VASP License Requirements: AML, Capital and Compliance

*By Magnus Müller · Reviewed by Magnus Müller · Last updated: 2026-06-14*

A VASP licence rests on four requirements that recur in almost every jurisdiction: a working AML/CFT programme, fit-and-proper owners and managers, minimum capital where the regime sets it, and local substance plus ongoing reporting. These four pillars sit on top of the FATF Recommendation 15 baseline that every credible country implements. The thresholds differ, the structure does not.

That structure is what this page maps. Rather than reproduce one country's checklist, we set out the jurisdiction-agnostic spine of VASP registration requirements, then show how each pillar is implemented under the EU's MiCA regime and the legacy national regimes it is replacing. Capital figures are bound to the statute that sets them, so you can see exactly where a number comes from before you build a business case around it.

What Are the Core Requirements for a VASP License?

The core requirements for a VASP licence are four: an AML/CFT programme equivalent to that of a regulated financial institution, fit-and-proper owners and managers, minimum capital where the jurisdiction sets it, and local substance with ongoing supervisory reporting. These pillars rest on the FATF Recommendation 15 floor: licence or register, supervise, apply the same AML/CFT measures, and enforce the Travel Rule.

Everything else on this page is detail underneath those four pillars. Capital is the most numerically searchable facet, so it gets a dedicated section with a sourced table, but the AML programme is usually the heaviest lift in practice. Before the pillars, it helps to understand the baseline that makes them universal.

The FATF R.15 baseline (license, supervise, AML/CFT, Travel Rule)

The Financial Action Task Force sets the global floor through Recommendation 15. Countries must require virtual asset service providers to be licensed or registered, subject them to supervision or monitoring by a competent authority, apply the same relevant AML/CFT preventive measures that apply to financial institutions, and implement the Travel Rule under Recommendation 16 for virtual asset transfers (FATF Recommendation 15).

A point that surprises many founders: FATF itself does not issue licences. It writes the standard; national competent authorities and financial intelligence units apply it, set the actual thresholds, and grant or refuse the authorisation. So "VASP requirements" always means the FATF floor plus the specific conditions of the country you choose. For the full standard-setting picture, see our explainer on the FATF VASP framework.

The four pillars at a glance

Across regimes, VASP requirements reduce to four pillars that this page uses as its spine:

1. AML/CFT programme: the same preventive measures expected of a financial institution (FATF R.15).
2. Fit-and-proper owners and managers: good repute, competence and clean records, codified for EU CASPs in MiCA Article 68.
3. Minimum capital: set by class under MiCA (EUR 50,000 to EUR 150,000), and by national rule under legacy regimes.
4. Substance and ongoing reporting: a registered office, local management presence, and continuing supervisory filings.

Each pillar below maps back to one of these four. If you read nothing else, read the pillar headings: they are the checklist.

VASP vs CASP (why the EU figures apply)

"VASP" is the FATF term; "CASP", or crypto-asset service provider, is the EU term used in MiCA. They describe the same regulated activity under different framings. That equivalence is why the concrete EU capital figures in this guide, EUR 50,000, EUR 125,000 and EUR 150,000, are the real-world numbers behind the abstract "minimum capital" pillar for any business that operates in or passports into the European Union.

If you are still deciding whether your model even falls in scope, start with what counts as a VASP. If you have settled on the EU, the detailed authorisation route is the CASP licence under MiCA.

Pillar 1, The AML/CFT Programme a VASP Must Run

The AML/CFT programme is the requirement FATF R.15 anchors directly: a VASP must apply the same anti-money-laundering and counter-terrorist-financing measures as a regulated financial institution (FATF Recommendation 15). In the EU this obligation comes from the AML framework alongside MiCA. It is also the pillar most applicants underestimate, because it is operational rather than a one-off capital deposit.

The nine components of a VASP AML programme

A defensible VASP AML programme contains nine working components:

1. ML/TF risk assessment: documented, business-wide and updated periodically.
2. Written AML/CFT policies and procedures: board-approved.
3. KYC / Customer Due Diligence (CDD): identity verification, ultimate-beneficial-owner (UBO) identification, and enhanced due diligence for high-risk or politically-exposed customers.
4. Transaction monitoring: ongoing screening for suspicious patterns.
5. Sanctions and PEP screening: against current lists.
6. STR / SAR reporting: suspicious transaction or activity reports filed to the national financial intelligence unit (FIU).
7. Recordkeeping: retention of CDD and transaction records.
8. Appointed MLRO / AML compliance officer: many regimes require a dedicated or local officer (Lithuania VASP rules).
9. Travel Rule solution: the FATF R.16 data-transmission capability described below (Elliptic, Travel Rule).

For the full compliance-silo treatment of customer due diligence and screening, see our guide to AML and KYC compliance.

