VASP vs CASP: Not Synonyms, and the Difference Costs Money

You can hold a valid VASP registration in one country and still be unlicensed to serve retail clients in the European Union. You can file for a CASP authorisation in Lithuania and still need a separate VASP Licence from Dubai's Virtual Assets Regulatory Authority before you market an exchange in the emirate. VASP and CASP sound interchangeable in pitch decks, but they answer different regulators' questions. FATF uses VASP as an AML category. MiCA uses CASP as a full internal-market authorisation. VARA uses VASP as the name of its Dubai activity licence. Digital asset licensing and structuring starts by naming which perimeter your product actually crosses, because the wrong label on the application form sends you to the wrong documentation stack.

Why three words trigger three different filing stacks

Consultants often say "get a VASP licence" when they mean any crypto permission anywhere. That shorthand hides three separate legal objects. A FATF VASP is whoever conducts one of five virtual-asset activities for another person as a business, and each country transposes that template into its own register or licence law. A MiCA crypto-asset service provider is a legal person authorised under Regulation (EU) 2023/1114 to provide one or more listed crypto-asset services to clients on a professional basis. A VARA VASP is an entity licensed under Dubai Law No. (4) of 2022 and the Virtual Assets and Related Activities Regulations 2023 to carry out one or more Schedule 1 VA Activities in or from Dubai, excluding the DIFC.

The words overlap in marketing copy because all three cover exchange, transfer, and custody in broad terms. They diverge in what the supervisor examines before you open, what capital you must hold, and what passport you can claim across borders. Treating them as synonyms is how teams file an AML registration where a prudential authorisation is required, or describe a Dubai marketing plan in a form built for an EU CASP.

‍

FATF VASP: the global AML template

FATF does not issue licences. Recommendation 15, as updated in 2019 with its Interpretive Note, tells each member country to apply AML and counter-terrorist financing measures to virtual assets and to virtual asset service providers. The 2021 updated guidance gives the working definition national supervisors transpose. For a founder, FATF VASP is the floor: identify whether your activity is in scope, then find how the countries you touch implemented that scope.

Definition and covered activities

FATF defines a virtual asset service provider as any natural or legal person who, as a business, conducts one or more of five activities for or on behalf of another person: exchange between virtual assets and fiat; exchange between virtual assets; transfer of virtual assets; safekeeping or administration of virtual assets or instruments enabling control over them; and participation in or provision of financial services related to an issuer's offer or sale of a virtual asset. The guidance stresses that limbs (i) and (ii) cover the activity regardless of whether the provider acts as principal, intermediary, or clearing facility. Limb (iii) covers transfers of ownership or control between users or between a user's own addresses. DeFi arrangements that operate without an intermediary fall outside a country's implementation until a person can be identified as the VASP.

Regulator and supervisory model

Each jurisdiction picks its competent authority and chooses registration, licensing, or both. The supervisor's first question is whether your AML/CFT framework, governance, and fit-and-proper management can mitigate money-laundering and terrorist-financing risk. FATF expects countries to license or register VASPs at least where they are created, and to supervise them for AML compliance, including the Travel Rule on information accompanying virtual-asset transfers. National registers in the EU before MiCA's CASP deadline were often AML-only files, which is why regulators now draw a bright line between legacy VASP registration and CASP authorisation.

Permission object

A FATF-style VASP permission is not a product passport. It is permission to operate as a covered business subject to AML obligations: customer due diligence, sanctions screening, suspicious-transaction reporting, record-keeping, and Travel Rule compliance. It does not by itself grant rights to operate a trading platform under consumer-protection rules, hold client assets under prudential segregation standards, or market crypto-asset services across the EU internal market. Founders who treat a national VASP register as a "crypto licence" for all purposes discover the gap when a bank, exchange, or EU counterparty asks for MiCA authorisation or VARA activity coverage instead.

Capital and substance

FATF standards focus on risk-based AML supervision, not harmonised prudential floors. Some countries add minimum capital, local office, or resident director rules when they transpose VASP rules. Others keep registration lightweight. Substance expectations therefore vary by implementing state, not by the FATF glossary. A team that budgets only for policy drafting and registration filing may still need paid-in capital, insurance, or physical office categories under the national law that hosts the register. Confirm the live national rulebook; FATF itself publishes no capital schedule.

