El Salvador was the first country to recognize Bitcoin as legal tender and to establish a dedicated digital-asset licensing regime under the Bitcoin Law and the subsequent Digital Assets Issuance Law (DAIL). For an inbound exchange operator, that distinction matters because it creates a defined regulatory basis – supervised by the Comisión Nacional de Activos Digitales (CNAD) – rather than the regulatory ambiguity present in many comparable markets. The operative question is not whether a regime exists, but whether your entity, your user base and your banking stack are structured to satisfy it.
Operating a crypto exchange in El Salvador without the appropriate authorisation from CNAD exposes the business to enforcement action, the suspension of local banking relationships and, in a cross-border context, the loss of correspondent-banking confidence in your entire group. The risk is not theoretical. Regulators in the leading digital-asset hubs have made clear that unlicensed activity – even where the operator is domiciled offshore – will be treated as a local breach if users are being served locally. This page sets out the regulated perimeter, the authorisation process for an inbound operator and the cross-border considerations that determine whether El Salvador belongs in your licensing stack.
What Is the Regulated Perimeter for a Crypto Exchange in El Salvador?
Any entity offering exchange, custody, transfer or issuance services related to digital assets to users in El Salvador requires authorisation from CNAD under the Digital Assets Issuance Law and the applicable VASP provisions. The perimeter is activity-based, not entity-based. That means a foreign-incorporated company serving Salvadoran users through a web platform is within scope regardless of where its servers or parent entity sit.
CNAD administers a registration and authorisation regime that covers the full range of digital asset service provider (DASP) activities. These include spot exchange, peer-to-peer brokerage, custody, issuance and transfer services. The Bitcoin Law – which gave Bitcoin the status of legal tender alongside the US dollar – remains the headline framework, but day-to-day supervision of crypto businesses now operates under the DAIL and the CNAD rulebooks that implement it.
In our practice advising inbound operators, the most common structural mistake is treating the Bitcoin Law as the whole of the Salvadoran regime. It is not. The DAIL and CNAD's operational guidance address capital adequacy, AML/CFT obligations, consumer protection and the technical standards that an exchange must meet before it can go live. Operators who plan only for the reputational benefit of the Bitcoin Law designation – without working through the CNAD authorisation requirements – face delays that are measured in months rather than weeks.
For operators who also intend to issue a proprietary token or a stablecoin product, the issuance provisions of the DAIL impose separate disclosure and reserve requirements. Token classification under the Salvadoran regime follows a substance-over-label logic that will be familiar to operators who have worked through MiCA (the EU's Markets in Crypto-Assets Regulation) or the FSRA framework in Abu Dhabi: the rights the token confers, not the name the issuer gives it, determine the regulatory category.
How Does the CNAD Authorisation Process Work for an Inbound Operator?
CNAD authorisation follows a formal application sequence that covers entity registration in El Salvador, the submission of a detailed business plan, AML/CFT policy documentation and a demonstration of fit-and-proper status for key controllers. The process is sequential: deficiencies at any stage pause the clock, so preparation quality is the primary determinant of timeline.
The main steps in the standard authorisation track are:
- Legal entity establishment in El Salvador (or a registered branch of a foreign entity, where permitted under the applicable DASP provisions).
- Appointment of a local compliance officer and, where required, a local director with genuine operational authority.
- Submission of the formal authorisation application to CNAD, including business plan, ownership structure, source-of-funds documentation for capitalization, AML/CFT programme, technology-risk assessment and user-protection disclosures.
- CNAD review, which may include requests for supplemental information; the regulator's standard review window is a matter of weeks from the point at which the file is accepted as complete.
- Conditional authorisation, followed by pre-launch compliance verification (systems audit, wallet controls, cold-storage segregation evidence where custody is included).
- Full authorisation and registry listing.
We regularly advise clients that the entity step is not merely administrative. El Salvador's corporate registry requirements interact with the CNAD authorisation criteria: the entity type, the stated objects and the capitalisation level stated in the articles of incorporation all feed directly into the CNAD file. Getting the corporate instrument wrong at the outset typically means a re-filing and a reset of the CNAD clock.
