VASP virtual asset frequently asked questions

For digital-asset custody, first clarify who controls the assets or private keys, and establish arrangements for identification, appropriate segregation, accounting and protection. VASP custody services have separate registration requirements; fund custody arrangements depend on the fund category and asset characteristics. Multisignature and cold storage may be used as technical safeguards, but they are not uniform statutory configurations for all entities.

Risk warning:Actually controlling clients' private keys without assessing the VASP registration requirements may constitute unregistered business activity.

First distinguish custody of fund assets from providing custody services as a VASP. A VASP must ensure that client assets are identifiable, appropriately segregated and accounted for, and establish arrangements to safeguard them; fund custody must be proportionate to the fund’s category, strategy and risks. Multisignature arrangements, hot-and-cold wallet segregation and recovery testing are optional control measures and should not be described as uniform minimum requirements for all entities.

Risk warning:Unclear control may result in client assets being mixed with proprietary assets.

Key controls include access management, private-key protection, vulnerability handling, cybersecurity, backup and recovery, and incident response. A VASP application must describe technology facilities proportionate to the business, independent technical assurance or system audits, capacity testing and disaster recovery. Multisignature arrangements and hot/cold separation should be selected according to the operating model; they are not uniform statutory configurations for all managers.

Risk warning:Backups that have not been tested for restoration may be unusable when an incident occurs.

SIBA primarily addresses investment business involving dealing, arranging deals, management and advice; the VASP Act addresses statutory virtual asset exchange, transfer, custody and related financial services. Applicability depends on the nature of the asset and the services actually provided. Digital-asset business may trigger multiple regimes; the choice is not necessarily one or the other.

Risk warning:Assessing only VASP requirements simply because crypto-assets are involved may overlook investment business licensing.

The VASP Act focuses on the actual service and control of assets: providing virtual-asset services in or from the BVI requires registration with the FSC, and an individual may not conduct such services as a business. General services, custody and exchange activities must be assessed separately. Having overseas customers or a platform that does not hold fiat currency does not automatically exclude the activity. Registration also does not automatically cover securities, banking, payment or other activities.

Risk warning:Treating VASP registration as a general-purpose crypto licence may lead to carrying on unauthorised business.

The statutory scope includes providing services to others for exchange between virtual assets and fiat currency or other virtual assets, transfer, custody or management, and financial services related to an issuer’s offer or sale. The substance of the service and control over assets are central to the assessment. VASP registration does not automatically cover general investment, banking, insurance or money-services business.

Risk warning:Classifying all Web3 businesses as the same type of VASP service may result in selecting the wrong registration category.

VASP is a registration regime for statutory virtual-asset services, whereas SIBA authorizes activities by investment-business category and subcategory. The key issue is not whether an asset is called a crypto asset, but its nature, contractual rights and actual operation. The same model may engage both routes, and qualification under either one does not automatically replace the other.

Risk warning:Choosing a regime solely by product name may cause another regulatory requirement to be overlooked.

The FSC focuses on whether an applicant can continuously meet fitness-and-propriety, prudential, resource and public-interest requirements. The application should clearly present the business model, ownership and control structure, management capability and risk controls. An individual cannot conduct business or hold themselves out as operating a VASP, and registration is not issued by an agent at the agent’s discretion.

Risk warning:A mismatch between the application description and actual operational capabilities may affect registration review.

Clear responsibilities should be assigned for governance, compliance, AML reporting and technology risk, but it should not be stated that all core roles must be based in the BVI. The location of each role, dual-hatting, outsourcing and approval requirements must be checked against the actual business and the latest application documents. The registered agent and registered office are not substitutes for operational staffing arrangements.

Risk warning:Using a registered address as a substitute for evidence of actual personnel capacity may not support the commitments made in the application.

A VASP is also required to maintain risk-based AML/CFT controls, but in practice should pay additional attention to on-chain addresses, wallet control, asset-transfer paths, and the continuity of counterparty information. These may be incorporated into risk-identification and monitoring design recommendations. Specific data, Travel Rule, and reporting requirements must be checked against the latest applicable materials.

