A virtual asset service provider licence is a permission to carry on a specific list of activities, in a specific place, granted by a named regulator, on conditions that can be inspected and withdrawn. It is a great deal more than nothing. It is also considerably less than the guarantee it is usually presented as, and the space between those two readings is where people get hurt.
What the term covers
"Virtual asset service provider", usually shortened to VASP, comes from the vocabulary of the Financial Action Task Force, the intergovernmental body whose recommendations most countries eventually write into their own law. The term describes a business that does at least one of a short list of things on behalf of other people: exchanges virtual assets for ordinary money, exchanges one virtual asset for another, transfers virtual assets, holds or administers them for a customer, or provides financial services connected with the issue or sale of a virtual asset.
The definition is built around activity rather than around self-description, which is the point of it. A business does not escape the category by calling itself a technology company or a marketplace. If a service takes a prepaid voucher from a customer and sends back USDT, it is exchanging value for a virtual asset on somebody else's behalf. That is a regulated activity in most places that regulate at all, whether or not anyone involved thinks of it as finance.
What a regulator looks at before granting one
Applications are long, and the length is the substance. Broadly, a supervisor wants satisfactory answers in five areas.
Who is behind it. Named beneficial owners and directors, their history, their other business interests, whether any of them has been refused a licence or barred elsewhere. Regulators call this fit and proper. In practice it is a background investigation of people, not an assessment of software.
Where the firm's own money came from. Not the customers' money. Capital has to be evidenced, and a shareholder who cannot explain their own funds is a problem before trading starts.
The compliance function. A named officer responsible for anti-money-laundering, with the seniority to stop a transaction and the obligation to report suspicion to the financial intelligence unit. An officer who reports to the person whose revenue they are blocking is not a compliance function.
The written programme. A business-wide risk assessment, customer due diligence procedures, monitoring rules, sanctions screening, record retention, staff training, escalation paths. This is a thick document and it is read.
What happens if it fails. Capital adequacy, segregation of customer assets from the firm's own, custody and key management, and a wind-down plan describing how customers get their property back if the business stops.
Applications are refused. Others are withdrawn once an applicant sees what supervision costs to maintain.
What a licence does guarantee
Four things, reliably.
- A real legal entity exists, with a registered address, identified owners and records that someone outside the business can demand.
- A supervisor exists who can inspect, impose conditions, fine, suspend and revoke. That authority is the whole mechanism.
- The firm carries continuing obligations rather than promises: verify identity, screen against sanctions lists, keep records for a set period, report suspicious activity, report to the regulator on schedule.
- There is a route of complaint that does not end at the firm's own inbox. A supervised firm can be complained about to its supervisor.
That last point is undervalued. Read it alongside our complaints process: the value of a supervised counterparty is not that it never makes mistakes, it is that a mistake has somewhere to go.
What a licence does not guarantee
- It is not deposit insurance. Bank deposits in many countries are covered by a scheme that repays customers when a bank fails. Virtual asset licences generally carry nothing of the kind. If the firm collapses, you are a creditor.
- It is not a solvency certificate. Licensed firms have failed, including large ones. Supervision reduces the chance of quiet insolvency. It does not remove it.
- It is not a quality rating. A regulator assesses whether a firm meets minimum standards of conduct and control. It does not assess whether the pricing is fair, the interface honest, or the support competent.
- It does not extend past the permission granted. Licences are scoped to named activities. A permission to operate an exchange does not authorise custody, lending or issuing. A firm advertising a licence for one activity while performing another is a serious warning sign, not a technicality.
- It does not travel between companies. A group may hold a licence in one entity and run the website from another in a different country. The entity you contract with is the one that matters, and the terms will name it.
- It is not permanent. Licences are suspended and withdrawn. A certificate proves what was true on the day it was issued and nothing about today.
- It does not reverse your own decisions. No licence anywhere unwinds a voucher code you read out over the telephone to a stranger.
A licence tells you who is accountable, and to whom. It does not tell you that nothing will go wrong.
Where the licence comes from matters
The United Arab Emirates does not have a single virtual asset regulator, and confusion about this is used to make weak claims sound strong. The financial free zones supervise their own firms: the Dubai International Financial Centre through the Dubai Financial Services Authority, and Abu Dhabi Global Market through the Financial Services Regulatory Authority. In the Emirate of Dubai outside the DIFC, virtual asset activity falls to the Virtual Assets Regulatory Authority. At federal level the Securities and Commodities Authority has its own role for the remaining Emirates. Four rulebooks, four registers, four sets of permitted activities.
The practical consequence is that "licensed in Dubai" is not a fact you can check. A named authority, a named legal entity and a licence number is.
Checking a claim for yourself
- Find the exact legal entity name and the licence number, not the brand name.
- Search the regulator's own public register. Not a certificate on the firm's website, not a badge in the footer, not a PDF sent to you in a chat. Certificates are trivially forged.
- Read the scope. The register entry lists the activities permitted. Compare that against what the firm is actually selling you.
- Check the status and the dates. Active, suspended, withdrawn.
- Watch the word "registered". A company registration, a trade licence or a free-zone establishment card is not a financial services licence. All of them can be photographed, and all of them look official.
If a firm cannot give you a registry entry, treat the claim as absent rather than as merely unverified.
Where this operator stands
Plainly: the virtual asset licence application is in progress and has not been granted. Trading is not enabled. Voucher products are configured in the system, but the operator has not begun buying or selling. Nothing on this site should be read as a claim to hold a licence, and when the position changes the register will say so before we do.
What is already settled is how the service is built to work. A person verifies every voucher with its issuer before any payment is released. Identity comes before any payout at every amount — declared over a rolling twelve months, verified against a government document at or above it. Sanctions screening applies to every counterparty, with no lower bound at all. Those obligations are set out in compliance and in our verification process, and the reasoning behind them is in why prepaid vouchers attract anti-money-laundering rules and how sanctions and PEP screening work.