Operating a licensed virtual asset service provider from El Salvador without demonstrable economic substance is a structural risk that regulators, correspondent banks and tax authorities in the major financial hubs are increasingly willing to test. El Salvador's Bitcoin Law (the 2021 statute that made Bitcoin legal tender) and the Digital Assets Issuance Law (Ley de Emisión de Activos Digitales) together establish a formal authorisation regime for VASPs (virtual asset service providers) supervised by the Banco Central de Reservas (BCR) and, for registered digital-asset issuers, the Comisión Nacional de Activos Digitales (CNAD). Obtaining a licence is only the first step. Demonstrating that your El Salvador entity is the genuine seat of management and control – not a brass-plate holding the licence while operations run elsewhere – is what determines whether that authorisation survives scrutiny.
This page sets out what economic substance means for a licensed VASP in El Salvador, how the BCR and CNAD approach it in practice, how it interacts with cross-border tax and banking obligations, and where the structural decisions lie for an inbound operator building for the region.
What Does Economic Substance Mean for a Licensed VASP in El Salvador?
Economic substance, in the VASP context, means that the licensed entity in El Salvador conducts genuine management and operational activity from El Salvador – not merely holds a regulatory authorisation while decisions and personnel sit in another jurisdiction. The concept draws on the FATF Recommendation 15 framework (which requires effective supervision of VASPs in the jurisdiction of registration) and aligns with international tax standards that scrutinise entities in jurisdictions viewed as low-tax or tax-neutral. El Salvador operates a territorial tax system: income sourced outside the country is generally not subject to local income tax. That feature attracts structuring interest – but it also raises the stakes on substance, because overseas tax authorities and banking partners apply heightened scrutiny to structures that rely on a territorial regime.
In our practice, we see operators underestimate this dynamic. The licence is visible; the substance underneath it is what determines whether it functions. A BCR-registered VASP that cannot demonstrate local staff, local decision-making or a local compliance function is exposed on at least three fronts: regulatory review by the BCR or CNAD, denial of banking facilities by correspondent banks applying their own FATF-aligned due diligence, and challenge by the operator's home-jurisdiction tax authority asserting that effective management remains onshore.
What Is the Regulatory Regime Governing Licensed VASPs?
El Salvador's Digital Assets Issuance Law established the CNAD as the supervisory authority for entities issuing or intermediating digital assets in El Salvador. The BCR retains a broader monetary and financial-stability oversight role. Together, these bodies set the authorisation conditions and the ongoing compliance expectations that a licensed VASP must satisfy.
The registration and licensing tracks differ by activity. A VASP providing exchange, transfer or custody services to El Salvador-resident users, or using El Salvador as an issuing jurisdiction for a token distributed internationally, faces distinct registration obligations. The FATF Travel Rule (the obligation to pass originator and beneficiary identifying information with a virtual asset transfer) applies to licensed VASPs, and the BCR has incorporated FATF-aligned AML/CFT requirements into its supervisory expectations.
What the regime does not do – and this matters for structure planning – is specify in statute a precise minimum headcount or local-payroll figure for substance. The BCR and CNAD assess substance qualitatively, much as regulators in Singapore, the ADGM and Malta do. The operative question is whether the entity in El Salvador is genuinely directing and controlling the business from that territory. Relevant indicators include the location of senior management, the location of compliance and AML officers, the existence of a physical office (not merely a registered address), and whether material decisions – risk approvals, product launches, counterparty onboarding – are documented as being made in El Salvador.
For a scoped assessment of your El Salvador licensing structure, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. Map your options.
Who Needs Substance, and Which Operator Profiles Are Most at Risk?
Not every VASP licensed in El Salvador faces identical substance pressure – the risk profile scales with the cross-border reach of the business and the character of the licence holder's broader tax and regulatory situation.
A regional operator running an exchange genuinely serving Central American users, with local staff and a local compliance function, will satisfy both the BCR's supervisory expectations and the correspondent bank's due diligence requirements with relatively modest documentation. The substance question is largely factual: if the business is actually run from El Salvador, demonstrating that is a compliance exercise, not a structural redesign.
A global operator using El Salvador as the licensing jurisdiction for an exchange or token issuer whose primary user base and management sit in Europe, the Gulf or Asia faces a materially different risk. That operator needs to be able to show – to the BCR, to its banking partners and to any foreign tax authority that looks behind the structure – that the El Salvador entity holds genuine decision-making authority and operational capacity. A single nominated local director who attends no board meetings and signs documents on instruction from a parent in another jurisdiction does not meet that standard. We regularly advise operators on how to build substance that is real, not cosmetic, and on how to document it contemporaneously.
A token issuer using El Salvador's CNAD registration to issue tokens into international markets has a compounded exposure: in addition to BCR/CNAD substance, it must consider whether the token constitutes a regulated instrument in the jurisdictions where it is marketed – a question that sits entirely outside El Salvador's authorisation framework and that the CNAD authorisation does not answer.
How Does Substance Interact With El Salvador's Territorial Tax System?
