Stablecoins
CASP vs VASP vs MiCA licence: what’s the difference?
The MiCA authorisation, the FATF AML term, and what a business should actually check.
By James Hickson · Updated 3 July 2026
Key takeaways
- CASP is the EU term under MiCA (Crypto-Asset Service Provider); VASP is the FATF and national anti-money-laundering term (Virtual Asset Service Provider). A "MiCA licence" generally means CASP authorisation. VASP is AML-focused and used across jurisdictions; the two labels are related but not interchangeable.
- CASP. Crypto-Asset Service Provider — the MiCA term (Regulation (EU) 2023/1114)
- VASP. Virtual Asset Service Provider — the FATF / national AML term
- "MiCA licence". Common shorthand for CASP authorisation in the EU
- Main focus. CASP: market conduct + authorisation. VASP: anti-money-laundering supervision
- Scope. CASP applies in the EU/EEA. VASP concepts apply globally, but vary by country
General information, not legal advice.
What is a CASP (Crypto-Asset Service Provider)?
A CASP, or Crypto-Asset Service Provider, is the defined term used in the European Union's Markets in Crypto-Assets Regulation, commonly abbreviated to MiCA (Regulation (EU) 2023/1114). It describes any legal entity or firm whose business is providing one or more crypto-asset services to clients within the EU. When people in the market talk casually about holding a "MiCA licence", they are usually referring to CASP authorisation: the permission a competent national authority grants under MiCA that allows a firm to offer these services lawfully across the bloc.
MiCA sets out a specific list of activities that count as crypto-asset services. These generally include operating a trading platform for crypto-assets, exchanging crypto-assets for funds or for other crypto-assets, executing orders on behalf of clients, providing custody and administration of crypto-assets, placing crypto-assets, receiving and transmitting orders, providing advice on crypto-assets, offering portfolio management, and providing transfer services. A firm that carries out any of these activities on a professional basis in the EU falls within scope and, subject to the regulation's transitional arrangements, is expected to be authorised as a CASP.
Authorisation under MiCA is more than a registration step. It is a market-conduct and prudential regime, closer in character to how investment firms are supervised than to a simple AML sign-off. A firm seeking CASP status is typically assessed on its governance, the fitness and propriety of its management, its capital and prudential safeguards, how it segregates and protects client assets, its complaints handling, conflict-of-interest controls, and its disclosures to clients. Once authorised, a CASP is subject to ongoing supervision by its home-state regulator and, in principle, can passport its services to clients in other EU and EEA member states without seeking a separate licence in each one.
The practical significance for a business buying crypto-asset services in Europe is straightforward. If a provider is offering exchange, custody, transfer, or execution services to EU clients, the relevant question to ask is whether it holds, or is progressing towards, CASP authorisation under MiCA. That is the authorisation that speaks directly to the EU market. Because MiCA has phased application dates and country-level transitional periods, the exact status of a given firm should always be verified against the register maintained by the competent authority rather than assumed. This is general information, not legal advice.
What is a VASP (Virtual Asset Service Provider)?
A VASP, or Virtual Asset Service Provider, is a term that comes from a different source altogether: the Financial Action Task Force, known as the FATF. The FATF is the global standard-setter for anti-money-laundering and counter-terrorist-financing measures. It introduced the VASP concept to bring crypto-asset businesses within the reach of the same AML and CTF expectations that apply to banks, money transmitters, and other financial institutions. Where the CASP label is about market conduct and authorisation inside the EU, the VASP label is fundamentally about AML supervision, and it is used far more widely around the world.
The FATF defines a virtual asset service provider by reference to activities carried out for or on behalf of another person. These typically cover the exchange between virtual assets and fiat currencies, the exchange between one or more forms of virtual asset, the transfer of virtual assets, safekeeping or administration of virtual assets or the instruments that enable control over them, and participation in and provision of financial services related to an issuer's offer or sale of a virtual asset. The wording is deliberately broad so that similar economic activity is captured consistently, whatever local labels a business chooses to use.