Do you need a local AML officer (MLRO)?

Most regimes require you to appoint a named AML compliance officer, often called the MLRO (money laundering reporting officer), who owns suspicious-activity reporting and the AML programme. Some regimes go further and require that officer to be dedicated and local. Lithuania, for example, requires an exclusive local AML officer attached to a single company (Lithuania VASP rules). This is not a universal rule, residency and exclusivity requirements vary by country, so confirm the standard in your chosen jurisdiction before you hire.

The Travel Rule in one paragraph

The Travel Rule is FATF Recommendation 16 applied to virtual-asset transfers. A VASP must obtain, hold and transmit originator and beneficiary information when it sends a transfer: typically the originator and beneficiary name, an account or unique transaction reference, and supporting identifiers (Elliptic, Travel Rule). FATF recommends a de-minimis threshold of USD/EUR 1,000, but national thresholds vary. We keep the deep dive on a dedicated page, see the crypto Travel Rule guide, rather than duplicate it here.

*Thresholds via Elliptic.*

Pillar 2, Fit-and-Proper Owners and Managers

The second pillar tests the people behind the licence. Regulators will not authorise a VASP whose owners or managers cannot demonstrate good repute and competence. In the EU this is codified for CASPs in MiCA Article 68; national VASP regimes apply equivalent vetting.

The MiCA Article 68 standard

Under MiCA Article 68, members of the CASP management body must be of sufficiently good repute and must possess appropriate knowledge, skills and experience, both individually and collectively. They must commit sufficient time to their functions and must not have been convicted of money-laundering or terrorist-financing offences, or of any other offences that would affect their good repute (MiCA Article 68). In short: clean record, real competence, and genuine time commitment, not a name on a letterhead.

Owners are vetted too, not just directors

A common misconception is that only directors face fit-and-proper scrutiny. They do not. MiCA Article 68(3) applies the same good-repute and no-conviction standard to shareholders and members with qualifying holdings. Where a significant owner's influence risks the sound and prudent management of the firm, the competent authority may suspend their voting rights (MiCA Article 68). Plan your cap table with that vetting in mind from the start.

How national regimes apply fit-and-proper

Legacy national VASP regimes reach the same result by their own route. They vet directors, the appointed MLRO and the ultimate beneficial owners for a clean criminal record, demonstrable competence and a verifiable source of funds (CMS, Estonia crypto regulation; Coincub, Lithuania VASP). The labels differ from MiCA's, the substance is the same: the regulator wants to know who really controls and runs the business.

Pillar 3, Minimum Capital Requirements (MiCA and Legacy Regimes)

Capital is the highest-intent facet of "VASP requirements", and the one most often misquoted. There is no single global number. Under MiCA, capital is set by service class; under legacy national regimes, by national rule. The table at the foot of this section gives every figure with its statutory source.

MiCA CASP minimum capital by service class

MiCA sets a permanent minimum capital for CASPs by service class in Annex IV (MiCA Annex IV / EUR-Lex):

• Class 1, EUR 50,000: execution of orders; placing; transfer services; reception and transmission of orders; advice; portfolio management.
• Class 2, EUR 125,000: all Class 1 services plus custody and administration; exchange of crypto for funds; exchange of crypto for crypto.
• Class 3, EUR 150,000: all Class 2 services plus operation of a trading platform.

The classes are cumulative: a Class 3 platform that also offers custody and execution still anchors to the EUR 150,000 floor for its highest activity. For the full per-country capital grid beyond the EU baseline, see VASP licence by country.

The own-funds rule (higher of capital or quarter of fixed overheads)

The Annex IV amount is a floor, not a ceiling. MiCA Article 67(1) requires a CASP's own funds to be the higher of the Annex IV minimum or one quarter of the preceding year's fixed overheads, reviewed annually (MiCA Article 67(1) / EUR-Lex). For a larger operator with substantial fixed costs, the overheads-based figure can exceed the headline class minimum, so budget against your actual cost base, not just the table.

Capital by regime (sourced)

*MiCA figures via EUR-Lex Regulation (EU) 2023/1114; Estonia via CMS; Lithuania via Coincub. National figures are corroborated via secondary legal sources and should be confirmed against the underlying AML Acts before you commit capital.*

Legacy national capital (Estonia, Lithuania) and why it is changing

Before MiCA, EU member states set their own VASP capital rules. Estonia required minimum share capital of EUR 100,000, rising to EUR 250,000 where the provider offered virtual-asset transfer services (CMS, Estonia). Lithuania set registered capital at EUR 125,000 from 1 November 2022 (Coincub, Lithuania). Treat both as legacy and transitional: they are being absorbed into the MiCA CASP regime. For the country-specific detail, see Estonia VASP registration and Lithuania VASP rules.