Operators adding a custody function alongside the exchange activity should expect CNAD to scrutinise wallet architecture separately. The regulator's published standards address key management, segregation of client assets and insurance or bonding arrangements. This is a recurring pain point for operators who build custody on a shared-infrastructure basis: CNAD expects demonstrable separation, not contractual separation on paper.
For a first assessment of whether your current entity and technology architecture can support a CNAD application, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your entity type, the user base you intend to serve and your banking arrangements change the analysis materially.
What Are the AML and Travel Rule Requirements?
El Salvador has aligned its DASP regime with the FATF Recommendations, including Recommendation 15 on virtual assets and the Travel Rule – the obligation to pass originator and beneficiary identifying information with each transfer above the applicable threshold. CNAD-authorised operators are required to implement a full AML/CFT programme as a condition of authorisation and as an ongoing supervisory obligation.
In practice, this means a written AML/CFT policy, a designated Money Laundering Reporting Officer (MLRO), customer due-diligence (CDD) and enhanced due-diligence (EDD) procedures, transaction monitoring, and a Travel Rule technical solution capable of communicating with counterparty VASPs in other jurisdictions. The Travel Rule threshold and de-minimis rules are set by CNAD guidance and are subject to revision; operators should verify the current thresholds against the CNAD rulebook in force at the time of application.
The cross-border dimension is significant. An El Salvador-licensed exchange whose users send assets to counterparty wallets at exchanges in Singapore, the EU or the United Kingdom will need a Travel Rule solution that is interoperable with the data standards used in those jurisdictions. FATF's guidance does not mandate a single technical protocol, so operators must select a solution that covers their likely counterparty footprint. We have seen applications stall because the operator selected a Travel Rule vendor whose coverage did not extend to the operator's primary user corridors.
What Does Bitcoin's Legal Tender Status Mean for an Exchange Operator in Practice?
Bitcoin's legal tender status under the Bitcoin Law means that Salvadoran merchants and service providers are required to accept it for payment, subject to the technological capacity exception, and that the government maintains a conversion facility. For an exchange operator, the practical consequence is that Bitcoin is a permitted settlement asset in domestic commercial transactions, reducing the frictionof denomination that operators face in jurisdictions where crypto remains a purely private instrument.
That said, legal tender status does not remove the licensing obligation. CNAD authorisation is required regardless of whether the operator is dealing exclusively in Bitcoin or in a broader basket of digital assets. The distinction matters for token classification: a Bitcoin-only exchange has a simpler product perimeter than a multi-asset exchange, but both fall within the DASP framework and both must satisfy CNAD's technical and AML standards.
In our cross-border practice, we regularly advise operators who assume that El Salvador's Bitcoin Law creates a permissive environment where normal VASP registration requirements do not apply. That assumption is incorrect. The DAIL and CNAD supervision exist precisely because El Salvador chose to formalise the Bitcoin sector rather than leave it ungoverned. The headline reputational benefit – operating in the world's first Bitcoin legal-tender jurisdiction – is real. But it is conditional on compliance.
How Do Tax and Banking Interact with an El Salvador Exchange Structure?
El Salvador's territorial tax system means that income derived from sources outside El Salvador is generally not subject to Salvadoran income tax. For an exchange whose revenues are predominantly generated by users outside the country, this creates a structuring opportunity that several operators have used to establish their primary booking entity in San Salvador. The qualification is important: the territorial exemption applies to foreign-source income, and CNAD-supervised activity serving local users generates locally sourced revenue that falls within the domestic tax base.
Corporate tax on Salvadoran-source income is levied at a rate set under the applicable tax legislation; we advise on the current rate and its interaction with any applicable treaty network as part of our structuring work, rather than stating a figure here that may be superseded by legislative amendment. Capital gains treatment for digital-asset disposals, and the VAT position on exchange services, similarly require jurisdiction-specific analysis at the time of structuring.
Banking is the more immediate operational challenge for most inbound operators. El Salvador's domestic banking sector maintains a cautious posture toward crypto businesses that is not unique to the jurisdiction: it reflects global correspondent-banking pressure on domestic institutions that hold accounts for VASPs. CNAD authorisation is a necessary but not sufficient condition for opening a functional banking relationship. In practice, operators need to demonstrate to their bank that their AML programme, their transaction monitoring and their user-base profile meet the bank's own risk-appetite standards.
