EMI licence for crypto firms in El Salvador

A crypto firm expanding into Latin America or seeking a dollar-denominated regulatory home faces a concrete legal question in El Salvador: does the country's electronic money issuer regime apply to digital-asset businesses, and if so, what does authorisation require? El Salvador operates one of the most distinctive regulatory regimes in the world for virtual assets – combining a Bitcoin legal-tender framework with a structured licensing pathway for crypto firms that handle fiat flows, token issuance and cross-border payments. Operators who misread the scope of that regime, or who assume a single offshore registration covers activity directed at El Salvador users, expose their business to enforcement, disrupted banking and interrupted customer rails. This page sets out the applicable regime, the authorisation process, the cross-border interactions that shape structuring decisions, and the decision point at which specialist counsel adds the most value.

What is the regulatory basis for crypto licensing in El Salvador?

El Salvador established its legal basis for digital-asset activity through the Bitcoin Law and the subsequent Digital Assets Issuance Law, which together create a tiered regulatory environment supervised by the Comisión Nacional de Activos Digitales (the CNAD, the National Commission of Digital Assets). The CNAD functions as El Salvador's primary digital-asset regulator, overseeing the registration and authorisation of entities that issue, exchange or transmit digital assets – including Bitcoin and other cryptocurrencies – and entities that issue tokenised instruments or stablecoins backed by real-world assets. Separately, the Banco Central de Reserva (BCR) retains oversight of electronic money issuers under El Salvador's payments law, creating a dual-track structure that directly affects how a crypto firm structures its El Salvador operations.

The intersection of these two tracks is the core compliance question. A firm that moves fiat – particularly US dollars, El Salvador's national currency alongside Bitcoin – through a digital platform may engage both the CNAD digital-asset regime and the BCR electronic money issuer regime simultaneously. In our practice, we regularly advise firms that arrive expecting a single registration and discover that their payment flow model requires authorisation under two regulatory bodies before they can open correspondent banking, hold client funds or issue a product that combines a fiat wallet with a crypto exchange function.

The Digital Assets Issuance Law further introduced a dedicated framework for the issuance of tokenised securities and digital assets backed by commodities or other financial instruments. Firms issuing such instruments require CNAD authorisation as a Digital Asset Service Provider (DASP). This regime carries its own disclosure, reserve and operational requirements – distinct from the Bitcoin Law registration applicable to basic wallet and exchange services.

Who needs regulatory authorisation in El Salvador?

Any business conducting regulated digital-asset activity in or from El Salvador – whether incorporated locally or operating cross-border into the Salvadoran market – must assess whether it falls within the CNAD's or BCR's perimeter before commencing operations. The perimeter covers exchange services (converting fiat to crypto and vice versa), custody of digital assets on behalf of third parties, the issuance of digital assets to the public, payment and transfer services in digital assets, and electronic money issuance tied to a digital account. Mere technology provision, where no client assets are held and no regulated activity is conducted, may fall outside the perimeter – but that analysis turns on the precise product architecture, not on how the business markets itself.

The cross-border dimension is material. A firm incorporated in, say, the British Virgin Islands or the Cayman Islands that actively solicits Salvadoran users, onboards them, and holds their funds is likely conducting regulated activity in El Salvador regardless of its place of incorporation. Regulators increasingly look through the entity wrapper to the substance of activity directed at local residents. We have seen firms conclude that a BVI registration is sufficient to serve Latin American users; that assumption breaks down the moment a local banking relationship, a marketing campaign aimed at El Salvador residents, or a local agent is introduced.

The CNAD's perimeter analysis focuses on the nature of activity and the residence of the counterparties. A firm with no Salvadoran users and no local infrastructure may legitimately operate without Salvadoran authorisation – but that boundary is narrow and fact-specific.

CTA #1

The analysis above describes the standard perimeter. Whether your specific product – particularly one combining fiat payment flows with crypto exchange – sits inside or outside that perimeter depends on the architecture of your service and your user base. To map the CNAD and BCR exposure for your model, contact OBOLUS at info@oboluslaw.com.

What does the authorisation process involve, and how long does it take?

The authorisation pathway for a digital-asset firm in El Salvador runs through the CNAD for DASP registration and, where the firm also issues or manages electronic money, through the BCR for EMI authorisation. The two processes can be run in parallel, but they involve distinct application packages, distinct capital assessments and distinct ongoing supervisory relationships. Neither regulator publishes fixed statutory timelines in the same way as, for example, ESMA or MAS in Singapore under the Payment Services Act – timelines vary by the complexity of the application, the completeness of documentation and the regulator's current workload.

In practice, a complete, well-prepared DASP application with robust AML/CFT documentation, a clear business model narrative, a functioning compliance function and a capitalized local entity progresses meaningfully faster than an application submitted piecemeal. We regularly advise clients that the preparation phase – building the compliance manual, drafting the risk assessment, assembling the beneficial ownership chain and clearing any adverse-media issues – takes as long as or longer than the regulator's formal review. Rushing the submission to start the regulatory clock does not accelerate the outcome; it typically generates a round of information requests that resets the practical timeline.