Risk warning:Relying solely on on-chain tools while neglecting customer identity verification may result in actual transaction risks going undetected.

Registration is divided into three categories: general virtual-asset services, custody services and exchange services. Transfers, exchanges and similar services must be assessed against the specific service; an independent licence category should not be added without authority. Custody focuses on holding assets or control instruments, while an exchange involves a trading platform and control over funds or assets; not holding fiat currency does not exclude either of the latter two categories.

Risk warning:Underestimating the platform’s actual control may lead to an incorrect application for the general service category.

Where virtual asset services and investment business are both involved, VASP registration and a SIBA licence may be assessed separately, but whether the same entity can obtain approval for both is subject to FSC review of the business model and conditions. The application should distinguish business permissions, control of client assets and risk management; obtaining one qualification must not be treated as authorization for the other business.

Risk warning:Mixing the permissions and asset flows of the two business lines may result in operations beyond the authorised scope.

Implementation of the Travel Rule should begin by confirming the applicable transfer and information-transmission rules; specific thresholds, data fields and exceptions must be verified against the latest AML/CFT documents. In practice, it is advisable to establish processes for collecting, checking and transmitting sender, recipient and counterparty information, and for handling missing information. Purchasing a tool does not by itself amount to compliance.

Risk warning:Automatically clearing incomplete materials may create compliance and traceability gaps.

Due diligence on the actual controller should not stop at the list of direct shareholders. To support the fitness assessment, it is advisable in practice to trace the full ownership and control chain, verify the identities of natural persons, the basis of control and the source of funds, and retain evidence. Regulatory due diligence and company BO registration are separate matters; the required depth of supporting documents should be checked against the latest application documents.

Risk warning:Omitting a non-equity controller may make the application and BO information inaccurate.

Customer-asset safeguards and wallet permissions should be designed according to asset-control risks. In practice, it is advisable to distinguish the accounting for customer and proprietary assets, reconcile accounts regularly, and establish multiple authorization and recovery mechanisms. Cold/hot wallet ratios, technical testing frequency and specific segregation methods cannot be stated as uniform statutory figures; they must be verified against the registration category and its conditions.

Risk warning:Concentrating key access in one person may result in client assets being misdirected or misappropriated.

VASP cybersecurity requirements are primarily defined by the VASP Act, 2022, and the FSC’s registration application guidance. Application materials should explain system controls, independent technical assurance or the system-audit approach, stress and capacity testing, cybersecurity and disaster recovery, and provide testing evidence proportionate to the business risk.

Risk warning:A security policy without evidence of actual testing may not demonstrate that controls are effective.

The FSC focuses on whether smart-contract risks can be identified, tested and governed; the same smart-contract audit frequency does not apply to every VASP. Where smart contracts are involved, describe the independent technical assurance method, access controls, vulnerability management and incident response, supported by reports and evidence of remediation.

Risk warning:Contract vulnerabilities or uncontrolled upgrade privileges may lead to the loss of customer assets.

A BVI VASP registration alone does not establish that services may be provided to retail clients in mainland China. Registration addresses the BVI regulatory route and is not an admission licence for an overseas market. Whether the business may market, open accounts or provide specific services must be checked case by case against the actual activities and the latest applicable rules in mainland China.

Risk warning:Conducting business without verifying market-entry requirements in the target market may breach local regulatory requirements.

It is not appropriate to conclude generally that a BVI VASP is easier or harder to obtain than an SFC VATP licence in Hong Kong. The BVI assesses the service category, control of client assets, resources and risks. A meaningful comparison should use the same business model and separately verify the latest requirements in both jurisdictions concerning client scope, technology, governance and capital.

Risk warning:Choosing a location based on a supposed ranking of approval difficulty may lead to the wrong regulatory pathway.

