A VASP (virtual asset service provider, the FATF term) is a company that performs, as a business and on behalf of other people, at least one of a short list of activities involving virtual assets: exchanging them for money, exchanging them for each other, transferring them, holding them, or arranging their sale. The term comes from the Financial Action Task Force, whose Recommendations define a virtual asset service provider as any natural or legal person not covered elsewhere who conducts one or more of those activities for or on behalf of another person.
That phrase, on behalf of another person, is the whole definition. A company moving its own stablecoins is not a VASP. The moment it does the same thing for a customer, it is, and a licensing obligation attaches in every country where the rules have been written. This post covers the five activities, how Brazil, the European Union and the United States each implement the idea, what the status obliges a company to do, and why the answer decides which payments provider a business can safely use.
The five activities
The list has been adopted almost word for word into national law, which makes it unusually stable.
Exchange between virtual assets and currency. Taking reais or pesos and returning USDC is this. Every on-ramp and every stablecoin off-ramp sits here.
Exchange between virtual assets. Swapping USDT for USDC for a client.
Transfer of virtual assets. Moving tokens from one address to another on someone else's instruction.
Custody or administration of virtual assets, or of the instruments that allow control over them. A custodial wallet service is this activity, and the wording deliberately reaches the private keys rather than the tokens.
Participation in financial services related to the offer or sale of a virtual asset. The catch-all for issuance and distribution.
A payments business that collects local currency, converts it and pays out abroad touches at least three of the five.
Brazil: the PSAV under Law 14.478
Brazil legislated the concept directly. Law 14.478 of December 21, 2022 defines a PSAV (Prestadora de Serviços de Ativos Virtuais, Brazil's virtual asset service provider authorization) in Article 5 as a legal entity that performs, on behalf of third parties, at least one of the five services, listed in the same order as the international definition.
Article 3 of the same law defines the virtual asset itself, and the exclusions are as useful as the inclusions: national and foreign currency are out, electronic money under Law 12.865 of 2013 is out, loyalty points are out, and so are representations of assets whose issuance or settlement is already regulated elsewhere.
The law set the frame and left the operating rules to the Central Bank, which issued Resolutions 519, 520 and 521 in 2025 covering authorization and conduct. The practical consequence for a fintech is that a provider serving Brazilian clients should be able to name the authorization it holds and the entity that holds it.
The same idea under other names
The European Union calls it a crypto-asset service provider. Under MiCA, Regulation (EU) 2023/1114, a crypto-asset service provider is a legal person whose occupation or business is providing one or more crypto-asset services to clients on a professional basis, and which is allowed to do so under Article 59 of that regulation. The service list covers the same ground, including custody and administration of crypto-assets on behalf of clients, defined as safekeeping or controlling the assets or the means of access to them.
The United States did not create a new category. A business exchanging or transmitting convertible virtual currency falls into the existing money services business definition and registers with FinCEN, an obligation that predates stablecoins by two decades.
Three legal traditions, one operating reality: doing these things for other people is licensed activity, and the licence is territorial.
What the status obliges a company to do
Register or obtain authorization in each country where it serves clients, under whichever regime applies there.
Run customer due diligence, which for business clients means KYB (know your business, the verification of a company and its owners) and KYC (know your customer, the verification of an individual) on the people behind it. The KYB explainer covers what that file contains.
Monitor transactions and report suspicious activity to the local financial intelligence unit.
Keep records, for periods set locally, and produce them on request.
Segregate and account for client assets, where the regime requires it, which is the obligation that matters most in a custody arrangement.
None of this is optional, and none of it is cheap, which is the honest reason a fintech usually buys the capability rather than building it.
When a company is not a VASP
When it only moves its own assets. A treasury converting part of its own reserve is acting for itself.
When the virtual asset is excluded by definition. In Brazil, electronic money and loyalty points are outside Article 3, so handling them is a different regulated activity or none.
When it builds software without touching the money. A wallet interface that never holds keys and never takes possession of funds is generally outside the definition, though this boundary is tested constantly and is worth legal advice rather than an article.
When it is an end user. A company paying suppliers in USDC through a licensed provider is a customer of a VASP, not one itself. This is the distinction most businesses are looking for when they ask the question.
Why this decides which provider you choose
The status is where operational promises come from. A provider authorized in a country can hold client funds there, connect to the local rail and pay a third party. One that is not is either routing through someone else, which the client is entitled to know about, or doing something it should not.
So the questions are concrete. Which legal entity will hold the client's funds, and in which country. What authorization does that entity hold, under which regime, and what is its number. Which countries in the flow are covered by a local licence and which are reached through a partner. The supported countries page is where our answer lives, and the operator map shows how the flows connect.
The most useful question I have been asked by a prospect took about forty seconds. Their compliance lead skipped the product entirely and asked which entity would be the counterparty on each leg of their flow, and what authorization that entity held in each country, and then waited. It was uncomfortable, because the honest answer at the time included one corridor served through a partner rather than by us directly, and I had been describing the corridor list as ours. We said it plainly, they took it fine, and the deal closed. What stayed with me is that I had been treating the entity question as due diligence paperwork and they were treating it as the product, and they were right. Now the entity and the authorization per corridor go into the first technical call, before anyone looks at an endpoint.
What this means for a business working with Lumx
Lumx is stablecoin payments infrastructure for businesses that move money between Latin America and the rest of the world: one API to collect, hold, convert, and pay out in BRL, MXN, COP, USD, EUR, and GBP or in USDC and USDT, over local rails such as PIX, SPEI, PSE, ACH, FEDWIRE, SEPA, and Faster Payments, with SWIFT and on-behalf-of payments and collections (POBO and COBO) in USD, EUR, and GBP, plus named virtual accounts, custodial wallets, and KYB/KYC built in.
A client integrating us is generally not a VASP itself, because it is buying the activity rather than performing it for others. Where a client does serve its own end users, the boundary depends on its market and its model, and it is a conversation for its counsel early rather than a surprise at launch. What we can do is be specific about our side: which entity, which registration, which country, per corridor.
Verified on September 25, 2026. Operational context, not legal, tax, or investment advice.
Cover photo: Scott Szarapka on Unsplash.
Is every crypto company a VASP?
No. The definition turns on performing one of the listed activities for other people as a business. A company that only moves its own assets, or that writes software without ever holding funds or keys, generally falls outside it, though the software boundary is contested and depends on the jurisdiction.
Does my fintech become a VASP by using a stablecoin API?
Usually not, because the provider is performing the regulated activity. A fintech that lets its own end users hold balances or convert may be performing it too, which is a question for its lawyers before launch rather than after.
What is a PSAV?
It is the Brazilian term for a virtual asset service provider, defined in Article 5 of Law 14.478/2022 as a legal entity that performs at least one of five virtual asset services on behalf of third parties. The Central Bank set the authorization and conduct rules in Resolutions 519, 520 and 521 of 2025.
How do I check whether a provider is authorized?
Ask for the legal entity name and the authorization it holds in each country of your flow, then check it against the local regulator's public register. A provider that cannot answer that in writing is asking you to carry a risk you have not been shown.
