On-shore VASP in Peru

No specific Licensing Regime for VASPs: There is no dedicated law requiring crypto exchanges, custody providers, or crypto-focused payment processors to obtain a specific "virtual asset license" from a regulatory body like the Superintendencia de Banca, Seguros y AFP (SBS) or the Banco Central de Reserva del Perú (BCRP).

AML/CTF Obligations for Existing "Obligated Subjects": The primary regulatory interaction for entities dealing with virtual assets comes from the Unidad de Inteligencia Financiera del Perú (UIF-Perú), which oversees AML/CTF compliance. Existing "obligated subjects" (sujetos obligados) under the AML/CTF framework (like banks, financial institutions, payment service providers dealing with fiat, and money transmitters) are expected to manage risks associated with virtual assets if they engage with them.

No specific crypto exchange license is required.

They typically operate under general commercial law, registering as a regular company in Peru.

However, if an exchange facilitates fiat-to-crypto or crypto-to-fiat conversions, or offers services that could be interpreted as financial intermediation or money transmission under existing laws, there's a risk they might be expected to comply with some aspects of financial regulation, particularly AML/CTF.

No specific crypto custody license is required.

Similar to exchanges, they operate under general company law.

If custody services evolve to offer interest-bearing accounts, lending, or other financial products using virtual assets, they could potentially attract scrutiny from the SBS and might be deemed to require traditional financial licenses.

No specific crypto payment processor license is required.

If they only process crypto-to-crypto payments, they generally fall outside existing financial services regulations.

If they facilitate crypto-to-fiat or fiat-to-crypto payments, or if their services resemble traditional payment services (e.g., money transfers in fiat), they might be subject to the regulations applicable to Electronic Money Issuing Companies (Empresas Emisoras de Dinero Electrónico - EEDEs) or other payment service providers, which are regulated by the SBS. However, the direct application to pure-play crypto firms is often unclear.

No specific capital requirements for VASPs. General company formation capital requirements apply based on the chosen legal entity type (e.g., S.A.C., S.A.A.).

If a VASP were to be deemed a traditional financial institution (e.g., an EEDE), then significant capital requirements mandated by the SBS would apply.

AML/KYC (Anti-Money Laundering/Know Your Customer): This is the most relevant area.

While VASPs are not explicitly listed as "obligated subjects" in the current AML/CTF law, the UIF-Perú encourages all entities engaged in activities susceptible to money laundering (including new technologies) to implement robust AML/KYC practices.

Expected Practices (even if not explicitly licensed):

Customer Due Diligence (CDD): Implementing KYC procedures to identify and verify customers (natural persons and legal entities).

Enhanced Due Diligence (EDD): For higher-risk customers or transactions.

Monitoring Transactions: Identifying unusual or suspicious patterns.

Reporting Suspicious Transactions (ROS): Reporting any suspicious activity to the UIF-Perú.

Record-Keeping: Maintaining records of transactions and customer data.

Risk Assessment: Conducting a comprehensive risk assessment of money laundering and terrorist financing risks.

Internal Controls: Establishing internal policies, procedures, and training programs.

Resolución SBS N° 893-2019 (and its preceding/subsequent modifications):

What it means for VASPs: VASPs are now required to implement an AML/CFT compliance program, appoint a compliance officer, and report to the UIF-Perú.

FATF Recommendations: As a member of the Financial Action Task Force of Latin America (GAFILAT/FATF-LAC), Peru is committed to implementing the FATF Recommendations. FATF Recommendation 15 specifically calls for countries to regulate and supervise VASPs for AML/CFT purposes, and to apply the FATF standards to them. Peru's regulatory moves reflect this commitment.

Identification and Verification:

Beneficial Ownership: Identify and verify the natural person(s) who ultimately own or control the customer, or on whose behalf a transaction is being conducted.

Purpose and Intended Nature of Business Relationship: Understand the customer's activities and the intended purpose and nature of the business relationship or transaction.

Ongoing Monitoring: Continuously monitor the business relationship and transactions to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile. This includes monitoring for unusual or suspicious transaction patterns.

Simplified CDD: May be applied in situations of lower risk, provided the VASP has sufficient information to determine that the risk is low.

Enhanced Due Diligence (EDD): Required for higher-risk customers, business relationships, or transactions. This includes:

Customers from high-risk jurisdictions.

Politically Exposed Persons (PEPs) and their family members/close associates.

Transactions involving significant amounts of virtual assets.

Transactions with unusual patterns or no apparent economic or lawful purpose.

Collecting additional information on the customer, beneficial owner, source of funds/wealth, and the reasons for the intended transactions.

Obtaining senior management approval for establishing or continuing relationships with such customers.