A BVI VASP registration is regulatory registration for statutory virtual asset services conducted in or from the BVI; it is not a globally portable licence. In comparing its regional positioning with Singapore DPT and Dubai VARA, assess the actual services and target markets, and verify each jurisdiction’s current regime separately; these qualifications should not be treated as interchangeable.

Risk warning:Treating regulatory qualifications in different jurisdictions as mutually recognised may create market-access gaps.

VASP registration does not automatically authorize the issuance of stablecoins. Separately analyze the nature of the token, issuance and redemption mechanisms, reserve arrangements, and whether financial services relating to an issuer's offer or sale are provided. Certain digital representations of fiat currency are excluded by definition; other regulated activities must also be assessed separately.

Risk warning:Mistaking VASP registration for a stablecoin issuance licence may result in other regulatory requirements being overlooked.

A VASP must submit an annual audited report, generally within six months after the end of its financial year; any approved extension may not exceed six months in total. This does not mean that an auditor must be replaced or reappointed every year. Auditor qualification, appointment and change arrangements should be checked against the latest applicable documents and registration conditions.

Risk warning:Insufficient audit-preparation materials may result in late submission of the report.

Client-asset insurance should not be treated as a uniform mandatory requirement for all VASPs. The FSC may, based on risk, impose professional-indemnity insurance or a similar arrangement as a registration condition, but this is not equivalent to full insurance of client assets. Whether or not insurance is obtained, client assets must remain identifiable, appropriately segregated, accounted for and protected.

Risk warning:Mistakenly believing that insurance covers all losses of client assets may leave a significant coverage gap.

A white paper or tokenomics explanation is not a document requirement that can be applied wholesale to every VASP application. If the business involves token issuance, financial services related to token sales or protocol operation, it is advisable to submit materials sufficient to explain token rights, control, fees and asset flows. The specific documents should correspond to the application guidance and FSC inquiries.

Risk warning:Inconsistencies between the white paper and the application materials may prompt further inquiries.

It is advisable to explain a cross-border marketing strategy by reference to the specific customer locations and customer-acquisition process, including target customers, advertising channels, services, account-opening screening and controls for restricted locations. This is a practical preparation method, not a uniform statutory template. BVI incorporation does not replace licensing in target markets; local boundaries should be checked against the latest documents.

Risk warning:Marketing that extends beyond the verified market access perimeter may trigger violations in foreign jurisdictions.

Prepare responses in advance around the FSC’s main areas of review: service categories, ownership and fit-and-proper persons, source of funds, three-year financial projections, AML/CFT, system security and client-asset controls. Custodians and exchanges should also clearly explain reconciliation, settlement, liquidity and exit arrangements. The actual questions will depend on the individual case.

Risk warning:Inconsistency between the business description and system permissions or fund flows may prolong the review.

Risk assessment should reflect the nature, scale and complexity of the business and cover customers and geography, money laundering and sanctions, transaction volumes, leverage, custody, liquidity, technology and cyber risks. It is advisable to document each risk scenario, controls, residual risk and responsible person, and align these with financial stress projections and actual systems arrangements.

Risk warning:Using a generic template may omit key risks specific to this business.

VASP entities have ongoing regulatory filing obligations, but all annual submissions should not be grouped under a single fixed “compliance report.” An annual audited report is generally due within six months after the financial year-end. The forms, scope and deadlines for other compliance, AML or regulatory returns should be confirmed separately against the notices and registration conditions applicable for that year.

Risk warning:Using an audit report as a substitute for other applicable returns may result in reporting omissions.

A VASP should keep records demonstrating how complaints are handled. It is advisable to establish procedures for receiving, registering, investigating, escalating and responding to complaints, and to retain evidence of the handling process. Relevant records must be kept for at least five years, with the starting point determined under the applicable rules. If client assets are found to have been unlawfully interfered with or damaged, the affected clients and the FSC must be notified immediately.

Risk warning:If complaint handling is not traceable, it may be impossible to demonstrate that appropriate protective measures were taken.

