Register as a Virtual Asset
Service Provider (VASP)

Crypto asset (CA) conversion businesses (crypto-crypto and fiat-crypto) are required to comply with anti-money laundering (AML) and counter-terrorist financing (CTF) in accordance with the internationally agreed Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers Publication.

In Gibraltar and the UK, VASPs include:

• Over the counter (OTC) crypto providers
• Crypto asset custodians
• Token Issuers (e.g. as part of a ICO, IEO or IDO)
• Other token and fiat conversion providers

I summarise some of the key issues to be considered if you wish to register in Gibraltar or the UK as a VASP below.

VASP registration in Gibraltar

Businesses involving activities related to virtual assets that fall under the definition of a ‘relevant financial business’ as per section 9 of the Proceeds of Crime Act 2015 of Gibraltar (POCA), are required to apply to register as a VASP with the GFSC (unless they require a DLT Provider full financial services authorisation that is applicable to crypto custodians).

The relevant excerpt of section 9 of POCA is as follows:

• undertakings that receive, whether on their own account of on behalf of another person, proceeds in any form from the sale of tokenised digital assets involving the use of DLT or a similar means of recording a digital representation of an asset;

• persons that, by way of business, exchange, or arrange to make arrangements with a view to the exchange of-

• virtual assets for money;
• money for virtual assets;
• one virtual asset for another.                                                          

A VASP registration is required by the GFSC for Anti-Money Laundering/Combating the Financing of Terrorism (AML/CFT) supervision and enforcement purposes only. Other legislative requirements apply if these are required for whatever reason (e.g. a DLT Provider authorisation for crypto custodians) and VASP registration is not required if you are already an authorised and regulated firm for that activity. 

Failure to register but still carry out such a business in Gibraltar is an offence and, on conviction, may result in either a fine or imprisonment.

VASP registration process

The first step involves liaising with the GFSC’s AML/CFT team to discuss the application proposal, business model, envisioned activities, and services to be provided in or from Gibraltar to determine whether it falls within POCA. Following this, an application pack is submitted to the GFSC who then takes approximately 2-3 weeks to revert with their initial feedback and request follow-up meetings with the company’s directors and its appointed MLRO. The application includes approval of all directors, the MLRO and the controlling shareholders of the VASP as being suitable to be involved as a VASP controller. 

VASP registrants must be able to show primarily that they have suitable AML policies and procedures to manage the risks of criminal activities related to their VASP services. The requirements include monitoring and reporting, training, risk assessments, KYC/KYB, source of wealth and sanctions checks and rules in relation to outsourcing.

Time to complete VASP registration

This varies and is subject to the GFSC’s processes, but it is usually around 3 months.

GFSC Fees

• Registration fee: £2,500
• Annual registration renewal fee: £2,500

Our fees

We offer a fixed-fee package to set up and manage a company, provide accounts and support the VASP registration process. We can provide you with suitable AML policies and procedures and also support your with our outsourced compliance service. 

Corporate presence required in Gibraltar

There are no prescribed requirements on local Directors, but we generally advise a minimum of 1 Gibraltar-based director. Please note that a GFSC-approved MLRO is also required and this should usually be a resident in Gibraltar.

Our fiduciary company can provide support with company administration regarding the Gibraltar entity registering as a VASP, including accounting and tax filings. Please see our full list of Services for more information.

Non-Fungible Tokens (NFTs)

Note that the position in respect of NFT issuers, sellers and platforms requires specific consideration as to whether they are in scope.

Market Makers & Liquidity Providers

We work with a range of crypto asset market makers and liquidity providers on company set up, tax structuring and advising on when their activities may constitute an authorised DLT Provider activity or a registrable VASP activity.

Tumbler & Mixing Services

Given the heightened AML risks these service providers are not permitted to register in Gibraltar.

Additional Support

We can also provide a quote for other support you need including: corporate and commercial advice, tax and corporate structuring support, provision of local Director and assistance in finding an MLRO.  