Cross-border use

FATF's Travel Rule requires originating VASPs to collect and transmit originator and beneficiary information on transfers, and beneficiary VASPs to receive and hold it. That obligation follows the transfer chain; it does not passport your business model. Serving clients in another country still triggers that country's licensing or registration rules, marketing restrictions, and tax reporting. A VASP registered in jurisdiction A cannot rely on FATF membership alone to solicit retail clients in jurisdiction B. Multi-country groups stack national VASP permissions, or move up to regimes with explicit passport rights such as MiCA for EU services.

‍

EU MiCA CASP: internal-market authorisation

MiCA replaced the patchwork of national crypto registers for full-service providers in the European Union. From 30 December 2024, firms that want to provide crypto-asset services to clients in the Union on a professional basis need authorisation as a crypto-asset service provider unless a narrow exemption applies. The acronym on the street is CASP. The legal term in Regulation (EU) 2023/1114 is crypto-asset service provider. Our MiCA overview for operators walks the issuer and stablecoin titles; this section stays on the service-provider permission.

Definition and covered activities

Article 3(15) defines a crypto-asset service provider as a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis, and that is allowed to provide those services under Article 59. Article 3(16) lists ten services: custody and administration; operation of a trading platform; exchange for funds; exchange for other crypto-assets; execution of orders; placing of crypto-assets; reception and transmission of orders; advice; portfolio management; and transfer services on behalf of clients. MiCA also regulates issuers of asset-referenced tokens and e-money tokens under separate titles. A desk that only issues tokens may need issuer authorisation without every CASP service, while a desk that runs an exchange and custody needs both the right service lines on the authorisation and the matching operational rules.

Regulator and supervisory model

National competent authorities in the Member State of the CASP's registered office grant, refuse, or withdraw authorisation. ESMA maintains central registers and coordinates supervision with EBA on prudential matters. The assessment covers governance, conflicts, complaints handling, custody policy, orderly wind-down, and AML alignment, not AML alone. The Central Bank of Ireland stated in May 2024 that CASP authorisation assessment is significantly broader than VASP registration under Ireland's pre-MiCA regime, and that an existing VASP registration provides no indication of CASP outcome and no simplified CASP path.

Permission object

The permission object is an authorisation to provide specified crypto-asset services across the European Union, with a single home-state supervisor and passporting to other Member States through notification. The authorisation lists which of the ten services the firm may provide. Marketing, client-facing terms, and whitepaper obligations for certain tokens sit alongside the service permission. Credit institutions and certain investment firms can provide some services after notification rather than a standalone CASP file, but they still fall under MiCA conduct and prudential rules when they do. Fully decentralised services without an identifiable provider remain outside Title V, which pushes groups to structure identifiable EU entities when they want a CASP passport.

Capital and substance

Article 67 requires crypto-asset service providers to hold prudential safeguards equal to the higher of the permanent minimum capital tier in Annex IV for their authorised services and one quarter of fixed overheads from the prior year, reviewed annually. New entrants use projected overheads from the authorisation application until they have a full year of accounts. Own funds must meet Common Equity Tier 1 quality tests under the banking regulation cross-references. Substance rules require a registered office in the Member State where the CASP carries out substantive business, effective management in the Union, and organisational requirements proportionate to the services authorised. These categories sit in MiCA and in national implementing measures; confirm the live Annex IV tier map on EUR-Lex for your service mix before you model the stack.

Cross-border use

A CASP authorised in one Member State may provide the authorised services in other Member States after passport notification. That right is internal to the EU economic area and tied to the services on the licence. It does not replace VARA's permission for activity in or from Dubai, a US money-services registration, or a FATF-style VASP register in a non-EU hub. Third-country firms soliciting EU clients need authorisation unless a narrow reverse-solicitation fact pattern applies; MiCA treats promotion in the Union as in-scope. Groups often place the CASP in an EU Member State with experienced supervisors while housing Dubai client flows in a VARA-licensed entity, with explicit intercompany and client terms between the two.

‍

UAE VARA VASP: the Dubai activity licence

In Dubai, VASP is not FATF shorthand alone and not a MiCA label. VARA uses Virtual Asset Service Provider Licence as the name of the permission to carry on Schedule 1 VA Activities under Dubai Law No. (4) of 2022. Article 3 of that Law applies VARA across Dubai, including free zones, with the Dubai International Financial Centre carved out to the DFSA. Any firm carrying on virtual-asset activity in or from Dubai outside the DIFC must hold a VARA licence before operations begin.

