Entities and licence categories
VASP, CASP, EMI, MSB and the rest: work out which class of regulated entity you are in a given jurisdiction before anything else.
Key points
- The same abbreviation means different things in different jurisdictions
- Categories are defined by activity, not by what a product is called
- Regulator acronyms tell you who supervises, not what is permitted
- Substance, UBO and change of control appear in almost every regime
- Definitions here reflect the position as at August 2026
Thirty terms, defined for practical use rather than for completeness. The organising principle is that most of these abbreviations are jurisdiction-specific: a VASP in one framework, a CASP in the EU and an MSB in North America overlap without matching, and treating them as synonyms is one of the most reliable ways to choose the wrong licence.
Thirty terms, defined for use rather than for completeness. The organising idea is the thing that catches people out most reliably: these abbreviations are not international standards, and treating them as though they were is a fast route to the wrong licence.
How the terms group together
Regulators and instruments
FINMA, MiCA, the Swiss AML Act: who writes the rules, and who supervises against them.
Compliance obligations
KYC, CDD, EDD, UBO, AML officer: what you must actually do once you hold a permission.
Money and structure
Minimum capital, substance, change of control: the requirements that constrain how the business can be built and sold.
Why does the same abbreviation mean different things?
Because most of them are national implementations of a shared idea. The FATF recommendations describe a virtual asset service provider in functional terms; each country then writes that into domestic law with its own boundaries, thresholds and exemptions. The result is a family of categories that rhyme without matching. A firm that is squarely a VASP under one framework may fall partly outside the EU's CASP definition and require a separate payments permission in a third country.
The practical consequence is that you cannot reason from the label. "We're a VASP" is not a classification; it is a hypothesis to be tested against each jurisdiction under consideration, which is the exercise described on choosing a licence.
How should you use this glossary?
Read the entity and category terms first, because they determine which permissions exist for you. Read the compliance terms second, because they determine what holding one costs. The regulator acronyms tell you who supervises — useful for knowing whose published guidance to read, and not a guide to what is permitted.
Where a term is genuinely contested or in flux, the entry says so and carries a date. Crypto regulation is moving quickly enough that an undated definition is often an expired one — the end of the MiCA transitional period on 1 July 2026 invalidated a great deal of otherwise reasonable published material. Definitions here reflect the position as at August 2026.
Shorter answers to the questions these terms usually sit inside are on the FAQ, and the long-form treatments — the Swiss route end to end, what a licence really costs, what happens after a refusal — are collected under insights. Nothing here is legal advice: CryptoLicense is an advisory firm, not a regulator and not a law firm.
A
ADGM — Abu Dhabi Global Market
A financial free zone with its own courts and its own regulator, operating a purpose-built framework for virtual-asset activity. Suits businesses seeking a regionally credible base, and expects genuine presence within the zone.
AML Officer / AMLCO
The individual responsible for the AML compliance function. Regimes increasingly test whether the appointee can genuinely perform the role — meaning someone who can discuss your specific business, customer risk and monitoring, rather than a qualified name attached to a file.
AML/CFT — Anti-Money Laundering and Counter-Financing of Terrorism
The combined framework of obligations — risk assessment, due diligence, monitoring, reporting, training and record-keeping — that almost every licensing regime imposes. The baseline standards derive from the FATF recommendations, with national law adding detail.
AMLA / GwG — Swiss Anti-Money Laundering Act
The Swiss statute that defines financial intermediation and imposes due diligence, documentation and reporting duties. Whether your activity falls within its scope is the question that determines whether SRO affiliation is required at all.
API — Authorised Payment Institution
A payment institution authorised in full rather than registered under a small-firm exemption, permitted to provide the payment services listed in its authorisation. Common shorthand in the UK and EU frameworks; the equivalent category exists under other names elsewhere.
AUSTRAC — Australian Transaction Reports and Analysis Centre
Australia's AML/CTF regulator and financial intelligence unit. Digital currency exchange providers must be registered with AUSTRAC before operating, and registration carries ongoing programme and reporting duties.
B
BIN sponsorship
The arrangement under which a licensed issuer lends its Bank Identification Number and scheme membership to a programme manager, allowing cards to be issued without the programme holding scheme membership itself. The sponsor sets its own risk and compliance conditions independently of any regulator.
C
CASP — Crypto-Asset Service Provider
The authorisation category under EU MiCA. A CASP is authorised by a member state's competent authority to provide specified crypto-asset services, itemised individually rather than granted in bulk. Once authorised, the listed services can be provided across the EEA.
CBB — Central Bank of Bahrain
Bahrain's financial regulator, which operates a dedicated crypto-asset services regime with defined categories by activity. One of the earlier Gulf frameworks written specifically for the sector rather than adapted to it.
CDD — Customer Due Diligence
Establishing who the customer is, who ultimately owns or controls them, what the relationship is for, and monitoring it over time against that expectation. Broader than identity verification, and the part most commonly under-documented in an application.
