El Salvador stands apart from every other sovereign when it comes to digital assets. The country's recognition of Bitcoin as legal tender – codified in the Bitcoin Law (Ley Bitcoin) enacted in 2021 – transformed it into the only jurisdiction where a staking service (a business that validates proof-of-stake transactions and distributes rewards to depositors) operates inside a legal environment that explicitly treats at least one crypto-asset as sovereign currency. For a business considering whether to establish, passport or white-label a staking product in Central America, that distinction changes the legal calculus at every level: licensing, tax, banking and cross-border structure. This guide walks through each step of that calculus, from the regulated perimeter to the decision point.
What Is the Regulated Perimeter for Staking in El Salvador?
Staking services in El Salvador operate at the intersection of the Bitcoin Law, the Digital Asset Issuance Law (Ley de Emisión de Activos Digitales) enacted in 2023, and general financial-services supervision by the Comisión Nacional de Activos Digitales (CNAD) – the dedicated digital-asset regulator established under that 2023 framework. The CNAD supervises the issuance, custody, and service provision related to digital assets beyond Bitcoin, and a staking service that holds or manages third-party assets for reward is likely to fall within its supervisory perimeter. Bitcoin itself sits in a separate legal compartment: because it is legal tender, services that deal exclusively in Bitcoin-layer validation may not require a CNAD licence in the same way, but that carve-out is narrow and does not extend to liquid staking tokens, wrapped representations or reward-bearing instruments built on top of it.
The practical implication is that a staking business must determine, at the outset, which assets it intends to support. A protocol limited to Bitcoin-denominated reward aggregation sits in one regulatory lane. A protocol supporting proof-of-stake assets – ETH, SOL, ADA or any other token – sits in another, and the CNAD's oversight of digital-asset service providers applies in full. The CNAD is the primary licensing authority for digital-asset service businesses that manage, hold or operate on behalf of third parties in El Salvador. Any business that pools user stakes, issues a receipt token or distributes programmatic rewards without clarity on this distinction exposes itself to operating without authorisation.
Classification of the staking instrument itself is a second and equally important question. A receipt token – sometimes called a liquid staking token (an on-chain representation of staked assets, often tradeable) – may carry features that resemble a profit-participation right. Under the Digital Asset Issuance Law, assets with investment-return characteristics attract disclosure and registration requirements. The rule in our DeFi and tokenisation practice is consistent: classification turns on the substance of the rights the token confers, not on what the whitepaper calls it. A utility label does not settle the legal classification. That is the single most common misunderstanding we encounter from operators entering this market.
How Does a Business Register a Staking Service with the CNAD?
Registration with the CNAD follows a structured process that broadly parallels the digital-asset service-provider frameworks now standard across the leading hubs, though El Salvador's regime retains features specific to its Bitcoin Law architecture. The steps below reflect the current regulatory design; specific timelines and capital thresholds are set by the CNAD in its operative rules and should be confirmed against current published guidance before any application is filed.
Step one: entity establishment. The applicant must have a legal presence in El Salvador. Foreign companies generally establish a local subsidiary or branch. The local entity must be properly constituted under Salvadoran commercial law before the CNAD application proceeds. El Salvador does not presently operate a free-zone structure equivalent to ADGM or the DIFC, so the operating entity sits in the general commercial environment, subject to general corporate law alongside the CNAD's specific requirements.
Step two: classification analysis and product scoping. Before filing, the business must document which assets the staking service supports, how rewards are calculated and distributed, whether a receipt token is issued, and how custody is managed. This documentation forms the foundation of the regulatory submission. Where a receipt token is issued, the CNAD will assess whether it falls under the Digital Asset Issuance Law's registration pathway. Operators we advise at this stage invariably find that a pre-submission meeting with the CNAD – essentially a no-names regulatory dialogue – saves material time later. El Salvador's regulator has signalled openness to inbound digital-asset businesses; that posture is commercially important but does not substitute for a complete application.