Definition and covered activities

VARA regulates Virtual Asset services through eight VA Activities in Schedule 1 of the 2023 Regulations: Advisory Services, Broker-Dealer Services, Category 1 VA Issuance, Custody Services, Exchange Services, Lending and Borrowing Services, VA Management and Investment Services, and VA Transfer and Settlement Services. The activity test is functional. A wallet marketed as "non-custodial" can still trigger Transfer and Settlement or Broker-Dealer limbs depending on who holds keys and who matches trades. Issuance splits between Category 1 tokens that need a VARA issuance licence and Category 2 paths that rely on licensed distributors. Picking the wrong activity label misaligns the rulebook pack VARA expects in Stage 2.

Regulator and supervisory model

VARA is the sole virtual-asset regulator for its geographic scope. Applications run through Dubai Economy and Tourism for mainland entities or through a Dubai free zone for zone companies, with VARA reviewing the virtual-asset overlay. Stage 1 delivers Approval to Incorporate after an Initial Disclosure Questionnaire and partial application fee; ATI allows incorporation and office setup but not VA business. Stage 2 is the VASP Licence application with full documentation, interviews, and remaining fee categories. VARA supervises ongoing compliance through compulsory rulebooks and activity-specific rulebooks, market conduct, technology and information standards, and periodic reporting.

Permission object

The permission object is a VASP Licence authorising named VA Activities, not a generic crypto registration. Schedule 4 defines the licence as VARA's grant to carry out those activities in the Emirate. Multi-activity licences are permitted except Custody, which must sit in a separate legal entity with its own licence. Proprietary trading uses a No Objection Certificate path rather than the regulated-activity licence. Marketing to Dubai residents, operating matching engines from a Dubai office, or holding client assets through a Dubai company all point to specific Schedule 1 lines on the licence face. A CASP authorisation from the EU does not substitute for that grant.

Capital and substance

Paid-up capital, insurance, and reserve-account requirements live in the Company Rulebook and activity rulebooks, with fee categories in Schedule 2 of the 2023 Regulations. Capital scales by activity and, for several activities, by whether custody is outsourced to another VARA-licensed custodian. Multi-activity VASPs hold capital for each licensed activity separately rather than blending floors. Substance categories include physical office, responsible individuals, wind-down planning, and banking arrangements that satisfy VARA's trust-account rules for capital. Check the live Company Rulebook Part IV and Schedule 2 on vara.ae before you file; this article names categories only.

Cross-border use

A VARA VASP Licence authorises activity in or from Dubai within VARA's perimeter. It does not passport into the EU as a CASP authorisation or into the DIFC as a DFSA permission. Overseas parent companies still need a Dubai entity and licence if the Dubai team conducts VA Activities or if marketing targets the emirate. Conversely, a VARA-licensed group that wants EU retail clients still needs MiCA CASP authorisation or another EU permission unless a very narrow exemption applies. UAE company formation and licensing maps these stacks side by side because banks and counterparties ask for the Dubai activity list, not the FATF glossary entry.

‍

Where national VASP registration stops and CASP begins

European founders who registered as VASPs under national AML laws between 2020 and 2024 often assume that file converts automatically into MiCA. It does not. Ireland's Central Bank told firms that legacy VASP registration assessed only AML/CFT and fitness and probity, while CASP authorisation assesses operational, organisational, and prudential requirements across MiCA Titles V and VI. Firms that registered before 30 December 2024 could use a transitional period to keep operating while a CASP application was pending, but only if they were already registered and operating lawfully as VASPs. New entrants after that date go straight to CASP authorisation if they want EU clients.

The practical fork shows up in application timing. Supervisors with long VASP queues told prospective applicants to prioritise CASP preparation rather than opening a fresh VASP registration that would soon be obsolete. A mislabelled filing that describes the business as seeking "VASP registration" in an EU Member State after MiCA's CASP date can land in the wrong team, with the wrong checklist, and with no passport at the end. National AML registers may remain for record-keeping, but the commercial permission for crypto-asset services in the Union is the CASP authorisation.

