On- and off-ramps are one of the most competitive, most heavily regulated corners of crypto: Coinbase, Kraken, Ramp, Bitget, Paybis and dozens of smaller players all compete on the same activity...turning fiat into crypto and back.
The most useful filter when you’re choosing between them isn’t brand recognition; it’s whether they’ll show you an actual registration number. An on-ramp turns fiat into crypto; an off-ramp turns it back; both are licensed activities, and that licensing is exactly what a business should be checking.
The Financial Action Task Force calls a business that does this a Virtual Asset Service Provider, or VASP. In the US, FinCEN classifies the same activity as a money services business. That’s the difference between a provider you can actually check up on and one you just have to trust.
What an on-ramp and off-ramp actually are
On-ramps are the platforms or services that allow you to buy digital assets with conventional fiat money. Off-ramps are the tools or services that allow you to withdraw from the cryptocurrency market, and get your money back in fiat.
In practice:
- On-ramp: you send fiat, usually by bank transfer or card, and receive crypto in a wallet.
- Off-ramp: you send crypto, and fiat lands in your bank account.
For this business, this is a cycle that repeats itself over and over again: crypto comes in from customers or partners, and it needs to become usable money on a regular basis.
Why this is a licensed activity, not just a feature
FATF introduced the VASP category specifically because moving value between crypto and fiat creates a money laundering risk.
On-chain value can move wallet to wallet with no identity attached. The moment it converts to fiat, it becomes spendable, sitting in a normal bank account, usable anywhere. The ramp is the one point where those two systems touch and the location where a launderer has to reveal an identity, or try to avoid it.
That means that a VASP has to run KYC, screen for sanctions, and report suspicious activity, the same obligations a bank has. In the US, FinCEN goes further with the Travel Rule: transfers over $3,000 require the provider to pass along originator and beneficiary information, not just process the payment. Trying to bypass this step can get your account flagged or a bank relationship closed.
You may be familiar with the Bitfinex hacking case. After husband-and-wife team Ilya Lichtenstein and Heather Morgan hacked digital asset trading platform Bitfinex, they left the stolen crypto untouched for years.
When the couple eventually tried to move it through exchanges using fake identities and "chain hopping" (moving funds across multiple cryptocurrencies), the DOJ traced the entire path and seized roughly $3.6 billion in bitcoin, the largest financial seizure in DOJ history at the time. It’s precisely why these checks are important (and why on-chain trails never really disappear).
When you’re vetting providers, always make sure that they list actual registration numbers. Paybis, for example, publishes its FinCEN MSB registration numbers and its VASP registration in Poland directly on its site. Ramp holds a FinCEN MSB registration that specifically covers 38 US states.
The concentrated market, and the custodial line running through it
Coinbase, Kraken, Ramp, Bitget, Paybis, and dozens of smaller players all compete directly on the same activity: converting crypto to fiat and back. When a segment is this competitive, brand recognition isn’t enough of a filter. Two providers can look identical on the surface and differ enormously in terms of the jurisdictions they're actually licensed in (which is the little detail that will determine whether or not your bank will keep working with you).
Most named providers are custodial, meaning they hold your fiat or crypto briefly during the conversion and carry the VASP/MSB obligations described above. A smaller, decentralised segment of the market skips that custody step entirely, and with it, most of the KYC and registration apparatus.
If you’re a business owner, that’s not the right provider for you. Non-custodial on-ramps exist mainly to serve individual traders who value privacy over a paper trail, not businesses that need a provider their bank can verify.
What actually happens to a payment
Crypto arrives, gets confirmed on-chain, and the provider converts it at whatever rate applies at that moment. Fiat then moves to a bank account, on a timeline that varies by provider, sometimes same-day, sometimes the next business day.
The conversion portion of this transaction is actually the simplest part of a complicated process that includes KYC checks before you can transact at all, thresholds like the $3,000 Travel Rule trigger that add data requirements to larger transfers, and settlement timing that might not match your expectations. There's also slippage, i.e. the rate can move between the moment a conversion starts and the moment it actually executes.
That gap tends to widen on lower-liquidity platforms and shrink on larger, more liquid ones.
How to evaluate an on/off-ramp provider
- Ask for the actual registration, not just a claim of being "licensed" (FinCEN MSB number, VASP registration, or equivalent for your jurisdiction)
- Confirm which jurisdictions that registration actually covers, since a US MSB registration doesn't cover EU customers
- Get the real settlement timeline in writing (same-day vs. next business day)
- Ask how Travel Rule data requirements apply to your typical transaction size
- Check which fiat currencies and crypto assets are supported on both sides, not just the ones advertised on the homepage
- Ask what happens to a payment that fails KYC or gets flagged, before you're relying on the provider at volume
- Ask how much slippage to expect at your typical transaction size, particularly if you're moving larger amounts
Final thoughts
Once you strip away the jargon, an on-ramp or off-ramp is just the moment crypto and fiat touch. It’s licensed because it’s the one place regulators can catch a potential launderer.
For a business, it’s just another check like you would do with any other financial institution. Look for a registration number, a jurisdiction that actually covers your customers, a settlement timeline in writing, that's the whole exercise. The providers worth working with will make it easy to verify.