Because the FATF sets standards rather than passing law, the VASP concept only has legal force once individual countries implement it. Many jurisdictions have done so, and the shape of the resulting regime varies. In some countries a VASP must register with, or be licensed by, a financial intelligence unit or an AML supervisor; it must run customer due diligence and know-your-customer checks, screen for sanctions, monitor transactions, keep records, file suspicious-activity reports, and comply with the "travel rule", which requires certain originator and beneficiary information to travel with transfers above a threshold. The obligations are recognisably AML obligations rather than a full market-conduct rulebook.
It is worth stressing that VASP registration in one country does not automatically carry across to another. A firm registered as a VASP under a national AML regime outside the EU is meeting that country's anti-money-laundering requirements; it is not, by that fact alone, authorised as an EU CASP. Xchange360, for example, operates as a regulated provider under several such regimes, holding registration with Switzerland's ARIF (self-regulatory organisation number 4572), registration as a Money Services Business with Canada's FINTRAC, and authorisation in Costa Rica. Each of these speaks to obligations in its own jurisdiction. As always, the specific scope of any registration should be checked directly; this is general information and not legal advice.
How do CASP and VASP differ and overlap?
The clearest way to hold the distinction in mind is to separate the source of each term from its purpose. CASP is a European legal category created by MiCA, and its primary purpose is authorisation and market conduct: who may offer crypto-asset services in the EU, and to what standards of governance, client-asset protection, and disclosure. VASP is a FATF-derived category, adopted into a patchwork of national laws, and its primary purpose is anti-money-laundering: making sure crypto-asset businesses run proper customer checks, monitor transactions, and report suspicious activity. Different origin, different emphasis.
There is genuine overlap, which is why the terms are so often confused. The activities each regime describes are similar, so a single firm frequently sits inside both. An EU exchange that is authorised as a CASP under MiCA will also be subject to AML obligations, because MiCA operates alongside the EU's own anti-money-laundering framework rather than replacing it. In that sense a European CASP carries VASP-style AML duties as well as its market-conduct obligations. The AML dimension does not disappear once a firm is a CASP; it sits underneath.
The reverse, however, does not hold. A business can be a VASP under a national AML regime without being an EU CASP at all. A provider registered with an AML supervisor outside the EU has satisfied that country's money-laundering controls, but it has not thereby obtained authorisation to offer crypto-asset services to clients in the European Union. If it wants to serve EU clients within scope of MiCA, CASP authorisation is the relevant permission, and AML registration elsewhere is not a substitute for it. The two answer different questions.
For that reason the labels should not be treated as interchangeable, even though they are frequently swapped in casual usage and marketing. Calling a firm a VASP tells you it is within an AML regime somewhere; it does not by itself tell you which country, which activities are covered, or whether the firm can lawfully serve EU clients under MiCA. Calling a firm a CASP tells you it is authorised for crypto-asset services in the EU under MiCA, with the AML expectations that come with that. Precision here matters, because the wrong assumption can leave a business relying on an authorisation that does not actually cover the jurisdiction or service it needs. This is general information, not legal advice.
What should a business actually check?
For a finance or compliance team assessing a crypto payments or settlement provider, the useful move is to stop treating "CASP" and "VASP" as badges and start treating them as questions about jurisdiction and activity. The first question is where the service will be delivered and to whom. If the answer involves offering crypto-asset services to clients in the EU or EEA, then CASP authorisation under MiCA is the permission that speaks to that market, and a "MiCA licence" is the shorthand you will hear for it. Confirm the authorisation exists on the competent authority's public register rather than taking it on trust.
The second question is which specific activities you actually need, because authorisations are scoped. Custody is not the same permission as operating a trading platform, and exchange is not the same as transfer or execution. A provider may be authorised for some crypto-asset services and not others, so the check is not simply "are they licensed?" but "are they authorised for this activity, in this jurisdiction, for this type of client?" Matching the provider's permissions to your intended use is what makes the review meaningful.
