A VASP licence is the authorisation or registration a regulator requires before a business can exchange, transfer or hold crypto for customers. There is no global VASP licence: you need one in each market you serve, under that market’s own name.
As of 14 October 2026, the EU route is MiCA CASP authorisation (national VASP registrations stopped giving access when the transitional periods ended, by 1 July 2026 at the latest), the UK still uses FCA registration until a new authorisation regime starts on 25 October 2027, Dubai’s VARA charges AED 40,000 to AED 100,000 per activity to apply, Singapore charges S$1,000 to S$1,500 with S$100,000 to S$250,000 base capital, and Hong Kong’s SFC had licensed 13 trading platforms. Regulator fees are the small part of the bill. Capital, staff and advisers make up most of it.
If you are launching an exchange, wallet, broker or on-ramp, “do we need a VASP license?” is usually the first legal question, and the answers online come mostly from firms selling licence packages. Many still describe Polish or Czech registrations as a cheap route into Europe, or quote fees with no source and no date. This guide defines a VASP, then sets out a dated table of the main licences: the name of each, the regulator, minimum capital, the official application fee, the timeline and the conditions that matter. Fees come only from regulators’ own schedules. Where a figure is a consultant’s quote, it is labelled as one.
What is a VASP?
VASP stands for virtual asset service provider. The term comes from the Financial Action Task Force (FATF), which brought crypto businesses under its anti-money-laundering standards when it updated Recommendation 15 in 2019. FATF’s glossary defines a VASP as any person who, as a business and on behalf of others, carries out one or more of five activities:
- exchange between virtual assets and fiat currencies;
- exchange between one or more forms of virtual assets;
- transfer of virtual assets;
- safekeeping or administration of virtual assets, or instruments enabling control over them;
- participation in and provision of financial services related to an issuer’s offer or sale of a virtual asset.
Exchanges, custodial wallets, brokers, OTC desks, crypto ATM operators and token sale platforms are all typical VASPs. A person using their own self-custody wallet is not. FATF sets the standard, but it does not issue licences. Each country writes its own law, which is why the same business is a CASP in the EU, a cryptoasset business in the UK, a digital payment token service provider in Singapore and a VASP in Dubai.
Is Coinbase considered a VASP?
Yes. Coinbase exchanges and holds crypto for customers, which is the FATF definition. In practice it operates through several regulated legal entities. Its help centre says the entity serving you is named in your terms of service, and that it does not publish a real-time list of all its local licences and registrations (checked 14 October 2026). That is the pattern for most large exchanges: one licence per market, held by a local entity.
VASP licence vs registration vs CASP
“VASP licence” is a search term, not a legal category. Some regimes only register you for anti-money-laundering supervision, such as the UK’s current FCA registration and the Cayman Islands’ original VASP registration. Others are full licences with capital, conduct and custody rules, such as MiCA, VARA and Hong Kong. A registration usually costs less and comes faster, but it gives you fewer rights, and several regimes are now replacing registration with full authorisation.