The budget should distinguish official fees, establishment costs and ongoing operating funds. For a standard VASP, the application, initial and annual fees are 5,000, 7,500 and 7,500 US dollars respectively; for custody, 10,000, 15,000 and 15,000 US dollars; and for an exchange, 10,000, 25,000 and 25,000 US dollars. Also budget for technology, AML, audit, authorised representative and contingency funding, and prepare three-year projections.

Risk warning:Budgeting only for government fees may leave insufficient funds for operations.

Choose partners based on their ability to support genuine regulatory controls, not merely on their brand. Key considerations include system security, access controls, client-asset reconciliation, evidence of independent testing, incident response and disaster recovery. The third-party service’s responsibilities, data flows and exit arrangements should be incorporated into governance documents. These are practical assessment methods.

Risk warning:Reliance on a critical system provider whose controls cannot be verified may create a single point of operational failure.

Collaboration with licensed institutions in Hong Kong or Singapore may be explored, but BVI VASP registration does not confer mutual recognition or automatic access to dual-licence arrangements. The parties should define each entity’s customer relationships, service scope, asset control and responsibilities, and separately verify the latest rules in each jurisdiction and the permitted business scope of both parties.

Risk warning:An unclear division of responsibilities may result in one party actually providing unauthorised services.

BVI VASP registration does not automatically authorize advertising virtual assets in every country. Cross-border advertising should be assessed against the latest applicable requirements in the target market, taking account of audience location, promotional content, customer-acquisition links and subsequent services. BVI registration must not be promoted as a general authorization covering securities, banking or other businesses.

Risk warning:Advertising that reaches prohibited or restricted markets may constitute unlawful local marketing.

Assess strategic value by considering whether the business fits a statutory BVI service category, whether it can bear ongoing regulatory costs, and whether access to the target market is feasible. BVI VASP status may form part of a project’s regulatory structure, but it does not guarantee global operations, acceptance by counterparties, or a particular tax outcome, and does not replace other business licences.

Risk warning:Treating registration status as a global passport may lead to overestimating a project's commercial viability.

There is no VASP approval timeline that can be uniformly guaranteed. Resources should cover business classification, ownership and personnel information, three-year financial projections, AML/CFT, technical testing and client-asset controls. It is advisable to schedule the process in stages for document preparation, submission and queries, supplemental materials, and implementation of conditions. Complexity, document quality and FSC review all affect timing.

Risk warning:Committing to launch by a fixed approval date may result in providing regulated services before registration.

Source-of-capital due diligence should be able to explain who provided the funds, through which entities they passed and whether they are genuinely available. Application materials should corroborate one another through an ownership and control chart, capital-contribution documents and traceable fund records. For example, a VASP application must explain the source of capital and financial projections. The scope of evidence required depends on the actual funding structure and applicable requirements.

Risk warning:An unexplained source-of-funds chain may lead to further due diligence.

Cybersecurity cannot be reduced to a single fixed set of technical indicators applicable to every licence. It is advisable to establish access controls, system monitoring, backup and recovery, incident escalation and outsourcing oversight according to business and client-asset risks. These are operational recommendations; mandatory requirements and registration conditions should be checked for each licence. A VASP should also explain its technology and cyber-risk controls.

Risk warning:A failure of critical systems may interrupt services and affect the security of customer assets.

For crypto-asset business, first determine whether it falls within VASP or another regulated activity, then decide on enhanced due diligence based on the risks relating to customers, jurisdictions, transactions and asset control. It is advisable to verify customers and UBOs, source of funds, transaction purpose and unusual fund flows. Technical analysis may assist but does not replace customer verification; specific requirements should be determined by reference to the latest AML documents.

Risk warning:Relying solely on on-chain analysis may miss risks relating to the true controller.

A professional-services budget may include regulatory classification and legal review, preparation of application materials and policies, a registered agent and authorised representative, audit, compliance, technology and personnel support. Not every item is provided by the same service provider, and there is no uniform total price. Distinguish one-off preparation, responses to queries and supplemental-document requests, and annual maintenance services.