What breaks when the application uses the wrong label

Wrong-label applications waste money in predictable categories even before any enforcement fine. Refiling costs come first. VARA expects VA Activity names from Schedule 1; an application that describes the desk as a generic "VASP" or copies EU CASP service language without mapping to Advisory, Exchange, or Custody triggers clarification cycles and revised rulebook selections. EU competent authorities likewise expect the MiCA service list from Article 3(16), not FATF limb numbers alone.

Documentation mismatch is the second category. FATF-style VASP packs centre on AML policies, MLRO appointment, and Travel Rule procedures. CASP packs add prudential own-funds evidence, custody segregation, conflicts policy, complaints handling, and business continuity under MiCA operational articles. VARA Stage 2 packs add regulatory business plans, technology rulebook compliance, insurance certificates, and capital held under Company Rulebook trust rules. Submitting an AML-only binder to a CASP or VARA Stage 2 reviewer forces a full rewrite.

Capital and insurance categories misalign easily. MiCA own-funds tiers in Annex IV track authorised crypto-asset services and overhead tests. VARA paid-up capital categories track Schedule 1 activities and custodian arrangements. Budgeting for one regime's capital line while filing in another leaves Stage 2 blocked when the supervisor asks for proof in the format its rulebook defines. Insurance lines differ too: professional indemnity, directors and officers, and crime policies must match the activity rulebooks of the regulator actually reviewing the file.

Substance and staffing categories add delay when the label is wrong. CASP authorisation expects Union management and registered-office substance. VARA expects Dubai office, responsible individuals, and zone or mainland incorporation paths. An EU-entity template submitted to VARA, or a Dubai lean shell described as a CASP applicant, fails fit-and-proper and substance reviews for reasons unrelated to product quality.

Cross-border enforcement risk sits in a separate category. Marketing EU crypto services without CASP authorisation, or operating a Dubai exchange without a VARA VASP Licence, exposes the group to cease-and-desist orders, client redress claims, and banking exits. Professional fees to rescope the structure after a refused or withdrawn application often exceed the original filing budget because counsel must rebuild entity charts, intercompany agreements, and client terms around the correct permission.

‍

Cross-border marketing with three different passports

A passport is only as good as the regime that issued it. MiCA passports crypto-asset services across EU Member States for the services listed on the CASP authorisation. VARA's VASP Licence passports nothing into Europe; it permits defined VA Activities in Dubai's perimeter. A FATF VASP registration in a non-EU hub passports nowhere by itself; it signals AML registration to partners who understand that country's implementation.

Groups with legitimate multi-market desks split flows deliberately. EU retail-facing apps sit behind the CASP entity with MiCA-compliant terms and custody policies. Dubai operations sit behind the VARA-licensed entity with Schedule 1 activities that match the local desk. Group treasury and developer teams may sit in holding companies without client-facing VA Activities, but banks still ask which entity signs client contracts in each country. Travel Rule compliance then runs entity-to-entity across the chain, with VASP information exchanged per transfer even when the brands look unified in the app store.

‍

When FATF VASP logic is enough for your desk

FATF VASP framing fits early when you are mapping whether exchange, transfer, or custody activities trigger AML duties in a target country before you choose a hub. It fits when your product serves only clients in jurisdictions that still operate a standalone VASP register without a MiCA-style prudential overlay, and you have confirmed that register covers your activity list. It fits for Travel Rule programme design because FATF defines the information chain supervisors expect on virtual-asset transfers regardless of whether you later upgrade to CASP or VARA licences.

It fails when EU retail clients, EU marketing, or EU custody of crypto-assets are in scope after 30 December 2024. It fails when you operate in or from Dubai outside the DIFC and need to carry on VA Activities locally. It fails when counterparties demand MiCA authorisation numbers or VARA licence verification regardless of your home register. FATF vocabulary helps compliance officers explain AML scope to the board; it does not replace the permission object on the commercial contract.

‍

When MiCA CASP authorisation is the real gate

Choose the CASP path when the business model includes any Article 3(16) service to EU clients on a professional basis: exchange, platform operation, custody, transfer, execution, placing, advice, or portfolio management. Choose it when investors or banking partners require an EU authorisation they can verify in ESMA's registers. Choose it when you need passport notification to serve multiple Member States without separate national filings per service line.

