A VASP is any business that exchanges, transfers, or custodies virtual assets like stablecoins for customers. FATF's definition and what it requires in practice.
A VASP, virtual asset service provider, is any business that exchanges, transfers, custodies, or safeguards virtual assets like stablecoins on behalf of customers. FATF, the intergovernmental body that sets global anti-money laundering standards, created the category in 2019 to pull crypto and stablecoin companies under the same AML rules banks already follow.
The category matters because it decides who needs a license. If a company's activity fits FATF's VASP definition, the countries it operates in expect registration, AML controls, and reporting, the same obligations a bank or money transmitter carries, not a lighter version built for crypto.
FATF Recommendation 15 defines a VASP as any natural or legal person who, as a business, conducts one or more of the following on behalf of another person:
Classification is activity-based: a company doing any one of these as a business, for someone else, is a VASP, regardless of what it calls itself. A stablecoin off-ramp that converts USDC to reais sits directly in the first category; background on that specific flow is in what is a stablecoin off-ramp. Most VASPs package these activities behind a stablecoin API rather than exposing raw wallets and exchange rails.
Any business performing the activities above, in a jurisdiction that has implemented Recommendation 15. That covers most of the world's major markets by now, since FATF membership and mutual evaluation pressure pushed adoption broadly through the early 2020s. The details, though, are set by each country individually: registration with a financial intelligence unit in some places, a full authorization regime with capital and governance requirements in others.
Brazil is a concrete example worth studying because the rules are recent and specific: the Banco Central do Brasil built its PSAV authorization directly on the FATF categories, requiring companies that exchange, transfer, or custody virtual assets for Brazilian customers to obtain a license under Resolutions 519, 520, and 521. The full breakdown is in our PSAV explainer.
Once a company is classified as a VASP, the recurring obligations look similar everywhere: customer identification and KYC on individuals, KYB on business customers, sanctions and watchlist screening, transaction monitoring for suspicious activity, and increasingly the travel rule, which requires sharing sender and receiver information on transfers above a threshold, the same way a wire transfer carries originator data today. Our stablecoin payments guide covers how these checks sit inside an actual payout.
None of this is optional once the activity test is met. A company that calls itself a "technology platform" rather than a payment provider is still a VASP if it exchanges or transfers virtual assets for customers; regulators evaluate the activity, not the label on the pitch deck.
The activities FATF defines are consistent; the implementation is not. The EU folds virtual asset services into MiCA's authorization regime. The US applies its existing money transmitter and money services business framework, state by state, to the same activities. Brazil built a dedicated PSAV license from scratch in 2025. Details on how these regimes compare are in our stablecoin regulation tracker. A company operating across borders typically needs a different license, or license-equivalent, in each market it serves, which is one reason global stablecoin payment coverage is hard to build and harder to fake.
BlindPay operates as a licensed entity in the markets it serves, including as a VASP-equivalent authorized provider in Brazil under the transitional PSAV regime, with KYC, KYB, sanctions screening, and travel rule handling built into every payout. Entity and license details by market are published on the licenses page, and how the full compliance program runs is on the compliance page. More on the mechanics behind the API is in the resources hub.
This article is for general information only and is not legal, tax, or financial advice.
Stablecoin transfers settle final in minutes and cannot be reversed. That finality proves custody at every step, but it also opens a fraud gap on the fiat side of the payment.
What MiCA means if your business uses stablecoins in the EU: EMTs vs ARTs, issuer requirements, why USDC is compliant and USDT was delisted, and a practical checklist.
PSAV is Brazil's authorization for virtual asset service providers, created by BCB Resolutions 519, 520, and 521 under Law 14.478/2022. What it requires and who needs it.