El Salvador operates one of the most accessible VASP licensing (virtual asset service provider registration) regimes in the Western Hemisphere. Under the Digital Assets Issuance Law and the supervision of the Comisión Nacional de Activos Digitales (CNAD), any business offering virtual asset services in or from El Salvador must register before it begins operations. The cross-border reality is equally direct: registration in El Salvador does not substitute for authorisation in the jurisdictions where your users actually reside, and most serious operators must build a multi-layer licence stack from day one.
This page sets out the regulatory basis, the inbound application process, the cross-border interactions that most commonly trip operators, and the practical decision point between El Salvador and the competing licence hubs. It is written for general counsel and founders who need the legal answer, not a promotional overview.
Why El Salvador Is a Serious Licensing Destination
El Salvador established a dedicated digital-asset legal regime earlier than most jurisdictions in the Americas, giving it a structural first-mover position that matters to inbound operators. The country passed foundational legislation recognising Bitcoin as legal tender, then built a separate commercial licensing framework for the broader class of digital-asset businesses through its digital-assets issuance and services law. The CNAD functions as the dedicated prudential and conduct supervisor for registered VASPs, distinct from the general banking regulator. That specialisation is operationally meaningful: the regulator understands on-chain mechanics, and the application review reflects that.
In our licensing practice we see El Salvador selected most often by two profiles: exchanges and brokers seeking a cost-effective Latin American regulatory anchor, and stablecoin or token issuers who want a jurisdiction that has explicitly engaged with Bitcoin-native infrastructure. The regime is not a sandbox or an exemption – it is a live commercial licensing track with ongoing compliance obligations.
For inbound businesses the operative question is not whether to register, but how to structure the entity, capitalise it correctly and layer the El Salvador registration on top of whatever other regulatory authorisations the group already holds.
What Does the CNAD Regulate, and Who Needs a Licence?
Any natural person or legal entity conducting virtual-asset service activities commercially in El Salvador must register with the CNAD before providing those services. The licensing requirements under the applicable digital-assets regime cover a defined set of activities: exchange between virtual assets and fiat currencies, exchange between virtual assets, transfer of virtual assets, custody and administration, and participation in token offerings. The activity test is conduct-based, not entity-based – a foreign company with Salvadoran users may trigger registration obligations even if it has no physical presence in the country.
The CNAD regime does not adopt a single consolidated VASP licence. Instead it issues registrations keyed to the specific activities the applicant intends to carry out. A business running an exchange and also providing custody must register for both activity categories. Attempting to operate one activity under the authorisation granted for another is a compliance failure, not a technical oversight.
Self-assessment at the outset is therefore structural. Operators we advise regularly underestimate the scope of their activity set – a business that describes itself as a "broker" frequently turns out to be executing transfers and providing incidental custody, each of which carries its own registration requirement under the CNAD regime.
CTA #1 – Early Assessment
The activity mapping above is where most applications succeed or fail. If you are building the scope of your Salvadoran registration, the right moment to engage counsel is before the entity is incorporated, not after. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. Map your options
What Does the CNAD Application Process Involve?
The CNAD application follows a structured submission process that requires corporate, technical and compliance documentation presented together. The regulator expects a complete file on first submission; incomplete applications are returned rather than processed in stages. The core submission covers the corporate constitution of the Salvadoran entity, the identity and background documentation for all beneficial owners and directors, a detailed description of the intended activities and products, an anti-money-laundering and counter-financing-of-terrorism programme aligned with FATF Recommendation 15, technology and security documentation for the platform, and evidence of the required capital level for the relevant activity category.
Capital requirements vary by activity category and are set under the CNAD's regulatory rules. Because those figures are subject to regulatory update, operators should confirm the current thresholds directly with the CNAD or through counsel before building a capitalisation plan. Writing a qualitative note here is the conservative and correct approach: the number that appears in a secondary source today may not be the number the regulator applies tomorrow.
Review timelines are not prescribed by statute at a fixed number of days, though in practice the process moves faster than comparable applications in the EU or the Gulf. Operators we have assisted through structured submissions have received initial CNAD feedback within a matter of weeks rather than months. Completeness of the first-submission file is the single largest determinant of speed.
The CNAD may issue conditional registration or request supplemental information before granting a final authorisation. A conditional registration does not permit live commercial operations in the regulated activities – full authorisation is required before launch.
AML, the Travel Rule and Ongoing Compliance
El Salvador's digital-assets regime incorporates the Travel Rule (the obligation to pass originator and beneficiary data with a virtual asset transfer) in line with FATF Recommendation 15, meaning registered VASPs must implement counterparty data-sharing with other regulated VASPs before processing a transfer above the applicable de-minimis threshold. That threshold is set by Salvadoran implementing rules and should be confirmed at the time of application, as FATF-aligned jurisdictions periodically revise it.
