← Regulations / Ecuador / Operating Models / Custodial SaaS

Custodial wallet / SaaS in Ecuador

Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).

Conditional AI-Generated · Unreviewed

Custodial SaaS is conditionally permitted in Ecuador with a local entity, subject to AML obligations and high licensing burden.

Verdict Details

Permitted
conditional
Local entity required
Yes
Licensing burden
High
Last updated
2026-07-13

AML Obligations

  • Registration as 'Obligated Subject' (Sujeto Obligado) with UAFE under Resolución No. UAFE-DG-2022-0001.
  • Customer due diligence (CDD): obtain and verify full name, date of birth, nationality, ID number (cédula/passport), address, contact info, occupation for natural persons.
  • For legal entities: verify legal name, registration number, date of incorporation, legal form, address, directors/partners/shareholders, and authorized individuals.
  • Beneficial ownership identification: identify and verify natural persons who ultimately own or control the customer.
  • Purpose and intended nature of business relationship: understand reason for VASP usage, expected type and volume of transactions.
  • Ongoing transaction monitoring and regular CDD updates.
  • Risk assessment framework: develop and implement risk assessment to identify, assess, and mitigate ML/TF risks.
  • Enhanced due diligence (EDD) for PEPs, high-risk jurisdictions, complex/large transactions, and anonymity-favoring technologies.
  • Suspicious transaction reporting (ROS) to UAFE for any transaction, attempted transaction, or activity raising suspicion — no minimum threshold.
  • No tipping-off prohibition.
  • Record-keeping: transaction records (amount, type of virtual asset, sender/recipient addresses, timestamps, fiat equivalents, transaction hashes).
  • Mandatory internal policies and procedures for identifying, evaluating, and reporting suspicious transactions (SARLAFT system).

Key Restrictions

  • Cryptocurrencies (Bitcoin, Ethereum, etc.) cannot be used as legal tender or alternative currency — Banco Central del Ecuador explicitly prohibits this.
  • Financial institutions are barred from facilitating cryptocurrency transactions as means of payment.
  • Stablecoins attempting to function as a means of payment are problematic unless backed by USD and transparently regulated by Ecuadorian authorities.
  • Any tokens classified as securities (including investment tokens, security tokens, or utility tokens marketed for speculative value) trigger full securities-law compliance: SCVS registration, prospectus, ongoing disclosure, corporate governance.
  • Secondary trading of security tokens must occur on regulated stock exchanges (Bolsas de Valores) authorized by SCVS.
  • If the custodial wallet holds tokens classified as securities, broker-dealer registration (casa de valores) may be required for facilitation.
  • Custodial services for security tokens require specific authorization and compliance with SCVS custody regulations.

Key Risks

  • Legal ambiguity: the custodial wallet model may straddle securities regulation (if hosted tokens are classified as securities) and general VASP AML rules — unclear regulatory treatment for mixed-asset wallets.
  • Enforcement risk: the 2014 BCE ban (Resolution 014-2014-M) broadly prohibited cryptocurrency use as payment, which risks enforcement against any wallet facilitating transfers with payment characteristics.
  • No crypto-specific custody/qualified-custodian regime exists — operators rely on general securities custody rules if applicable, or operate in a regulatory gap.
  • White-label SaaS structure creates AML allocation risk: the SaaS provider and the white-label client may each be 'Obligated Subjects' under UAFE, with unclear division of CDD/SAR responsibilities.
  • Registration requirement is mandatory but the licensing/custody framework for VASPs beyond AML is underdeveloped — gap between AML registration and operational authorization.
  • Stablecoin custody carries heightened BCE scrutiny risk.

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 60% confidence

Superintendencia de Compañías, Valores y Seguros (SCVS): The superintendency responsible for regulating companies, securities, and insurance. This body would classify tokens as securities.

licensing 60% confidence

Banco Central del Ecuador (BCE): The Central Bank, which has historically taken a very strict stance against cryptocurrencies being used as means of payment.

licensing 60% confidence

Security Tokens: These are explicitly designed to represent traditional securities such as shares, bonds, or interests in a fund. They confer rights like dividends, voting rights, profit sharing, or a claim on assets.

licensing 60% confidence

Investment Tokens: Tokens that are primarily sold to raise capital for a project or company, where purchasers expect a return on their investment due to the efforts of the issuer or a third party. This includes tokens that grant a share of future revenues, profits, or are marketed with promises of appreciation based on the success of a venture.