For further information, see also the 2022 GFSC guidance on the VASP regime.

The UK crypto asset registration regime

The primary regulation in respect of VASPs (including token issuers) within the UK is the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 which require registration by VASPs for anti-money laundering and counter terrorist financing.

Since 10 January 2021, UK-based firms carrying out CA activities (including exchanging and holding custody of CAs on a customer’s behalf) must be registered with the UK Financial Conduct Authority. If such firms are not registered, they are at risk of being subject to the FCA’s criminal and enforcement powers. Registrants must have suitable due diligence procedures in place and implement adequate AML/CTF systems and controls.

The UK CA regime requires the submission of a very wide range of information that is more akin to the full prudential regime and, in my opinion, goes much further than what is actually required to assess the suitability of a business to combat criminal misuse of their services. This has led to many crypto businesses leaving the UK. 

In truth, many good UK businesses are simply not able to justify the costs and risks of undertaking an FCA registration process that might take up to 2 years and could often result in rejection that may not be entirely related to AML suitability and compliance (and in the meantime the VASP business can not operate from the UK).

Under UK law, a crypto asset is:

“a cryptographically secured digital representation of value or contractual rights that uses a form of distributed ledger technology and can be transferred, stored or traded electronically, and for the purposes of the definition of a cryptoasset exchange provider includes a right to, or interest in, the cryptoasset” (MLR 14A(3)(a) and (c)).

A cryptoasset exchange provider is:

“a firm or sole practitioner who by way of business provides one or more of the following services, including where the firm or sole practitioner does so as creator or issuer of any of the cryptoassets involved, when providing such services—

(a) exchanging, or arranging or making arrangements with a view to the exchange of, cryptoassets for money or money for cryptoassets,

(b) exchanging, or arranging or making arrangements with a view to the exchange of, one cryptoasset for another, or (c) operating a machine which utilises automated processes to exchange cryptoassets for money or money for cryptoassets” (MLR 14A(1)).

A custodian wallet provider is:

“a firm or sole practitioner who by way of business provides services to safeguard, or to safeguard and administer— (a) cryptoassets on behalf of its customers, or (b) private cryptographic keys on behalf of its customers in order to hold, store and transfer cryptoassets, when providing such services” (MLR 14A(2)).

Territorial Scope

VASPs, including utility token issuers, located outside of the UK (e.g. in Gibraltar) also need to ensure that they are not considered to be providing their CA services in or from the UK (even if offered by a non-UK company).

The FCA guidance on territorial scope for VASPs states:

“Every case will need to be assessed on its own merits, with reference to the nature and business model that is being undertaken. When deciding whether we consider the business as being carried on in the UK, we will consider a variety of factors including:

• Where the business has a UK office or its head office in the UK this may indicate that the activity is being carried on in the UK (MLRs, Regulation 9). If the office is not a registered office or head office, we will need to consider the type of activity that is carried on by that office (offices) and whether we consider the presence of that UK office means that it is carrying on business in the UK. In addition, the presence of a UK ATM will be considered business carried on in the UK, and so the operator will require registration.
• Where the business has no UK office or other activity in the UK, beyond simply having a client in the UK, we are likely to consider that the business firm is not carrying on UK business. For example, if a cryptoasset exchange, registered in a jurisdiction other than the UK, and which has no offices or agents in the UK but nevertheless permits UK customers to open trading accounts and permits them to buy/sell/hold cryptoassets; we would not automatically consider that as business being carried on in the UK.“

Please also note that the UK is currently undergoing significant changes to its regulation of crypto assets including for stablecoin issuers, custodians and in respect of the financial promotion regime for crypto assets including token sales. 

See: Our latest article on the financial services promotion regime for cryptoassets  and the UK regulation of cryptoassets

We can advise you on the UK law issues related to crypto assets, including the various regulatory and tax nexus issues related to whether a non-UK company could:

• be deemed to undertaking financial promotions in the UK
• be deemed to be providing VASP services from the UK requiring UK CA Regime registration prior to such activity being conducted.