Ongoing compliance obligations for a registered CNAD VASP include transaction monitoring, suspicious-transaction reporting to the relevant Salvadoran financial intelligence unit, customer due diligence at onboarding and on a risk-sensitive ongoing basis, and periodic regulatory reporting. The CNAD conducts supervisory reviews, and registered entities are expected to maintain documented compliance programmes that can be produced on request.
Businesses that have undergone AML programme design for another FATF-aligned jurisdiction – MAS, FCA, VARA – will find the substantive requirements familiar. The difference is implementation specificity: the programme must reflect Salvadoran regulatory instruments, not a generic global template.
How Does El Salvador Interact With Cross-Border Banking and Tax?
Regulatory authorisation is one layer; banking access is another, and in cross-border digital-asset operations they rarely move in tandem. A CNAD registration makes a business credible to Salvadoran correspondent banks and to the domestic payment system. It does not guarantee account access with international correspondent institutions, which apply their own risk appetite, AML/KYC protocols and jurisdiction policies independently of what the local regulator has approved.
In our cross-border practice, the banking layer is addressed in parallel with the licensing application, not sequentially. Operators who wait for CNAD authorisation before approaching banking partners frequently find themselves registered but unbanked – operationally blocked even though legally authorised. The preparation work for a banking relationship includes a regulatory business plan, an entity structure diagram, a summary of the AML programme and, often, introductory engagement with the prospective bank before the CNAD file is submitted.
On the tax side, El Salvador operates a territorial tax system, which means income earned outside El Salvador is generally not subject to Salvadoran income tax. For a business whose operations, clients and revenues are predominantly non-Salvadoran, this structure can be materially efficient – but only if the legal and factual substance of the Salvadoran entity is correctly established and the group's transfer-pricing and permanent-establishment exposure in other jurisdictions is managed. A Salvadoran entity that exists only on paper, while the real management and control sits elsewhere, will not hold up to substance scrutiny from a foreign tax authority. Proper structuring requires a lawyer with experience in both the Salvadoran regime and the group's home-jurisdiction tax rules, which is a recurring pattern in the mandates we manage.
Bitcoin's legal-tender status creates an additional layer of consideration for businesses operating Bitcoin-denominated products. The specific tax treatment of Bitcoin receipts, capital gains realisation events and VAT applicability to crypto services in El Salvador is set by domestic fiscal instruments that a Salvadoran tax adviser should confirm for each product type.
CTA #2 – Structure Before Commitment
If a banking relationship or a prior application in another jurisdiction has stalled, a second read can surface the structural reason and the route back. If you are mapping the licence, banking and tax stack for an El Salvador build, write to OBOLUS at info@oboluslaw.com before you commit the entity. Map your options
How Does El Salvador Compare to Competing Licence Hubs?
El Salvador occupies a distinct position in the global licensing map: accessible cost structure, a dedicated digital-asset supervisor, and a territorial tax system, set against a smaller international banking network and a regulatory regime that has less secondary case law and interpretive guidance than the EU, UK or UAE equivalents. The comparison is not a ranking; it is a decision matrix.
Profile A – Exchange or broker targeting Latin American retail users. El Salvador offers a logical regulatory anchor. The CNAD regime is fit for purpose, the cost structure is competitive, and the territorial tax position is advantageous for a Latin American revenue base. Key risk: banking access requires active management.
Profile B – Stablecoin or token issuer seeking EU market access. A CNAD registration does not confer EU passporting. An issuer serving EU users needs a MiCA (Markets in Crypto-Assets Regulation) authorisation under ESMA and the relevant national competent authority. El Salvador may work as a parallel holding or operational entity alongside a EU CASP – but it does not substitute for one.
Profile C – Institutional custodian with US or Gulf clients. The CNAD regime is not yet recognised by the SEC, CFTC or NYDFS as a qualifying foreign regime for reciprocal treatment, and it does not satisfy the VARA regime requirements for Dubai-authorised operations. A custodian serving institutional clients in those markets will need VARA, FCA or SEC-aligned authorisation in addition to any Salvadoran registration.
Profile D – DeFi protocol or Web3 infrastructure operator. The activity test under the CNAD regime focuses on commercial service provision. A non-custodial protocol with no Salvadoran users or operations may not trigger the registration threshold at all – but that analysis must be done formally, not assumed. The structural question of whether a given protocol constitutes a VASP activity is jurisdiction-specific and fact-sensitive.
The cross-border reality that runs through all four profiles is the same: El Salvador is a licensing layer, not a licensing solution. Operators we advise who approach it as a standalone answer to a multi-jurisdiction operation consistently find compliance gaps that create exactly the enforcement exposure the registration was meant to prevent.
What Are the Most Common Regulatory Mistakes on a CNAD Application?
