Virtual assets have moved from the fringes of finance to the centre of the regulatory agenda. Stablecoins, tokens and other digital-value instruments now move billions across borders every day, and supervisors expect any business that touches them to apply the same anti-money-laundering discipline as a bank. For fintechs building on digital-asset rails, understanding what a virtual asset is, and what the rules require, is no longer optional.
This guide explains what virtual assets are, who counts as a Virtual Asset Service Provider (VASP), how the global standards apply, and what changed in 2025 and 2026.
What is a virtual asset?
The Financial Action Task Force (FATF), the global standard-setter for anti-money-laundering and counter-terrorist-financing (AML/CFT), defines a virtual asset as a digital representation of value that can be traded or transferred digitally and used for payment or investment. In practice this covers cryptocurrencies such as Bitcoin and Ether, stablecoins pegged to fiat currencies, and many tokens.
Notably, the definition excludes digital representations of fiat currency issued by central banks and most traditional financial assets that are already regulated elsewhere. The test is function, not branding: if an instrument carries value and can be transferred or traded digitally, it is likely to fall within scope.
What is a VASP?
A Virtual Asset Service Provider is any business that, as a commercial activity, performs one or more virtual-asset services on behalf of customers. The core activities include:
- Exchange services: converting between virtual assets and fiat currency, or between one virtual asset and another.
- Transfer: moving virtual assets from one address or account to another on a customer’s instruction.
- Custody and administration: safekeeping virtual assets or the instruments that enable control over them.
- Issuance and financial services: participating in and providing services related to the offer or sale of a virtual asset.
Exchanges, custodians, on-ramp and off-ramp providers, and many wallet operators are therefore VASPs, and must register or obtain a licence in the jurisdictions where they operate.
How virtual assets are regulated
The baseline standard is FATF Recommendation 15, which extends AML/CFT obligations to virtual assets and VASPs. A compliant VASP must run customer due diligence (KYC), screen against sanctions and watchlists, monitor transactions, and report suspicious activity, just like a traditional financial institution.
Two frameworks matter most in 2026. In the European Union, the Markets in Crypto-Assets Regulation (MiCA) creates a single licensing regime: a Crypto-Asset Service Provider authorised in one member state can passport across all 27 EU member states, extending to the wider European Economic Area as the three non-EU EEA states adopt the regime. The MiCA transition period closes on 1 July 2026, after which any firm serving EU clients without full authorisation is in breach. In the United States, obligations flow through FinCEN registration, state money-transmitter licences and, in some cases, the NYDFS BitLicense.
The FATF Travel Rule
The single most important operational requirement is the Travel Rule, the application of FATF Recommendation 16 to virtual-asset transfers. For every transfer above the USD/EUR 1,000 threshold, the originating VASP must collect and transmit verified information about both the sender and the recipient, and the receiving VASP must obtain and check it.
Adoption is accelerating. By the 2025 FATF survey, 85 of 117 jurisdictions had passed Travel Rule legislation, up from 65 a year earlier. In June 2025 the FATF published its sixth targeted update and new Best Practices on Travel Rule Supervision, while also flagging the sharp rise in illicit use of stablecoins, most on-chain illicit activity now involves them. The direction of travel is clear: more jurisdictions, tighter enforcement, and growing scrutiny of stablecoin flows.
What this means for fintechs
For any platform building digital-asset products, compliance must be designed in from day one rather than bolted on. That means treating virtual-asset activity as regulated activity: verifying every customer, screening counterparties, capturing Travel Rule data automatically, and monitoring transactions on a continuous basis. Firms that build this discipline into the product can move quickly and safely; those that treat it as an after thought face enforcement risk and lost market access, especially after the July 2026 MiCA deadline.
Frequently asked questions
What is the difference between a virtual asset and a cryptocurrency?
Cryptocurrency is one type of virtual asset. The term virtual asset is broader, covering tokens, stablecoins and other digital representations of value that can be traded or transferred digitally.
Is a stablecoin a virtual asset?
Yes. Stablecoins fall within the FATF definition and are subject to the same AML/CFT obligations, and increasingly to specific stablecoin rules under frameworks such as MiCA.
Who has to register as a VASP?
Any business that exchanges, transfers, custodies or issues virtual assets for customers as a commercial activity must register or obtain a licence in the jurisdictions where it operates.
What is the FATF Travel Rule threshold?
Verified originator and beneficiary information must be exchanged for virtual-asset transfers above USD/EUR 1,000.
