Centralized exchange in Paraguay

Law No. 6995/2022: Ley que crea el marco regulatorio para la explotación comercial de la minería, comercialización y la industrialización de activos digitales criptoactivos (Law creating the regulatory framework for the commercial exploitation of mining, commercialization, and industrialization of crypto digital assets).

Ministry of Industry and Commerce (MIC): This is the primary regulatory body designated by Law 6995/2022 for issuing operating licenses and overseeing the activities related to the commercial exploitation, mining, commercialization, and industrialization of crypto assets.

General Operating License: Law 6995/2022 mandates that any company engaged in the "commercial exploitation, mining, commercialization and industrialization of crypto assets" must obtain an operating license from the Ministry of Industry and Commerce (MIC).

SEPRELAD (Secretaría de Prevención de Lavado de Dinero o Bienes): This is the key regulatory body for AML/CFT compliance for virtual assets. SEPRELAD defines Virtual Asset Service Providers (VASPs) and sets forth their obligations.

Resolution No. 222/2022: This resolution from SEPRELAD specifically established guidelines for the prevention of money laundering and terrorism financing for Virtual Asset Service Providers. It defines what constitutes a VASP and outlines their obligations.

Resolution No. 24/2023: This resolution modified certain aspects of Resolution No. 222/2022, particularly detailing reporting requirements for VASPs.

FATF Recommendations: Paraguay, as a member of GAFILAT (the regional FATF-style body), adheres to FATF recommendations, which include guidance on virtual assets and VASPs (Recommendation 15 and its Interpretive Note).

Exchanges (Virtual Asset Exchange Providers): Entities that conduct the exchange between virtual assets and fiat currencies, or between one or more forms of virtual assets, are considered VASPs.

Custody Providers (Virtual Asset Custody Providers): Entities that provide safekeeping services for virtual assets or instruments enabling control over virtual assets are considered VASPs.

AML/KYC (Anti-Money Laundering / Know Your Customer): This is the core requirement.

Robust Policies and Procedures: Implementation of comprehensive AML/CFT policies and procedures, including risk assessment, customer due diligence (CDD), enhanced due diligence (EDD) for high-risk customers, and ongoing monitoring.

Customer Identification and Verification: Collecting and verifying identity information for natural and legal persons (KYC).

Transaction Monitoring: Monitoring transactions for suspicious patterns and activities.

Suspicious Activity Reports (SARs): Reporting suspicious transactions to SEPRELAD.

Compliance Officer: Appointment of a qualified and designated Compliance Officer responsible for AML/CFT compliance.

Employee Training: Regular training for employees on AML/CFT obligations.

Record Keeping: Maintaining records of customer identification data and transactions for the prescribed period (usually 5 years).

Legal Entity: The VASP must be established as a legal entity (e.g., corporation or limited liability company) duly registered in Paraguay.

Registered Office: Maintenance of a physical registered office in Paraguay.

There is no specific "crypto custody license" distinct from the general operating license for crypto businesses established by Law 6995/2022, nor is there a dedicated financial regulator (like the BCP) overseeing crypto custody in the same way they do for traditional financial institutions.

No Explicit Requirements: The current legislation does not explicitly mandate insurance coverage or bonding requirements specifically for crypto asset custodians.

No Explicit Mandates: There are no explicit regulatory mandates in Paraguay for the use of cold storage (offline storage) for digital assets under custody. The law does not prescribe specific technical security measures for asset storage.

No Specific Definition: Paraguay's existing legislation does not provide a specific definition for a "qualified custodian" in the context of digital assets, similar to those found in U.S. or European financial regulations.

General commercial and consumer protection laws would apply, but there are no specific crypto-focused requirements for asset segregation.