El Salvador occupies a genuinely singular position in digital-asset regulation. It was the first sovereign state to adopt Bitcoin as legal tender, and it has since built a formal licensing regime for digital-asset service providers that sits largely outside the traditional banking-licence model. For an inbound operator, that combination raises an immediate legal question: does the Salvadoran regime actually grant the market access and banking connectivity the business needs, or does it create a local compliance obligation that sits in tension with the operator's home regulatory stack?
Digital-asset licensing in El Salvador is governed by the Digital Assets Issuance Law (the DAIL) and administered by the Comisión Nacional de Activos Digitales (CNAD), the purpose-built digital-asset regulator. Registration under the CNAD is the gateway to operating legally in El Salvador. It is not, however, a passport into the European Union, the United Kingdom or any other major financial market. Operators we advise treat Salvadoran authorisation as one layer in a multi-jurisdiction structure – not as a standalone global licence.
This page covers the CNAD framework, the categories of entities that must register, the practical steps for an inbound applicant, the cross-border tension points, and the factors that determine whether El Salvador belongs in a given operator's licensing strategy.
The CNAD and the Regulatory Architecture
The Comisión Nacional de Activos Digitales (CNAD) is the primary competent authority for digital-asset service providers in El Salvador. It was established under the Digital Assets Issuance Law and is operationally independent from the Banco Central de Reserva, though the two bodies coordinate on monetary stability questions. The CNAD supervises registration, licensing, ongoing compliance and enforcement across all regulated digital-asset activities in the country.
The regime distinguishes between entities that issue digital assets and those that provide services in relation to digital assets. Issuers of tokenised securities or other regulated instruments face a separate authorization track. Service providers – exchanges, custodians, wallet providers, payment processors and brokers – fall under the VASP registration framework. In our practice, the most common inbound inquiry concerns the service-provider track, because it is the gateway to offering exchange, custody or payment services to Salvadoran residents.
The CNAD framework sits alongside, and interacts with, El Salvador's Bitcoin Law, which designates Bitcoin as legal tender and requires merchants to accept it in specified circumstances. That designation has practical consequences for any entity handling Bitcoin-denominated transactions in the country, including questions about settlement finality and the handling of customer refusals.
Who Needs a CNAD Registration?
Any entity offering digital-asset services to persons in El Salvador on a commercial basis is, as a general matter, expected to operate under the CNAD framework. The regime applies both to Salvadoran-incorporated entities and to foreign businesses that actively target Salvadoran residents – a territorial reach that mirrors the approach taken by MiCA in the European Union and the MAS Payment Services Act in Singapore, both of which extend their perimeter to foreign operators actively soliciting local users.
The functional categories that trigger a registration obligation include: spot exchange services (converting fiat to digital assets or digital assets between themselves), custody of digital assets on behalf of third parties, digital-asset payment processing, and portfolio management or advice relating to digital assets. The precise scope of each category is determined by the CNAD's implementing regulations, which have evolved since the framework's initial adoption. Operators we advise conduct a formal activity mapping before the first Salvadoran user is onboarded.
Two categories of entity frequently approach us with the mistaken assumption that no local registration is needed. First, foreign operators relying on a "no active solicitation" argument – a position that is increasingly difficult to sustain when a Spanish-language website, a local payment integration or a Salvadoran bank account is in place. Second, operators already licensed in another jurisdiction who assume that authorisation elsewhere resolves the El Salvador question. It does not. The CNAD does not currently recognise any foreign licence as a substitute for local registration.
A common assumption among operators is that a single well-recognised offshore licence covers global operations. In practice, every jurisdiction with a functioning VASP regime applies its own perimeter test. El Salvador is no exception.
Operating without the right authorisation risks enforcement action by the CNAD, loss of banking relationships and, in extreme cases, a mandatory wind-down of local operations. We have seen operators in comparable jurisdictions face exactly that sequence after a period of unlicensed activity.
To assess whether your activities in or toward El Salvador trigger a registration requirement, contact OBOLUS at info@oboluslaw.com for a scoped activity-mapping review.
The process above describes the standard perimeter analysis. Your facts – the entity structure, the user acquisition channel, the payment flow and the asset classes – change the outcome.
What Does the CNAD Registration Process Involve?
The CNAD registration process follows a sequential documentation and review model broadly comparable to VASP registration in other civil-law jurisdictions, though the timeline and specific documentary requirements reflect the relative novelty of the framework. The CNAD has publicly stated its intention to process applications efficiently, and in our practice the indicative window from submission to a decision has generally been measured in weeks to a few months, depending on application quality and the complexity of the business model.
