VARA Licence Application in El Salvador: Legal Requirements for Businesses
Operating a digital-asset business in El Salvador without the right licence exposes the company to enforcement action, severed banking relationships and blocked access to the payments infrastructure the market now expects. El Salvador enacted its Bitcoin Law and later its broader digital-assets regime through the Digital Assets Issuance Law (known locally by its Spanish acronym), creating a national supervised category for VASPs (virtual asset service providers) and assigning regulatory authority to CNAD (the Comisión Nacional de Activos Digitales – the National Commission for Digital Assets). For inbound operators, the question is not whether to engage the regulatory process but how to structure it correctly from the outset.
El Salvador's digital-asset regime is purpose-built for commercial operators rather than retail speculative activity. CNAD sits as the dedicated supervisor for VASP registration and ongoing compliance. The practical entry path involves entity domiciliation, an application to CNAD, satisfaction of AML/CFT conditions aligned with FATF Recommendation 15 on virtual assets, and the ongoing reporting and Travel Rule obligations that follow authorisation. Cross-border operators must further address the interaction between El Salvador's regime and the rules of the jurisdictions where their users and banking counterparties sit.
This page maps the regulated perimeter, the application process, the cross-border interaction and the decision points that determine whether El Salvador is the right first – or complementary – licensing jurisdiction for your build.
What activities require a VASP registration in El Salvador?
Any entity offering digital-asset exchange, transfer, custody, issuance or brokerage services in or from El Salvador requires registration with CNAD under the applicable digital-assets legislation. The regime draws its perimeter broadly. Operating an exchange, managing a custodial wallet, facilitating peer-to-peer transfers or issuing a token instrument that does not qualify as a traditional security will each, in principle, engage the registration requirement. Regulators in El Salvador have signalled an inclusive reading: if the activity involves a virtual asset and a commercial counterparty, the presumption runs in favour of authorisation being required.
The CNAD perimeter is not limited to Salvadoran-resident clients. An entity incorporated in El Salvador offering services to users in other jurisdictions remains within CNAD's supervision but must also assess whether those foreign users trigger licensing obligations in their home jurisdictions. In our practice, operators frequently underestimate this layered exposure. A Salvadoran entity serving EU users, for example, must address MiCA and ESMA requirements in addition to its CNAD obligations – the two regimes do not cancel each other out.
Entities that deal exclusively in securities or instruments regulated as such under Salvadoran capital-markets law fall outside the CNAD perimeter and into the securities supervisory authority instead. The boundary between a regulated digital asset and a security token is a substance-over-label analysis: the rights the instrument confers, not the marketing term used, determine the classification.
How does the CNAD application process work?
The CNAD registration process proceeds in identifiable stages, and the quality of the initial filing determines whether the review moves efficiently or stalls on supplementary information requests. CNAD is the receiving authority for all VASP applications in El Salvador, and the process involves documentary submission, a technical review of the business model and AML/CFT programme, and a fit-and-proper assessment of the beneficial owners and senior management.
The standard application package covers: a legal opinion confirming the entity's corporate standing under Salvadoran law; a detailed business-model memorandum identifying the specific digital-asset activities and the markets they serve; an AML/CFT policy manual calibrated to FATF standards; a technology and cybersecurity architecture description; and fit-and-proper declarations from directors and beneficial owners. CNAD may require in-person or remote interviews with key personnel during the review.
Timeline from submission to authorisation varies by the complexity of the business model and the completeness of the initial filing. A single-activity operator with a clean structure and a well-prepared AML programme will generally move faster than a multi-activity platform with layered ownership. In our cross-border practice, we have seen well-prepared filings progress through regulatory review in a matter of weeks rather than months – and poorly structured applications extend significantly beyond that. Front-loading the preparation – entity review, AML manual, beneficial-owner mapping – before the submission date is the single most effective lever an operator controls.
A common mistake at this stage is treating the business-model memorandum as a marketing document. CNAD reviews it as a supervisory tool. It should set out, with precision, which FATF-defined VASP activities the entity will conduct, how customer due diligence will be performed, how suspicious-transaction reporting flows internally, and which technical controls govern wallet custody and key management.
The process above describes the standard path. Your facts – the entity structure, the user base, the banking arrangements – change the analysis materially. For a scoped assessment of your El Salvador registration, contact OBOLUS at info@oboluslaw.com or map your options before you commit to a structure.
What AML and Travel Rule obligations apply?
A CNAD-registered VASP must operate a full AML/CFT programme aligned with FATF Recommendation 15 and the accompanying guidance on virtual assets and virtual asset service providers. The programme must be live before authorisation is granted – it is a condition of registration, not a post-authorisation undertaking. CNAD reviews the programme at the point of application and supervises its ongoing adequacy through periodic reporting and examination.
