What is a
VASP?

What activities make an entity a VASP?

Under FATF Recommendation 15 (and its supporting guidance), a VASP is any entity that conducts one or more of these activities for or on behalf of another person:

• Exchange between virtual assets and fiat currencies.
• Exchange between one or more forms of virtual assets.
• Transfer of virtual assets.
• Safekeeping and/or administration of virtual assets.
• Participation in and provision of financial services related to an issuer's offer and/or sale of virtual assets.

What's the difference between FATF VASP and VARA VASP?

The FATF definition is the global standard used for AML/CFT purposes. The VARA framework adopts the FATF concept but with UAE-specific licensing requirements and activity-category structure. A VARA-licensed entity is automatically a VASP for FATF purposes, but FATF VASP status alone does not satisfy VARA's licensing requirements — the entity must specifically hold the relevant VARA authorisations.

What AML/CFT obligations apply to VASPs?

The Travel Rule (FATF Recommendation 16) requires VASPs to obtain, hold and transmit beneficiary information for virtual-asset transfers above defined thresholds. Customer due diligence, source-of-funds and source-of-wealth checks, transaction monitoring, suspicious transaction reporting and beneficial-ownership identification all apply to VASPs as to traditional financial institutions.

How does VARA enforce AML/CFT compliance?

VARA's Compliance & Risk Rulebook prescribes detailed AML/CFT obligations. Independent compliance audits, regular reporting, supervisory inspections and enforcement action are all part of the framework. Breach of AML/CFT obligations is one of the most serious enforcement triggers in the VARA framework.

Is a VASP the same as a crypto exchange?

An exchange is one type of VASP. The term covers the whole service stack — brokers, custodians, advisers, asset managers, lenders and transfer providers — each mapping to its own licence category and rulebook in regimes such as Dubai’s VARA framework.

Do foreign VASPs serving Dubai clients need a VARA licence?

Actively marketing or providing virtual-asset services in or from Dubai (outside DIFC) triggers VARA’s perimeter. Reverse solicitation is construed narrowly — foreign platforms courting Dubai users without a licence risk enforcement action.

Where does the term VASP come from?

From the FATF Recommendations, which define virtual-asset service providers so that exchange, transfer, custody and issuance-related services fall inside the global AML/CFT framework. National regimes — including the UAE’s — build their licensing categories on that definition.