Early-stage VASP founders routinely underestimate how quickly compliance obligations attach. Under the FATF Recommendation 15 standard – which obliges jurisdictions to regulate virtual asset service providers (VASPs, businesses that exchange, transfer, custody or administer digital assets on behalf of others) – the legal clock starts the moment your product accepts value from a third party, not the moment you apply for a licence. A business risk assessment is not a checkbox. It is the document that tells a regulator, a banking partner and a future acquirer that you understand your own exposure. This page explains what a VASP business risk assessment requires, why it matters for early-stage operators, and how OBOLUS structures that work.
What Is a VASP Business Risk Assessment and Why Does It Matter Now?
A VASP business risk assessment is a structured, documented analysis of the money-laundering, terrorist-financing and proliferation-financing risks inherent in a firm's products, customer types, delivery channels and geographic reach. It is the foundation of every compliant AML program. Regulators across the major hubs – from ESMA and the national competent authorities enforcing MiCA in the EU, to VARA in Dubai and the Monetary Authority of Singapore (MAS) under the Payment Services Act – require that a VASP produce and maintain a risk assessment before it designs its controls. The assessment does not just satisfy a filing obligation. It determines the appropriate level of customer due diligence, the scope of transaction monitoring, and the thresholds that trigger enhanced review.
For an early-stage founder, the timing pressure is acute. Operating without documented risk controls exposes the business to enforcement action, licence refusal, and – critically – the loss of banking relationships. Payment rails are the first casualty when a bank's correspondent compliance team cannot find evidence of a functioning AML framework. We have seen this pattern repeatedly: a product is live, users are onboarding, and then the EMI or neo-bank closes the account with limited notice and no appeal path. The cost is not just the banking fee. It is the months of recovery work and the reputational signal it sends to the next bank in the queue.
Operating without documented AML controls is the single fastest route to a frozen payment rail. The regulator may come later. The bank will come first.
Reach out early. The process above describes the standard path. Your facts – the entity structure, the user base, the banking partners – will change the analysis materially. Map your options with our team before the gaps become enforcement items.
What Law Requires a VASP to Conduct a Business Risk Assessment?
The obligation flows from the FATF framework, implemented at the national level through AML/CFT legislation in every jurisdiction where a VASP operates or has users. The principle is consistent: a VASP must understand and document its own risk profile before it can design proportionate controls. Under MiCA and the associated Transfer of Funds Regulation, EU-licensed CASPs (Crypto-Asset Service Providers) must maintain a documented risk assessment and keep it current as the business changes. VARA in Dubai applies a parallel obligation through its activity-specific rulebooks. MAS requires DPT (Digital Payment Token) service licensees to conduct and document a risk assessment as a precondition to obtaining and maintaining a licence.
The BVI FSC under the VASP Act 2022, CIMA under the Cayman VASP regime, and the FCA under its MLR registration framework each impose similar documentation requirements. What varies across these regimes is the granularity expected, the review frequency, and how the risk assessment integrates with the AML policy and the MLRO's (Money Laundering Reporting Officer's) annual report. A business serving users in multiple jurisdictions must satisfy the most demanding standard in its operating footprint, not a single home-state floor.
The Travel Rule – the FATF obligation requiring VASPs to pass originator and beneficiary identification data alongside every qualifying virtual-asset transfer – adds a second layer of complexity. A risk assessment must now address not just the VASP's own customer base but also the counterparty VASPs in the transfer network. If your transaction monitoring does not flag transfers to or from non-compliant or unhosted wallets, the risk assessment is incomplete by design.
What Does a VASP Business Risk Assessment Actually Cover?
A compliant VASP business risk assessment addresses five structural dimensions. First, the product and service risk: what does the VASP do, and which activities carry elevated ML/TF exposure? Custody and exchange carry different risk profiles. A peer-to-peer mechanism carries a higher exposure than an OTC desk serving institutional clients. Second, the customer risk: who are the users, how are they onboarded, and what CDD (customer due diligence) tiers apply? High-risk customer categories – politically exposed persons, customers in sanctioned or high-risk jurisdictions, high-volume traders with opaque source-of-funds – require enhanced procedures.
Third, the geographic risk: where are users located, where do the counterparty VASPs sit, and which jurisdictions appear in the transaction graph? A VASP domiciled in an EU member state that serves customers in jurisdictions flagged on the FATF grey list faces an automatically elevated baseline. Fourth, the delivery channel risk: is the product app-based, API-only, or intermediated through a network of agents? Each delivery model creates different identity-verification gaps. Fifth, the transaction risk: what is the value profile, the velocity, and the asset mix? A VASP offering privacy-enhanced tokens or cross-chain bridging functions must address those exposures explicitly.
The output of the assessment is not a narrative memo. It is a risk-rated matrix that maps each dimension to a residual risk score and feeds directly into the AML policy, the KYC framework (the documented customer-identification and verification procedures), and the transaction monitoring calibration. Regulators expect to trace a clear line from the assessment to the controls. An assessment that lives separately from the compliance program is, in practice, worthless at an inspection.