The Travel Rule – the obligation to pass originator and beneficiary data alongside a virtual-asset transfer – applies to CNAD-registered VASPs. The precise de-minimis threshold at which the obligation is triggered follows the FATF standard, with the applicable Salvadoran implementing measure setting the operative figure. Until that figure has been confirmed in current legislation and reviewed for the specific transaction type, it should be treated as a live compliance variable rather than a fixed number. Operators we advise invariably need a technical Travel Rule solution – software or a shared-protocol integration – before they can satisfy this requirement operationally.
Customer due diligence expectations follow the standard FATF tiered model: simplified measures for lower-risk relationships, enhanced due diligence for higher-risk profiles including politically exposed persons and cross-border correspondent relationships. For businesses accepting Bitcoin as a settlement currency – a commercially realistic scenario in El Salvador given the Bitcoin Law's legal-tender provisions – the transaction monitoring system must be able to handle both Bitcoin and other virtual-asset transfers across the full range of AML risk indicators.
How does an El Salvador licence interact with other jurisdictions?
El Salvador's CNAD registration does not function as a global passport. A VASP licensed in El Salvador and serving clients in the EU, the UK, Singapore or the UAE must independently satisfy the digital-asset licensing or registration requirements of each of those jurisdictions – or structure the business so that the Salvadoran entity's activities do not engage those foreign perimeters. The architecture of who is the contracting entity, where the contract is formed and where the users are located all factor into the cross-border exposure analysis.
For operators building an international user base from an El Salvador base, the most common structure involves a Salvadoran operating entity for the markets where El Salvador's regime is the primary supervisor, combined with a separately licensed entity – in the EU under MiCA as a CASP, in Dubai under VARA, or in Singapore under the MAS Payment Services Act – for those specific regional user bases. The entities may share infrastructure but must have separate compliance programmes and, critically, separate banking relationships where the banking counterparty's own regulatory environment demands it.
Banking is the cross-border pressure point most often underestimated. A CNAD-registered VASP remains a digital-asset business in the eyes of most correspondent banking networks. Banking access – both in El Salvador and in the currencies and clearing systems the business needs – requires a dedicated banking strategy that runs in parallel with the licensing process, not after it. Operators who treat banking as a post-licence problem consistently find themselves authorised but unable to operate at commercial scale.
Tax is a further dimension. El Salvador has adopted a territorial tax regime with particular provisions affecting digital-asset income. The interaction between the Salvadoran tax position of the operating entity and the home-jurisdiction tax obligations of the beneficial owners requires structured advice from the outset. We regularly advise on the entity, tax and banking layers as an integrated stack – because a licence that does not survive the banking or tax stress test is not a solution.
If a prior application stalled or an account was closed, a second structural review can surface the reason and the route forward. To pressure-test your structure before you commit, message us via t.me/oboluslaw or map your options.
A cross-border registration in practice
In a recent engagement, a payments technology company incorporated outside Latin America sought CNAD registration to serve both the Salvadoran market and a parallel Central American user base. The initial structure presented two problems: the beneficial-owner chain included a holding entity in a jurisdiction that CNAD's AML review would flag as requiring enhanced disclosure, and the AML programme had been drafted for an EU regulatory standard that did not map cleanly onto the FATF-aligned Salvadoran requirements. We restructured the holding chain to simplify the transparency analysis, rewrote the AML manual for the specific FATF-Salvadoran posture, and coordinated the filing with allied counsel in the relevant jurisdiction for the parallel compliance considerations. The application proceeded to authorisation without a request for supplementary information on the ownership structure – the usual point of delay in cross-border applications of this type.
Which operator profile should consider El Salvador as a licensing base?
El Salvador is most attractive for operators whose business model, client base or strategic footprint has a genuine Latin American or dollarised-economy dimension. The regulatory regime is comparatively accessible for a well-prepared applicant, the legal-tender status of Bitcoin creates commercial infrastructure that other jurisdictions do not offer, and the territorial tax environment can be efficient for the right entity design. That combination of factors suits certain operator profiles specifically.
Profile A – Regional exchange or remittance operator. A business focused on Latin American retail or SME remittance corridors, or on exchange services denominated in USD, will find that El Salvador's CNAD registration addresses the primary regulatory perimeter for its core market. The process is manageable with proper preparation, and the jurisdiction's commercial infrastructure for Bitcoin and dollar-denominated settlement is a genuine operational advantage. The key risk is banking: the operator must build banking relationships that can handle the transaction volumes before launch, not after.
