TL;DR
VASP data APIs let compliance and engineering teams pull information about crypto exchanges and service providers directly into onboarding, screening, and Travel Rule workflows. Best for risk-scored VASP profiles: Elliptic Discovery and TRM Labs. Best for counterparty monitoring: Crystal Intelligence. Best free foundations: GLEIF's LEI API and official regulator registers such as ESMA's MiCA register.
Why VASP data needs an API, not a spreadsheet
Every transfer between two VASPs raises the same questions: who is the counterparty, are they licensed where they operate, can they receive Travel Rule data, and what is their on-chain risk? Compliance teams that answer those questions manually, with PDFs and regulator websites, do not scale past a handful of counterparties.
A VASP data API turns those answers into fields a system can act on in milliseconds: block, allow, or escalate. That makes the use case different from general blockchain analytics. The buyer here is usually an engineering or compliance-ops team wiring decisions into product flows, so documentation, data structure, and update frequency matter as much as the data itself.
Criteria that matter
Data scope. Licensing and registration, jurisdiction, ownership, Travel Rule capability, and on-chain risk.
Identifiers. Stable entity IDs and support for Legal Entity Identifiers (LEIs), which make matching across systems reliable.
Freshness. How quickly licence changes, enforcement actions, and risk shifts appear.
Integration. REST APIs, webhooks for changes, and clear documentation.
Cost model. Free public data versus commercial contracts priced by volume.
Quick comparison table
| Source | Type | Licensing data | On-chain risk | Travel Rule data | Change alerts | Cost |
|---|---|---|---|---|---|---|
| Elliptic Discovery | Commercial | Yes | Yes, with peer benchmarking | Supports counterparty checks | Yes | Quote-based |
| TRM Labs Know Your VASP | Commercial | Yes | Yes, configurable indicators | Via TRM Travel Rule and partners | Yes | Quote-based |
| Crystal Intelligence | Commercial | Yes, licence verification | Yes, 330+ blockchains | Via 21 Analytics, Sumsub and others | Yes | Quote-based |
| Chainalysis | Commercial | Varies by product | Yes, deepest attribution | Via Travel Rule partner integrations | Yes | Premium, quote-based |
| GLEIF LEI API | Free, public | Legal entity identity only | No | Identifier used in Travel Rule data | Public updates | Free |
| Regulator registers (ESMA MiCA register, FinCEN MSB search) | Free, public | Authoritative licence and registration status | No | No | Periodic updates | Free |
Based on vendor documentation and public registry sources, checked October 2026. Commercial API access is usually sold as part of a wider platform contract, so confirm that API calls are included in your tier.
Top options compared
Elliptic Discovery
What it does well: structured VASP risk profiles covering thousands of crypto businesses, with peer benchmarking and month-over-month risk trends that are easy to turn into onboarding rules. Where it breaks: commercial contract required, and Travel Rule messaging sits elsewhere. Best for: banks and PSPs automating crypto-business onboarding.
TRM Labs Know Your VASP
What it does well: entity-level risk profiles with configurable risk indicators, alongside wallet screening and monitoring through the same platform. Where it breaks: configuration needs analyst time. Best for: teams that want to define their own scoring logic.
Crystal Intelligence
What it does well: continuous counterparty monitoring with alerts, licence verification, and jurisdiction risk, plus native links to Travel Rule providers. Where it breaks: does not transmit Travel Rule data itself. Best for: monitoring a growing counterparty list over time.
Chainalysis
What it does well: the deepest attribution data behind every risk decision, widely accepted by regulators. Where it breaks: highest typical cost; VASP data is one component of a large platform. Best for: enterprises already on Chainalysis.
Free foundations: GLEIF and regulator registers
What they do well: authoritative, free data. GLEIF's public API returns Legal Entity Identifier records, increasingly used to identify VASPs in Travel Rule data. Regulator registers, such as ESMA's register of crypto-asset service providers authorized under MiCA and FinCEN's money services business registration search, are the source of truth for licence status. Where they break: no risk scoring, inconsistent formats across jurisdictions, and no single global register. Best for: verifying licence claims and enriching commercial data.
Key differences that actually matter
Commercial APIs sell judgement: risk scores built on attribution data and analyst research. Public sources sell authority: the official record of who is licensed. Robust stacks use both, matching vendors' VASP profiles against regulator registers and LEIs, so that a risk score is never the only evidence for a licensing decision.
When the top pick is not the right choice
If you only need to confirm licence status for a few counterparties, public registers plus GLEIF may be enough. If Travel Rule reach is the problem, a Travel Rule network provider such as Sumsub or 21 Analytics matters more than risk scores. For a broader view of the vendors, see our guides to the best VASP screening and due diligence tools and the best crypto counterparty risk platforms.
The verdict
Elliptic Discovery or TRM Labs for risk-scored VASP profiles via API. Crystal for monitoring a changing counterparty set. Chainalysis where attribution depth justifies the cost. GLEIF and regulator registers as the free foundation underneath any of them.
FAQs
What is a VASP data API?
A VASP data API provides machine-readable information about virtual asset service providers, such as licensing, jurisdiction, ownership, Travel Rule capability, and on-chain risk, so systems can automatically decide whether to onboard, transact with, or escalate a counterparty.
Is there a free VASP directory?
There is no single free global VASP directory with risk data. Free sources include regulator registers, such as ESMA's MiCA register and FinCEN's MSB registration search, and GLEIF's Legal Entity Identifier API. Risk-scored directories are commercial.
How are VASPs identified in Travel Rule messages?
Travel Rule data identifies the originating and beneficiary institutions, increasingly using Legal Entity Identifiers alongside names and network-specific IDs. Counterparty discovery services match a destination address or entity to the VASP that controls it.
How often does VASP data change?
Often. Licences are granted and revoked, firms rebrand or are acquired, and on-chain risk shifts month to month. Choose APIs with change alerts or webhooks rather than relying on periodic manual checks.
Reach out if you are building in this space.
Last updated: October 13, 2026.
