DeFi protocol frontend in Paraguay
Operates a web frontend or aggregator that interacts with permissionless smart contracts on behalf of users. May or may not screen users / restrict regions.
DeFi frontend is conditionally permitted in Paraguay with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- AML/KYC obligations under SEPRELAD oversight via Resolution No. 222/2022 and Resolution No. 24/2023 for any entity qualifying as a VASP
- Customer identification and verification (KYC) for natural and legal persons
- Transaction monitoring for suspicious patterns and activities
- Suspicious Activity Reports (SARs) filing to SEPRELAD
- Appointment of a qualified Compliance Officer responsible for AML/CFT compliance
- Regular employee training on AML/CFT obligations
- Record keeping of customer identification data and transactions for at least 5 years
- Implementation of robust AML/CFT policies and procedures including risk assessment, CDD, and EDD for high-risk customers
- Adherence to FATF Recommendation 15 and Interpretive Note on virtual assets and VASPs (Paraguay is a GAFILAT member)
Key Restrictions
- The frontend operator likely qualifies as a VASP if it facilitates virtual asset transfers/exchanges on behalf of users (payment processor or exchange service definition under SEPRELAD), triggering AML/CFT registration obligations
- Legal entity (corporation or LLC) must be established and duly registered in Paraguay with a physical registered office
- Must obtain a general operating license from the Ministry of Industry and Commerce (MIC) under Law No. 6995/2022 if engaged in 'commercialization' of crypto assets
- If the frontend merely provides non-custodial user interface to permissionless protocols without taking fees or exercising control over transactions, the VASP classification is ambiguous — fee-taking increases the likelihood of regulation
- No explicit exemption for decentralized protocols — SEPRELAD's VASP definitions are broad and could cover frontend operators facilitating transactions
Key Risks
- Regulatory ambiguity: Paraguay's crypto laws (Law 6995/2022, Law 7041/2023) focus on mining and commercialization; frontend/DeFi protocol operation is not clearly addressed, creating uncertainty
- SEPRELAD has issued AML/CFT resolutions for VASPs but enforcement against DeFi frontends is untested — potential for retroactive enforcement or broad interpretation
- BCP has publicly warned about crypto risks and does not recognize crypto as legal tender — negative regulatory sentiment could lead to restrictive measures
- Primary enforcement activity to date has targeted illegal crypto mining (electricity theft), not VASPs, meaning SEPRELAD's enforcement posture on frontends is unknown
- If fee-taking occurs without proper licensing/registration, operator could face criminal charges or SEPRELAD sanctions
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Resolution No. 222/2022: This resolution from SEPRELAD specifically established guidelines for the prevention of money laundering and terrorism financing for Virtual Asset Service Providers. It defines what constitutes a VASP and outlines their obligations.
Resolution No. 24/2023: This resolution modified certain aspects of Resolution No. 222/2022, particularly detailing reporting requirements for VASPs.
SEPRELAD (Secretaría de Prevención de Lavado de Dinero o Bienes): This is the key regulatory body for AML/CFT compliance for virtual assets. SEPRELAD defines Virtual Asset Service Providers (VASPs) and sets forth their obligations.
Exchanges (Virtual Asset Exchange Providers): Entities that conduct the exchange between virtual assets and fiat currencies, or between one or more forms of virtual assets, are considered VASPs.
Payment Processors (Virtual Asset Transfer Providers): Entities that perform transfers of virtual assets on behalf of another natural or legal person. If a payment processor facilitates transactions involving virtual assets (e.g., sending/receiving crypto), they would fall under this definition. If they only process fiat payments for crypto services without touching the crypto itself, they might be subject to traditional payment processor regulations but not necessarily VASP-specific rules.
AML/KYC (Anti-Money Laundering / Know Your Customer): This is the core requirement.
Legal Entity: The VASP must be established as a legal entity (e.g., corporation or limited liability company) duly registered in Paraguay.
Registered Office: Maintenance of a physical registered office in Paraguay.
FATF Recommendations: Paraguay, as a member of GAFILAT (the regional FATF-style body), adheres to FATF recommendations, which include guidance on virtual assets and VASPs (Recommendation 15 and its Interpretive Note).
General Operating License: Law 6995/2022 mandates that any company engaged in the "commercial exploitation, mining, commercialization and industrialization of crypto assets" must obtain an operating license from the Ministry of Industry and Commerce (MIC).
Ministry of Industry and Commerce (MIC): This is the primary regulatory body designated by Law 6995/2022 for issuing operating licenses and overseeing the activities related to the commercial exploitation, mining, commercialization, and industrialization of crypto assets.
Banco Central del Paraguay (BCP) - Central Bank of Paraguay.
Secretaría de Prevención de Lavado de Dinero o Bienes (SEPRELAD) - Secretariat for the Prevention of Money or Asset Laundering.
October 2023 (SEPRELAD Resolution): SEPRELAD issues Resolution No. 343/2023, establishing the regulatory framework for the prevention of money laundering and terrorist financing for VASPs. This means non-compliance with these rules could lead to future fines.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- low
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — operating a DeFi frontend in Paraguay likely requires VASP registration with SEPRELAD (AML/CFT obligations) and may require an MIC operating license under Law 6995/2022 if the operator facilitates transactions or takes fees, but legal clarity is low due to a lack of specific DeFi/protocol exemptions and no enforcement precedent against frontend operators.
Questions this verdict aims to answer
- Is operating the frontend a regulated activity even if the protocol is decentralized?
- What geofencing or KYC obligations apply?
- Does fee-taking change classification?