Profile B – Global exchange seeking a secondary licence. An exchange already licensed in a major hub – under MiCA, the MAS Payment Services Act or the VARA regime in Dubai – may use a CNAD registration as a specific-market overlay for Latin American user acquisition. In this configuration, El Salvador is a complement to an existing licence stack, not a replacement for it. The AML programme integration between entities is the primary compliance management question.
Profile C – Token issuer with a USD settlement requirement. El Salvador's digital-asset issuance framework accommodates token issuance with proper CNAD notification and, where applicable, registration. For an issuer whose instrument is denominated in or settled in USD – and for whom the Bitcoin legal-tender environment offers commercial synergies – El Salvador is a credible primary issuance jurisdiction. The issuance framework requires careful analysis of whether the instrument crosses into the securities perimeter before the registration path is confirmed.
Operators who are primarily serving EU or UK users with no genuine Latin American nexus will generally find that a dedicated MiCA CASP authorisation or FCA registration addresses their actual exposure more directly than a CNAD registration. Geography of the user base, not the preference of the founder, should drive the jurisdictional selection.
What mistakes do operators most commonly make in the El Salvador application?
The most consistent error we observe is filing before the entity structure is ready. CNAD's fit-and-proper review extends to the full beneficial-owner chain, and a complex or opaque holding structure – particularly one involving intermediate entities in low-transparency jurisdictions – creates a review bottleneck that is difficult to resolve once the application is in process. Restructuring after submission is slower and more disruptive than getting the entity right before the filing date.
A second recurring error is the AML programme gap. Applicants frequently submit a generic AML policy – often one drafted for a European or Cayman regulatory context – without adapting it to the specific FATF-aligned Salvadoran requirements. CNAD reviewers are alert to templates. A programme that does not identify specific Salvadoran risk factors, that fails to address the Bitcoin transaction-monitoring dimension or that omits Travel Rule procedures will draw a supplementary-information request and delay the authorisation.
A third error is the myth that a single offshore registration resolves global exposure. A CNAD licence covers the Salvadoran regulatory perimeter. It does not address the licensing obligations that arise when the business serves users in the EU, the UK, Singapore, the UAE or any other jurisdiction with its own digital-asset supervisory regime. Operators who assume that one registration is sufficient consistently discover, at the banking stage or at an enforcement interaction in a foreign market, that the assumption was wrong. Each user jurisdiction requires its own analysis.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – the full cross-jurisdictional licence stack, from exchange to custody to issuance.
- VASP licensing in Poland – EU entry under MiCA transition and the Polish AML/VASP registration framework.
- Security token offering structuring in Lithuania – structuring a regulated token issuance inside the EU under MiCA and transitional Lithuanian rules.
FAQ
How long does a crypto licence take to obtain?
Timeline varies materially by jurisdiction and the complexity of the application. A well-prepared single-activity VASP filing in a straightforward jurisdiction can progress through regulatory review in a matter of weeks. Multi-activity platforms or applications with complex ownership chains typically take longer. The dominant variable is preparation quality at the point of filing: incomplete applications draw supplementary-information requests that extend the review cycle significantly. Engaging counsel before the filing date rather than at submission is the most reliable way to manage the timeline.
Which jurisdiction is best for licensing my crypto business?
There is no universally correct answer. The right jurisdiction turns on where your users are, what activity you are conducting, where your banking counterparties sit and what tax position your entity structure produces. El Salvador suits operators with a genuine Latin American or dollar-economy nexus. EU-facing businesses need MiCA CASP authorisation. Dubai-facing or global exchange operations may prioritise VARA. A credible jurisdictional selection requires mapping the user base, the activity type and the banking stack together – not choosing a jurisdiction first and fitting the business around it.
Do I need a separate custody licence?
In most leading jurisdictions, custody of virtual assets is a separately regulated activity from exchange or transfer services. Under MiCA, VARA and the MAS Payment Services Act, custody requires either a dedicated authorisation or a specific licence tier that covers it. El Salvador's CNAD regime similarly treats custody as a defined VASP activity requiring registration in its own right. Operating custody functions under a registration that does not expressly cover that activity is a compliance gap that banking counterparties and institutional clients will identify during onboarding. The custody layer of the licence stack should be assessed at the outset of any jurisdictional analysis.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence, banking and tax stack before you commit – so that authorisation translates into operational capacity, not just a regulatory certificate. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums when recovery is required. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP registration strategy, cross-border licence stacking and entity structuring for digital-asset operators entering emerging and growth-market regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.