The CASP path fails when the desk is purely non-EU and will not solicit EU clients, provided reverse solicitation is documented conservatively and marketing stays offshore. It fails when the token is a security under MiFID II rather than a crypto-asset under MiCA, because a different permission stack applies. It fails when the team expects a quick AML registration; competent authorities have publicly warned that CASP assessment timelines exceed legacy VASP registration by a wide margin. Budget the prudential, operational, and substance categories MiCA imposes, not a FATF register alone.

‍

When Dubai needs VARA's VASP licence

VARA's VASP Licence is the gate for VA Activities conducted in or from Dubai, excluding the DIFC. Choose it when the company is incorporated in a Dubai free zone or on the mainland, when staff operate matching, custody, or issuance functions from Dubai offices, or when marketing targets Dubai residents for virtual-asset products. Choose it when a global brand wants a regulated Dubai presence banks and regional partners recognise.

It fails when the entity and substance sit entirely in the DIFC and the product is a DFSA Crypto Token permission case instead. It fails when the Dubai company is only a passive holdco with no VA Activity. It fails when founders expect a MiCA CASP to cover Dubai client contracts signed locally. VARA's process is two-stage; ATI is not permission to trade. Label the Schedule 1 activities correctly on the IDQ because VARA uses those labels through supervision, fee categories, and capital rulebooks for the life of the licence.

‍

FAQ

Is a VASP licence the same as a CASP licence?

No. VASP is FATF's AML category and the name VARA gives its Dubai activity licence. CASP is MiCA's EU authorisation for crypto-asset services. The words describe different regulators, different permission objects, and different documentation stacks. A national VASP registration before MiCA assessed AML frameworks; a CASP authorisation assesses prudential, operational, and conduct rules across the Union.

Can I use one licence to serve clients in the EU and Dubai?

Not with a single permission. MiCA CASP authorisation passports specified services across EU Member States. VARA's VASP Licence covers VA Activities in or from Dubai outside the DIFC. Most multi-market groups use separate entities, separate licences, and explicit client routing. Banks and exchanges usually ask to see both files when the group brands itself globally.

Do I still need a VASP registration in Europe after MiCA?

For new market entry after 30 December 2024, EU crypto-asset services require CASP authorisation, not a standalone AML VASP registration. Legacy VASP registrants had transitional arrangements in some Member States, but continuing after the transitional window requires CASP authorisation. Check your home supervisor's MiCA implementation page for current deadlines and forms.

What happens if I file for the wrong licence type?

Supervisors typically issue deficiency letters, request reframing, or reject the application. You lose time rebuilding the pack around the correct service list, capital category, and substance model. VARA may withhold ATI or VASP Licence if activities fall outside its perimeter or standards. EU authorities treat misaligned VASP registration requests after MiCA as the wrong queue entirely.

Which regulator looks at AML for a VARA VASP?

VARA supervises the VASP Licence and expects compliance with its Compliance and Risk Management Rulebook. Federal UAE AML rules, including Cabinet Resolution No. (134) of 2025, apply in parallel. EU AML directives apply to CASPs in the Union. FATF sets the global template countries transpose. AML is layered on every permission; it is not a substitute for the activity licence itself.

Does FATF define CASP?

FATF does not use the term CASP. It defines virtual asset service providers and expects countries to license or register them for AML purposes. The European Union created the crypto-asset service provider category in MiCA. Dubai uses VASP as the licence name for Schedule 1 activities. Consultants who mix the terms in one sentence usually mean "some crypto licence somewhere."

Where do I confirm capital and fee categories before filing?

For MiCA CASPs, read Regulation (EU) 2023/1114 Article 67 and Annex IV on EUR-Lex, plus your national competent authority's forms. For VARA, read Schedule 2 fee categories and Company Rulebook Part IV capital rules on vara.ae. For FATF-style national VASP registers, read the implementing country's published rules. Confirm live schedules before you pay or file; categories change with rulebook updates.

‍

Sources

• FATF — Regulation of Virtual Assets and Interpretive Note to Recommendation 15
• FATF — Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs (MENAFATF)
• Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA)
• Central Bank of Ireland — Impact of MiCAR on VASPs
• VARA — Licence Applications
• VARA — Virtual Assets and Related Activities Regulations 2023
• Dubai Law No. 4 of 2022 Regulating Virtual Assets

‍