VASP licences compared by jurisdiction (as of 14 October 2026)
| Jurisdiction | Licence or registration | Regulator | Minimum capital | Official application fee | Timeline | Key conditions |
|---|---|---|---|---|---|---|
| European Union | MiCA crypto-asset service provider (CASP) authorisation | The national competent authority in your home member state | EUR 50,000 (class 1), EUR 125,000 (class 2) or EUR 150,000 (class 3), or a quarter of last year’s fixed overheads if higher | Set by each member state, not harmonised | Statutory clock once complete: 25 working days for completeness, then 40 working days to assess (Central Bank of Ireland) | National VASP registrations only covered the transitional period, which ended by 1 July 2026 |
| United Kingdom (now) | Cryptoasset registration under the Money Laundering Regulations 2017 | FCA | None stated on the FCA pages checked | FCA fee page lists cryptoasset firms in pricing Category 6 (£11,260); the registration page says crypto registrations use an income-based sliding scale | FCA decides within 3 months of holding all the information it needs | Must register before starting in-scope services; registration will not convert to the new regime |
| United Kingdom (from 25 October 2027) | FSMA authorisation for cryptoasset regulated activities | FCA | Not published on the pages checked | Not published on the pages checked | Application period 30 September 2026 to 28 February 2027 | Firms that never apply must run off UK business before the start date |
| Dubai (mainland and free zones except DIFC) | VASP licence, one per virtual asset activity | VARA | Paid-up capital from AED 100,000 (advisory) to AED 1,500,000 (exchange), or 15% to 25% of fixed annual overheads if higher | AED 40,000 (advisory, transfer and settlement) or AED 100,000 (exchange, custody, broker-dealer and others); each extra activity 50% of the lower fee | No statutory clock in the schedules checked | Annual supervision fee AED 80,000 or AED 200,000 per activity; capital held in a UAE trust account or surety bond naming VARA |
| Abu Dhabi (ADGM) | FSRA authorisation for virtual asset activities | FSRA | Custody: higher of USD 250,000 or six months’ audited expenditure. Trading venue (MTF): six months’ operating expenses | In the FSRA fees rules (amounts not verified for this article) | Not stated | Regulatory capital must be held in fiat (FSRA guidance, version 10 June 2025) |
| Dubai International Financial Centre | DFSA authorisation for financial services involving crypto tokens | DFSA | Depends on the financial service permission (not checked) | Not checked | Starts with an enquiry through DFSA Connect | Since 12 January 2026, firms assess each token’s suitability themselves; the DFSA no longer keeps a recognised token list |
| Singapore | Standard (SPI) or major (MPI) payment institution licence for digital payment token services | MAS | Base capital S$100,000 (SPI) or S$250,000 (MPI); MPIs also post security of S$100,000 or S$200,000 | S$1,000 (SPI) or S$1,500 (MPI) for a DPT service | No statutory clock in the regulations checked | Firms serving only overseas customers need a separate licence since 30 June 2025, which MAS says it will generally not issue |
| Hong Kong | Virtual asset trading platform (VATP) licences: SFO Types 1 and 7 plus an AMLO VASP licence | SFC | HK$5 million paid-up share capital and HK$3 million liquid capital (see note below) | HK$4,740 per licence or regulated activity; HK$2,950 per responsible officer; HK$1,790 per representative | Not stated by the SFC | 13 platforms licensed on the SFC list updated 12 October 2026 |
| Cayman Islands | VASP registration; full licence for custody and trading platforms since 1 April 2025 | CIMA | None stated on CIMA’s FAQ | Registration CI$1,000 (US$1,219.50) plus an assessment fee on approval; licence fees in Schedule 2 of the 2025 regulations (not reproduced by CIMA’s FAQ) | Existing registrants had 90 days from 1 April 2025 to apply for a licence | Annual fees due by 15 January, with monthly late surcharges |
| British Virgin Islands | VASP registration under the Virtual Assets Service Providers Act 2022 | Financial Services Commission | Not checked | Not checked | Not checked | 22 entities on the FSC’s VASP list when checked |
| El Salvador | Digital asset service provider (DASP) registration under the Digital Assets Issuance Law | National Commission of Digital Assets (CNAD) | Not checked | Not checked | Not checked | CNAD states that operating without its approval is illegal |
Checked 14 October 2026 against ESMA’s MiCA single rulebook, the Central Bank of Ireland, FCA, VARA rulebook, ADGM FSRA guidance, DFSA, Singapore Statutes Online, SFC and CIMA pages. “Not checked” means no official figure could be confirmed for this article, not that none exists. Hong Kong capital figures come from the SFC’s VATP guidelines as summarised by two of the ranking pages reviewed; the SFC pages fetched for this article did not restate them, so read the guidelines before relying on them. This is a summary, not legal advice.
European Union: MiCA CASP authorisation replaces national VASP regimes
Under MiCA, Regulation (EU) 2023/1114, a business that provides crypto-asset services in the EU needs CASP authorisation from the competent authority of its home member state. The old national VASP registrations, such as those in Lithuania, Czechia and Poland, were anti-money-laundering registrations. They are not MiCA authorisations.
