VASP licence application in El Salvador: Legal Requirements for Businesses

Operating a digital-asset business in El Salvador without the correct authorisation exposes the company to enforcement action, the loss of domestic banking relationships and the inability to onboard institutional counterparties who demand a licensed entity. El Salvador's Bitcoin Law and the subsequent Digital Assets Issuance Law together create a mandatory registration and licensing regime for any entity providing virtual-asset services to persons in the country. For inbound operators – exchanges, custodians, wallet providers and token issuers – understanding the scope of that regime, the application sequence and the cross-border implications is the difference between a compliant launch and a forced exit. This page maps the process from first assessment through to supervised operations, with particular attention to the multi-jurisdiction stacking that most cross-border builds require.

What is the legal basis for VASP supervision in El Salvador?

El Salvador's regulatory architecture for digital assets rests on two primary instruments: the Bitcoin Law, which established bitcoin (BTC) as legal tender and created a framework for service providers facilitating BTC transactions, and the Digital Assets Issuance Law, which governs the public issuance of digital assets more broadly and places supervisory authority in the hands of the Comisión Nacional de Activos Digitales (CNAD) – the National Commission of Digital Assets. The CNAD is the competent authority for authorisation, supervision and enforcement in the domestic digital-asset sector.

The scope is broad. Any entity that commercially provides exchange services, custody, transfer or payment processing involving digital assets – including bitcoin, stablecoins and other tokens – and does so within El Salvador or to Salvadoran users, must register with or obtain authorisation from the CNAD before commencing operations. The law applies on the basis of service delivery, not entity incorporation. A company registered in the British Virgin Islands but actively marketing to Salvadoran residents is within the regulatory perimeter.

In our licensing practice, the most common analytical question is whether a given activity falls within the "provision of digital-asset services" definition or sits outside it. The answer turns on whether the operator takes custody of client assets, processes transfers for third parties or intermediates exchange. An operator that does none of those things – running purely self-custodied infrastructure with no client-facing intermediation – may fall outside the mandatory authorisation threshold, but that is an analysis that requires a fact-specific assessment, not an assumption.

Which businesses require a VASP licence or CNAD registration?

The obligation to register or obtain authorisation from the CNAD attaches to any natural or legal person that habitually provides digital-asset services in or into El Salvador for commercial gain. The CNAD has identified several core categories of regulated activity.

Exchange services – the conversion of digital assets into fiat currency, into other digital assets, or vice versa – are regulated. Custody and wallet services, where the operator holds or controls private keys on behalf of clients, are regulated. Transfer or remittance services involving digital assets, and the intermediation of digital-asset transactions between buyers and sellers, are regulated. Token issuers conducting public offerings of digital assets in El Salvador are separately subject to registration requirements under the Digital Assets Issuance Law.

Non-resident entities servicing the Salvadoran market face the same substantive obligation. The CNAD does not confine its reach to domestically incorporated companies. A business incorporated in Seychelles or Singapore that actively solicits Salvadoran users must apply for the relevant authorisation before those activities commence. Operating through a local subsidiary is one structural response to this reality, but it does not by itself satisfy the regulatory obligation – the subsidiary must itself obtain the relevant authorisation.

In a recent matter, a payments company with operations in Central America sought to extend its stablecoin-based remittance service into El Salvador. The entity was incorporated offshore and had an existing VASP registration in a third jurisdiction. The offshore registration gave no comfort under Salvadoran law. We mapped the activity against the CNAD's regulated-activity definitions and confirmed that a fresh Salvadoran registration was required before launch. The company restructured its regional entity to include a local presence, filed the CNAD application and launched on schedule.

What does the VASP licence application process involve?

The CNAD application process for a digital-asset service provider follows a structured sequence: pre-application preparation, submission of the prescribed application package, regulatory review, possible supplementary requests and, if approved, issuance of the authorisation and notification of ongoing supervisory obligations.