Step three: AML/CFT programme and Travel Rule readiness. El Salvador follows FATF Recommendation 15 on virtual assets, and CNAD-registered service providers must maintain a compliant AML/CFT programme. The Travel Rule (the obligation to pass originator and beneficiary data with a transfer above the applicable threshold) applies to qualifying transfers. For a staking protocol that receives deposits and distributes rewards, the Travel Rule creates a data-management obligation at the point of inbound stake and outbound reward settlement. Non-custodial protocols that have no intermediary role may fall outside the strict definition of a VASP (virtual asset service provider) under the FATF standard, but that analysis must be performed asset by asset and function by function – not assumed globally.
Step four: submission, review and authorisation. The CNAD reviews the application, may request additional documentation, and issues an authorisation. The timeline from submission to decision varies. Based on the design of comparable frameworks and the CNAD's stated intent to be a responsive regulator, the review period can span a matter of weeks for straightforward applications and longer for complex structures. Operators should plan for a minimum of several months from entity incorporation to active service launch. Rushed timelines that treat the CNAD review as a formality create the greatest licensing risk.
Step five: ongoing compliance. Post-authorisation, the CNAD imposes periodic reporting, change-notification and audit requirements. Any material change to the staking product – adding a new asset, introducing a receipt token, modifying the reward mechanism – is likely to require prior notification or re-approval. Operators we advise structure their product roadmaps to build that lead time into the release cycle from the outset.
We regularly advise clients entering markets at the CNAD-registration stage that the product documentation prepared for the regulator – classification analysis, custody architecture, AML programme – serves a second function: it becomes the due-diligence anchor for the institutional banking relationship that every staking business needs.
For a scoped assessment of your staking product's CNAD registration pathway, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the asset mix, the receipt-token design, the user base geography – change the analysis materially.
How Is a Staking Receipt Token Classified Under El Salvador Law?
A staking receipt token issued in El Salvador is assessed against the Digital Asset Issuance Law's classification criteria, not against a label chosen by the issuer. The law distinguishes between digital assets that represent a claim to a return or profit and those that represent access to a utility or service. That distinction maps imprecisely onto the FINMA payment/utility/asset taxonomy and the MiCA ART/EMT/"other crypto-asset" categorisation, but the underlying logic is consistent across all three regimes: substance over form governs classification.
For a liquid staking token – one that is tradeable and carries a programmatic entitlement to staking rewards – the risk of classification as a regulated investment instrument is real. The indicators that push a receipt token toward investment-instrument status include: (i) a fixed or algorithmically determined yield marketed to depositors; (ii) secondary-market trading on a CNAD-authorised exchange; (iii) use of the token as collateral in a lending or borrowing protocol. Each indicator, on its own, does not determine the outcome. Together, they create a pattern that the CNAD and, in a litigation context, a Salvadoran court would weigh cumulatively.
The cross-border dimension here is acute. A staking service that issues receipt tokens to users in the United States must independently assess whether those tokens constitute securities under SEC or CFTC doctrine. A service issuing to EU users must assess MiCA's ART or EMT categories. The El Salvador authorisation, on its own, does not confer passportable recognition in any other jurisdiction. That is not a defect specific to El Salvador – no jurisdiction currently operates a globally recognised staking-service passport. It is a structural feature of the current multi-jurisdictional digital-asset environment, and any operator building a staking product for cross-border users must layer the classification analysis for each target market.
What Are the Tax and Banking Implications for Cross-Border Staking Operations?
El Salvador's tax treatment of digital assets has evolved alongside its Bitcoin Law architecture. The country does not currently levy capital-gains tax on Bitcoin gains for individuals, and the government has signalled a broadly favorable posture toward digital-asset businesses. For a corporate staking service, however, the tax position requires more granular analysis: corporate income, withholding on reward distributions, and VAT treatment of service fees are each assessed under Salvadoran fiscal rules, and the applicable treatment for staking rewards – whether classified as income at receipt or only on disposal – should be confirmed with local tax counsel before launch.
Banking access is a consistent pressure point for staking services in every jurisdiction, and El Salvador is not an exception. While the Bitcoin Law required Salvadoran businesses to accept Bitcoin, it did not compel the banking sector to extend USD correspondent relationships to all digital-asset businesses. In our cross-border practice, we regularly see staking operators structure a Salvadoran operating entity alongside a separate banking entity in a jurisdiction with stronger correspondent-banking relationships – frequently the Cayman Islands, BVI or a licensed EU entity – to manage the USD settlement leg of the business cleanly. The Salvadoran entity holds the CNAD authorisation and conducts the regulated activity; the treasury function lives elsewhere. This bifurcated structure requires careful transfer-pricing documentation and is subject to El Salvador's own substance and permanent-establishment rules, but it is a commercially workable model.