El Salvador's territorial system exempts foreign-source income from local income tax. That is a genuine structural advantage for a VASP whose revenue largely derives from users and transactions outside El Salvador. However, the benefit is contingent on the structure being respected by other jurisdictions.
A VASP entity licensed in El Salvador whose management and control is actually exercised from, say, a European country faces the risk that European tax authorities characterise the entity as tax-resident in their jurisdiction under effective-management-and-control rules. If that characterisation succeeds, the anticipated tax neutrality of the El Salvador structure evaporates – and the operator is left with the compliance cost of maintaining a foreign entity without the tax benefit that justified the structure. This is not a hypothetical: in our cross-border practice, we see this pattern arise particularly where founders or senior technical staff remain physically located in a high-tax jurisdiction while the nominal registration is elsewhere.
The interaction with VAT (or its functional equivalent) and withholding taxes on payments between the El Salvador entity and related parties in other jurisdictions adds further complexity. Transfer-pricing expectations apply where there is an intragroup arrangement – services rendered by the El Salvador entity to a parent, or intellectual property licensed from a group entity. These obligations require careful planning before the structure is fixed, not after the first audit query arrives.
What Are the Banking Realities for a Licensed El Salvador VASP?
Banking is the acute pressure point for VASPs licensed in smaller jurisdictions, and El Salvador is no exception. A BCR or CNAD authorisation does not in itself provide access to correspondent banking. Global correspondent banks make independent judgments about whether a VASP relationship creates acceptable compliance risk. Those judgments turn on the same substance questions that regulators ask.
Banks applying FATF-aligned due diligence will look at the location of the VASP's beneficial owners, the quality of its AML programme, whether its compliance function is credentialed and locally present, and whether the BCR or CNAD exercise effective ongoing supervision. A licence from a jurisdiction with a young regulatory regime – and El Salvador's digital-asset framework is recent – will be scrutinised more carefully than one from Singapore's MAS, the ADGM's FSRA or the FCA. That does not make the El Salvador licence unworkable for banking purposes; it means the operator needs to arrive at the banking relationship with a substance package that pre-answers the bank's due diligence questions.
In practice, this means operators often need to run banking across multiple institutions and jurisdictions. A primary account with a crypto-friendly institution in one jurisdiction, supplemented by payment processing relationships elsewhere, is a common architecture. The El Salvador entity then sits as the licensed operating entity with documented substance, while banking is distributed across a small number of permitted jurisdictions. We structure these arrangements to ensure that the banking profile does not create its own substance or tax problem in the jurisdiction where the account is held.
If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back. OBOLUS maps the licence, banking and tax stack as a single mandate. Map your options.
How Do You Build Genuine Substance? Practical Steps for Inbound Operators
Building substance in El Salvador is primarily an operational and governance exercise, not a legal fiction. The following steps reflect what the BCR, correspondent banks and foreign tax authorities collectively look for.
Locally present senior management. At least one senior officer – a CEO, COO or Chief Compliance Officer – should be physically based in El Salvador and engaged substantively in the business. A nominee director arrangement, without real authority and real presence, does not meet the standard that either the BCR or a diligent correspondent bank will accept.
A functioning compliance and AML infrastructure. The FATF-aligned expectations embedded in the BCR's framework require a credentialed AML officer, documented policies, transaction monitoring, and a Travel Rule compliance programme. These should be operated by staff in El Salvador, not outsourced entirely to a group function sitting abroad.
Board and management decisions documented in El Salvador. Where the licensed entity is the decision-making entity for the VASP business, board minutes and management decisions should reflect meetings held – physically or demonstrably – by people present in the jurisdiction. The paper trail matters: it is the contemporaneous evidence that both regulators and tax authorities will seek.
A genuine physical office. A registered address with a mail-forwarding service is not a physical office. A staffed office with lease documentation, utilities and a visible operational footprint is. The distinction is relevant not only to the BCR's supervision but to the commercial-substance analysis applied by banks.
Local service provider relationships. Legal, audit and accounting relationships with El Salvador-based providers are evidence of genuine local operational engagement. They also create an independent record of the entity's in-country activity.
In a recent registration matter, a payments company seeking to establish a licensed VASP operation in Central America had structured its entity with a sole foreign director and no local staff. We advised on a restructuring that introduced local management, a credentialed compliance function and documented governance – and the entity subsequently obtained its BCR registration and successfully passed correspondent bank due diligence. The substance build added several weeks to the timeline but prevented the structural exposure that would otherwise have materialized at the first regulatory review.
Which Operator Profile Should Choose El Salvador – and When?
El Salvador makes structural sense for certain operator profiles. It does not make sense for all of them. The decision turns on four axes: the geographic reach of the user base, the tax posture of the founders and controlling shareholders, the availability of banking for the VASP's business model, and the readiness of the management team to build genuine local substance.
Profile A – Regional exchange, Central American focus. A VASP serving users in El Salvador and neighbouring jurisdictions, with local management and a local compliance function, is the profile the licensing regime was designed for. The BCR and CNAD framework is proportionate. Banking is achievable with a well-documented substance package. The tax position under the territorial system is straightforward. This profile should proceed with El Salvador as the primary licensed entity and should expect a timeline that varies by category and caseload at the regulator – typically a matter of weeks to a few months depending on application completeness.