Pre-application preparation is not optional. The CNAD expects applicants to arrive with a complete set of corporate and operational documentation. That set typically includes certified corporate constitutions and ownership registers, identification and background documentation for ultimate beneficial owners and directors, an AML/CFT (anti-money-laundering and counter-terrorism financing) policy suite, a business plan that explains the services, the target market, the revenue model and the projected transaction volumes, and – for entities providing custody – a description of the custody architecture and safeguarding procedures.

The application is submitted to the CNAD in the prescribed form. Following submission, the CNAD conducts a completeness check before moving to substantive review. If documentation is missing or deficient, the clock for substantive review typically does not begin running until the deficiency is resolved. This is the single most common source of delay we see in El Salvador applications: operators underestimate the document burden on the AML and beneficial-ownership side and submit incomplete packages.

Once the substantive review begins, the CNAD may issue supplementary requests for information. Operators should treat those requests as time-sensitive. Protracted response times extend the review period and, in the CNAD's experience, can raise questions about operational readiness. Review periods under the CNAD regime are not publicly prescribed as fixed statutory deadlines in the same way as some comparable regimes. In our practice, well-prepared applications with responsive legal teams complete the review phase more quickly than those that do not address supplementary requests promptly. Overall timelines from a complete application submission to authorisation decision are typically a matter of months rather than weeks, though this varies by activity category and the complexity of the applicant's structure.

The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. For a scoped assessment of your El Salvador application strategy, contact OBOLUS at info@oboluslaw.com.

What AML and Travel Rule obligations apply?

El Salvador's VASP regime incorporates AML/CFT obligations drawn from the Financial Action Task Force (FATF) Recommendations – in particular Recommendation 15, which requires that virtual-asset service providers be brought within the scope of AML supervision. The CNAD supervises compliance with those obligations for entities under its authorisation.

Authorised VASPs in El Salvador must implement customer due diligence (CDD) procedures, including Know Your Customer (KYC) processes that identify and verify clients before account opening. Enhanced due diligence applies to higher-risk client categories and to transactions that meet defined risk criteria. Ongoing monitoring of client transactions and the filing of suspicious transaction reports (STRs) to the relevant financial intelligence unit are mandatory.

The Travel Rule – the FATF obligation to pass originator and beneficiary information with each virtual-asset transfer above the applicable threshold – applies to VASPs operating in El Salvador. The precise domestic threshold is subject to CNAD regulatory guidance and should be confirmed against current published rules. In cross-border transfers, the obligation applies on both the sending and receiving side, which means a Salvadoran VASP transacting with a foreign VASP must also manage Travel Rule compliance in the counterpart jurisdiction. This is a practical operational challenge for multi-corridor remittance businesses, and one that requires a compliant technical solution – manual processes are not sufficient at volume.

Operators whose parent entity holds a VASP registration in a third jurisdiction should not assume that their group-level AML policies automatically satisfy Salvadoran requirements. The CNAD expects a locally calibrated AML policy that reflects Salvadoran risk factors, Salvadoran STR filing obligations and Salvadoran threshold rules. A group policy that references MiCA or MAS standards will need adaptation.

How does El Salvador licensing interact with banking and cross-border structure?

Securing a CNAD authorisation is a necessary condition for compliant operation in El Salvador. It is not, by itself, sufficient to solve the banking question. Domestic banks in El Salvador have shown varying appetites for crypto-business clients, and several operators we work with have found that even an authorised VASP faces friction when opening a local peso or dollar account. A CNAD authorisation demonstrates regulatory standing; it does not guarantee that a Salvadoran bank will extend an account relationship.

The dollarised economy – El Salvador uses the US dollar as its official currency alongside bitcoin as legal tender – creates a particular dynamic. US dollar clearing runs through correspondent banking relationships that are sensitive to US regulatory posture. An El Salvador-incorporated VASP with US dollar flows will be assessed by correspondent banks against the same AML and compliance standards applied to any USD-clearing entity. Operators must be prepared for that scrutiny and should structure their compliance architecture with a correspondent-bank audit in mind, not only a CNAD review.