For staking protocols that denominate rewards in a stablecoin – most commonly USDT or USDC – the issuer-level freeze authority of Tether and Circle is a material operational risk factor. Both issuers maintain the contractual and technical ability to freeze balances on their respective chains. A staking platform that holds user stablecoin balances may find those balances inaccessible if the issuer acts on a law-enforcement request, an OFAC designation or its own compliance protocol. Operators should ensure their terms of service, custody architecture and reserve management plans account for this risk explicitly. It is not a theoretical concern: in our practice we have seen freeze events disrupt stablecoin-denominated yield products with no advance notice.
How Do DAO Structures and Smart Contracts Interact with El Salvador's Regime?
A DAO (decentralised autonomous organisation) operating a staking protocol in El Salvador cannot, under current law, simply point to its on-chain governance structure and claim exemption from CNAD supervision. The regulatory question is functional: does the protocol manage, hold or operate on behalf of third parties? If yes, the CNAD's perimeter analysis applies regardless of the governance model. El Salvador has not enacted specific DAO-recognition legislation of the type currently being developed in certain US states or considered under AIFC governance reform in Kazakhstan. A DAO that wants a defensible legal wrapper in El Salvador must therefore use a conventional corporate form – most typically a sociedad anónima (S.A.) or a branch of a foreign entity – and assign the CNAD-regulated activity to that entity.
Smart contracts that automate the staking and reward-distribution logic are not themselves a separate legal subject under El Salvador law. Liability for a smart-contract failure defaults to the parties responsible for the contract's deployment and operation – typically the founders or the corporate entity that published the code. A common assumption in early-stage DeFi projects is that deploying immutable code removes operator liability. It does not. The CNAD, and any court applying Salvadoran law, would look through the technology to identify the responsible party. If the contract has an upgrade mechanism, or if a multisig controls the treasury, the operator is identifiable and remains accountable for the regulated outcome.
In our DeFi and smart-contract practice, the governance architecture of a staking protocol is one of the first documents we review. The distribution of signing keys, the upgrade pathway, the oracle dependencies and the emergency-pause logic all have legal significance that far exceeds their technical footprint. Getting this architecture documented correctly before launch is materially cheaper than resolving a regulatory enforcement action or a user-loss dispute after launch.
How This Plays Out in Practice: An Illustrative Matter
In a recent engagement, a blockchain infrastructure company sought to launch a multi-asset liquid staking service targeting Central and South American institutional depositors. The founders had structured the product offshore and assumed that their El Salvador operating presence, combined with a utility characterisation of their receipt token, was sufficient to begin onboarding users. In our review, we identified three problems: the receipt token carried yield characteristics that crossed the Digital Asset Issuance Law threshold; the AML programme had not been calibrated for the Travel Rule's data obligations on reward settlements; and the DAO governance layer lacked a legal entity capable of holding the CNAD authorisation. We restructured the product wrapper, revised the token architecture to segregate the utility function from the yield entitlement into separate instruments, and prepared the CNAD pre-submission package. The client entered the formal registration process on a defensible basis and avoided the cost – and reputational damage – of a post-launch enforcement inquiry.
Which Operator Profile Should Build in El Salvador?
El Salvador is not the right primary domicile for every staking business. The decision turns on the operator's asset mix, user geography, institutional banking requirements and appetite for regulatory novelty. The following profiles guide the analysis.
Profile A – Bitcoin-native validator or custody service. For an operator whose product is limited to Bitcoin-layer or Lightning Network services, El Salvador's Bitcoin Law creates genuine competitive advantages: legal-tender status, a proactive regulatory posture, and a jurisdiction that has publicly committed to digital-asset business development. The CNAD authorisation process is proportionate for this use case. The residual cross-border risk is the US nexus: any US-person user base reintroduces federal compliance requirements regardless of the Salvadoran authorisation.