licensing 60% confidence

Payment Tokens / Cryptocurrencies (e.g., Bitcoin, Ethereum): These are generally not considered "securities" in the traditional sense, but their use as legal tender or alternative currency is explicitly prohibited by the Banco Central del Ecuador. Financial institutions are barred from facilitating transactions with them. This prohibition makes their status in Ecuador highly problematic, regardless of whether they are securities.

licensing 60% confidence

Stablecoins: While the SCVS focuses on securities, it's worth noting that the BCE would likely view any stablecoin as problematic if it attempts to function as a means of payment, especially if it is not backed by the USD or if its backing is not transparent and regulated by Ecuadorian authorities.

licensing 60% confidence

Registration with SCVS: Mandatory registration of the offering and the issuer with the Superintendencia de Compañías, Valores y Seguros.

licensing 60% confidence

Prospectus Requirements: Preparation and submission of a detailed prospectus containing comprehensive information about the issuer, the project, financial statements, risks, and the rights associated with the token.

licensing 60% confidence

Information Disclosure: Ongoing periodic and material event disclosures to the SCVS and the public.

licensing 60% confidence

Corporate Governance: Compliance with corporate governance standards applicable to public companies.

licensing 95% confidence

Broker-Dealer Registration: Entities facilitating the trading of such tokens would need to be registered as broker-dealers (casas de valores) with the SCVS.

licensing 95% confidence

Regulated Exchanges: Secondary trading of registered securities typically must occur on regulated stock exchanges (Bolsas de Valores) authorized by the SCVS.

licensing 90% confidence

Custody: Custodial services for such tokens would likely require authorization and compliance with specific regulations.

aml 40% confidence

Unidad de Análisis Financiero y Económico (UAFE) - The Financial and Economic Analysis Unit.

aml 40% confidence

Ley Orgánica de Prevención, Detección y Erradicación del Delito de Lavado de Activos y Financiamiento de Delitos (Organic Law for the Prevention, Detection, and Eradication of the Crime of Money Laundering and Financing of Crimes)

aml 40% confidence

Resolución No. UAFE-DG-2022-0001 (Resolution No. UAFE-DG-2022-0001)

aml 40% confidence

Identification and Verification of Customer Identity:

aml 40% confidence

Beneficial Ownership (BO) Identification:

aml 40% confidence

Purpose and Intended Nature of the Business Relationship:

aml 40% confidence

Continuously monitor customer transactions and activities to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile.

aml 40% confidence

Develop and implement a risk assessment framework to identify, assess, and mitigate ML/TF risks.

aml 40% confidence

Apply enhanced due diligence (EDD) for higher-risk customers (e.g., Politically Exposed Persons - PEPs, customers from high-risk jurisdictions, complex or unusually large transactions, new technologies and products that favor anonymity).

aml 40% confidence

Reporting Obligation: Any transaction, attempted transaction, or activity that raises suspicion of money laundering or terrorist financing, regardless of the amount, must be reported.

aml 40% confidence

No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or any third party that a report has been or will be submitted to UAFE.

aml 40% confidence

Internal Policies: VASPs must have internal policies and procedures to identify, evaluate, and report suspicious transactions.

aml 40% confidence

Transaction Records: All details of virtual asset transactions (e.g., amount, type of virtual asset, sender/recipient addresses, timestamps, fiat currency equivalents, transaction hashes).

enforcement 70% confidence

Legal Basis: Resolution 014-2014-M (or its subsequent reiterations) issued by the Monetary and Financial Policy and Regulation Board (Junta de Política y Regulación Monetaria y Financiera) and implemented by the Central Bank of Ecuador (BCE). This resolution, dated July 28, 2014, effectively banned private cryptocurrencies, stating that they are not recognized as legal tender and cannot be used as a means of payment within the country.

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
low

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — custodial wallet/SaaS providers may operate in Ecuador but face a fragmented regulatory landscape: AML registration with UAFE as an Obligated Subject is mandatory, but there is no dedicated crypto-custody or qualified-custodian regime; any hosted tokens classified as securities trigger full SCVS securities-law compliance, while payment-token custody risks BCE enforcement under the 2014 cryptocurrency ban.

Questions this verdict aims to answer

  • What custody license / qualified-custodian status applies?
  • What segregation, insurance, and proof-of-reserves rules apply?
  • What AML obligations attach to the SaaS vs the white-label client?