VASP Due Diligence Now Reaches the Company Behind the Crypto Exchange
Compliance teams that screen crypto counterparties can now pull registry-sourced company records on the firms operating exchanges, custodians and wallet providers, extending VASP due diligence into territory that wallet-tracing tools do not cover. Worldbox Business Intelligence has launched a dataset of company profiles for virtual asset service providers (VASPs), using official company registries to document the legal identity, ownership and control of the businesses that blockchain analytics can trace on-chain while their corporate identity off-chain stays unanswered.
The launch lands against a regulatory backdrop that keeps pointing to the same gap. The Financial Action Task Force (FATF), whose anti-money laundering standards cover VASPs, used its July 2026 update on virtual assets to warn that jurisdictions still struggle to identify the natural and legal persons carrying out VASP activity, and that offshore providers remain a persistent challenge. For banks and fintechs that transact with crypto businesses, knowing which legal entity sits behind a brand has become a frontline compliance requirement rather than a back-office formality.
What does the VASP dataset actually give compliance teams?
A verifiable corporate identity for each VASP, drawn from primary registry sources rather than the provider's own marketing. Worldbox says the profiles build on its database of more than 500 million entities across over 240 jurisdictions, with records sourced directly from company registries and backed by original corporate documents such as certificates of incorporation, articles of association and government registry extracts.
The company frames the dataset around four recurring failure points in VASP counterparty checks. The first is matching the right legal entity, since brand names, trading names and group companies routinely overlap, and the entity named in a contract should match both the registry record and any licence held. The second is ownership and control: the ultimate beneficial owners, the directors and the parent structures that often sit across several jurisdictions, including offshore ones. The third is documentary evidence that an auditor or regulator can open and read. The fourth is change over time, because ownership and status can shift after onboarding, which turns a one-off check stale.
Why can't blockchain analytics answer this?
Because they look at a different layer. Chainalysis, Elliptic and TRM Labs trace wallets, transactions and on-chain exposure, work that establishes where funds moved. They do not establish who owns or controls the company running a blockchain-based service, information that lives in company registries, filings and corporate documents rather than on a ledger. Worldbox chief executive Adrian Ashurst framed the dataset as answering that second question, the identity of the business behind an exchange, with records a compliance team can open and verify.
FATF's own private-sector guidance in the July update points the same way, calling for blockchain analytics to detect rapid layering and, separately, enhanced due diligence on offshore counterparties. The two are complementary layers of the same check: one follows the money, the other names the company.
What is the regulatory backdrop driving demand?
A widening gap between crypto rules on paper and their enforcement. FATF's July 2026 update, its seventh on virtual assets, reported that 83% of surveyed jurisdictions now have Travel Rule legislation, up from 73% a year earlier, yet almost half of those with such laws have taken no related supervisory or enforcement action. The Travel Rule requires VASPs to pass originator and beneficiary details alongside transfers, and FATF again flagged offshore VASPs that exploit weaker supervisory regimes.
Licensing regimes show a similar funnel. In Singapore, where VASPs are regulated as digital payment token service providers, the Monetary Authority of Singapore (MAS) has licensed around 37 firms out of close to 300 applications, with most of the rest rejected or withdrawn. In the European Union, the European Securities and Markets Authority (ESMA) called on unauthorised crypto-asset service providers to wind down their EU activity after the Markets in Crypto-Assets Regulation (MiCA) transitional period ended on 1 July 2026, and told clients to check its register to confirm a provider's status. ESMA went further, warning that MiCA protections apply only to the specific entity authorised in the EU, not to other companies in the same group or to non-EU affiliates. That is precisely the entity-matching problem the Worldbox dataset sets out to address.
How does this fit the crypto-compliance market?
It targets the identity layer rather than the transaction layer. Blockchain-analytics providers have built large businesses on wallet screening and transaction monitoring. Registry-based entity intelligence occupies the adjacent space, confirming the corporate reality behind a counterparty before and during a relationship. Worldbox operates from offices in Zurich, Singapore and other locations, and sells the data through company profiles and due-diligence reports aimed at compliance and onboarding teams.
Why This Matters to FinanceX Readers
For compliance leaders, investors in crypto infrastructure, and banks opening accounts for digital-asset firms, the signal is clear: counterparty identity is becoming a discrete, auditable control, separate from on-chain monitoring. Firms that can evidence who owns and controls a VASP, and keep that evidence current, will clear onboarding and audit faster than those relying on brand-level assurances. For investors weighing crypto-compliance vendors, the market is splitting into transaction intelligence and entity intelligence, and both now carry regulatory weight.