The third question is anti-money-laundering coverage, which is where the VASP concept is most relevant outside the EU. If a provider operates under national AML regimes, ask which authorities it is registered with and what those registrations cover. A regulated provider will usually be transparent about this. Xchange360, to give a concrete example, operates under Switzerland's ARIF (number 4572), holds Money Services Business registration with Canada's FINTRAC, and is authorised in Costa Rica. Those registrations describe its AML standing in those jurisdictions; they are a different thing from EU CASP authorisation, and a careful buyer keeps the two distinct rather than conflating them.
Bringing it together, the sensible posture is to verify the provider holds the right authorisation for the jurisdiction and the activity in question, to read the register entry rather than the marketing page, and to remember that AML registration and EU market authorisation answer different questions. A "MiCA licence", meaning CASP authorisation, is what matters specifically for EU crypto-asset services; VASP-style registration is what matters for AML obligations in the countries that impose it. Because regimes are still settling and transitional periods differ by country, treat this as a prompt to check current, jurisdiction-specific facts with a qualified adviser. This page is general information and does not constitute legal advice.
CASP vs VASP
| CASP | VASP | |
|---|---|---|
| Term from | EU MiCA regulation (Regulation (EU) 2023/1114) | FATF standards, adopted in national AML regimes |
| Full name | Crypto-Asset Service Provider | Virtual Asset Service Provider |
| Primary focus | Market conduct and authorisation | Anti-money-laundering registration and supervision |
| Jurisdiction | EU / EEA | Global concept; specifics vary by country |
| What it authorises | Providing crypto-asset services (exchange, custody, transfer, execution, advice) to EU clients | Meeting a country's AML/CTF obligations for virtual-asset activities |
| Also called a "MiCA licence"? | Yes — CASP authorisation is what "MiCA licence" usually means | No — VASP is an AML term, not the MiCA authorisation |
General information, not legal advice.
FAQ
Common questions
Is a "MiCA licence" the same as CASP authorisation?
In everyday usage, yes. "MiCA licence" is common shorthand for authorisation as a Crypto-Asset Service Provider under Regulation (EU) 2023/1114. There is no separate document literally titled "MiCA licence"; the formal permission is CASP authorisation granted by a competent national authority. This is general information, not legal advice.
Can a firm be both a CASP and a VASP?
Yes, and many are. An EU-authorised CASP also carries anti-money-laundering obligations, so it performs VASP-style AML duties alongside its MiCA market-conduct requirements. The reverse is not automatic: a VASP registered under a national AML regime outside the EU is not, by that fact alone, an EU CASP.
Does VASP registration let a firm serve EU clients?
Not by itself. VASP registration shows a firm meets a particular country's AML requirements. To offer crypto-asset services to clients in the EU within scope of MiCA, the relevant permission is CASP authorisation. AML registration elsewhere is not a substitute for EU authorisation. Verify current status with the competent authority.
Are CASP and VASP interchangeable terms?
No. They come from different sources and serve different purposes. CASP is an EU authorisation and market-conduct category under MiCA; VASP is an AML category derived from FATF standards and adopted in national laws. They often overlap for the same firm, but using them interchangeably can obscure which jurisdiction and activity are actually covered.
What authorisations does Xchange360 hold?
Xchange360 operates as a regulated provider under several regimes, including registration with Switzerland's ARIF (number 4572), Money Services Business registration with Canada's FINTRAC, and authorisation in Costa Rica. Each registration relates to obligations in its own jurisdiction. The precise scope should be confirmed directly; this is general information, not legal advice.
What should we check before using a crypto payments provider?
Confirm the provider holds the right authorisation for both the jurisdiction and the specific activity you need, such as custody, exchange, or transfer. For EU crypto-asset services, look for CASP authorisation (a "MiCA licence") on the competent authority's register. Check AML registrations separately, and take jurisdiction-specific legal advice.