VASP

The definition above says which businesses carry the label. What it does not cover is that the category is defined by activity rather than by business type. FATF treats as a VASP any person who conducts one or more of five activities as a business for another party: exchanging virtual assets for fiat currency, exchanging one virtual asset for another, transferring virtual assets, safekeeping or administering them or the instruments that control them, and providing financial services connected to an issuer's offer or sale of a virtual asset. Nothing in that list requires holding customer funds, so a firm can qualify without ever taking custody.

Naming diverges across jurisdictions, which matters when mapping obligations. The European Union regulates broadly the same population as crypto-asset service providers under MiCA. FinCEN treats most of them as money services businesses. The underlying activities line up closely; the registration route, the thresholds and the supervisor do not.

The unsettled edge is software. FATF guidance issued in 2021 concluded that a DeFi protocol is not itself a VASP, while the creators, owners and operators who retain control or sufficient influence over it may be. That places the test on residual control rather than on architecture. A team deciding how much admin authority to keep is therefore also deciding whether it sits inside the perimeter, and whether Travel Rule obligations follow.