Article 143(3) let firms already operating under national law before 30 December 2024 continue “until 1 July 2026 or until they are granted or refused a MiCA authorisation”, and member states could shorten that period (ESMA). ESMA’s list of national choices shows how different the end dates were: 6 months in Poland, the Netherlands, Latvia, Hungary, Slovenia and Finland; 12 months in Germany, Ireland, Lithuania, Austria and Slovakia; and 18 months, the maximum, in France, Malta, Czechia and others. So as of 14 October 2026, no EU transitional period is still running. A firm without a CASP authorisation, or a passport from one, cannot serve EU clients.
Minimum capital under MiCA
MiCA ties capital to the heaviest service you are authorised for (ESMA interactive single rulebook):
- Class 1, EUR 50,000: executing orders, placing, transfer services, receiving and transmitting orders, advice and portfolio management.
- Class 2, EUR 125,000: class 1 plus custody and administration, and exchanging crypto for funds or for other crypto.
- Class 3, EUR 150,000: class 2 plus operating a trading platform.
Article 67 requires the higher of that figure or “one quarter of the fixed overheads of the preceding year, reviewed annually”. For a mid-sized exchange, the overheads test is usually the binding one.
Poland and Czechia after MiCA
Poland: as of 14 October 2026 Poland has no functioning MiCA framework. President Karol Nawrocki vetoed the Crypto-Asset Market Act, which would have made the KNF the supervisor, and the latest override attempt failed (BeInCrypto, 6 September 2026). The KNF itself has said Poland still has no designated authority for the sector. A Polish VASP registration bought as a shelf company is not a route into the EU.
Czechia: Czechia chose the full 18-month transition, but only for firms that applied for MiCA authorisation before 31 July 2025 (ESMA list). That period ended on 1 July 2026. Offers of a “Czech VASP licence” for EU access are out of date.
United Kingdom: FCA registration now, authorisation from October 2027
Today, cryptoasset exchange providers and custodian wallet providers carrying on business in the UK must register with the FCA under the Money Laundering Regulations before starting. Once the FCA has everything it needs, it has 3 months to decide. The FCA’s fees page puts cryptoasset firms in pricing Category 6 (£11,260), while its registration page says crypto registrations use an income-based sliding scale, so confirm the exact fee in the FCA Connect system before you budget.
A new regime replaces this. Firms doing the new cryptoasset regulated activities will need full FSMA authorisation. The application period “started on 30 September 2026 and will close 28 February 2027”, and the regime is expected to start on 25 October 2027 (FCA, how the gateway will operate). Registered firms get no automatic conversion.
Firms that apply in the window and are still waiting at the start date can keep operating until the FCA decides. Late applicants enter a transitional provision that only lets them perform existing contracts. Firms that never apply must run off their UK business. If you are planning a UK launch now, register only as a stepping stone and plan for the authorisation application in parallel. The Binance UK guide shows what operating without FCA status means in practice.
UAE: VARA, ADGM and DIFC
The UAE has three separate crypto regulators depending on where your company sits.
VARA (Dubai mainland and most free zones). VARA licenses each activity separately and publishes its fees in Schedule 2 of its regulations (VARA fee schedule):
| VA activity | Application fee | Annual supervision fee | Paid-up capital (higher of) |
|---|---|---|---|
| Advisory services | AED 40,000 | AED 80,000 | AED 100,000 |
| Transfer and settlement | AED 40,000 | AED 80,000 | AED 500,000 or 25% of fixed annual overheads |
| Broker-dealer | AED 100,000 | AED 200,000 | AED 600,000 or 25% (AED 400,000 or 15% if using a VARA-licensed custodian) |
| Custody | AED 100,000 | AED 200,000 | AED 600,000 or 25% |
| Exchange | AED 100,000 | AED 200,000 | AED 1,500,000 or 25% (AED 800,000 or 15% if using a VARA-licensed custodian) |
| Lending and borrowing | AED 100,000 | AED 200,000 | AED 500,000 or 25% |
| VA management and investment | AED 100,000 | AED 200,000 | AED 500,000 or 25% (AED 280,000 or 15% with a VARA custodian) |
Checked 14 October 2026 on VARA’s rulebook site (Schedule 2 and Company Rulebook Part VI.B). Each additional activity carries a licence extension fee of 50% of the lower application fee. VARA may raise fees based on a firm’s risk profile.
