El Salvador sits in a distinctive position among digital-asset jurisdictions. Since the country's Bitcoin Law (the legislation recognizing Bitcoin as legal tender) came into force, and since the subsequent establishment of the Digital Assets Issuance Law and the oversight role of the Comisión Nacional de Activos Digitales (CNAD, the national digital-asset regulator), operators have had a formal, regulated path for licensing, renewing, and varying their authorizations. For any business already holding a CNAD authorization – or preparing to apply for one – the renewal and variation process is not an administrative afterthought. It is a compliance event with hard consequences if missed.
Letting a licence lapse, or operating under an authorization that no longer reflects the actual scope of business, exposes the entity to enforcement, banking disruption, and potential loss of the legal-tender and tax-treatment benefits that make El Salvador attractive in the first place. The cross-border dimension compounds the risk: a company whose banking relationship runs through a third-country correspondent, or whose custody layer sits in a different jurisdiction, carries a multi-regulatory exposure that a purely domestic renewal calendar will not capture. This page addresses each element of the renewal and variation process, the cross-border interactions that shape it, and the decision points operators typically face at the mid-licence stage.
The CNAD Regime and the Renewal Obligation
Authorizations issued by CNAD are time-limited and activity-specific. The renewal obligation is a positive duty: the licence holder must initiate the process before the authorization expires, not wait for a regulator prompt. Under the applicable regime, CNAD supervises digital-asset service providers, token issuers, and exchange operators operating in or from El Salvador. Failure to renew on time converts an authorized operator into an unlicensed one – with immediate legal consequences for every client contract, every fiat on-ramp, and every banking arrangement dependent on regulatory standing.
The renewal triggers are calendar-based, but the preparatory work is substantive. CNAD expects the renewing entity to demonstrate that its compliance program, AML/CFT controls, and technical infrastructure remain fit for the licensed activity. Regulators in the leading hubs increasingly expect renewal submissions to function as miniature re-authorizations, not administrative form-fills. In our licensing practice, we see operators consistently underestimate the documentation refresh cycle that a credible renewal requires.
For a scoped assessment of your renewal timeline and documentation requirements, contact OBOLUS at info@oboluslaw.com. The renewal process above describes the standard path. Your facts – the entity's current scope, its user base, its banking stack – change the analysis materially.
What Triggers a Variation Application?
A variation application is required whenever the authorized scope no longer matches the business as actually conducted. The most common triggers include adding a new activity (for example, introducing a custody service to an existing exchange authorization), changing the entity's beneficial ownership or control, adding a new token or asset class beyond those originally covered, or materially altering the technical architecture through which a regulated service is delivered.
Operating outside the authorized scope while a variation application is pending is not a safe harbor. CNAD does not treat a submitted application as permission to proceed. The practical answer is to sequence expansion decisions against the variation timeline: plan the product launch or corporate change after authorization is confirmed, not before. In our cross-border practice, we regularly advise operators who have restructured their holding architecture – often for tax or banking reasons in a third jurisdiction – without updating their El Salvador authorization, then discovered that the new structure is no longer consistent with the entity on the licence face.
The variation process requires a fresh set of KYC materials for any new beneficial owner, a revised business plan describing the expanded scope, and – where technical changes are involved – updated technical documentation. If the variation adds a regulated activity that carries its own capital or surety requirements, CNAD will assess those requirements independently of the existing authorization.
How Does the Renewal Process Work, Step by Step?
The renewal process at CNAD follows a defined sequence, and operators who miss the early steps typically arrive at the submission deadline with incomplete documentation. The steps below reflect the standard path; your specific authorization category may add requirements.
Step one: internal compliance audit. Before any regulator interaction, the entity should audit its AML/CFT program against current CNAD expectations, review the Travel Rule (the obligation to pass originator and beneficiary data with a transfer) implementation, and confirm that its technical systems remain consistent with the original authorization. CNAD may request evidence of a recent independent compliance review.
Step two: document compilation. This includes updated corporate documents, current beneficial ownership registers, a refreshed financial position, evidence of ongoing technical capacity, and – if applicable – confirmation that the entity's compliance officer and MLRO remain in post and qualified. Where personnel have changed, the new appointees need to be notified to CNAD and may require separate approval.
