VASP (Virtual Asset Service Provider)
A VASP (Virtual Asset Service Provider) is a FATF regulatory term for any company that exchanges, holds, transfers, or manages cryptocurrency on behalf of clients: exchanges, custodians, payment services, some P2P platforms. VASP status obligates a company to follow AML/KYC requirements, and addresses linked to platforms without VASP status (unhosted or unregistered) automatically pick up an elevated risk score in systems like Chainalysis, TRM Labs, and Amler.
How VASP Classification Works
FATF (the Financial Action Task Force), the intergovernmental body that leads the fight against money laundering, introduced the term VASP as a way to extend banking-grade AML standards to the crypto industry. Formally, a VASP is any organisation that, as a business, exchanges virtual assets for fiat or other virtual assets, transfers virtual assets, holds them in custody, or provides financial services related to their offering or sale.
Registered vs unregistered VASP
Major exchanges (Binance, Bybit, OKX, Coinbase) are registered as VASPs in one or more jurisdictions and must comply with the Travel Rule — sharing sender and recipient information above a set transfer threshold. Smaller or anonymous exchange platforms, some P2P services, and decentralised protocols often carry no VASP status at all — formally they fall outside the same obligations, which creates a grey zone for AML monitoring.
How VASP status shapes an address's risk score
Analytics platforms (Chainalysis, TRM Labs, Elliptic, and services like Amler, which powers the AML check on this site) assign a higher risk score to addresses linked to platforms that lack VASP status or haven't been verified as a trusted service provider. In reports, these addresses are often flagged with a tag like "untrusted VASP" or "unregistered exchange." That doesn't automatically mean fraud — but it sharply raises the odds of an automatic block when moving funds to an exchange with stricter compliance.
Why VASP Status Matters for Your Crypto Security
Understanding the VASP concept explains one of the most common and frustrating freeze triggers: you send funds to a legitimate but small or unregulated platform (a P2P exchange, a local unlicensed service), then try to withdraw to a major international exchange, and hit a block because the intermediate address picked up an "untrusted VASP" tag. KarCrypto uses the same classification in its free address AML check, to flag this risk before you make the transaction.
A Worked Example: Following Funds Through a VASP
Suppose a user sells goods for crypto and receives the payment on a small, unlicensed trading service that offers fast withdrawals and no identity checks. A week later they send the funds to a large regulated exchange. On arrival, the exchange's analytics flag the source as an unverified service with no VASP registration, and the deposit is placed under review. The user did nothing wrong, but the path of the coins carries a label that the exchange's rules treat cautiously.
Had the funds moved through a registered VASP instead, the exchange would have seen a counterparty that performs customer checks, and the transfer would more likely have passed without extra questions. This is one practical reason to look at where an address belongs before you rely on it.
VASP Status in Investigations and Common Misconceptions
For investigators, VASP status shows where information may exist. A registered exchange holds customer records and can respond to formal requests from law enforcement or to freeze requests that come with evidence of theft. When stolen coins land at a registered VASP, there is a real point of contact. When they land in a self-custodied wallet or on a service with no registration, tracing continues but the path to a legal request is much harder.
Several misconceptions are worth clearing up. Being a VASP does not mean a company is safe or trustworthy, only that it falls under a regulatory framework that varies by country. Lacking VASP status does not prove a service is criminal. And a private wallet owned by an individual is generally not a VASP, because the term covers businesses that provide services for others. If you need to check a counterparty, look for its registration with the regulator in the relevant jurisdiction and review the platform's published compliance policy, rather than relying on marketing claims.
Frequently Asked Questions
Is a P2P platform a VASP?
It depends on the specific platform. Large, regulated P2P services built into licensed exchanges typically hold VASP status. Anonymous or local P2P exchanges usually don't, which raises the AML-block risk for later transactions moving through their addresses.
What does an "untrusted VASP" tag mean in an address check report?
It means the address is linked to a service that provides virtual asset services but hasn't confirmed AML/KYC compliance or doesn't hold formal VASP status in its jurisdiction. Such a tag raises the address's risk score and can trigger an automatic block when transferring to a regulated exchange.
Can an individual user become a VASP?
Formally, yes, if they systematically provide exchange or transfer services for virtual assets to third parties on a commercial scale — that activity falls under the VASP definition and requires registration. One-off personal transactions don't create VASP status.
Is a decentralised exchange a VASP?
It depends on the structure and the jurisdiction. Guidance generally looks at whether a person or entity controls the service, earns fees, or operates it as a business. Purely automated protocols with no identifiable operator are treated differently from platforms that have an owner or an operating company, and the rules are still evolving.
How can I tell whether an exchange is a registered VASP?
Check the platform's own legal or compliance page for the entity name and registration details, then confirm them on the relevant regulator's public register. Be wary of services that give no company information, since a missing registration is a common reason for withdrawals to be questioned by other platforms.