A complete application typically covers: corporate documents confirming the legal existence and ownership structure of the applicant; a detailed business plan describing the services to be offered, the target market and the technical infrastructure; evidence of anti-money laundering (AML) and know-your-customer (KYC) policies meeting FATF standards; source-of-funds and source-of-wealth documentation for ultimate beneficial owners; and a description of the technology and security architecture underpinning the service.
The CNAD will also assess the fitness and propriety of directors and senior managers. This is standard across leading regimes – VARA in Dubai, the FCA in the United Kingdom and the SFC in Hong Kong all conduct comparable officer vetting. A clean regulatory and criminal history for the senior team is a practical prerequisite, not merely a formal requirement.
Minimum capital requirements exist under the framework, though the specific thresholds vary by activity category and the CNAD has authority to adjust them by regulatory notice. We advise applicants to verify current capital requirements directly from the CNAD's published guidance at the time of application – this is the only reliable source, given that the framework continues to develop.
For custodians and payment processors, the CNAD expects evidence of client-asset segregation, technical security controls and business continuity arrangements. These requirements align broadly with what MiCA demands of CASPs in the EU context, though the Salvadoran framework uses its own defined standards rather than cross-referencing EU technical rules.
AML, the Travel Rule and Ongoing Compliance
El Salvador has implemented the FATF Recommendations on virtual assets, including Recommendation 15 and the associated Travel Rule – the obligation to pass originator and beneficiary information with a digital-asset transfer above the applicable threshold. Compliance with the Travel Rule is a live obligation for registered VASPs in El Salvador, not a future requirement. Operators must have a technical solution in place before commencing operations.
The AML/CFT framework in El Salvador draws on the Unidad de Investigación Financiera (UIF) as the financial intelligence unit. VASPs are required to report suspicious transactions to the UIF, maintain transaction records for the periods specified in applicable legislation, and conduct ongoing customer due diligence. These are standard FATF-compliant obligations; the compliance architecture an operator has built for another FATF-member jurisdiction can, in most cases, be adapted rather than rebuilt from scratch.
In a recent matter, a payment-technology business seeking to expand into Central America engaged us to assess whether its existing European AML programme – built for an FCA-registered entity – satisfied the Salvadoran UIF requirements. The gap analysis identified three areas requiring local adaptation: the suspicious-transaction reporting template, the record-retention period and the Travel Rule counterparty-identification procedure. Adjustments were made before the CNAD application was filed, avoiding a request for further information from the regulator.
What Are the Cross-Border Tension Points for Operators?
El Salvador's regulatory environment creates a distinct set of cross-border tensions that operators must account for in their structure from the outset. The most significant is the interaction between the Salvadoran CNAD framework and the home jurisdiction of the operator's banking relationships.
Correspondent banks in the United States, the EU and the UK continue to apply heightened due-diligence standards to digital-asset businesses. An entity incorporated in El Salvador and licensed by the CNAD may face difficulties maintaining USD-correspondent banking if its US banking partner applies a conservative jurisdiction-risk assessment to El Salvador. Operators we advise who use El Salvador as their primary operating jurisdiction almost always need a parallel banking relationship – often held through an EU or UK entity – to access SWIFT connectivity and USD/EUR settlement reliably.
The second tension point is the relationship between a CNAD registration and the regulatory perimeter in the operator's customer markets. A Salvadoran-licensed exchange that onboards EU residents is not MiCA-compliant by virtue of its CNAD registration. It must either restrict EU users, obtain CASP authorisation in an EU member state, or apply a defensible reverse-solicitation analysis under MiCA – a position that ESMA has publicly treated with increasing scepticism. The same logic applies to UK users (requiring engagement with the FCA), Singapore users (MAS) and Hong Kong users (SFC).
The third tension is the Bitcoin legal-tender obligation. Foreign entities that conduct any business in El Salvador – even operationally minor activities – need to assess whether the Bitcoin legal-tender rules create settlement, tax or accounting obligations in their home jurisdiction. This is not a hypothetical concern. We have seen treasury teams at mid-market payment businesses receive a surprise query from their external auditors about whether the Bitcoin legal-tender exposure required disclosure.
If a prior application stalled or a banking relationship was withdrawn, a second read of the structure often surfaces the root cause and the route back. Write to us at info@oboluslaw.com or message us via t.me/oboluslaw.
How Does El Salvador Compare for an Inbound Operator?
El Salvador's CNAD regime is best understood as a regionally significant authorisation rather than a gateway licence into major developed markets. For certain operator profiles, that is precisely what they need; for others, it is a secondary consideration.
