VASP Registration vs Full Licence: When Registration Alone Is Sufficient

The Distinction Between Registration and Licensing

The global regulatory landscape for virtual asset service providers presents two fundamentally different authorisation models: registration and full licensing. The distinction is not merely semantic. It determines the scope of permitted activities, the capital requirements imposed, the supervisory intensity applied, and — critically — the credibility of the authorisation when onboarding banking partners and institutional clients.

The Financial Action Task Force (FATF) Recommendation 15, updated in 2019, requires countries to ensure that VASPs are "licensed or registered" in the jurisdiction where they are created or from which they operate. FATF deliberately uses both terms, recognising that different jurisdictions apply different regulatory intensities.

What Registration Typically Entails

A VASP registration regime generally requires the applicant to:

• Notify the competent authority of its intention to provide virtual asset services
• Demonstrate AML/CFT compliance through the submission of an anti-money laundering programme, including customer due diligence procedures, transaction monitoring arrangements, and suspicious activity reporting mechanisms
• Pass fit-and-proper assessment for directors and beneficial owners, typically involving criminal background checks and source-of-funds verification
• Maintain records of transactions and customer information for a specified retention period (usually five years under FATF standards)

What registration does not typically require:

• Minimum capital or own funds thresholds
• Prudential supervision or ongoing financial reporting
• Client asset segregation requirements
• Operational resilience or IT security standards
• Consumer protection obligations beyond basic disclosure

What a Full Licence Entails

A full VASP licence — as exemplified by MiCA's CASP authorisation in the EU, the DFSA's VATP licence in the DIFC, or the MAS's Major Payment Institution licence in Singapore — imposes substantially greater requirements:

• Capital requirements: Minimum own funds ranging from €50,000 to €150,000 under MiCA, or significantly higher under some national regimes
• Governance standards: Detailed requirements for board composition, key function holders, internal audit, and risk management frameworks
• Prudential supervision: Ongoing reporting obligations, periodic regulatory returns, and exposure to supervisory review processes
• Client asset protection: Mandatory segregation of client assets, safeguarding arrangements, and in some cases, insurance requirements
• Operational resilience: ICT security standards, business continuity planning, and incident reporting obligations aligned with frameworks such as DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554)
• Market conduct rules: Fair treatment of customers, pre-contractual disclosure, complaints handling, and conflicts of interest management

Jurisdiction-by-Jurisdiction Comparison

Registration-Only Regimes

United Kingdom The FCA operates a VASP registration regime under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (MLR 2017). Registration is limited to AML/CFT compliance — the FCA does not impose prudential requirements, capital adequacy standards, or consumer protection rules on registered cryptoasset businesses. However, the FCA's financial promotions regime (extended to cryptoassets from October 2023) does apply regardless of registration status.

Poland Poland maintains a simple VASP registration regime through the Tax Administration Chamber in Katowice. Registration requires AML/CFT compliance and fit-and-proper checks but imposes no capital requirements. The process is administrative rather than substantive.

Czech Republic The Czech Trade Licensing Office (Zivnostensky urad) administers VASP registration. It is one of the least burdensome registration processes in the EU, requiring minimal documentation and imposing no ongoing supervisory obligations beyond AML/CFT.

Full Licensing Regimes

European Union (MiCA) As of 30 December 2024, MiCA requires full CASP authorisation for all crypto-asset service providers operating in the EU. This replaces previous national registration regimes and imposes comprehensive prudential, governance, and conduct requirements.

Dubai (DFSA / VARA) The Dubai Financial Services Authority licenses Virtual Asset Service Providers in the DIFC, while the Virtual Assets Regulatory Authority (VARA) licenses VASPs in mainland Dubai. Both impose capital requirements, governance standards, and conduct obligations.

Singapore The Monetary Authority of Singapore (MAS) licenses Digital Payment Token (DPT) service providers under the Payment Services Act 2019. Major Payment Institution licences impose capital requirements of SGD 250,000 and comprehensive regulatory obligations.

