Crypto ATM / kiosk operator in Peru

No specific Licensing Regime for VASPs: There is no dedicated law requiring crypto exchanges, custody providers, or crypto-focused payment processors to obtain a specific "virtual asset license" from a regulatory body like the Superintendencia de Banca, Seguros y AFP (SBS) or the Banco Central de Reserva del Perú (BCRP).

AML/CTF Obligations for Existing "Obligated Subjects": The primary regulatory interaction for entities dealing with virtual assets comes from the Unidad de Inteligencia Financiera del Perú (UIF-Perú), which oversees AML/CTF compliance. Existing "obligated subjects" (sujetos obligados) under the AML/CTF framework (like banks, financial institutions, payment service providers dealing with fiat, and money transmitters) are expected to manage risks associated with virtual assets if they engage with them.

No specific crypto exchange license is required.

They typically operate under general commercial law, registering as a regular company in Peru.

However, if an exchange facilitates fiat-to-crypto or crypto-to-fiat conversions, or offers services that could be interpreted as financial intermediation or money transmission under existing laws, there's a risk they might be expected to comply with some aspects of financial regulation, particularly AML/CTF.

AML/KYC (Anti-Money Laundering/Know Your Customer): This is the most relevant area.

Customer Due Diligence (CDD): Implementing KYC procedures to identify and verify customers (natural persons and legal entities).

Enhanced Due Diligence (EDD): For higher-risk customers or transactions.

Monitoring Transactions: Identifying unusual or suspicious patterns.

Reporting Suspicious Transactions (ROS): Reporting any suspicious activity to the UIF-Perú.

Record-Keeping: Maintaining records of transactions and customer data.

Risk Assessment: Conducting a comprehensive risk assessment of money laundering and terrorist financing risks.

Internal Controls: Establishing internal policies, procedures, and training programs.

Resolución SBS N° 893-2019 (and its preceding/subsequent modifications):

What it means for VASPs: VASPs are now required to implement an AML/CFT compliance program, appoint a compliance officer, and report to the UIF-Perú.

Identification and Verification:

Individuals: Obtain and verify identity using reliable independent source documents (e.g., national ID, passport). This includes full name, date of birth, place of birth, nationality, address, and national identification number.

Legal Entities: Obtain and verify legal name, legal form, address of main place of business, names of directors/partners, legal representative, and evidence of legal existence (e.g., articles of incorporation, business registration).

Beneficial Ownership: Identify and verify the natural person(s) who ultimately own or control the customer, or on whose behalf a transaction is being conducted.

Purpose and Intended Nature of Business Relationship: Understand the customer's activities and the intended purpose and nature of the business relationship or transaction.

Ongoing Monitoring: Continuously monitor the business relationship and transactions to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile. This includes monitoring for unusual or suspicious transaction patterns.

Enhanced Due Diligence (EDD): Required for higher-risk customers, business relationships, or transactions. This includes:

Customers from high-risk jurisdictions.

Politically Exposed Persons (PEPs) and their family members/close associates.

Transactions involving significant amounts of virtual assets.

Transactions with unusual patterns or no apparent economic or lawful purpose.

Collecting additional information on the customer, beneficial owner, source of funds/wealth, and the reasons for the intended transactions.

Obtaining senior management approval for establishing or continuing relationships with such customers.