From a cross-border structuring perspective, most serious operators do not rely on a single Salvadoran entity to carry the entire business. A common architecture places the El Salvador-licensed entity in the role of the local operating vehicle – holding the CNAD authorisation and interfacing with Salvadoran users – while a parent entity in a jurisdiction with stronger institutional banking (Singapore, the ADGM, a European Union member state under MiCA) provides the liquidity, custody and treasury function. This structure requires careful analysis of the inter-company relationships, the tax treatment in both jurisdictions and the applicable currency-control rules.

El Salvador's bitcoin legal-tender status also creates a distinct layer of operational design. Entities required to accept bitcoin as payment under the law have obligations around exchange and settlement that pure crypto exchanges may not encounter in other jurisdictions. Operators who are both digital-asset businesses and retailers or service businesses face a regulatory overlay that combines CNAD supervision with general commercial obligations.

What are the tax and structuring considerations for an El Salvador VASP?

El Salvador does not levy income tax on foreign-sourced income for entities resident in El Salvador – a territorial tax system that has attracted international interest from crypto businesses seeking a favorable operating base. Gains from digital-asset transactions that originate outside El Salvador may be outside the domestic tax base, depending on how the entity's activities and income are characterised. This is a fact-specific determination; it depends on where the activity generating the gain is legally located, where clients are located and how the entity's management and control are exercised.

The territorial system creates an apparent planning opportunity. It does not create a guaranteed tax shelter. An El Salvador entity that is managed and controlled from another jurisdiction – where directors make decisions, where key personnel are located, where contracts are executed – may be treated as resident for tax purposes in that other jurisdiction under its domestic law. Several jurisdictions assert tax residence on the basis of place of effective management, regardless of where an entity is incorporated or licensed. Operators cannot rely on El Salvador incorporation to shed tax obligations in a jurisdiction where they actually conduct management activity.

For groups with operations across Latin America or with US-connected persons (US citizens, green card holders, US corporations with ownership stakes), the US tax framework – including Subpart F and GILTI rules for controlled foreign corporations – adds a layer of analysis that the El Salvador licensing assessment does not address. We regularly advise on the interaction between a licensing decision and the tax exposure it creates in the group's home jurisdictions.

Which operator profile should choose El Salvador?

El Salvador is not the right licensing anchor for every digital-asset business, but it is well suited to several specific profiles. Understanding which profile fits which need avoids an expensive false start.

Profile A – the regional remittance operator. A payments company focused on US-to-El Salvador or intra-Central-America remittance corridors, using stablecoins or bitcoin as the settlement layer, has a genuine operational reason to be authorised in El Salvador. The CNAD authorisation provides the regulatory standing to operate locally. The bitcoin legal-tender environment is an operational advantage for that specific use case. The key risk is US dollar banking access. Timeline: subject to CNAD review, typically several months from a complete application.

Profile B – the global exchange seeking a secondary licence. An established exchange holding a primary licence in Singapore, the UAE or an EU member state may seek a Salvadoran authorisation to open the Central American retail market or to establish an entity that benefits from the territorial tax system. The key risk for this profile is that the El Salvador authorisation does not passport into any other jurisdiction. The entity is a standalone operating vehicle, not a gateway. Banking complexity and the need for a locally adapted AML programme add operational overhead.

Profile C – the token issuer. A business conducting a public digital-asset offering for Salvadoran participants must register with the CNAD under the Digital Assets Issuance Law. This is a distinct registration track from the VASP service-provider authorisation. Issuers should not assume that a VASP service-provider registration covers their offering activity.

For all three profiles, the decision to pursue a Salvadoran authorisation should be made after mapping the full compliance, banking and tax stack – not on the basis of the licensing alone. If a prior application stalled or a banking relationship was closed after an initial enquiry, there is usually a structural reason that a second read of the application can identify.

