CryptoverselawyersVisit Website →
← Back to blog

UBO Requirements for VASPs: US Rules and Wider Context

November 1, 2026
UBO Requirements for VASPs: US Rules and Wider Context

A US virtual asset service provider (VASP) deals with ultimate beneficial owner (UBO) rules in two separate ways. First, it must identify and verify the owners of its own legal-entity customers, applying the 25% ownership test and a control test. Second, it may have to disclose its own owners to FinCEN, to state regulators and to the banks that service it. Since March 2025 the federal Corporate Transparency Act (CTA) filing has applied only to certain foreign-formed entities, while customer due diligence (CDD) and state licensing expectations remain fully in force.

This guide sets out the regulatory mandate, the thresholds, the records you keep, the enforcement exposure and the structuring decisions that follow. It also notes where the UAE regime, which many of our clients hold in parallel, differs.

Cryptoverselawyers
Navigate VASP Ownership Rules
Get legal guidance on crypto regulation and compliance frameworks across the UAE and more than 30 crypto-friendly jurisdictions.
Explore legal services

Regulatory Mandate: which US rules reach a VASP

The US has no single "VASP" statute. A business is regulated because of what it does. FinCEN's 2013 virtual-currency guidance treats an administrator or exchanger that accepts and transmits convertible virtual currency, or buys or sells it for any reason, as a money transmitter, and therefore a money services business (MSB), unless a limitation or exemption applies.

Three layers then determine UBO obligations:

  1. Bank Secrecy Act (BSA) programme duties. An MSB must register with FinCEN, renew every two years and maintain an effective written AML programme. Federal registration is separate from state licensing.
  2. The CDD Rule, 31 CFR 1010.230. It obliges covered financial institutions to identify and verify the beneficial owners of legal-entity customers. Whether your VASP is itself a covered institution depends on its status, for example a bank charter or broker-dealer registration. A standalone MSB should confirm its position with counsel. Even where the rule does not bind you directly, your sponsor banks and payment partners will apply it to you.
  3. The Corporate Transparency Act. This is an entity's own filing with FinCEN about its owners. FinCEN distinguishes it clearly from CDD: CTA reporting is a filing for law-enforcement and specified governmental purposes, whereas CDD is information a financial institution collects to know its customer. Giving ownership details to a bank does not satisfy a separate CTA filing obligation, and the two regimes can require different information.

Foreign location does not remove exposure. Treasury's digital asset action plan states that VASPs operating wholly or in substantial part in the United States must maintain an effective AML/CFT programme and meet reporting and recordkeeping obligations prescribed by FinCEN, including when they are located abroad. For the wider programme, see our US crypto AML requirements guide.

Who counts as a beneficial owner: the two prongs

The CDD Rule defines a beneficial owner through two prongs. Both must be applied to every legal-entity customer.

ProngTestWho must be identified
OwnershipAny individual who owns, directly or indirectly, 25% or more of the equity interestsEach such individual, if any
ControlAn individual with significant responsibility to control, manage or direct the entityOne individual

The text of 31 CFR 1010.230 sets out both prongs, and FinCEN's CDD Rule page confirms that the ownership prong generally covers each 25% holder while the control prong requires one person. The control individual typically includes an executive officer such as the CEO, CFO or COO, or a managing member, as practitioner summaries of the rule note.

Two practical points follow for VASP customers:

  • Indirect ownership counts. A token foundation held through a holding company and a trust must be traced through each layer until natural persons are reached. Lack of a 25% holder is a legitimate outcome, but the file should record that the analysis was done.
  • The control prong always yields a name. Even a widely held DAO wrapper or a fund with no 25% investor needs one individual with managerial control.

FinCEN's CDD FAQs also record that, on 13 February 2026, FinCEN granted exceptive relief from collecting beneficial ownership at each new account opening. Check the current terms of that order before relying on it. Many institutions will keep their own onboarding standards regardless.

Licensable Activities and how they change UBO scope

UBO scope follows activity, because activity decides which regulator and which licence apply.