Where capital is EUR 0 (pure-registration regimes)

Historically, several pure-registration regimes imposed no minimum capital at all: registration was an AML notification rather than a prudential licence. That model is closing inside the EU, where MiCA replaces light registration with full CASP authorisation and its Annex IV capital floor. Outside the EU some registration-only regimes persist, but a EUR 0 capital line should be read as a red flag for credibility rather than a feature, the next section explains why.

Pillar 4, Local Substance and Ongoing Reporting

The fourth pillar asks whether the business is genuinely present and governed where it is licensed, and whether it keeps reporting after authorisation. A shell with a brass-plate address does not satisfy modern substance rules.

MiCA substance requirements (office, management, EU-resident director)

MiCA Article 59 sets the EU substance baseline. A CASP must have a registered office in the member state where at least part of its services are carried out, its place of effective management in the Union, and at least one director resident in the Union (MiCA Article 59). The intent is to anchor real decision-making inside the EU, not merely an entity registration.

Example: Lithuania's residency and local-AML-officer rules

Legacy national regimes layer their own substance rules on top. Lithuania, for instance, requires a senior manager to be a Lithuanian tax resident and requires an exclusive, local AML officer attached to the company (Coincub, Lithuania). It is a concrete illustration of how the same "substance" pillar translates into specific residency and staffing obligations on the ground.

Ongoing obligations after you are licensed

A VASP licence is not a one-time event. FATF R.15 mandates continuing supervision or monitoring by a competent authority (FATF Recommendation 15). In practice that means periodic AML reporting, own-funds and financial reporting, ongoing STR filing to the FIU, and prompt notification of changes to ownership or management. Exact filing cadences and audited-accounts thresholds are national, so confirm them against your chosen regulator. For where the costs of ongoing compliance land, see VASP licence costs and fees.

Have questions about your specific situation? Book a free 15-minute discovery call with our licensed advisers, no commitment. Book a Call

How the MiCA Transition Changes VASP Requirements

The biggest recent shift in EU VASP requirements is the MiCA transition. The light national registration regimes that defined the last cycle are closing, replaced by a single CASP authorisation. If your plan still references an old national VASP registration, check the dates below before you rely on it.

Key dates (1 Nov 2022 / 30 Dec 2024 / 1 Jul 2026)

• 1 November 2022: Lithuania raised VASP registered capital to EUR 125,000 (Coincub, Lithuania).
• 30 December 2024: MiCA CASP rules apply; new Estonian VCSP authorisations stopped, and legacy national VASP/VCSP regimes began their sunset (MiCA / EUR-Lex; CMS, Estonia).
• 1 July 2026: Estonia's MiCA transition deadline (CMS, Estonia).

National regimes being sunset (Estonia, Lithuania, Poland, Ireland, Netherlands)

Inside the EU, the message is simple: the regime is now CASP. The legacy national VASP and VCSP registration regimes in Estonia, Lithuania, Poland, Ireland and the Netherlands are being sunset and replaced by MiCA authorisation (MiCA / EUR-Lex). Treat any national capital figure as legacy and transitional, and confirm the current open or closed status of a given national registration with its regulator before assuming you can still obtain it. The forward-looking baseline is MiCA Annex IV.

Are VASP Requirements the Same in Every Country?

No. FATF R.15 is the floor, but capital, residency and MLRO rules are national, and implementation around the world is uneven. That unevenness is exactly why the choice of jurisdiction matters as much as the requirements themselves.

What the FATF 2024 review found

FATF's March 2024 review assessed 58 jurisdictions and found wide gaps in implementation. Around 17 percent (10 jurisdictions) lacked a VASP licensing or registration framework, around 33 percent (19) had not enacted Travel Rule legislation, around 15 percent (9) had not conducted VASP supervisory inspections, and around 28 percent (16) had taken no enforcement action. Only the Bahamas was deemed fully compliant with R.15 (FATF, March 2024 review). These figures are quoted via secondary sources and are flagged for in-browser verification against the FATF report before publication.

Choosing a credible jurisdiction

The practical takeaway: a low headline capital figure or a fast registration route can signal a regime that has not built real supervision, and that reputational risk follows you to banking, payments and counterparties. A credible jurisdiction, with genuine supervision and a recognised framework, is usually worth more than a cheap one. Compare regimes side by side in our VASP licence by country grid, and read the full VASP licensing guide for the end-to-end route.

From our practice

In our advisory work at Crypto Valley Partners AG, the pillar that derails timelines is rarely capital, it is the AML programme and the fit-and-proper file. Founders arrive with the share capital ready but with no documented risk assessment, no named MLRO and an under-prepared ownership disclosure. The pattern is consistent: the regulator's questions cluster around governance and AML readiness, not the bank balance. The applicants who move fastest treat the four pillars as one integrated submission from day one, rather than assembling capital first and compliance later.