DeFi protocol frontend in Peru

No specific Licensing Regime for VASPs: There is no dedicated law requiring crypto exchanges, custody providers, or crypto-focused payment processors to obtain a specific "virtual asset license" from a regulatory body like the Superintendencia de Banca, Seguros y AFP (SBS) or the Banco Central de Reserva del Perú (BCRP).

AML/CTF Obligations for Existing "Obligated Subjects": The primary regulatory interaction for entities dealing with virtual assets comes from the Unidad de Inteligencia Financiera del Perú (UIF-Perú), which oversees AML/CTF compliance. Existing "obligated subjects" (sujetos obligados) under the AML/CTF framework (like banks, financial institutions, payment service providers dealing with fiat, and money transmitters) are expected to manage risks associated with virtual assets if they engage with them.

No specific crypto exchange license is required.

They typically operate under general commercial law, registering as a regular company in Peru.

However, if an exchange facilitates fiat-to-crypto or crypto-to-fiat conversions, or offers services that could be interpreted as financial intermediation or money transmission under existing laws, there's a risk they might be expected to comply with some aspects of financial regulation, particularly AML/CTF.

If they facilitate crypto-to-fiat or fiat-to-crypto payments, or if their services resemble traditional payment services (e.g., money transfers in fiat), they might be subject to the regulations applicable to Electronic Money Issuing Companies (Empresas Emisoras de Dinero Electrónico - EEDEs) or other payment service providers, which are regulated by the SBS. However, the direct application to pure-play crypto firms is often unclear.

AML/KYC (Anti-Money Laundering/Know Your Customer): This is the most relevant area.

While VASPs are not explicitly listed as "obligated subjects" in the current AML/CTF law, the UIF-Perú encourages all entities engaged in activities susceptible to money laundering (including new technologies) to implement robust AML/KYC practices.

Customer Due Diligence (CDD): Implementing KYC procedures to identify and verify customers (natural persons and legal entities).

Reporting Suspicious Transactions (ROS): Reporting any suspicious activity to the UIF-Perú.

Record-Keeping: Maintaining records of transactions and customer data.

Risk Assessment: Conducting a comprehensive risk assessment of money laundering and terrorist financing risks.

Internal Controls: Establishing internal policies, procedures, and training programs.

Resolución SBS N° 893-2019 (and its preceding/subsequent modifications):

What it means for VASPs: VASPs are now required to implement an AML/CFT compliance program, appoint a compliance officer, and report to the UIF-Perú.

Identification and Verification:

Individuals: Obtain and verify identity using reliable independent source documents (e.g., national ID, passport). This includes full name, date of birth, place of birth, nationality, address, and national identification number.

Legal Entities: Obtain and verify legal name, legal form, address of main place of business, names of directors/partners, legal representative, and evidence of legal existence (e.g., articles of incorporation, business registration).

Beneficial Ownership: Identify and verify the natural person(s) who ultimately own or control the customer, or on whose behalf a transaction is being conducted.

Ongoing Monitoring: Continuously monitor the business relationship and transactions to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile. This includes monitoring for unusual or suspicious transaction patterns.

Enhanced Due Diligence (EDD): Required for higher-risk customers, business relationships, or transactions. This includes:

Customers from high-risk jurisdictions.

Politically Exposed Persons (PEPs) and their family members/close associates.

If a VASP were to be deemed a traditional financial institution (e.g., an EEDE), then significant capital requirements mandated by the SBS would apply.

If custody services evolve to offer interest-bearing accounts, lending, or other financial products using virtual assets, they could potentially attract scrutiny from the SBS and might be deemed to require traditional financial licenses.