Risk warning:Unclear service boundaries may result in duplicate charges or omitted work.

A budget covering twelve to twenty-four months can be used as a project-management recommendation, with monthly estimates for the preparation, regulatory review and operating stages. Calculate separately official fees, company maintenance, personnel and office, legal and audit, compliance technology and account-opening expenses, and provide for supplementary requests or delays. This budgeting period is not a statutory approval timeline.

Risk warning:Failure to reserve funds for fixed expenses during an extension period may result in a funding interruption.

Costs that are easily overlooked include annual company maintenance, an authorised representative, document certification and translation, additional legal review, audit and compliance, technology remediation, and personnel and premises costs during any delay. In practice, list items according to the specific structure; do not present them as fixed fees or uniform amounts payable by everyone.

Risk warning:Budgeting only for FSC fees may leave insufficient funds to cover actual ongoing operating costs.

Crypto assets, stablecoins and tokenized assets should be classified individually according to their nature and the actual services involved; they should not all be described as VASP business. Check in particular client trading, custody control, financial services related to issuance, and whether the asset represents a fiat or securities claim. VASP registration does not automatically cover securities, payment or banking business, and requirements in overseas markets must also be checked separately.

Risk warning:Misclassifying tokenised securities or fiat payments as general VASP services may result in other licensing requirements being overlooked.

Yes, but the accurate description is the FSC’s VASP registration regime, with separate routes for general virtual-asset services, custody and exchange. Whether registration is triggered depends on the actual services and control; not all Web3 activities are covered. A BVI company providing relevant services to overseas clients may also be subject to regulation. An individual may not conduct VASP business, and registration does not automatically cover securities, banking or payment services.

Risk warning:Mistakenly assuming that business with overseas clients is outside BVI regulation may amount to carrying on business without registration.

Choose a platform appropriately qualified in the service location, verify eligibility for corporate accounts, custody and source-of-funds requirements, and retain wallet and transaction records. Opening an account for a company’s own investments must be analysed separately from providing exchange or custody services to others. VASP registration is not a universal licence for all crypto activities; economic substance does not automatically apply or exempt the activity.

Risk warning:Actually controlling customer assets without identifying the custodial service may trigger registration requirements.

A Hong Kong service provider may be asked whether it accepts BVI entities for the relevant account or wallet, but support for USDT and account opening must be confirmed under local rules and platform policies. Holding one’s own assets and providing services to others should be assessed separately. Clear director backgrounds and successful KYC do not guarantee account opening and do not replace analysis of business regulation.

Risk warning:Using a service provider without the appropriate qualifications may affect asset protection.

The main matters to assess are price volatility, custody and counterparty risks, the source of funds, and regulatory requirements in the relevant locations. Before investing, it is advisable to confirm asset ownership, wallet access rights and arrangements for transaction records. If exchange, transfer or custody services are also provided to others, the VASP registration boundary must be assessed separately; it should not be stated broadly that digital assets have no clear legal status.

Risk warning:Custodian failure or loss of control over wallet permissions may result in asset losses.

Before accepting virtual-currency payments, distinguish receiving payment for one’s own goods from providing virtual-asset services to others; the payment method alone does not establish that VASP registration is required. As a risk-management recommendation, verify the payer and source of funds and retain transaction records. Enhanced due diligence and suspicious-activity reporting should be assessed under applicable AML rules; there is no single monetary threshold that can be applied uniformly here.

Risk warning:Exchanging or transferring funds for others may involve service authorization that has not been obtained.

For a Web3 project, first assess the regulatory perimeter based on the actual services and control of assets; not every project requires VASP registration. Exchange or transfer on behalf of clients, custody, and financial services related to issuance or sale may fall within VASP activities. Company registration, an authorised representative and economic substance are separate tests; the name Web3 cannot replace an analysis of the business.

Risk warning:Overlooking control of private keys or assets may lead to an incorrect assessment of VASP registration obligations.