Change of control
A change in who ultimately owns or controls a licensed entity. Almost universally requires the regulator's prior approval, with the incoming owners assessed against much the same standards as a new applicant — which is why buying a licensed company is a regulatory approval with a share purchase attached.
Custody
Holding or controlling assets on behalf of another person. Usually the highest-obligation category in any crypto regime, and the one most often wrongly assumed not to apply — if you hold the keys, or can move assets without per-transaction customer authorisation, a supervisor is likely to treat you as a custodian.
E
EDD — Enhanced Due Diligence
The heightened measures applied where risk is higher: politically exposed persons, high-risk jurisdictions, unusual structures or unexplained wealth. A regulator will want to see the trigger criteria written down, not applied by judgement alone.
EMI — Electronic Money Institution
An institution authorised to issue electronic money: stored value that a customer can redeem or spend later. Because it involves holding other people's funds, the safeguarding, capital and reporting obligations are materially heavier than for a pure payment-initiation permission.
F
FinCEN — Financial Crimes Enforcement Network
The bureau of the US Treasury that administers federal anti-money-laundering rules and MSB registration. Federal registration does not remove the need for state money transmitter licences, which are separate and numerous.
FINMA — Swiss Financial Market Supervisory Authority
Switzerland's integrated financial regulator. In the AML context it recognises and oversees the self-regulatory organisations rather than supervising each intermediary itself, which is why a crypto firm's counterparty is normally an SRO.
FINTRAC — Financial Transactions and Reports Analysis Centre of Canada
Canada's financial intelligence unit and the body with which money services businesses register. Registration brings reporting, record-keeping and compliance-programme obligations, and Canadian requirements were extended by the Retail Payment Activities Act regime.
FSP — Financial Service Provider registration
New Zealand's register of financial service providers, overseen by the Financial Markets Authority. Often mistaken for a light-touch route: registration carries obligations, and the regulator has been explicit about removing providers whose connection to New Zealand is nominal.
K
KYC — Know Your Customer
The identification and verification of a customer before and during a business relationship. In practice KYC is the narrow identity step within the wider customer due diligence obligation, though the terms are often used interchangeably.
M
MiCA — Markets in Crypto-Assets Regulation
The EU regulation governing crypto-asset issuance and services. Its transitional period ended on 1 July 2026, after which a firm without CASP authorisation can no longer serve EU clients on a legacy national registration. It also creates distinct regimes for asset-referenced tokens and e-money tokens.
Minimum capital
The capital a regime requires a licensed entity to hold, often calculated by category or by transaction volume. It is not a fee: it is working capital that cannot be deployed, which for an early-stage business is sometimes a harder constraint than the cost of the application.
MPI — Major Payment Institution
Singapore's licence class for payment service providers whose transaction volumes exceed the thresholds set under the payments framework administered by the Monetary Authority of Singapore. Below those thresholds a standard payment institution licence applies.
MSB — Money Services Business
The North American category covering money transmission, currency exchange and, in several formulations, dealing in virtual currency. Registration is with FinCEN in the United States and FINTRAC in Canada; state-level licensing in the US applies on top of federal registration.
MSO — Money Service Operator
Hong Kong's licence for money changing and remittance operators. Frequently relevant to crypto businesses whose activity includes moving fiat value, and distinct from Hong Kong's virtual asset regime.
P
PI — Payment Institution
The general category for a firm authorised to provide payment services — execution of transfers, acquiring, money remittance and related activities. The precise service list, and whether client funds may be held, is set by the authorisation rather than the label.
S
SRO — Self-Regulatory Organisation
In the Swiss context, a body recognised by FINMA that admits financial intermediaries as members and supervises them directly for anti-money-laundering purposes. Affiliation is how a Swiss financial intermediary comes within AML supervision; it is not a banking or securities licence.
Substance
The regulator's test of whether your presence in a jurisdiction is real: an entity, a verifiable address, people who can perform their roles, and an operation matching the filed documents. The most underestimated cost in a licensing project, and the most common quiet reason a route fails.
U
U Card / stablecoin-settled card
A payment card whose balance is funded from stablecoin holdings and settled into fiat at the point of transaction. Not a licence in itself: it sits on top of an e-money or equivalent permission plus a scheme or issuing relationship.
UBO — Ultimate Beneficial Owner
The natural person who ultimately owns or controls a legal entity, traced through every intermediate layer. Applications fail where ownership does not resolve to identified individuals, and this is also the first thing a bank checks during onboarding.
V
VASP — Virtual Asset Service Provider
The generic concept in the FATF recommendations: a business that, for or on behalf of another person, exchanges, transfers, safekeeps or participates in the issuance of virtual assets. Each country converts it into domestic law under its own name, with its own thresholds and exemptions, so the term is a starting point rather than a category you can apply for.
