Remote VASP serving residents in Paraguay

Banco Central del Paraguay (BCP) - Central Bank of Paraguay.

Secretaría de Prevención de Lavado de Dinero o Bienes (SEPRELAD) - Secretariat for the Prevention of Money or Asset Laundering.

October 2023 (SEPRELAD Resolution): SEPRELAD issues Resolution No. 343/2023, establishing the regulatory framework for the prevention of money laundering and terrorist financing for VASPs. This means non-compliance with these rules could lead to future fines.

July 2022 (BCP Warning): The BCP issued warnings about the risks associated with cryptocurrencies.

SEPRELAD (Secretaría de Prevención de Lavado de Dinero o Bienes): This is the key regulatory body for AML/CFT compliance for virtual assets. SEPRELAD defines Virtual Asset Service Providers (VASPs) and sets forth their obligations.

Resolution No. 222/2022: This resolution from SEPRELAD specifically established guidelines for the prevention of money laundering and terrorism financing for Virtual Asset Service Providers. It defines what constitutes a VASP and outlines their obligations.

Resolution No. 24/2023: This resolution modified certain aspects of Resolution No. 222/2022, particularly detailing reporting requirements for VASPs.

Law No. 7041/2023: While primarily focused on the energy aspects of crypto mining, this law indirectly touches upon the commercialization of crypto. However, it does not establish a specific licensing regime for VASPs in the sense of financial services licensing, deferring that to SEPRELAD's AML/CFT framework.

Exchanges (Virtual Asset Exchange Providers): Entities that conduct the exchange between virtual assets and fiat currencies, or between one or more forms of virtual assets, are considered VASPs.

Custody Providers (Virtual Asset Custody Providers): Entities that provide safekeeping services for virtual assets or instruments enabling control over virtual assets are considered VASPs.

Payment Processors (Virtual Asset Transfer Providers): Entities that perform transfers of virtual assets on behalf of another natural or legal person. If a payment processor facilitates transactions involving virtual assets (e.g., sending/receiving crypto), they would fall under this definition. If they only process fiat payments for crypto services without touching the crypto itself, they might be subject to traditional payment processor regulations but not necessarily VASP-specific rules.

AML/KYC (Anti-Money Laundering / Know Your Customer): This is the core requirement.

Robust Policies and Procedures: Implementation of comprehensive AML/CFT policies and procedures, including risk assessment, customer due diligence (CDD), enhanced due diligence (EDD) for high-risk customers, and ongoing monitoring.

Customer Identification and Verification: Collecting and verifying identity information for natural and legal persons (KYC).

Transaction Monitoring: Monitoring transactions for suspicious patterns and activities.

Suspicious Activity Reports (SARs): Reporting suspicious transactions to SEPRELAD.

Compliance Officer: Appointment of a qualified and designated Compliance Officer responsible for AML/CFT compliance.

Employee Training: Regular training for employees on AML/CFT obligations.

Record Keeping: Maintaining records of customer identification data and transactions for the prescribed period (usually 5 years).

Legal Entity: The VASP must be established as a legal entity (e.g., corporation or limited liability company) duly registered in Paraguay.

Registered Office: Maintenance of a physical registered office in Paraguay.

SEPRELAD's resolutions for VASPs do not explicitly define a minimum capital requirement for the purpose of AML/CFT registration. However, as a business operating in Paraguay, the entity must demonstrate financial solvency and operational capacity, which implies having sufficient capital to operate responsibly and meet its obligations. Financial institutions, if a VASP were to be considered one, would have capital requirements imposed by the Central Bank (BCP), but currently, VASPs are primarily regulated for AML/CFT purposes, not as licensed financial institutions.

Technology and Security:

Internal Controls and Governance:

General Operating License: Law 6995/2022 mandates that any company engaged in the "commercial exploitation, mining, commercialization and industrialization of crypto assets" must obtain an operating license from the Ministry of Industry and Commerce (MIC).

Ministry of Industry and Commerce (MIC): This is the primary regulatory body designated by Law 6995/2022 for issuing operating licenses and overseeing the activities related to the commercial exploitation, mining, commercialization, and industrialization of crypto assets.

Banco Central del Paraguay (BCP): The BCP has historically maintained a cautious stance. They have issued statements emphasizing that cryptocurrencies are not legal tender in Paraguay and do not fall under their direct regulation as financial instruments or currencies. They typically do not issue licenses for crypto-related financial services.

No Specific Definition: Paraguay's existing legislation does not provide a specific definition for a "qualified custodian" in the context of digital assets, similar to those found in U.S. or European financial regulations.

No Explicit Requirements: The current legislation does not explicitly mandate insurance coverage or bonding requirements specifically for crypto asset custodians.

No Explicit Mandates: There are no explicit regulatory mandates in Paraguay for the use of cold storage (offline storage) for digital assets under custody. The law does not prescribe specific technical security measures for asset storage.

Entity Targeted: Numerous individuals and groups operating large-scale, unauthorized cryptocurrency mining farms. Outcome: Hundreds of illegal mining farms disconnected, numerous arrests, significant economic losses to operators through equipment confiscation and fines, and continued efforts by authorities to curb the practice.

Entity Targeted: The general public and potential Virtual Asset Service Providers (VASPs). Violation Type: Not applicable, as these are warnings/guidance, not punitive actions. Penalty Amount: Not applicable. Outcome: Increased awareness of risks, and a clear signal that regulatory oversight for VASPs is developing. SEPRELAD has issued guidance on AML/CFT for VASPs, indicating future enforcement will likely come from them once a comprehensive licensing regime is in place.

Outcome: Hundreds of illegal mining farms disconnected, numerous arrests, significant economic losses to operators through equipment confiscation and fines, and continued efforts by authorities to curb the practice.

Outcome: Increased awareness of risks, and a clear signal that regulatory oversight for VASPs is developing. SEPRELAD has issued guidance on AML/CFT for VASPs, indicating future enforcement will likely come from them once a comprehensive licensing regime is in place.