Step three: submission and fee payment. The renewal application is submitted to CNAD through the applicable channel, accompanied by the prescribed fee. Timeline from a complete submission to formal renewal confirmation varies by category and CNAD's current processing load; operators should treat the process as taking a matter of weeks at minimum and build that buffer into commercial planning.
Step four: regulator queries. CNAD may issue information requests following submission. Response windows are typically short. Operators who manage queries promptly and completely generally see faster processing. Delays in responding extend the timeline and may, in some categories, require the operator to confirm it has not materially changed its business during the processing period.
Cross-Border Complications: Banking and Tax Interaction
El Salvador's regulatory posture does not exist in isolation from the correspondent banking environment. An operator whose primary banking relationship runs through a US, EU, or regional correspondent bank will find that its banking counterparty has its own expectations about regulatory standing – and that those expectations do not pause during a renewal gap. In our practice, we have seen accounts closed or frozen during periods of licence uncertainty, even where the operator was technically in a renewal process.
The tax dimension adds a further layer. El Salvador's treatment of digital-asset transactions under its applicable tax provisions reflects the Bitcoin Law's legal-tender status for Bitcoin and the tax neutrality it introduced for certain transactions. A variation that changes the scope of business – from exchange-only to exchange-plus-custody, for example – may alter the tax characterization of the entity's revenues. That analysis should run in parallel with the variation application, not after it. Engaging allied counsel in the relevant tax jurisdiction (whether El Salvador domestic counsel or a cross-border structuring adviser) before filing the variation is the lower-risk path.
For operators with a European or Asian user base, there is an additional MiCA question. MiCA (the EU's Markets in Crypto-Assets Regulation, supervised by ESMA and national competent authorities) may apply to an El Salvador-licensed operator if it actively markets to EU residents. The El Salvador CNAD authorization does not substitute for a MiCA CASP authorization. Operators who have been using the El Salvador licence as their primary regulatory anchor while serving European users should assess whether the post-MiCA enforcement environment requires a separate EU authorization.
If a prior application stalled or a banking relationship became strained during a licensing gap, a second read can surface the structural reason and the route back. Write to info@oboluslaw.com.
Who Is Affected by the CNAD Renewal and Variation Requirements?
CNAD's renewal and variation requirements apply to every entity holding a digital-asset authorization under the applicable El Salvador regime – exchanges, custodians, token issuers, payment service providers using digital assets, and any other VASP (virtual asset service provider) category recognized under the framework. Foreign-incorporated entities that have established a presence in El Salvador to benefit from the licensing regime are not exempt; in many cases the ongoing compliance obligation is heavier for them than for domestic entities, because CNAD expects evidence that the foreign parent's group compliance program extends to the El Salvador entity.
A practical self-assessment for the mid-licence period covers four questions. First: is the entity's currently authorized scope still accurate? Second: have any beneficial owners, directors, or compliance officers changed? Third: has the technical architecture changed in a material way? Fourth: has the entity begun serving users in a jurisdiction that requires a separate authorization? If the answer to any of these is yes, a variation filing is needed. If the renewal date is within the coming business quarter, preparation should already be underway.
A Common Assumption: One Licence Is Sufficient
A common assumption among operators expanding from El Salvador is that the CNAD authorization provides a sufficient regulatory basis for serving clients across Latin America, the United States, or Europe. It does not. The CNAD authorization establishes regulatory standing in El Salvador. It does not passport to other jurisdictions. US federal and state requirements – including FinCEN's applicable VASP provisions, state money-transmitter licensing regimes, and the NYDFS BitLicense where New York users are involved – apply independently. MiCA applies for EU-user-facing operations. FATF Recommendation 15 (covering virtual assets and the Travel Rule) creates AML/CFT obligations that each operating jurisdiction enforces under its own legal framework.