Three operator profiles illustrate the decision logic:
Profile A – the Latin American-focused exchange: A business whose primary user base is in Central and South America, with USD settlement already handled domestically, is well served by a CNAD registration. The regime is purpose-built, the regulator is accessible, and the Bitcoin legal-tender environment gives the exchange a meaningful local brand story. The key risk is correspondent-banking access for USD outflows to regional counterparties. Timeline from application to registration, assuming a well-prepared file, is generally measured in months rather than years.
Profile B – the European operator seeking a secondary base: A MiCA-authorised CASP looking at El Salvador for cost-of-operations or talent reasons should treat the CNAD registration as a local operational licence, not a regulatory substitute. The EU users remain within MiCA's perimeter; the Salvadoran entity can serve Salvadoran users and potentially users in other jurisdictions that accept the CNAD framework. Banking complexity is the primary cost driver. Timeline is comparable to Profile A, but the structural set-up – two regulated entities, two compliance programmes, coordinated travel-rule flows – takes longer to build than the licence alone.
Profile C – the custody-specialist entering the region: A custodian seeking to hold digital assets for institutional clients in Central America can use the CNAD framework as its primary licence in the region. The key diligence point is whether institutional clients themselves – funds, family offices, corporates – require their custodian to hold a licence in a recognised jurisdiction (the Cayman Islands' CIMA framework or the BVI's VASP Act, for example) in addition to the CNAD registration. In our practice, institutional mandates frequently specify recognised-jurisdiction custodians, which may require a parallel Cayman or BVI structure regardless of the CNAD licence.
A Common Assumption – and Why It Fails
A common assumption among founders and CFOs is that El Salvador's Bitcoin-friendly public posture translates into a permissive regulatory environment. In practice, the CNAD has demonstrated an intent to enforce its registration requirements seriously. The reputational and political capital El Salvador has invested in its digital-asset strategy creates an incentive for the regulator to demonstrate credibility – which means enforcement against unlicensed operators, not tolerance of them.
A related assumption is that the small size of the Salvadoran market makes the compliance overhead disproportionate. That calculus misses two things. First, the upside of a clean CNAD registration as evidence of regulatory engagement when approaching other Latin American regulators – the CNAD stamp carries weight in a region where comparable frameworks are still developing. Second, the downside of operating without registration includes not only local enforcement but also the reputational damage with correspondent banks and institutional counterparties that comes from a public CNAD action. Loss of banking is a slower and more damaging wound than most operators anticipate.
In our cross-border practice, we regularly advise clients who underestimated the banking consequence of a regulatory action in a jurisdiction they considered minor. The correspondent bank's response is rarely proportional to the size of the infraction.
Related at OBOLUS
- Licensing & Registration for Digital-Asset Businesses – our full practice across 70+ jurisdictions, from CASP authorisation to VASP registration
- VASP Licence Application: The Structuring Angle – how entity structure affects application quality and approval timelines
- MiCA Whitepaper Review in Estonia – EU authorisation strategy for operators considering an MiCA CASP base alongside a regional structure
FAQ
How long does a crypto licence take to obtain?
The timeline varies significantly by jurisdiction and application quality. In El Salvador, a well-prepared CNAD registration file generally moves through review in a matter of weeks to a few months. Jurisdictions with more established pipelines – such as EU member states under MiCA or Singapore under the Payment Services Act – may involve longer review periods due to application volume and deeper supervisory scrutiny. The single greatest cause of delay across all regimes is an incomplete or inconsistent application file.
Which jurisdiction is best for licensing my crypto business?
There is no universally correct answer. The right jurisdiction depends on where your users are, where your banking lives, which asset classes you offer and how your investors define "recognised jurisdiction." El Salvador suits Latin American-focused operators and those comfortable managing correspondent-banking complexity. EU-facing businesses generally need MiCA CASP authorisation. Singapore suits Asia-Pacific operators under the MAS Payment Services Act. We map the full licence, banking and tax stack before advising on jurisdiction selection.
Do I need a separate custody licence?
In most leading regimes, custody of digital assets on behalf of third parties is a separately regulated activity requiring its own authorisation or an express extension of an existing licence. Under the CNAD framework, custody is a defined activity category. Under MiCA, custody and administration of crypto-assets on behalf of clients is a distinct CASP service. Bundling custody with exchange services into a single corporate entity without the correct authorisation is a common and serious compliance error that we regularly identify in structural reviews.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice, and we act only for businesses – meaning our work is never diluted by retail advice or general commercial law. We map the licence, custody and payment layers before you commit to a structure. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in inbound licensing strategy and cross-border VASP registration across Latin America, the Gulf and Asia-Pacific.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.