We have seen clients secure CNAD authorisation and then spend a comparable period working through banking onboarding. The resolution typically involves a combination of: selecting a bank with an established VASP practice, pre-engagement with the bank's compliance team before the CNAD application is filed, and structuring the initial product scope to exclude high-risk asset categories that the bank's own policies flag. Banking is a parallel workstream, not a post-authorisation task.
For US-dollar-denominated operations, El Salvador's dollarized economy is an advantage: there is no exchange-rate risk at the domestic level, and US-dollar settlement rails are the standard. For operators running a multi-currency or stablecoin product, the interaction between the domestic banking infrastructure and offshore correspondent banks requires mapping before launch.
If your banking or tax structure needs pressure-testing before you commit to an El Salvador domicile, write to OBOLUS at info@oboluslaw.com. If a prior application stalled or a banking relationship was refused, a second read can surface the structural reason and the route forward.
How Does an El Salvador Licence Fit into a Multi-Jurisdiction Licensing Stack?
An El Salvador CNAD authorisation does not carry passporting rights into other jurisdictions. Unlike the EU's CASP authorisation under MiCA – which allows a firm authorised in one member state to operate across the EU and EEA – an El Salvador authorisation covers El Salvador. Operators serving users in the EU, the UK, Singapore or Hong Kong will need separate authorisation from the relevant regulator in each of those markets, or a structure that confines El Salvador operations to the Salvadoran market.
In our practice, operators typically slot El Salvador into their licensing stack in one of two ways. The first is as a primary domicile for a business whose user base is concentrated in Latin America and whose global operations are conducted through separate licensed entities in the relevant jurisdictions. The second is as a Bitcoin-specific operating entity within a broader multi-jurisdiction structure, taking advantage of the legal-tender framework and the territorial tax position while the main exchange licence sits in a passportable jurisdiction such as an EU member state.
The choice between these approaches turns on four variables: where the users are located, where the banking infrastructure can reliably be established, the operator's long-term product roadmap (Bitcoin-only versus multi-asset), and the capital and compliance cost of maintaining parallel licensed entities. We map this decision matrix for clients before they commit to a structure, because the cost of unwinding an incorrectly assembled stack – regulatory re-applications, corporate restructuring, banking transitions – consistently exceeds the cost of getting it right at the design stage.
Allied counsel in the relevant jurisdiction support our work where local-law sign-off is required for the El Salvador entity step or for parallel filings in the operator's other target markets.
A Representative Engagement
In a recent licensing matter, a payments-focused digital-asset operator approached us after receiving a preliminary rejection from CNAD on the basis of deficiencies in its AML/CFT programme and its custody architecture documentation. The operator had filed without specialist counsel and had submitted a generic compliance policy that did not address CNAD's specific requirements for wallet segregation and Travel Rule technical capacity. We reviewed the rejection, restructured the AML programme to align with the CNAD rulebook and the FATF Recommendation 15 standards, and coordinated a revised custody architecture brief with the operator's technology team. The re-filed application was accepted as complete and the operator received CNAD authorisation in the subsequent review cycle. The banking workstream, which we had initiated in parallel, closed within weeks of the authorisation date.
Which Operator Profile Is Best Suited to an El Salvador Structure?
Not every exchange operator is a natural fit for El Salvador as a primary licensing jurisdiction. The decision depends on the profile of the business.
Profile A – Latin America-focused exchange: An operator whose primary user base is in Central and South America, whose product set includes Bitcoin and a small number of major digital assets, and whose banking needs can be met through a dollarized domestic bank with correspondent reach into the US. This operator benefits most directly from the CNAD regime, the legal-tender framework and the territorial tax position. The licensing timeline is a matter of weeks from a complete file; the key risk is banking onboarding. Recommended instrument: primary CNAD authorisation with allied counsel in any secondary jurisdictions where users are located.