Capital is per activity: a firm licensed for exchange and custody holds both amounts. It must sit in a UAE bank trust account or a surety bond with VARA as beneficiary, and be reconciled monthly.
ADGM (Abu Dhabi). The FSRA authorises virtual asset activities inside ADGM. Its guidance (version 10 June 2025) sets custody capital at the higher of USD 250,000 or six months of audited annual expenditure, requires trading venues to hold six months of operating expenses, and requires regulatory capital in fiat.
DIFC (Dubai International Financial Centre). The DFSA treats crypto tokens as financial instruments, so you apply for the ordinary financial services permission your business model needs. Rules effective 12 January 2026 moved token suitability assessments onto firms, and the DFSA no longer publishes a recognised token list.
Singapore: MAS digital payment token licence
A business providing a digital payment token (DPT) service in Singapore needs a licence under the Payment Services Act 2019. The Payment Services Regulations set the numbers (Singapore Statutes Online, version current at 14 October 2026):
- Standard payment institution: base capital of at least S$100,000; application fee S$1,000 for a DPT service.
- Major payment institution: base capital of at least S$250,000; application fee S$1,500; plus security with MAS of S$100,000 where monthly volume per service averages no more than S$6 million, otherwise S$200,000.
The fee is the easy part. MAS sets a high bar on substance and controls. Since 30 June 2025, Singapore firms serving only customers outside Singapore also need a digital token service provider licence, and MAS said on 6 June 2025 that it “has set the bar high for licensing and will generally not issue a licence” for that model. Singapore is no longer a place to book an offshore-only exchange.
Hong Kong: SFC VATP licence
A virtual asset trading platform in Hong Kong needs SFC licences under two laws: Types 1 and 7 under the Securities and Futures Ordinance for security tokens, and a VASP licence under the Anti-Money Laundering Ordinance for other tokens. The SFC recommends applying under both because a token’s classification can change. Application fees are low: HK$4,740 per licence or regulated activity, HK$2,950 per responsible officer approval and HK$1,790 per licensed representative (SFC page last updated 16 January 2025). Capital is not: platforms are widely reported to need HK$5 million paid-up share capital and HK$3 million liquid capital under the SFC’s VATP guidelines.
As of 12 October 2026 the SFC lists 13 licensed platforms. Two applicants are “deemed to be licensed” and may still be refused. One platform, Matrixport HK, must close by 12 January 2027. The SFC warns that applicants not deemed licensed should not do business in Hong Kong or market to Hong Kong investors (SFC VATP list).
Offshore VASP registrations: what they can and can’t do
Offshore options are popular because the official fees are low and the process is shorter. The catch is what they give you.
- Cayman Islands: CIMA charges CI$1,000 (US$1,219.50) to apply for registration, plus an assessment fee on approval. Since 1 April 2025, custody and trading platform businesses need a full licence, and existing registrants had 90 days to apply. Cayman is no longer a registration-only regime for exchanges.
- British Virgin Islands: the FSC registers VASPs under the 2022 Act. Its public list showed 22 entities when checked, including Bitstamp Global and a Kraken entity (Payward Oceanic). Fee and capital figures could not be confirmed on the FSC pages fetched.
- El Salvador: CNAD registers digital asset service providers and keeps a public registry. Requirements and fees were not published on the pages checked.
The honest caveat: an offshore registration lets you operate from that jurisdiction. It does not let you serve customers in the EU, the UK, Singapore or Hong Kong, where the licence follows the customer. FATF’s targeted update of 16 July 2026 again called for stronger action on virtual asset risks, so expect banks and payment partners to ask how an offshore-only licensee is supervised.
How much does a VASP licence cost?
There is no single price, and regulator fees are the smallest part. A useful budget has four layers:
- Official fees: the figures in the table above, plus annual supervision fees.
- Capital you must hold: not spent, but tied up for as long as you are licensed.
