What Is a Crypto Exchange or VASP?

Quick answer: A crypto exchange is a platform where people buy, sell or swap crypto assets such as Bitcoin or stablecoins. A VASP (virtual asset service provider) is the wider term, from the global standard-setter FATF, for any business that exchanges, transfers, holds or issues crypto for customers. Exchanges are one type of VASP. Almost every major country now requires VASPs to register or be licensed and to run an anti-money laundering program. In Canada, that means registering with FINTRAC as a money services business, and crypto trading platforms also need securities registration through the CSA and CIRO.

Running an NFT platform? Find out whether your NFT marketplace might already be an MSB.

Globally, regulators use the term Virtual Asset Service Provider, or VASP, to describe these businesses. A VASP may include exchanges, wallet providers, OTC desks, and certain DeFi platforms. The term comes from the Financial Action Task Force (FATF), which sets the global AML standards most countries follow.

If your business involves crypto transfers, wallet services, or trading platforms, chances are you're a VASP under local law.

Crypto exchange vs VASP: what's the difference?

Every crypto exchange is a VASP, but not every VASP is an exchange. "VASP" covers any business that handles crypto for customers, including:

• Custodial wallet providers that hold crypto for users
• Crypto ATM operators
• OTC (over-the-counter) desks for large trades
• Crypto transfer and payment services
• Token issuers, including stablecoin issuers
• Some DeFi platforms, where there is an identifiable operator

The label matters less than what you actually do. Regulators look at your activities (exchange, transfer, custody or issuance) to decide which rules apply.

Where Are VASPs Regulated?

Almost every major jurisdiction has adopted or is implementing AML laws for crypto companies. The rules vary, but the core obligations are similar.

Canada

In Canada, VASPs must register as Money Services Businesses (MSBs) with FINTRAC. This applies to any company offering crypto exchange, transfer, or custodial services.

Key requirements:

• MSB registration

• Appointed Chief Anti-Money Laundering Officer (CAMLO)

• AML/CTF compliance program

• KYC and transaction monitoring

• Reporting large crypto transactions

• Recordkeeping and audit readiness

In some cases, businesses also fall under the Retail Payment Activities Act (RPAA) and must register with the Bank of Canada. Learn more on our pages for MSB Registration, RPAA Registration, and CAMLO Services.

What crypto businesses in Canada also need to know:

• FINTRAC treats them as MSBs that deal in virtual currencies, which covers both crypto exchange and crypto transfer services. Foreign platforms serving Canadians must register too.
• They must report crypto received in amounts of $10,000 or more (large virtual currency transaction reports) and follow the travel rule, sending sender and recipient details with crypto transfers.
• Crypto trading platforms also fall under securities law. The Canadian Securities Administrators (CSA) require them to register (through CIRO) or operate under a public pre-registration undertaking while they register.
• Under the Budget 2025 Implementation Act (March 26, 2026), stablecoin issuers will also have to register as MSBs, on a date set by regulations.

For the full picture, see crypto MSBs in Canada: registration, monitoring and risk management.

European Union

The EU regulates crypto businesses under its AML rules and MiCA (the Markets in Crypto-Assets Regulation), which has applied in full since December 30, 2024. Crypto firms now need CASP authorization (crypto-asset service provider) from a national regulator, which they can then "passport" across the EU. Transition periods for existing firms ended by July 1, 2026 at the latest.

MiCA applies across all EU states and includes:

• Licensing under a national authority

• AML program requirements

• Custody controls

• Whitepaper obligations for token issuers

• Cross-border passporting within the EU

United Arab Emirates (UAE)

In the UAE, VASPs are regulated at both the federal level and by free zones like VARA (Virtual Assets Regulatory Authority) in Dubai.

In Dubai, VASPs need a VARA licence, issued in 2 stages. Abu Dhabi (ADGM) and the DIFC have their own regulators. See our Dubai VARA licence guide for costs, steps and timelines.

Key features:

• Pre-approval and licensing required

• AML framework aligned with FATF

• Clear rules for token issuance, custody, and exchange

• Inspections and financial reporting duties

Our team supports UAE-based startups working with VARA and ADGM, including token compliance and internal audits.

Singapore

Singapore’s MAS (Monetary Authority of Singapore) regulates VASPs under the Payment Services Act. A crypto company must be licensed for digital payment token services if it facilitates trading or transfers.

The process involves:

• Registration and licensing

• AML policies and transaction monitoring

• Risk-based due diligence

• Fit and proper management standards

United States

The US treats VASPs as money transmitters, with registration required under FinCEN at the federal level. State-level licensing is also required in most jurisdictions, making compliance complex.

Stablecoin issuers now have their own federal framework (the GENIUS Act, 2025), including BSA/AML duties. Read what compliance officers need to know now that stablecoins are BSA-regulated.

Obligations include:

• FinCEN registration

• AML policy and suspicious activity reporting

• State-by-state money transmission licenses

• Enhanced enforcement risk for violations

The US remains one of the most fragmented and high-risk jurisdictions from a compliance standpoint.

Shared Compliance Requirements Across Jurisdictions

Despite regional differences, most VASPs must do the following:

• Register or license with a financial regulator

• Maintain a written AML/CTF program

• Appoint a qualified compliance officer

• Identify and verify customers (KYC)

• Screen for sanctions and politically exposed persons (PEPs)

• Monitor and report suspicious transactions

• Keep audit-ready records

These requirements apply whether you're launching in Canada, expanding into Europe, or entering the UAE market. You can explore common pitfalls in our post on navigating compliance challenges in FinTech.

How AML Incubator Supports VASPs Globally

We’ve worked with crypto exchanges and service providers across Canada, the EU, Dubai, Singapore, and the US. Our services include:

• Registration with FINTRAC, RPAA, and other regulators

• Ongoing CAMLO or MLRO support

• Transaction monitoring system setup

• Risk-based KYC workflows

• Token due diligence

• Effectiveness reviews and audit prep

• Regulatory remediation after warnings or fines

• Custom compliance frameworks for VASP-specific business models

Frequently asked questions

Is a crypto exchange a VASP?

Yes. A crypto exchange is one type of VASP. VASP is the wider term for any business that exchanges, transfers, holds or issues crypto for customers.

Do crypto exchanges need to register with FINTRAC?

Yes. Crypto exchanges serving Canadians must register as MSBs dealing in virtual currencies, including foreign exchanges. Trading platforms also need securities registration with the CSA/CIRO.

What does VASP stand for?

Virtual asset service provider. The term comes from the Financial Action Task Force (FATF).

What is the travel rule?

A rule that requires VASPs to send sender and recipient information along with crypto transfers, just as banks do with wire transfers. In Canada, FINTRAC requires it for every virtual currency transfer an MSB sends, whatever the amount.

What is MiCA?

The EU's Markets in Crypto-Assets Regulation. It requires crypto-asset service providers (CASPs) to be authorized, and it has applied in full since December 30, 2024.

Get help with VASP compliance

VASPs are no longer flying under the radar. Whether you're in Canada, Dubai, Europe, or Singapore, regulators expect more than surface-level policies.

You need systems that match your services. You need documentation that proves what you’ve built. And you need people who understand crypto, regulation, and what happens when the two don’t align.

Explore our services for Crypto Exchanges and VASPs or contact us to make sure your setup is compliant and ready to grow.