Profile B – Multi-jurisdiction exchange seeking a secondary domicile: An operator already licensed in a passportable jurisdiction (an EU member state, Singapore, Hong Kong) who wants an El Salvador entity to capture the Bitcoin legal-tender commercial opportunity and to hold a booking entity in a low-complexity, dollarized environment. This operator treats the CNAD authorisation as a component of a broader stack. The risk is corporate-governance complexity across multiple licensed entities. Recommended instrument: El Salvador subsidiary with a defined product scope, coordinated compliance programme and a clear intra-group policy on which entity books which activity.
Profile C – Token issuer seeking a disclosure-light environment: This profile frequently misreads El Salvador's framework. The DAIL's issuance provisions impose substantive disclosure and reserve requirements for token issuance. El Salvador is not an unregulated venue for token launches; CNAD supervises issuances, and attempting to use the jurisdiction as a disclosure-avoidance structure creates regulatory risk in every jurisdiction where the token is distributed. We advise against structuring a token issuance on this basis.
Addressing a Common Assumption
A common assumption among operators approaching El Salvador is that the Bitcoin Law itself constitutes a licence, or that operating in a Bitcoin legal-tender jurisdiction carries an implicit regulatory blessing that other jurisdictions are obliged to recognise. Neither is correct.
The Bitcoin Law established Bitcoin as legal tender and created a government-operated conversion wallet. It did not authorise any private entity to operate an exchange or custody service without a separate CNAD authorisation. Operators who launched in El Salvador in the period between the Bitcoin Law and the DAIL without formalising their regulatory status are in a position that CNAD has the mandate and the inclination to address. And no foreign regulator – not the FCA, not ESMA, not MAS – treats a CNAD authorisation as a substitute for its own authorisation requirements. The principle is simple: each jurisdiction licences for its own perimeter.
The related myth – that a single offshore licence is sufficient to serve clients globally – is addressed at length elsewhere in our practice content. The short answer is that it is not, and the operators most exposed to this misunderstanding are those who obtained an early-generation offshore registration and have since expanded their user base into regulated markets without expanding their licence stack.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – our full practice on exchange, custody and VASP authorisation across 70+ jurisdictions.
- EMI licensing for crypto firms in Canada – how the Canadian regulatory framework applies to payment and exchange businesses.
- Token legal classification under heightened scrutiny – how regulators assess whether a token is a security, an e-money instrument or an unregulated asset.
FAQ
How long does a crypto licence take to obtain?
In El Salvador, CNAD's review window runs from the point at which the application is accepted as complete. Timeline varies by the complexity of the business, the quality of the initial submission and whether the regulator raises supplemental requests. A well-prepared application from a single-jurisdiction exchange with a defined product scope typically progresses materially faster than a multi-activity application with a complex ownership structure. We advise clients to treat the corporate preparation and banking onboarding as parallel workstreams that begin before the CNAD file is submitted.
Which jurisdiction is best for licensing my crypto business?
There is no universally correct answer. The best jurisdiction depends on where your users are located, where your banking can reliably be established, what activities you intend to carry on, and your long-term capital and compliance budget. El Salvador suits a Latin America-focused operator or one that wants a Bitcoin-specific booking entity in a dollarized jurisdiction with a territorial tax position. An EU-facing operator typically needs a CASP authorisation under MiCA. We map the full licence, banking and tax stack for each client before they commit to a structure.
Do I need a separate custody licence?
Under the CNAD framework, custody of digital assets on behalf of clients is a regulated activity that must be covered by the operator's authorisation. If your exchange holds client keys – whether in hot, warm or cold storage – the custody function is within scope. Operators who intend to offer both exchange and custody must ensure that their CNAD application addresses both activities and that their technical architecture satisfies the regulator's wallet-segregation and key-management standards. Attempting to package custody inside an exchange authorisation without declaring it as a separate activity is a common error that we have seen lead to post-authorisation compliance notices.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than seventy jurisdictions, on disputes and on-chain asset recovery across more than twenty-five forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – and we have done so for clients across the full range of exchange structures, from single-jurisdiction Bitcoin platforms to multi-asset operators with parallel licensed entities in four or more markets. To discuss your El Salvador structure or your broader licensing strategy, contact info@oboluslaw.com or message us via t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in inbound exchange and VASP authorisation across Latin America and the Middle East digital-asset regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.