To map the licence, banking and tax stack for your El Salvador build, write to OBOLUS at info@oboluslaw.com or reach us via t.me/oboluslaw. Map your options.

What are the most common mistakes in El Salvador VASP applications?

The most common error is submitting an incomplete application under the assumption that deficiencies can be corrected after submission without restarting the clock. In the CNAD process, an incomplete submission typically triggers a deficiency notice that suspends substantive review until the full package is provided. Each round of supplementary exchange adds weeks to the timeline and raises the administrative cost of the application.

A related error is using a generic AML policy template drawn from another jurisdiction's requirements. The CNAD will assess the policy against Salvadoran risk factors and Salvadoran regulatory expectations. A policy written for a European MiCA application or a MAS-supervised entity will not be adequate without material Salvadoran-specific adaptation. The adaptation is not cosmetic – it requires an understanding of the domestic financial crime typologies, the STR filing procedure and the applicable threshold rules.

A common assumption is that a single offshore licence is enough to serve clients globally. It is not, and it is not enough to serve Salvadoran clients either. An entity registered as a VASP in, say, the BVI or the Cayman Islands is registered under the applicable FSC or CIMA regime. That registration carries no authority in El Salvador. Serving Salvadoran users from an offshore entity without CNAD authorisation is operating without a licence in the Salvadoran market – regardless of what other licences the group holds.

Finally, operators sometimes underestimate the ongoing compliance obligations that attach after authorisation. The CNAD authorisation is not a one-time event. Supervised VASPs must file periodic reports, notify the CNAD of material changes to their business, their ownership structure or their AML programme, and submit to on-site or remote supervisory reviews. A licensing strategy that does not budget for the ongoing compliance function is setting up for regulatory friction post-launch.

Related at OBOLUS

• Licensing and Registration for Digital-Asset Businesses – how we scope, prepare and manage VASP and CASP applications across 70+ jurisdictions.
• Economic Substance for Licensed VASPs in Seychelles – substance requirements that affect offshore VASP structures used alongside a Salvadoran entity.
• Corporate Tax Residency Planning in Singapore – planning the parent-entity layer for groups that anchor custody and treasury in a tier-one hub.

FAQ

How long does a crypto licence take to obtain?

Timelines vary by jurisdiction and activity category. In El Salvador, a well-prepared CNAD application with a complete document package and responsive follow-up on supplementary requests typically resolves in a matter of months. In other regimes – such as MAS in Singapore or the SFC in Hong Kong – review periods are longer and resource-intensive. The single largest controllable variable is the quality of the initial submission. An incomplete application adds weeks or months to every regime.

Which jurisdiction is best for licensing my crypto business?

There is no single correct answer; the right jurisdiction depends on your target user base, the services you are providing, your banking requirements, your group's tax position and your institutional counterparty expectations. El Salvador suits specific profiles – particularly regional payments and operators who benefit from the territorial tax system. For global exchange or custody operations, a primary licence in a tier-one hub such as Singapore, the UAE or an EU member state typically provides better institutional credibility and banking access. We assess the full stack before recommending a structure.

Do I need a separate custody licence?

In most flagship regimes, custody of digital assets on behalf of clients is a separately regulated activity. In El Salvador, the CNAD's regulated-activity definitions cover custody and wallet services where the operator controls private keys. An entity that provides both exchange and custody services must ensure its CNAD authorisation covers both activity categories. In other jurisdictions – such as under MiCA or the MAS Payment Services Act – custody is a distinct regulated activity requiring its own authorisation or licence category. The answer is fact-specific and jurisdiction-specific.

OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence, banking and tax stack across operating, custody and payment layers before you commit – and our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums when matters require it. To discuss your situation, contact info@oboluslaw.com.

By Aisha Tan, Licensing & Jurisdictions Analyst – specialises in VASP authorisation strategy and multi-jurisdiction licensing stack design for inbound operators in emerging digital-asset regimes.

This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.