Custodial wallet / SaaS in Paraguay

Law No. 6995/2022: Ley que crea el marco regulatorio para la explotación comercial de la minería, comercialización y la industrialización de activos digitales criptoactivos (Law creating the regulatory framework for the commercial exploitation of mining, commercialization, and industrialization of crypto digital assets).

General Operating License: Law 6995/2022 mandates that any company engaged in the "commercial exploitation, mining, commercialization and industrialization of crypto assets" must obtain an operating license from the Ministry of Industry and Commerce (MIC).

Ministry of Industry and Commerce (MIC): This is the primary regulatory body designated by Law 6995/2022 for issuing operating licenses and overseeing the activities related to the commercial exploitation, mining, commercialization, and industrialization of crypto assets.

While the law defines "commercialization" broadly, it is not explicitly detailed whether a pure third-party custody service (i.e., not involved in mining or general trading platform operation) falls squarely under this definition, or if a separate, specific "custody license" is required.

There is no specific "crypto custody license" distinct from the general operating license for crypto businesses established by Law 6995/2022, nor is there a dedicated financial regulator (like the BCP) overseeing crypto custody in the same way they do for traditional financial institutions.

General commercial and consumer protection laws would apply, but there are no specific crypto-focused requirements for asset segregation.

No Explicit Requirements: The current legislation does not explicitly mandate insurance coverage or bonding requirements specifically for crypto asset custodians.

No Explicit Mandates: There are no explicit regulatory mandates in Paraguay for the use of cold storage (offline storage) for digital assets under custody. The law does not prescribe specific technical security measures for asset storage.

No Specific Definition: Paraguay's existing legislation does not provide a specific definition for a "qualified custodian" in the context of digital assets, similar to those found in U.S. or European financial regulations.

SEPRELAD (Secretaría de Prevención de Lavado de Dinero o Bienes): This is the key regulatory body for AML/CFT compliance for virtual assets. SEPRELAD defines Virtual Asset Service Providers (VASPs) and sets forth their obligations.

Resolution No. 222/2022: This resolution from SEPRELAD specifically established guidelines for the prevention of money laundering and terrorism financing for Virtual Asset Service Providers. It defines what constitutes a VASP and outlines their obligations.

Resolution No. 24/2023: This resolution modified certain aspects of Resolution No. 222/2022, particularly detailing reporting requirements for VASPs.

Custody Providers (Virtual Asset Custody Providers): Entities that provide safekeeping services for virtual assets or instruments enabling control over virtual assets are considered VASPs.

AML/KYC (Anti-Money Laundering / Know Your Customer): This is the core requirement.

Robust Policies and Procedures: Implementation of comprehensive AML/CFT policies and procedures, including risk assessment, customer due diligence (CDD), enhanced due diligence (EDD) for high-risk customers, and ongoing monitoring.

Customer Identification and Verification: Collecting and verifying identity information for natural and legal persons (KYC).

Transaction Monitoring: Monitoring transactions for suspicious patterns and activities.

Suspicious Activity Reports (SARs): Reporting suspicious transactions to SEPRELAD.

Compliance Officer: Appointment of a qualified and designated Compliance Officer responsible for AML/CFT compliance.

Employee Training: Regular training for employees on AML/CFT obligations.

Record Keeping: Maintaining records of customer identification data and transactions for the prescribed period (usually 5 years).

Legal Entity: The VASP must be established as a legal entity (e.g., corporation or limited liability company) duly registered in Paraguay.

Registered Office: Maintenance of a physical registered office in Paraguay.

SEPRELAD's resolutions for VASPs do not explicitly define a minimum capital requirement for the purpose of AML/CFT registration. However, as a business operating in Paraguay, the entity must demonstrate financial solvency and operational capacity, which implies having sufficient capital to operate responsibly and meet its obligations. Financial institutions, if a VASP were to be considered one, would have capital requirements imposed by the Central Bank (BCP), but currently, VASPs are primarily regulated for AML/CFT purposes, not as licensed financial institutions.

Technology and Security:

Internal Controls and Governance:

BCP Stance Example: Comunicado del BCP sobre criptomonedas (2021) (While older, it reflects their general position of non-recognition as legal tender/financial instrument under their direct oversight).

Entity Targeted: Numerous individuals and groups operating large-scale, unauthorized cryptocurrency mining farms. Outcome: Hundreds of illegal mining farms disconnected, numerous arrests, significant economic losses to operators through equipment confiscation and fines, and continued efforts by authorities to curb the practice.