What Are the Most Common AML Mistakes Early-Stage VASPs Make?
Early-stage teams make identifiable, recurring errors. The first is timing: treating the risk assessment as a pre-launch task rather than a living document. Regulators do not want a snapshot. They want evidence that the business reviews and updates the assessment when the product changes, when the user geography shifts, or when a new asset class is added. A three-year-old risk assessment describing a product that was pivoted two years ago is affirmative evidence of a broken compliance program.
The second error is scope compression. Founders often scope the assessment to the entity holding the licence and exclude the group holding company, the payment agent, or the offshore treasury vehicle. In practice, a regulator applying substance-over-form analysis will look at the economic reality of the group. If the licensed entity receives funds from a group entity that has not conducted CDD, the chain is broken regardless of how cleanly the licensed entity's own policies read.
The third error is the technology gap. A risk assessment that references transaction monitoring without specifying the rule sets, the threshold logic and the review workflow is not an assessment. It is a statement of intent. VARA, MAS and the FCA have each taken supervisory action against firms whose monitoring systems were deployed but not calibrated to the risks documented in the firm's own assessment. Consistency between the documented risk and the deployed controls is a minimum expectation.
A fourth error, relevant specifically to cross-border operators: failing to address the Travel Rule infrastructure. A VASP that has not identified which of its counterparty VASPs are compliant, which are non-compliant, and what its policy is for unhosted-wallet transfers has a structural gap in its AML program. Regulators increasingly treat this not as a future build item but as a current obligation.
How Does the Cross-Border Reality Complicate a VASP Risk Assessment?
For most early-stage VASPs, the entity, the banking, and the users sit in different jurisdictions. That is not a problem to be solved – it is the normal operating reality of a digital-asset business. But it means the risk assessment must be jurisdiction-layered. A VASP licensed in Malta under the MiCA CASP regime that services users in Singapore and maintains a treasury in the BVI is subject to MFSA oversight, the Transfer of Funds Regulation for EU-nexus transactions, MAS guidance on DPT risks for Singapore-resident users, and BVI FSC expectations for the treasury vehicle. Each of those regimes has its own AML rulebook. The risk assessment must address all of them, not the most convenient one.
The same logic applies to Travel Rule compliance. The applicable data-transfer threshold varies by jurisdiction. The definition of a VASP counterparty, the treatment of unhosted wallets, and the acceptable technological solution for transmitting originator/beneficiary data all differ across the EU, Singapore, the UK, and the UAE. A VASP operating across those jurisdictions cannot build a single Travel Rule procedure and apply it uniformly. The risk assessment must document the jurisdictional variation and specify how the VASP's Travel Rule solution addresses each version of the rule.
Banking is a direct downstream consequence of the assessment. A correspondent bank conducting enhanced due diligence on a VASP will request the risk assessment as part of its onboarding pack. A well-structured, jurisdiction-layered assessment that demonstrates an understanding of cross-border AML exposure is a credibility document with the bank's compliance team. A generic template with no geographic specificity will be read – accurately – as a sign that the VASP has not taken the work seriously.
If your prior AML documentation stalled a banking application or surfaced gaps at a supervisory review, a second read can identify the structural reason. Our team works through the substance with you. Map your options before the next application cycle opens.
Which Early-Stage VASP Profile Needs What Level of Assessment?
Not all early-stage VASPs carry the same risk profile, and the depth of the assessment should be proportionate to the actual risk. The following profiles represent the main decision branches we encounter in practice.
Profile A: Single-product, single-jurisdiction, institutional-only. A VASP offering custody or OTC services exclusively to verified institutional counterparties within one EU member state, with no retail onboarding and no peer-to-peer mechanism, faces a lower inherent risk. The assessment can be structured at a standard depth, with a focused customer-risk section addressing PEP screening and source-of-funds for high-net-worth entities. The Travel Rule obligation still applies, but the counterparty population is manageable. Timeline to a complete, regulator-ready assessment: typically several weeks from engagement, depending on how much prior documentation exists.
Profile B: Multi-product, multi-jurisdiction, mixed retail and institutional. A VASP running an exchange with retail and institutional onboarding, serving users across multiple jurisdictions, using third-party payment channels and offering a wallet product, faces a materially higher inherent risk. The assessment must address each product line separately, model the geographic risk by user distribution, and integrate with a tiered CDD framework that can apply enhanced procedures at the right triggers. The Travel Rule section will need to address multiple jurisdictional versions of the obligation. Timeline is longer and depends on the maturity of the existing compliance documentation.
Profile C: DeFi-adjacent or token-issuance model. A business that issues its own tokens, operates a bridging function, or provides access to liquidity pools faces the most complex risk profile. The regulatory perimeter is itself uncertain in several jurisdictions. The assessment must address the threshold question – does the activity constitute a VASP function in each relevant market – before it can address the AML risks. Allied counsel in the relevant jurisdiction may need to provide a legal opinion on the perimeter question as an input to the risk assessment. Timeline and complexity vary significantly.