  • Exchange and transfer of convertible virtual currency: MSB registration with FinCEN and, in most states, a money transmitter licence.
  • Hosted-wallet custody: treated by many states as money transmission or a custody-type licence, with fuller control-person disclosure.
  • Payments and stablecoin transfer: money transmission analysis, plus sanctions screening of owners and counterparties.
  • Tokenisation and RWA platforms: securities-law analysis may apply before any MSB question arises. See our tokenisation and RWA structuring service.

State regulation is activity-specific and state-specific. The Conference of State Bank Supervisors (CSBS) reported in June 2024 that 37 states required a money-transmitter or similar licence for virtual-currency transmission, while some states limited licensing to transactions involving fiat currency. Applications typically require substantive background and financial information on the applicant and its principals.

Capital and Prudential Standards

Federal MSB registration carries no capital requirement. Capital is a state matter. The CSBS Model Money Transmission Modernization Act standardises control, licensing, net worth, bonding and permissible investments and enables multistate supervision. Its virtual-currency provisions treat currency accepted by multiple parties as exchangeable value when received for transmission.

The link to UBO is direct. Net worth and surety bond calculations are run on the applicant, but regulators assess who stands behind it. States adopt the model differently, and CSBS's 2023 legislative update records variations, including control-person and ownership thresholds. A 10% shareholder who is invisible in the federal analysis may therefore be a named control person in a particular state.

For prudential modelling, we advise clients to:

  1. Build a single ownership chart showing every holder above the lowest state threshold in your target states, not only 25%.
  2. Model net worth and bonding for each state at the planned transaction volumes.
  3. Keep the chart and the model synchronised, so that a cap table change triggers a prudential review.

Governance and Control Requirements

Regulators read the board as part of the ownership picture. A sound governance file for a VASP includes:

  • a register of directors, officers and controllers with biographical and criminal-history information;
  • a documented approval path for changes in control, including who decides and who notifies regulators and banks;
  • a named individual accountable for BSA compliance, reporting to the board;
  • minutes showing the board reviewed the AML risk assessment, including customer ownership risk.

Change-in-control rules matter most in funding rounds. Share issuances to new investors, token-warrant conversions and secondary sales can each move an investor across a state notification threshold. Build the notification check into every term sheet.

AML/CFT and Travel Rule Implications

For your customers, the CDD cycle is:

  1. Identify the legal entity and its beneficial owners at onboarding.
  2. Verify each identity using risk-based procedures. FinCEN's rule allows an institution to rely on information supplied by the customer unless it has knowledge of facts that reasonably call that information into question. Adverse media, a registry mismatch or a wallet cluster linked to a different person are such facts.
  3. Understand the nature and purpose of the relationship and build a risk profile.
  4. Monitor on an ongoing basis and report suspicious activity, as the CDD Rule requires.

Higher-risk customers, such as unhosted-wallet-heavy businesses, offshore holding structures and entities with nominee shareholders, warrant enhanced due diligence beyond the minimum 25% test. Sanctions screening applies to every identified owner. Our guide to OFAC crypto compliance covers that layer.

Records to keep

Retain the certification or form relied on, the documents used to verify each owner, the ownership analysis and the resolution of any discrepancy. The five-year periods in 31 CFR 1020.220 for bank customer identification, as summarised by practitioners, run from record creation for verification records and from account closure for identification records. Those practitioners stress that records should be detailed enough for a regulator to reconstruct the verification process. Confirm the retention rule that applies to your own licence type and any longer state period.

Five-year retention periods for two record types

The Travel Rule adds originator and beneficiary data to transfers, but it does not replace UBO work. It makes the owner file more important, because a counterparty VASP will ask who is behind the entity you serve.

Technology and Custody Controls

Ownership data is only useful if systems enforce it. We recommend:

  • Structured storage. Hold owner data as fields, not PDFs, so that screening and monitoring can query it.
  • Re-verification triggers. Ownership changes, new wallet addresses, jurisdiction changes and adverse alerts should reopen the file.
  • Access control. Limit who can view and edit owner data, and log every change.
  • Wallet attribution. Link whitelisted withdrawal addresses to the verified entity and its owners, and segregate client assets from corporate assets in the custody model.

Enforcement Exposure and Penalty Framework

Exposure falls into three groups.

