A VASP is a virtual asset service provider, such as an exchange, custodian, or transfer platform that handles crypto-related services for customers. In compliance work, the term usually refers to firms that must manage customer due diligence, transaction controls, and information sharing obligations under Travel Rule requirements.
What a VASP does in the virtual asset ecosystem
A VASP is the regulated service layer between users and virtual assets. It may exchange cryptoassets, safeguard customer holdings, move assets between wallets, or provide adjacent transfer services. That role matters because the provider is not just a marketplace, it is a trust anchor for custody, settlement, access control, and compliance duties.
In practice, a VASP often sits where identity, transactions, and records intersect. The business may need to know who the customer is, what activity is permitted, where funds are moving, and which obligations apply when transfers cross platforms, jurisdictions, or counterparties. Those operational duties are what make the term important in compliance and security work.
Why VASPs are governed differently from ordinary crypto platforms
VASPs are commonly treated as higher-risk intermediaries because they can concentrate funds, transaction flow, and customer relationships in one service. That creates stronger expectations around customer due diligence, sanctions screening, recordkeeping, and Travel Rule information exchange than a purely non-custodial or software-only service would face.
The governance difference is not about the technology label alone, it is about the control surface. A VASP may be able to freeze, move, or refuse assets; it may also have visibility into counterparty details and transaction metadata. Regulators and compliance teams therefore care about how the platform proves control over those processes and how it prevents misuse.
Core compliance and security controls for VASPs
For most firms, the key control questions are whether customer due diligence is reliable, whether transaction monitoring is calibrated to the business model, and whether information sharing can occur when required. Those controls need to work together, because weak onboarding can undermine downstream monitoring, while weak monitoring can miss suspicious movement after onboarding.
Security controls are equally important. A VASP needs strong authentication, privileged access management, logging, segregation of duties, and resilient key or wallet operations where it provides custody or transfer services. If those controls fail, the organisation can lose assets, lose transaction integrity, or lose confidence in its records and reporting.
Where the platform uses APIs, custody tooling, wallets, or external service providers, the VASP should treat those integrations as part of the control environment. The business must know which services can initiate transfers, who can approve them, and how exceptions are reviewed.
How to assess exposure and manage VASP obligations
Exposure assessment starts with service scope: custodial, exchange, brokerage, remittance, and transfer functions do not all carry the same obligations. Organisations also need a clean asset inventory of wallets, admin consoles, signing workflows, customer accounts, and third-party dependencies so they can map controls to actual operational flows.
When obligations span multiple jurisdictions, the hard part is often consistency, not policy wording. A VASP has to align onboarding, screening, monitoring, and information sharing with the jurisdictions in which it operates, while still maintaining a coherent internal control model and audit trail.
Risk and Threat Considerations
VASPs concentrate high-value targets, so compromise can quickly become theft, fraudulent transfer, data exposure, or compliance failure. Attackers are often interested in account takeover, privileged access abuse, wallet compromise, or manipulation of transfer workflows because a single successful intrusion can affect many customers at once.
Failure mechanism: Weak authentication, excessive privilege, poor segregation between operational roles, or inadequate monitoring can let an attacker move funds, alter records, or bypass required checks before the organisation notices.
Impact: The result can include direct asset loss, regulatory sanctions, broken customer trust, failed incident reconstruction, and follow-on laundering or exfiltration through the platform.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | VASPs rely on strong staff authentication to protect transfer, compliance, and admin workflows. |
| AC-6 — Least Privilege | VASP operations need tight permissioning for transfer, custody, review, and exception-handling duties. | |
| AU-2 — Event Logging | VASP control assurance depends on logs for onboarding, transfers, overrides, and compliance investigations. | |
| Recommendation — Enforce strong authentication for privileged staff who can approve, move, or review customer assets and controls. Restrict operational access so no role can both create and independently approve sensitive VASP actions. Log customer, transfer, approval, and administrative events so compliance and incident review remain reconstructable. | ||
| CIS Controls v8 | CIS-5 — Account Management | VASP governance depends on managing privileged and service accounts that can move assets or alter controls. |
| Recommendation — Inventory and control all accounts that can affect transfers, custody, screening, or compliance workflows. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Many VASPs expose APIs and portals where broken authentication can enable unauthorized transfers or access. |
| Recommendation — Harden API and portal authentication so attackers cannot impersonate users or operators. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions and Authorizations | VASP services depend on enforcing permissions for custody, transfer, review, and information-sharing functions. |
| Recommendation — Define and enforce authorization boundaries for transfer, custody, and compliance operations. | ||
Practitioner Guidance
Why practitioners should care: For VASPs, compliance and security are inseparable because the same platform processes customer onboarding, asset movement, and evidence for oversight. If those functions are owned separately, gaps usually appear in handoffs, exception handling, or audit readiness.
Common misunderstanding: Some teams treat Travel Rule readiness as a messaging problem. In reality, it depends on identity assurance, wallet and counterparty data quality, role-based controls, and operational discipline around who can approve or override a transfer.
Practitioner takeaway: A VASP should be designed as a controlled financial trust service, not just a crypto interface, because the real risk sits in how access, transfer authority, and compliance evidence are managed together.
Related resources from NHI Mgmt Group
- Why does Travel Rule compliance become harder as VASP networks grow?
- Who is accountable when Travel Rule compliance fails in a VASP workflow?
- What breaks when VASP licensing exists on paper but supervision is weak?
- Who is accountable when a VASP fails to exchange accurate Travel Rule information during a virtual asset transfer?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org