How This Works in Practice
In a recent engagement, an early-stage exchange operator preparing its first licence application in a Gulf hub discovered that its draft AML policy referenced a risk assessment that had never been formally completed. The business had been operating in a pilot capacity for several months. We conducted the risk assessment from scratch, identifying three product-level gaps in the transaction monitoring configuration and a Travel Rule gap for transfers to certain counterparty VASPs. The assessment was completed and the policy updated before the application was filed. The regulator's initial review raised no AML process queries.
In a second matter, a token-issuing business with a Malta-licensed entity and users distributed across Southeast Asia and the Gulf sought banking support from an EU neo-bank. The bank's compliance team rejected the first application on the basis that the risk assessment did not address the Southeast Asian geographic risk or the cross-border Travel Rule obligation. We restructured the assessment, added the jurisdictional layers, and documented the Travel Rule solution. The second application succeeded.
How OBOLUS Structures a VASP Business Risk Assessment Engagement
Our process for early-stage founders is structured around four stages. The first is a scoping call to understand the product, the entity, the user geography, and the existing compliance documentation. This call is held under NDA and is the basis for a fixed-scope engagement letter. The second stage is the assessment itself: we work through the five risk dimensions – product, customer, geography, channel and transaction – and produce a risk-rated matrix with residual scores and recommended control responses.
The third stage is integration: we map the assessment output to the existing AML policy and KYC framework, and identify the gaps between the documented risks and the deployed controls. Where gaps exist in the transaction monitoring configuration or the Travel Rule infrastructure, we specify the required changes. The fourth stage is a review memo that the MLRO can use to demonstrate to the regulator that the assessment was conducted by qualified persons, reviewed against current regulatory expectations, and documented in a form that supports the firm's compliance program.
Our pricing model uses transparent fixed-scope packages, structured so that the engagement cost is known before work begins. Where scope is open-ended – for example, where the VASP faces a live regulatory inquiry or a cross-border enforcement risk – we can structure the engagement on an hourly basis. We do not quote fees in our published content; the engagement letter makes the cost clear before any work starts.
In our cross-border practice, we regularly advise founders whose entity, banking and users sit in different regulatory environments. We map the applicable regime in each jurisdiction and advise on the most demanding standard the VASP must satisfy. For jurisdictions where allied counsel are required, we coordinate with local practitioners in the relevant market.
Related at OBOLUS
- AML & Travel Rule practice overview – the full scope of our compliance advisory work for digital-asset businesses
- VASP risk assessment under heightened scrutiny – for firms facing supervisory review, enforcement risk or prior application failures
- VASP risk assessment for regulated entities – for licensed VASPs updating existing programs to meet current standards
FAQ
What does the Travel Rule require from a VASP?
The Travel Rule requires a VASP to collect, verify and transmit originator and beneficiary identification data alongside every qualifying virtual-asset transfer. The applicable data threshold and the required data fields vary by jurisdiction: the EU Transfer of Funds Regulation, MAS requirements under the Payment Services Act, and the FCA's MLR rules each specify slightly different obligations. A VASP operating across those markets must satisfy each version of the rule for the transfers that fall within its scope, and must have a documented policy for transfers involving unhosted wallets or non-compliant counterparty VASPs.
Who must act as MLRO for a crypto firm?
Most regulated VASP regimes require the appointment of a named MLRO (Money Laundering Reporting Officer) who is responsible for receiving internal suspicious-activity reports, filing external reports to the financial intelligence unit, and overseeing the AML compliance program. The MLRO must meet a fit-and-proper standard set by the relevant regulator – ESMA's guidance under MiCA, VARA's fit-and-proper expectations, and MAS requirements each define the role with some variation. For early-stage firms, a founder may initially hold the MLRO role, but regulators increasingly expect the function to be held by a qualified compliance professional as the business scales.
How do regulators audit crypto AML programs?
Regulators audit VASP AML programs through a combination of desk-based document review and on-site or remote inspection. They will typically request the business risk assessment, the AML policy, the KYC framework procedures, a sample of customer due diligence files, transaction monitoring logs and alert-disposition records, and evidence of MLRO activity. The audit focus has shifted in recent supervisory cycles: regulators now scrutinize the consistency between the documented risk assessment and the deployed controls. A well-drafted policy that does not match the actual monitoring configuration will be treated as evidence of a governance failure, not a minor gap.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the AML, Travel Rule and compliance obligations that sit around them. We map the licence and compliance stack across operating, custody and payment layers before clients commit – so the gaps surface in due diligence, not at a regulatory inspection. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Victor Olsen, Regulatory & Compliance Analyst – specialises in VASP AML frameworks, business risk assessments and cross-border regulatory compliance for early-stage digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.