The key documents in a CNAD DASP application package generally include a certified constitutional document for the applicant entity, evidence of paid-up capital meeting the applicable minimum, a business plan with a detailed description of the proposed activities, an AML/CFT program meeting FATF Recommendation 15 standards, identification and fitness-and-propriety documentation for beneficial owners and directors, and a technology and security description. For an EMI application with the BCR, additional requirements address payment system interoperability, reserve management and client-fund safeguarding.

A micro-matter from our recent practice illustrates the preparation dynamic. In a recent licensing engagement, a payments company seeking to offer a dollar-denominated wallet with integrated crypto conversion mapped its activities across both the CNAD DASP perimeter and the BCR EMI perimeter. We identified that its custody model – where client dollar balances were held on the company's own books rather than segregated – triggered the EMI reserve and safeguarding requirements in addition to the DASP registration. Restructuring the custody architecture before filing saved the company a material round of deficiency notices and shortened the overall authorisation timeline to a fraction of what a post-filing restructure would have required.

How do AML and the Travel Rule apply to El Salvador digital-asset firms?

El Salvador has aligned its digital-asset AML/CFT framework with the standards set by the Financial Action Task Force (FATF), including Recommendation 15, which requires that virtual asset service providers implement controls equivalent to those applicable to financial institutions. The Travel Rule – the obligation to pass originator and beneficiary identification data with qualifying digital-asset transfers – applies to Salvadoran-licensed firms transacting above the applicable threshold, which mirrors the FATF guidance on de-minimis treatment. The precise local de-minimis figure is set by regulation and should be confirmed against current CNAD guidance.

In practice, Travel Rule compliance for a Salvadoran DASP requires integration with a Travel Rule solution capable of exchanging VASP-to-VASP messages, a counterparty VASP vetting process, and a documented policy for handling transfers to or from non-compliant or unhosted wallets. El Salvador's position as a Bitcoin legal-tender jurisdiction adds a layer of operational complexity: peer-to-peer Bitcoin transactions conducted through the government-issued wallet are treated differently from commercial transfers through licensed DASPs. Firms operating both a consumer wallet and a commercial exchange function must map the two flows and apply the appropriate controls to each.

FATF's mutual evaluation process scrutinizes exactly this kind of dual-flow model. Regulators we engage with increasingly expect a documented risk-based approach to wallet classification – not a blanket rule – supported by on-chain analytics and transaction monitoring.

What are the cross-border tax and banking interactions for an El Salvador digital-asset firm?

For a business sitting between El Salvador and an offshore holding structure – whether in the BVI, Cayman Islands or elsewhere – the legal question turns on substance, not label. El Salvador operates a territorial tax system: income derived from sources outside El Salvador is generally not subject to Salvadoran income tax for entities and individuals resident in El Salvador. That characteristic makes it attractive for regional structuring. However, the substance requirements attached to a CNAD or BCR authorisation – a local presence, local directors, local compliance officers – affect the transfer-pricing and permanent-establishment analysis for the wider group, particularly where the El Salvador entity is the licensed operating entity and the offshore parent holds intellectual property or serves as the holding vehicle.

Banking is the practical pressure point for any digital-asset firm, and El Salvador is not exempt from that reality. The majority of Salvadoran commercial banks have historically been cautious about onboarding licensed crypto businesses. Correspondent banking for dollar clearing runs through US banks, which apply their own enhanced due-diligence standards to crypto-related customers – regardless of the Salvadoran regulatory status of the applicant. In our cross-border practice, we regularly see firms obtain a CNAD registration and then discover that the banking infrastructure they assumed would follow does not materialize without a comprehensive banking-package narrative: a clear business-model description, a transaction-flow diagram, AML/CFT documentation, and evidence of the regulatory authorisation itself.

The Bitcoin legal-tender status creates an additional dynamic. El Salvador requires merchants to accept Bitcoin as payment if the customer chooses to pay in it. For a licensed DASP offering a commercial payment product, this creates a settlement design question: does the firm settle in Bitcoin, convert to dollars at the point of sale, or offer both rails? Each model carries different reserve, reporting and consumer-protection implications under the applicable regime.

CTA #2

If your banking relationships stalled after your licence application, or if your correspondent bank is requesting documentation you are unsure how to structure, the issue is almost always a presentation and architecture problem rather than a regulatory disqualification. A second read of your banking package – in light of your actual authorisation status – often surfaces the route forward. Write to us at info@oboluslaw.com or reach us via t.me/oboluslaw.

Which operator profile should choose El Salvador, and which should look elsewhere?

El Salvador's licensing environment suits a specific set of operator profiles. Understanding where it fits – and where it does not – is as important as understanding the process.