Abu Dhabi (FSRA) The Financial Services Regulatory Authority of the Abu Dhabi Global Market (ADGM) licenses VASPs under its comprehensive Framework for the Regulation of Virtual Asset Activities, which includes capital requirements, custody standards, and technology governance.

Hybrid Regimes

Cayman Islands The Cayman Islands Monetary Authority (CIMA) requires VASP registration under the Virtual Asset (Service Providers) Act, 2020 (as amended). While termed a "registration," it imposes requirements that approach licensing intensity, including AML/CFT compliance, fit-and-proper assessments, annual fees, and ongoing regulatory reporting.

British Virgin Islands The BVI Financial Services Commission administers VASP registration under the Virtual Assets Service Providers Act, 2022. The regime includes AML/CFT requirements, fit-and-proper checks, and certain ongoing obligations, but stops short of full prudential licensing.

When Registration Is Sufficient

Registration alone may be sufficient when:

• The business model is limited in scope: If the firm provides only crypto-to-crypto exchange services or acts as an intermediary without holding client funds, the risks addressed by prudential regulation are lower
• The target market does not require a full licence: If the firm's customers are primarily retail users in jurisdictions that accept registration-level authorisation, a full licence may not provide additional market access
• The firm is in an early stage: Registration can serve as a stepping stone, allowing the firm to commence operations and generate revenue before investing in the more expensive full licensing process
• Banking requirements are modest: If the firm does not require correspondent banking relationships with Tier 1 banks, registration may be adequate

When Registration Is Not Sufficient

Registration alone is inadequate when:

• The firm custodies client assets: Holding client crypto-assets or fiat funds creates risks that registration-level oversight does not address. Banking partners and institutional counterparties will expect full licensing
• The firm targets EU customers post-MiCA: MiCA requires full CASP authorisation for any firm providing crypto-asset services to EU residents. National registrations are being replaced
• The firm seeks institutional business: Institutional counterparties, fund administrators, and prime brokers increasingly require their VASP counterparties to hold full licences, not mere registrations
• Banking access is critical: Tier 1 banks and major payment processors are far more willing to onboard fully licensed VASPs than registered-only firms
• The firm plans to issue tokens: Token issuance — whether utility tokens, security tokens, or stablecoins — typically requires specific authorisation beyond VASP registration

Cost Comparison

Factor	Registration	Full Licence
Setup cost	€20,000-€80,000	€150,000-€500,000
Capital requirement	Nil or minimal	€50,000-€250,000+
Timeline	2-6 months	6-18 months
Annual compliance cost	€20,000-€50,000	€100,000-€300,000
Banking access	Limited	Strong
EU market access (post-MiCA)	No	Yes
Institutional credibility	Low-moderate	High

Strategic Approach

The optimal approach for many businesses is a staged strategy:

1. Commence with registration in a jurisdiction that allows rapid market entry (BVI, Cayman, or a transitional EU regime)
2. Build revenue and track record during the registration period
3. Apply for full licensing in the target market once the business model is proven and the revenue supports the compliance cost
4. Passport or expand from the licensing jurisdiction into additional markets

This approach balances the cost of early-stage regulatory compliance with the long-term requirement for full licensing as the business scales.

Key Takeaways

• VASP registration and full licensing are fundamentally different regulatory models with different cost structures, compliance obligations, and market access implications
• Registration is adequate for early-stage businesses with limited scope, but insufficient for firms that custody client assets, target EU customers, or seek institutional counterparties
• MiCA has effectively ended the registration-only model within the EU — full CASP authorisation is now required
• Banking access and institutional credibility are strongly correlated with licensing intensity; registered-only VASPs face persistent challenges in securing Tier 1 banking relationships
• A staged approach — registration first, licensing later — can be an effective strategy for managing costs while building toward full regulatory compliance
• The total cost differential between registration and full licensing is typically 3-5x, but the market access and credibility benefits of full licensing often justify the investment