassets" under the Financial Instruments and Exchange Act (FIEA), with full enforcement effective June 13, 2026. This creates the legal architecture for spot crypto ETFs and subjects exchanges to securities-grade oversight.

Hong Kong

Hong Kong's SFC licenses Virtual Asset Trading Platforms (VATPs) under the Anti-Money Laundering Ordinance. As of May 2026, 13 platforms hold VATP licenses. Base capital is HKD 5 million, rising to HKD 15 million for retail-facing custodial platforms. Critically, VATPs serve only professional investors (portfolios of at least HKD 8 million) unless they obtain separate retail-access approval with enhanced safeguards.

Comparing VASP Licensing Across Jurisdictions

How Smaller Businesses Navigate Multi-Jurisdictional Costs

For a startup building a crypto wallet or exchange, the cost of licensing across even three or four jurisdictions can be prohibitive. A US-focused operation needs FinCEN registration plus individual state licenses: pursuing all 49 required states might cost $1 million to $5 million in aggregate bonds, legal fees, and compliance infrastructure, with ongoing AML program costs of $200,000 to $500,000 annually. Adding the EU through a MiCA license requires a legal entity in a member state, EUR 125,000 or more in own funds, and a compliance architecture that satisfies the e-money and AML/CFT requirements.

Common strategies for managing costs include:

• Licensing in a single EU jurisdiction (often Lithuania, Malta, or the Netherlands) to access the full EEA market through passporting
• Using the NMLS multi-state licensing system in the US, where 31 to 41 states have adopted the Money Transmission Modernization Act (MTMA) to partially standardize requirements
• Partnering with a licensed sponsor bank or money services business to operate under their license while building direct licensing capacity
• Starting in jurisdictions with faster approval timelines (UAE at 3 to 6 months, or Switzerland via SRO membership) to launch revenue-generating operations while longer applications are pending

The compliance infrastructure tax: Beyond license fees and capital reserves, VASPs must invest in transaction monitoring systems, Travel Rule data-sharing protocols, sanctions screening, SAR filing workflows, and ongoing audit. For a mid-stage fintech, this infrastructure alone costs $200,000 to $500,000 annually before any licensing fees.

Emerging Frameworks: Australia and Brazil

Several major economies finalized new licensing regimes in 2025 and 2026. Australia's Corporations Amendment (Digital Assets Framework) Act received Royal Assent on April 8, 2026, requiring ASIC licensing for platforms exceeding AUD 10 million in annual volume. Brazil's Central Bank published three resolutions in November 2025, establishing VASP authorization with capital requirements between BRL 10.8 million and BRL 37.2 million ($2 million to $7 million). Brazil's rules became enforceable on February 2, 2026, with existing operators given a 270-day adaptation period.

The Self-Custodial Exemption: Why Architecture Matters

For wallet developers and protocol builders, the single most important question in VASP licensing is whether an application's architecture triggers registration requirements. The answer hinges on custody: does the service hold, control, or have the ability to move user funds?

The FATF has consistently held that software developers building non-custodial wallets where users retain full control of their keys fall outside the VASP definition. The EU's MiCA regulation explicitly excludes self-custody from its scope. In the US, FinCEN withdrew its proposed unhosted wallet rule in August 2024, and the GENIUS Act contains explicit exemptions for hardware and software facilitating self-custody. Singapore's MAS similarly excludes non-custodial wallet provision from its licensing requirements.

However, the line is not always clear. The UK FCA's April 2026 consultation on cryptoasset perimeter guidance proposed an expansive interpretation of "arranging" that could bring non-custodial interfaces offering connectivity to trading functionality within the regulatory perimeter, even without holding customer assets. The FATF's March 2026 report on stablecoins and unhosted wallets found that stablecoins accounted for 84% of illicit virtual asset transaction volume in 2025, intensifying pressure on issuers to implement controls for unhosted wallet interactions.

This distinction carries direct implications for builders on Bitcoin Layer 2 protocols. A Spark-based wallet where users hold their own keys and control their own VTXOs operates as a self-custodial application: the wallet developer does not take custody of funds and generally would not trigger VASP classification. If that same developer instead operates a custodial service that holds keys on behalf of users, they cross the line into VASP territory across every major jurisdiction.

What This Means for Builders

The global VASP licensing landscape is converging on a few principles: registration is mandatory, capital reserves are required, Travel Rule compliance is non-negotiable for custodial services, and self-custody generally remains outside scope. But implementation details diverge dramatically. A business licensed in the EU cannot operate in Singapore without a separate MAS license. A US money transmitter license in New York says nothing about compliance in California or Texas.

For developers evaluating where to build, the Spark SDK documentation covers the protocol's self-custodial architecture in technical detail. Builders interested in a Spark-powered wallet experience can explore General Bread, which demonstrates how self-custodial Bitcoin and stablecoin payments work in practice. For a broader view of how stablecoin regulation intersects with VASP requirements, see our stablecoin regulation global tracker.

This article is for educational purposes only. It does not constitute financial, legal, or investment advice. Regulatory requirements change frequently and vary by jurisdiction. Always consult qualified legal counsel for compliance decisions. Bitcoin and Layer 2 protocols involve technical and financial risk. Always do your own research and understand the tradeoffs before using any protocol.