Profile A – a Latin America-focused payments and crypto exchange business seeking a regulated base in a dollar-denominated, Bitcoin-positive jurisdiction with territorial taxation. This profile benefits most directly from the Salvadoran regime. The CNAD DASP registration provides regulatory cover for regional operations. The territorial tax treatment keeps the effective tax rate manageable. The challenge is banking infrastructure, which requires dedicated effort.

Profile B – a global exchange seeking a passport-equivalent into Latin American markets. El Salvador does not yet offer the kind of mutual-recognition or passporting mechanism that MiCA provides within the EU under the ESMA framework, or that MAS provides for Payment Services Act licensees in Singapore. Salvadoran authorisation does not give automatic access to other Latin American markets. A firm seeking regional market access should treat El Salvador as one component of a multi-jurisdiction licensing stack, not as a sole gateway.

Profile C – a tokenised-asset issuer seeking a compliant jurisdiction for the public issuance of digital securities or asset-backed tokens. The Digital Assets Issuance Law creates a specific pathway for this activity, with CNAD oversight. This profile may find El Salvador's regime more accommodating than, for example, a full MiCA ART or EMT authorisation in Europe, while still providing a recognised regulated basis for institutional counterparties.

A common assumption among operators is that a single offshore registration – a BVI VASP registration or a Cayman CIMA registration – is sufficient to serve clients across Latin America without separate in-country authorisation. That assumption is incorrect. The BVI VASP Act 2022 and the Cayman Virtual Asset (Service Providers) Act provide a regulated basis for operating from those jurisdictions, but they do not constitute authorisation to conduct regulated activity in El Salvador directed at Salvadoran residents. El Salvador's CNAD has been explicit that in-country regulated activity requires in-country registration.

Self-assessment: do you need to act before you build?

The following questions identify whether a regulatory assessment is urgent for your business.

• Does your product hold, transfer or convert US dollars or Bitcoin on behalf of Salvadoran users?
• Do you have or plan to hire a local agent, office or compliance officer in El Salvador?
• Are you marketing directly to Salvadoran residents through local advertising, influencers or app-store presence?
• Does your product include a fiat wallet function, even if crypto is the primary feature?
• Are you in discussions with a Salvadoran bank or payment processor for settlement infrastructure?
• Is your offshore holding structure reliant on a subsidiary or branch that will hold the CNAD or BCR authorisation?

If the answer to any of these questions is yes, a regulatory scoping assessment should precede any product build or marketing launch. The cost of a pre-build assessment is a fraction of the cost of a post-launch enforcement response or a banking closure.

Related at OBOLUS

• Licensing and registration for digital-asset businesses – how we scope and manage the full licence stack across operating, custody and payment layers.
• EMI licence for crypto firms under MiCA in the European Union – a comparative view of the EU's CASP and EMT authorisation framework under ESMA supervision.
• Staking services: what recent enforcement tells operators – the regulatory treatment of staking rewards and the enforcement signals shaping compliance obligations.

FAQ

How long does a crypto licence take to obtain?

The timeline varies significantly by jurisdiction and application quality. In El Salvador, a CNAD DASP registration for a well-prepared applicant with complete documentation, adequate capital and a functioning compliance program can progress within a matter of months. A parallel BCR EMI application adds time. Applications submitted with incomplete beneficial ownership chains, underdeveloped AML documentation or capital shortfalls generate information requests that extend the process substantially. Preparation quality is the primary variable operators control.

Which jurisdiction is best for licensing my crypto business?

There is no single best jurisdiction. The right choice depends on your target users, your product type, your banking needs and your tax position. El Salvador suits dollar-focused, Latin America-oriented firms with a willingness to invest in local substance. A firm serving EU users should consider MiCA CASP authorisation. A firm seeking Asian market access may look to MAS in Singapore or the SFC in Hong Kong. We assess these axes before recommending a licensing path, not after the entity is incorporated.

Do I need a separate custody licence?

In El Salvador, custody of digital assets on behalf of third parties falls within the CNAD's regulated perimeter and forms part of the DASP authorisation framework. A firm providing custody as a standalone service, or as part of an integrated exchange and wallet product, must ensure its authorisation expressly covers that activity. In other major jurisdictions – including Singapore under the Payment Services Act and Hong Kong under the SFC VASP regime – custody is similarly a regulated activity requiring explicit authorisation. We routinely identify custody as the activity most frequently overlooked in initial licensing scopes.

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice, and we act only for businesses. We map the licence stack across operating, custody and payment layers before you commit – not after a regulator or bank raises the question. To discuss your El Salvador authorisation, your regional licensing stack or a banking challenge, contact us at info@oboluslaw.com.

By Aisha Tan, Licensing and Jurisdictions Analyst – specialising in inbound digital-asset licensing across Latin America, the Gulf and Southeast Asia, with a focus on EMI and VASP regime interactions for cross-border payment and exchange businesses.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.