- Substance and people: local directors, a compliance officer and MLRO, office, audit, and the compliance tools covered in the crypto compliance guide.
- Advisers: legal, policy drafting and application management.
Two worked examples using only official figures, as of 14 October 2026:
- Dubai exchange using a VARA-licensed custodian: AED 100,000 application fee + AED 200,000 annual supervision fee = AED 300,000 paid to VARA in year one, plus at least AED 800,000 (or 15% of fixed annual overheads) held as paid-up capital. Adding your own custody activity adds a AED 50,000 extension fee, another AED 200,000 a year and at least AED 600,000 more capital, because VARA requires capital for each licensed activity.
- Singapore DPT major payment institution: S$1,500 application fee, S$250,000 base capital and S$100,000 security (at up to S$6 million average monthly volume per service). That is S$1,500 spent and S$350,000 committed before any staff or systems.
Consultant quotes (not official fees): a Prague licensing firm, Samson Solutions, advertises EU VASP registration packages “from €25,000”. A LegalBison article republished on Global Law Experts (May 2026) puts EU preparation costs at €15,000 to €50,000+ and a first year in Malta at €80,000 to €150,000. Google’s AI Overview for “how much does a VASP license cost” shows a table that mixes regulator fees and consultant estimates without saying which is which. Treat any quote that doesn’t separate official fees, capital and adviser fees as marketing.
Is a VASP licence free?
No. Every regime checked for this article charges at least an application fee, from CI$1,000 in the Cayman Islands to AED 100,000 per activity at VARA. (If you were searching for the VASP physics software, the Vienna Ab initio Simulation Package, that is a different product with its own licence.)
How long does it take?
Only some regulators commit to a clock, and it starts when your file is complete, not when you first submit:
- MiCA: 25 working days to confirm completeness, then 40 working days to assess, with one pause of up to 20 working days for questions (Central Bank of Ireland). One ranking page gives 20 and 60 days; the regulator’s figures are the ones above.
- UK registration: 3 months once the FCA has all the information it needs. Its case officers usually ask for more first.
- VARA, MAS, SFC: no statutory decision deadline in the documents checked. Vendor pages ranking for this keyword estimate 4 to 9 months for VARA and 6 to 12 months or more for Singapore and Hong Kong. These are consultant estimates, not regulator commitments.
Where to get one: choosing a jurisdiction
Pick the licence from your customers backwards, not from the cheapest fee table:
- Where are your customers? The EU, UK, Singapore and Hong Kong regulate who serves their residents. An offshore registration does not cover them.
- Do you need one licence for many markets? A MiCA authorisation is designed for the whole EU, which no other regime here offers.
- Which activities? VARA and MiCA price and capitalise by activity. Custody and trading platforms cost the most everywhere.
- Can you fund the capital and substance? A UAE trust account, a Singapore security deposit and local senior staff all have to be in place before approval.
- Will banks and partners accept it? Ask your banking and payment partners which licences they accept before you file.
Red flags when someone sells you a licence
- “Ready-made” Polish or Czech VASP companies for EU access. As of 14 October 2026 they give no EU market access: Poland has no functioning MiCA regime and Czechia’s transition ended on 1 July 2026.
- Undated fee tables. None of the top five ranking pages reviewed dated their fee figures. Ask for the regulator’s schedule.
- Timelines promised in weeks for full licences. No regulator checked here commits to that.
- “Deemed licensed” or “applied” presented as licensed. Hong Kong’s list shows the difference, and the SFC says deemed applicants may still be refused.
- Offshore registration sold as global. It covers the registering jurisdiction only.
What this means for you
As of 14 October 2026, the VASP licence map has moved from registration to authorisation. The EU’s national registrations are gone, Cayman now licenses custody and trading platforms, and UK crypto firms need FSMA authorisation from 25 October 2027, with the application window closing on 28 February 2027. Start with where your customers are, budget capital and people before fees, and check every figure against the regulator’s own page before you commit.
For firms that help with applications and ongoing compliance, see the KYC/AML & Compliance section and how providers are assessed in the methodology. Deadlines and enforcement that change month to month are tracked in the regulation roundup.
