What is a VASP licence?

A VASP — Virtual Asset Service Provider — is a business that handles crypto on someone else’s behalf. The term is the Financial Action Task Force’s, and for most of the world it is still the operative one.

For the European Economic Area it is not. On 1 July 2026 the transitional window under the EU Markets in Crypto-Assets Regulation closed, and national VASP and DASP registrations stopped authorising crypto-asset service anywhere in the EEA. The equivalent there is now a CASP authorisation. If that is your jurisdiction, this page is background — the page you want is MiCA CASP accounts.

Everywhere else, read on.

What FATF actually defines

FATF’s definition turns on doing something for or on behalf of another person. A VASP is a business that carries on any of:

• exchange between virtual assets and fiat currency;
• exchange between one virtual asset and another;
• transfer of virtual assets;
• safekeeping or administration of virtual assets, or of instruments enabling control over them;
• participation in, and provision of financial services related to, the issue or sale of a virtual asset.

The phrase that does the work is on behalf of. Moving your own crypto with your own keys is not a VASP activity. Doing it for customers, commercially, is — and that is the point at which registration obligations usually bite.

A VASP registration is an AML gateway, not a full authorisation

This is the most common misreading, and it matters when you are assessing a counterparty.

Most national VASP regimes grew out of anti-money-laundering law rather than prudential regulation. Passing one generally tells you a firm is supervised for financial crime: it has an AML programme, it screens, it monitors, it reports. It usually tells you far less about capital adequacy, client-asset segregation, governance quality or conduct.

That is precisely the gap MiCA was written to close in the EEA, and it is why the numbers moved so sharply when the standard rose: of roughly 3,000 nationally registered EEA firms, about 244 held MiCA authorisation at the deadline, reaching around 309 across the EEA by late July. ESMA has asked those that did not make it through to wind down in an orderly manner.

Read that as a calibration exercise. A national registration and a full authorisation are not interchangeable, and roughly nine in ten firms could not close the distance.

What holding a registration commits you to

Wherever the regime, the obligations rhyme:

• a full AML programme — KYB and KYC, sanctions screening, transaction monitoring, suspicious-activity reporting;
• the Travel Rule on qualifying transfers, following FATF Recommendation 16 as your regime implements it;
• governance — fit-and-proper testing of owners and controllers, a nominated officer responsible for financial crime, and records that survive an inspection;
• ongoing supervision, including the obligation to keep your register entry accurate as your business changes.

The last one catches people. A registration is a live obligation, not a certificate you file away.

The main regimes, and what they call themselves

Jurisdiction	What it is called	What it is
FATF standard	VASP	The international definition most national regimes are built from. Not itself a licence
European Economic Area	CASP, under MiCA	Full prudential authorisation — capital, governance, custody, conduct — passportable across the EEA. Replaced national VASP/DASP registration on 1 July 2026
United Kingdom	Cryptoasset business registration	AML-focused registration under the Money Laundering Regulations, held on the regulator’s cryptoasset register
Canada	MSB, plus PSP registration	Money Services Business registration with FINTRAC, including dealing in virtual currency; separately, Payment Service Provider registration under the Retail Payment Activities Act supervised by the Bank of Canada
Switzerland	Financial-intermediary status	Supervised under FINMA’s framework, in practice often via a self-regulatory organisation, with a separate banking or securities licence where the activity requires one
Singapore	DPT service provider	Digital Payment Token licensing under the Payment Services Act
United Arab Emirates	VASP	A federal framework plus emirate-level regimes, including Dubai’s VARA

A business operating across borders routinely holds more than one, and they do not substitute for each other. Nothing on that table passports anywhere except the MiCA row.

What a VASP licence does not do

It does not get you banked.

Every regime on that table authorises the crypto-asset activity. None of them obliges a bank, an electronic money institution or a payment institution to open you an account, and none of them makes a named IBAN appear. Firms complete a long registration process and then find the commercial problem untouched: they still need fiat in and out on rails their clients already use, foreign exchange at a real spread, a route between fiat and stablecoins, and a counterparty that has read the file rather than declining “crypto” on sight.

That gap is what KwiikPay fills for registered and authorised firms. If you are in the EEA, the specifics are on the MiCA CASP accounts page. If you are registered elsewhere on that table, the same eligibility rules apply: we serve firms incorporated and authorised in the EEA, the United Kingdom, Gibraltar, Switzerland and Canada, and we do not onboard crypto-asset businesses holding no authorisation anywhere.

KwiikPay’s own status, stated exactly

KwiikPay is a trading name of KWP Finance Limited. It is registered in Canada as a Payment Service Provider under the Retail Payment Activities Act, supervised by the Bank of Canada, and as a FINTRAC-registered Money Services Business including dealing in virtual currency.

Both of those are registrations. They are not licences and not authorisations, and we describe them that way on purpose — the Canadian regimes are registration-based, and a provider that inflates the language on its own permissions is showing you how it will describe everything else.

KwiikPay does not hold an EU VASP registration. It is not a MiCA-authorised CASP. The full position is on the compliance overview and in the risk appetite statement.