The practical consequence: an El Salvador-based operator serving a genuinely international user base needs a licence stack, not a single licence. The CNAD authorization is one layer of that stack – an important one, particularly given El Salvador's favourable tax treatment and the strategic positioning it offers in the region. But it is not the whole answer. Operators who discover this fact after receiving a correspondent-bank query, a regulatory inquiry from a foreign supervisor, or a payment-processor block are managing a crisis. Operators who discover it before expansion can sequence the additional authorizations against their growth plan.
Micro-Matter: Renewal Gap and Banking Disruption
In a recent licensing matter, an exchange operator that had held a CNAD authorization for several years allowed its renewal window to close without filing, relying on informal assurances from a local intermediary that the process was being managed. When the authorization expired, the operator's US-based correspondent bank – which had been monitoring the entity's regulatory status as part of its periodic review – flagged the gap and suspended the account pending evidence of current authorization. We were engaged to manage both the CNAD renewal filing and the banking counterparty communication simultaneously. The renewal was completed, and a formal status letter was provided to the banking counterparty. The account was reinstated, though the disruption to client settlements ran for several weeks. The episode illustrated a consistent pattern we have seen: renewal failures rarely remain purely regulatory – they propagate into banking and operational risk within days.
Decision Matrix: Renewal and Variation Profiles
Different operator profiles present different renewal and variation risks. Profile A is the single-jurisdiction El Salvador exchange with a domestic user base and a regional banking relationship. The renewal is calendar-driven, the documentation refresh is moderate, and the cross-border risk is limited. The main risk is operational inattention – missing the renewal window while management is focused elsewhere.
Profile B is the El Salvador-licensed exchange with an EU-facing or US-facing user base, a foreign holding company, and banking through a third-country correspondent. The renewal involves CNAD, but the variation risk is higher: any change in the holding structure, any new regulated activity, or any EU-product development may require parallel action in a second or third jurisdiction. Timeline and resource requirements are materially greater. Allied counsel in the relevant jurisdiction is a precondition, not an optional resource.
Profile C is the token-issuer entity that obtained an El Salvador authorization at launch but has since expanded its product, changed its tokenomics, or brought in new investors who now hold controlling positions. The variation obligation is likely triggered on multiple grounds – new beneficial owners, new token characteristics, potentially new regulated activities. A variation application here is more detailed than the original authorization and should be treated as a re-authorization event from a documentation and legal preparation standpoint.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – the full OBOLUS licensing practice across 70+ jurisdictions
- Licence Renewal and Variation in Australia – AUSTRAC – the Australian AUSTRAC registration renewal and variation process
- MLRO and Compliance Officer Function in Seychelles – compliance officer obligations in an offshore VASP jurisdiction
FAQ
How long does a crypto licence take to obtain?
Processing timelines vary by jurisdiction and licence category. In El Salvador under the CNAD regime, a complete application submission is typically processed within a matter of weeks, though CNAD may issue information requests that extend that window. Applications with missing documentation, pending beneficial-owner approvals, or complex corporate structures take longer. Build a conservative timeline buffer into any product or commercial launch plan that is dependent on authorization.
Which jurisdiction is best for licensing my crypto business?
There is no single answer. The right jurisdiction depends on where the business is operated, where users are located, where banking sits, and what activities are being conducted. El Salvador offers regional positioning and a defined digital-asset regulatory regime. EU operators serving European users require a MiCA CASP authorization. Businesses with US exposure face a distinct federal and state framework. In our practice, we map the licence, banking, and tax stack for each client before recommending a primary authorization jurisdiction.
Do I need a separate custody licence?
In most flagship jurisdictions, custody of digital assets is a regulated activity distinct from exchange or brokerage. Under the CNAD regime in El Salvador, custody services carried out as a separate line of business from exchange typically require authorization in that capacity. Adding custody to an existing exchange authorization is a variation event. Operators who provide wallet services or hold client keys – even informally – should assess whether that activity falls within a regulated custody category before proceeding.
About OBOLUS. OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers, and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking, and compliance that sit around them. Digital assets are the entirety of our practice. We map the licence stack across operating, custody, and payment layers before you commit – not after a regulator or a correspondent bank flags the gap. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in digital-asset authorizations, renewal and variation processes, and multi-jurisdictional licence stacking for inbound operators across emerging and established digital-asset hubs.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.