CTA reporting. It is a federal crime to wilfully provide false beneficial ownership information or fail to update a required report. Since the March 2025 interim final rule, the filing duty applies to foreign-formed entities registered to do business in a US state or tribal jurisdiction. FinCEN's announcement of that rule removed the requirement for US companies and US persons. As FinCEN's quick reference stood in August 2026, US companies are exempt, and foreign reporting companies need not report US-person beneficial owners or company applicants. Foreign entities registering after 26 March 2025 have 30 days from registration to file. Reports go through FinCEN's BOI E-Filing system, and FinCEN holds the data in a secure system for authorised law-enforcement and regulatory access. Rules in this area have changed repeatedly, so check FinCEN's current page before every filing.

BSA and CDD failures. Weak customer due diligence is a recurring theme in FinCEN enforcement against MSBs, including the facts and violations in a 2015 virtual-currency settlement that cited registration and programme failures. Penalties depend on the case, and the personal exposure of compliance officers is real.

Enforcement Exposure and Penalty Framework

State action. State regulators can restrict or revoke licences and require return of customer assets, as the CSBS-announced settlement above illustrates.

Practical Structuring Considerations

  • Choose the formation jurisdiction knowing the CTA consequence. A foreign-formed entity registered in a US state is a reporting company. A US-formed one is not, although its banks and state regulators will still ask for owners.
  • Keep the cap table clean. Nominee holdings, undocumented SAFTs and token allocations to unnamed advisers are the most common causes of delay in bank and licence reviews.
  • Plan the entity chain. Multi-entity groups should map which entity holds the licence, which holds the IP and which contracts with customers, and keep a UBO pack for each.
  • Prepare one owner pack, reuse it. Passports, proof of address, source-of-wealth narratives and organisation charts, reconciled to each regulator's form, save weeks across applications.
  • Rehearse supervision. Ask a colleague to pull the file on your largest customer and reconstruct the owner analysis in under an hour.

How UAE UBO rules compare

Many founders ask how the US position compares with Dubai and Abu Dhabi. In the UAE, beneficial ownership is embedded in the licensing process itself: the regulator reviews controllers and owners at application and on every change, rather than through a separate public-interest filing. The relevant instruments are the VARA Regulations and Rulebooks, DFSA and FSRA rules and Federal Decree-Law No. 20 of 2018 as amended. Our UAE federal AML law guide and VARA licence process overview explain the sequence. A group licensed in both systems should keep one master ownership dataset and tailor the output to each regulator.

Our perspective

Most UBO failures we see are not failures of law. They are failures of consistency. The cap table says one thing, the bank form another, and the regulator's application a third.

We treat beneficial ownership as a single, board-owned dataset. It is built once, tested against the strictest regime the group faces, and then reused for FinCEN, state regulators, banks and UAE authorities such as VARA, the DFSA and the FSRA.

Because our lawyers work across the UAE's five crypto regulators and in over 30 jurisdictions, we design that dataset so that a change in one place flows through every filing. This is what makes a licence application regulator-ready rather than merely complete.

CRYPTOVERSE

Support with ownership and licensing files

If your group needs a UBO framework that holds up with US banks, state regulators and the UAE authorities, our team can build it with you. We advise on VASP licensing in the UAE and globally, on AML/CTF and risk management and on multi-entity structures. We do not publish prices, so contact us through the site to scope an engagement.

Cryptoverselawyers

FAQ

Is the beneficial ownership threshold for a VASP 25% or 10%?

The federal CDD Rule uses 25% for the ownership prong, plus one individual under the control prong. Some state money-transmission regimes use different control-person or ownership thresholds, so a lower figure can apply in a specific state. Map every state you will operate in.

Does a US VASP still have to file a beneficial ownership report with FinCEN?

Under the March 2025 interim final rule, US-formed companies are exempt from CTA reporting. Only certain foreign-formed entities registered to do business in the US must file. Check FinCEN's current BOI guidance before relying on this, because the rules have changed several times.

Is giving my bank the owner details the same as a CTA filing?

No. FinCEN states that providing information to a bank does not satisfy a separate CTA filing obligation. The two regimes serve different purposes and can require different information.

Can a VASP rely on what its customer says about ownership?

A covered institution may rely on customer-supplied information unless it knows facts that reasonably call its reliability into question. Adverse media, registry mismatches and wallet links to other parties are typical examples, and each should trigger further verification.

Sources