What Is a VASP License?

What is a VASP license? It is the authorization a virtual asset service provider (VASP) needs to legally offer virtual asset trading, exchange, transfer or custody services in a given jurisdiction. The VASP concept comes from the FATF, the international anti-money laundering body, and each regulator builds its own licensing regime on top of it. So a “VASP license” is not one universal certificate but a category of licenses whose names, scope and requirements differ from place to place.

Which Businesses Need a VASP License?

Under the FATF definition, any business that exchanges, transfers or safekeeps virtual assets on behalf of others is a VASP. Jurisdictions split these activities into different license categories, and a business must apply for each one that matches what it actually does. Businesses dealing with a VASP should also check whether it is licensed first.

How Do VASP Licenses Differ in Hong Kong and Singapore?

In Hong Kong, the SFC licenses virtual asset trading platforms and requires at least 98% of client virtual assets to be held in cold storage. In Singapore, the MAS licenses digital payment token services under the Payment Services Act, and since June 30, 2025 it has also brought Singapore-based firms that serve only overseas clients under regulation.

What Do VASP Licenses Require for Wallets and Custody?

The details vary, but regulators focus on similar things. First, client assets must be segregated from the firm’s own assets, and the share held online must be controlled, which directly determines how much a business can keep in a hot wallet. Second, key management and transfer controls must stand up to scrutiny so that no single person can move funds alone, as set out in the Hong Kong SFC’s robust custody standards. Third, anti-money laundering capability, including customer due diligence, KYT monitoring of on-chain transactions, and the Travel Rule for passing originator and beneficiary information with transfers. Firms also need complete audit trails and a security incident response plan.

Conclusion

A VASP license is the authorization a virtual asset service provider needs to operate legally, and its name and scope vary by jurisdiction: Hong Kong’s SFC licenses trading platforms, Singapore’s MAS regulates under the Payment Services Act and the Financial Services and Markets Act, and the EU authorizes CASPs under MiCA. Wherever a firm applies, asset segregation, key controls and AML capability are central to the review. Safeheron’s MPC Wallet-as-a-Service provides businesses with MPC key management and a policy engine.

Building your wallet and custody setup for a VASP license application? Contact Safeheron’s Sales Team to Book a 1:1 Demo