Profile B – Global token issuer, using El Salvador as issuing jurisdiction. This profile works where genuine management and control is established in El Salvador and where the token's distribution in other jurisdictions is separately managed through appropriate regulatory arrangements in those jurisdictions. The El Salvador authorisation is not a substitute for compliance in the markets where users actually sit. If the founders remain outside El Salvador and token marketing is directed at regulated markets in Europe or Asia, the structure will face pressure from at least two directions – the BCR on substance and the European or Asian regulator on marketing without local authorisation.
Profile C – Holding company or group licensing hub, substance light. This profile carries the highest risk. A licensed El Salvador entity that holds an authorisation but whose management, staff and operations all sit elsewhere will face challenge from the BCR on its supervision obligation, from banks on due diligence, and from foreign tax authorities on effective management and control. We do not advise building on this basis; it is the profile most likely to result in enforcement, lost banking and structural unwinding.
Profile D – Genuine regional business with cross-border payments and custody. A VASP that operates exchange, custody and payments services for a defined user base in Latin America, with management in El Salvador and a cross-border banking arrangement managed across the region, is a viable structure. The licensing stack needs to cover each regulated activity – exchange, custody and payments may each require separate authorisation – and the banking architecture needs to be mapped before the business launches, not after the first account is declined.
We map the licence stack across operating, custody and payment layers before you commit. That planning work is what prevents the costly restructuring that operators who build without it routinely face.
Related at OBOLUS
- VASP licensing and registration across jurisdictions – the full licensing regime map for digital-asset businesses across 70+ jurisdictions
- VASP licensing in Poland – EU MiCA-aligned CASP authorisation for operators seeking an EU passport
- Alternative investment funds for digital assets in the Cayman Islands – fund structuring for digital-asset strategies under the Cayman CIMA regime
A Common Assumption That Creates Structural Risk
A common assumption among operators approaching El Salvador – or any single offshore jurisdiction – is that a single licence is sufficient to serve clients globally. It is not. An El Salvador BCR or CNAD authorisation governs what the licensed entity may do within the scope of El Salvador's regulatory regime. It does not authorise the provision of services to users in jurisdictions that apply their own VASP, CASP or equivalent licensing requirements – and most leading digital-asset markets now do.
Under the MiCA regime, a CASP authorised in an EU member state may passport its services across the EU/EEA. A non-EU entity – including one licensed in El Salvador – has no equivalent passport into the EU. If users in EU member states access the El Salvador VASP's services, and those services fall within the scope of MiCA, the operator needs separate authorisation in the EU or must geo-restrict access. The same logic applies in Singapore under the MAS Payment Services Act, in Hong Kong under the SFC's VASP licensing regime, and in the UK under the FCA's rules. An El Salvador licence combined with a geo-restricted service policy and an orderly approach to each jurisdiction where users actually sit is a workable structure. An El Salvador licence treated as a global pass is not.
We have seen businesses build on the single-licence assumption and then face the full cost of multi-jurisdictional remediation – amended structures, additional licences, regulatory notifications and, in some cases, user-base restrictions – after launch. The cost of pre-launch planning is a fraction of the cost of post-launch repair.
FAQ
How long does a crypto licence take to obtain?
The timeline for a VASP or digital-asset licence varies significantly by jurisdiction and by the completeness of the application. In El Salvador, the BCR and CNAD process applications on a case-by-case basis; a well-prepared application with complete documentation and a credentialed compliance function will progress materially faster than an incomplete one. Across jurisdictions we advise on, timelines range from a matter of weeks in some registration-based regimes to several months or longer in full-authorisation regimes. Substance readiness – having local management, AML infrastructure and governance in place before filing – is the single greatest factor in compressing the timeline.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The optimal jurisdiction depends on where your users sit, where your management and shareholders are based, what regulated activities your business model requires, and what banking you need to support the operation. El Salvador suits a regional business with genuine Central American operations and management. For EU market access, a MiCA CASP authorisation in an EU member state is necessary. For Asia-Pacific clients, MAS, SFC or FINMA may be the relevant starting point. We map these variables before recommending a structure, rather than defaulting to a single answer.
Do I need a separate custody licence?
In most leading regulatory regimes, custody of virtual assets is a separately regulated activity. El Salvador's digital-asset framework treats custody as a distinct service category, as do VARA in Dubai, MiCA in the EU, and MAS in Singapore. An operator that holds client assets – even incidentally, as part of an exchange or payments service – will generally need to satisfy the custody requirements of its licensed regime in addition to the primary activity licence. The precise scope of the custody obligation depends on the activity model and the jurisdiction, and we assess this as part of every licensing engagement.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We structure licensing, banking and tax as one mandate rather than three disconnected workstreams – because that is how the risk actually presents. To discuss your El Salvador structure or your wider licensing stack, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP authorisation strategy, economic substance planning and cross-border licence stack design for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.