Profile B – Multi-asset proof-of-stake staking platform. For an operator supporting ETH, SOL or a broad basket of PoS assets, El Salvador provides a workable licensing pathway but not a passportable one. The operator will need parallel regulatory engagement in every market where it actively solicits users. A Salvadoran CNAD authorisation is a credible anchor for the Central American and parts of the South American market; it does not substitute for a MiCA CASP authorisation for the EU, an SFC approval for Hong Kong or an MAS DPT licence for Singapore. The bifurcated banking structure described above is almost certainly necessary.
Profile C – DeFi protocol issuing a liquid staking token. This is the most structurally complex profile. The liquid staking token requires classification analysis under the Digital Asset Issuance Law. The DAO governance layer requires a Salvadoran legal wrapper. The cross-border token distribution requires a jurisdiction-by-jurisdiction securities law analysis. El Salvador can be one component of a multi-hub structure – particularly if the protocol is seeking a Central American regulatory anchor – but it is unlikely to be the sole domicile for an operator targeting global institutional users.
If a prior structure stalled or a classification question is unresolved, a second read of the architecture often surfaces the route forward. Write to OBOLUS at info@oboluslaw.com to scope a review.
A Common Assumption: Does a Utility Label on the Whitepaper Settle Classification?
A common assumption among operators launching staking products is that labelling a receipt token as a "utility token" in the whitepaper insulates the product from investment-instrument regulation. It does not – in El Salvador, the EU, Singapore or anywhere else that applies a substance-over-form standard. Regulators assess the rights the token actually confers: does it generate a return? Is it tradeable? Does the holder bear economic risk linked to the performance of an underlying pool? If the answers are yes, the utility label is irrelevant. We assess classification against the substance of rights, not the marketing label. That discipline is not optional; it is the threshold question that determines whether a product launch is a routine commercial event or an unregistered securities offering.
The objection we hear most often is: "But the token gives access to the protocol – that is a utility." Access and yield are not mutually exclusive. A token can unlock protocol usage and entitle the holder to proportionate rewards. When it does both, it is assessed on both dimensions. The classification path in that scenario is not binary; it may lead to a hybrid instrument with dual obligations – one set under the CNAD's digital-asset service-provider regime and another under the Digital Asset Issuance Law's disclosure pathway. Neither obligation disappears because the other exists.
Related at OBOLUS
- DeFi, Tokenization & Smart-Contract Law – legal counsel on DeFi protocol structure, token classification and smart-contract liability
- Staking service legal framework in South Korea – comparative analysis of the South Korean regulatory approach to staking services
- Exchange disclosure orders in Abu Dhabi Global Market (ADGM) – on-chain tracing and DIFC-adjacent disclosure relief for digital-asset disputes
FAQ
Can a DeFi protocol be regulated?
Yes. Regulators in El Salvador and across the leading hubs assess DeFi protocols on function, not form. A protocol that manages, holds or operates digital assets on behalf of third parties – regardless of how automated or decentralised its governance is – will typically fall within the supervisory perimeter of the applicable regime. In El Salvador, the CNAD applies this functional test. A DAO governance layer does not, on its own, remove regulatory obligations; a legal entity that holds the authorisation is still required.
What legal wrapper suits a DAO?
In El Salvador, a DAO operating a regulated digital-asset service requires a conventional legal entity – most commonly a sociedad anónima or a registered foreign branch – to hold the CNAD authorisation and serve as the regulatory counterparty. El Salvador has not enacted bespoke DAO-recognition legislation. The entity holds the licence; the on-chain governance structure manages operational decisions within the boundaries that entity sets. Cross-border DAO structures may layer additional wrappers in the Cayman Islands, BVI or a common-law foundation jurisdiction.
Who is liable when a smart contract fails?
Liability for a smart-contract failure defaults to the party responsible for the contract's deployment and ongoing operation – typically the founders or the operating entity that published the code. In El Salvador, as in most jurisdictions, the existence of an automated execution mechanism does not extinguish the operator's legal responsibility for the regulated outcome. If the contract has an upgrade mechanism or a multisig-controlled treasury, the operator is identifiable and remains accountable. Immutability of code does not equal immutability of legal obligation.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We assess token classification against the substance of rights, not the marketing label – and our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums when things go wrong. To discuss your situation, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – specialising in smart-contract liability, DeFi protocol structure and token-classification analysis across emerging digital-asset jurisdictions.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.