The most common error is scope mismatch between the activities described in the application and the activities the business actually intends to run. Operators frequently describe a narrower activity set to simplify the application, then begin offering services that fall outside the authorised scope within months of registration. The CNAD's conduct supervision identifies this pattern, and the remediation – retroactive scope amendment plus remedial compliance documentation – is more resource-intensive than getting the scope right at the outset.
The second recurring problem is AML programme transplantation. A business that lifts a compliance programme designed for its EU or Singapore entity and submits it with Salvadoran letterhead will not satisfy the CNAD's review. The programme must be localised: it must reference Salvadoran regulatory instruments, name the local compliance officer, describe the specific products and customer types the Salvadoran entity will serve, and articulate the escalation path to the Salvadoran financial intelligence unit.
The third is the myth this page explicitly addresses.
A common assumption is that a single offshore registration – whether in El Salvador, the BVI or another accessible jurisdiction – is sufficient to serve clients globally without further authorisation. It is not. The applicable legal test in most major markets is where the service is received or where the client is located, not where the service provider is registered. An exchange registered only in El Salvador but actively marketing to EU residents triggers MiCA obligations. The same exchange serving UK users triggers FCA registration requirements. El Salvador does not immunise operators from those obligations. We see this structural exposure most often in businesses that launched quickly on a single registration and are now managing enforcement inquiries in secondary markets.
A Recent Cross-Border Registration Matter
In a recent licensing matter, a digital-asset exchange operator incorporated outside the Americas sought to establish a regulated Salvadoran entity as the primary gateway for its Latin American user base. The operator had an existing EU regulatory authorisation but had not mapped its Salvadoran activity obligations independently. We conducted an activity-scope analysis against the CNAD regime, identified that the group's stablecoin product triggered a separate registration category beyond the exchange authorisation, and prepared a consolidated submission covering both activity sets. The CNAD file was submitted in a single tranche; the banking engagement ran in parallel, and the entity was operational within the same quarter as the authorisation was granted.
A Common Assumption About El Salvador Licensing
A common assumption among operators approaching El Salvador is that the relative accessibility of the CNAD regime signals lower compliance expectations once registered. That assumption is incorrect and increasingly costly. The CNAD conducts active supervisory oversight of registered entities. Annual reporting, transaction monitoring records and AML programme documentation are standard supervisory requests. An operator that treats the registration as a one-time cost and ignores the ongoing obligations is operating under a licence it is not actually complying with – which is a materially worse legal position than operating without a licence, because it adds regulatory estoppel to the underlying compliance failure.
Related to this: the fact that El Salvador's regime is newer than MiCA or the VARA regime does not mean it is less enforceable. The CNAD has statutory authority to suspend, revoke and sanction. It exercises that authority.
Related at OBOLUS
- Licensing and Registration for Digital Asset Businesses – full-scope VASP and CASP authorisation across 70+ jurisdictions, end to end.
- Legal Counsel for Digital Asset Custodians – custody-specific regulatory, structuring and compliance advice for institutional and commercial custodians.
- Stablecoin Freeze Requests in Liechtenstein – procedural and legal guide to issuer-level freeze requests in the Liechtenstein regime.
FAQ
How long does a crypto licence take to obtain?
Timelines vary significantly by jurisdiction and application quality. In El Salvador, a well-prepared CNAD submission typically receives initial regulatory feedback within weeks rather than months – faster than comparable EU or Gulf authorisations. However, the timeline resets with each round of supplemental information requests. A complete first-submission file, prepared with experienced counsel, is the most reliable path to a shorter process. Other jurisdictions – MiCA under ESMA, VARA in Dubai, the SFC regime in Hong Kong – operate on longer statutory review windows.
Which jurisdiction is best for licensing my crypto business?
There is no universally correct answer. The right jurisdiction depends on your activity set, your user base, your banking strategy and your tax position. El Salvador suits Latin American-focused operators who want a cost-effective, dedicated digital-asset supervisor and a territorial tax structure. A business targeting EU or Gulf institutional clients will almost certainly need MiCA or VARA authorisation in addition. We map the full licence, banking and tax stack for each client before recommending a primary jurisdiction – because the wrong choice at formation is expensive to correct.
Do I need a separate custody licence?
In El Salvador, custody of virtual assets is a distinct regulated activity under the CNAD regime. If your business holds client assets – even incidentally, as part of an exchange or transfer product – you will need registration for the custody activity in addition to the exchange or transfer registration. This is a common scope error in initial applications. The same principle applies in most serious jurisdictions: MiCA, VARA, the MAS Payment Services Act and the SFC VATP regime each treat custody as a separate regulatory category. Confirm the activity scope of your registration before you go live.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice, and we act only for businesses. We map the licence stack across operating, custody and payment layers before you commit – because the structural decisions made at formation define the compliance exposure a business carries for years. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in inbound digital-asset licensing strategy across the Americas, the Gulf and offshore financial centres.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.