Custodial wallet / SaaS in El Salvador
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in El Salvador with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- Licensing trigger: Any entity providing custody services for digital assets to third parties must be licensed as a Digital Asset Service Provider (PSAD) by the CNAD under the Digital Assets Issuance Law.
- Customer CDD: Obtain and verify identity using reliable independent source documents (valid national ID, passport) — full name, date of birth, nationality, address, unique ID number (sv.aml.natural-persons-obtain-and-verify, sv.aml.identification-and-verification).
- Legal entity CDD: Obtain and verify legal name, legal form, address, proof of incorporation, articles of association, names of directors and beneficial owners, authorized signatories (sv.aml.legal-entities-obtain-and-verify).
- Beneficial ownership identification: Identify and verify individuals who ultimately own or control 25% or more of the entity (sv.aml.beneficial-ownership-identify-and-verify).
- Risk-based customer classification: Classify customers as low/medium/high risk; apply enhanced due diligence (EDD) for higher-risk customers (sv.aml.vasps-must-classify-customers-based, sv.aml.edd-measures-may-include-obtaining).
- PEP screening: Politically Exposed Persons are always high-risk and require EDD, senior management approval, and source-of-wealth/funds verification (sv.aml.politically-exposed-persons-peps-are).
- Ongoing monitoring: Regularly review customer relationships, keep information up-to-date, monitor for changes in beneficial ownership or risk profile (sv.aml.regularly-review-the-customer-relationship, sv.aml.keep-customer-information-up-to-date-especially, sv.aml.monitor-for-changes-in-beneficial).
- The foundational AML/CFT statute is the Ley Contra el Lavado de Dinero y de Activos (LCLDA); VASPs are obliged entities under it (sv.aml.ley-contra-el-lavado-de, sv.aml.purpose-this-is-the-foundational).
- The Law for the Regulation of Virtual Asset Service Providers (LRPVAS), promulgated June 2023, imposes specific AML/CFT, consumer protection, and prudential requirements on VASPs (sv.aml.ley-de-regulacin-de-los, sv.aml.purpose-this-is-the-most).
- The SSF-issued Norms for the Prevention of Money Laundering and Terrorism Financing (NPLDFT) provide detailed implementation requirements for supervised entities handling virtual assets (sv.aml.normas-para-la-prevencin-del, sv.aml.purpose-these-norms-provide-detailed).
Key Restrictions
- Must obtain a PSAD (Digital Asset Service Provider) license from CNAD before offering custody services (sv.custody.who-any-entity-intending-to, sv.custody.digital-assets-issuance-law-article).
- Must be legally constituted in El Salvador (sv.custody.legal-constitution-in-el-salvador).
- Must meet minimum capital requirements (to be defined by CNAD norms) (sv.custody.minimum-capital-requirements-to-be).
- Client digital assets must be segregated from the custodian's proprietary assets (sv.custody.mandate-digital-asset-service-providers, sv.custody.digital-assets-issuance-law-article).
- Must implement financial guarantee or insurance fund mechanisms for client benefit against losses or damages; specific amounts/types to be elaborated in CNAD technical norms (sv.custody.digital-assets-issuance-law-article).
- Must adopt adequate technical and organizational measures to safeguard digital assets held on behalf of clients, strongly implying cold storage / secure key management (sv.custody.interpretation-while-the-law-does).
- Custodians owe a fiduciary duty to act in the best interest of clients and safeguard assets 'with the diligence of a good merchant' (sv.custody.digital-assets-issuance-law-article).
- Cannot rely on the Bitcoin Law exemption for capital gains; the full PSAD licensing and AML regime applies to custody services beyond simple Bitcoin-as-legal-tender usage.
Key Risks
- CNAD technical norms for capital requirements, insurance/guarantee fund specifics, and custody operational standards are not yet published — creating regulatory uncertainty on exact thresholds (sv.custody.details-the-specific-amounts-types).
- The CNAD is a new regulator (established 2023) with limited enforcement track record; licensing timelines and application rigor are untested (sv.enforcement.new-laws-new-regulation-the).
- AML obligations may apply to both the SaaS custodian (as the licensed PSAD) and white-label clients (as obliged entities dealing with virtual assets), creating potential dual-reporting complexity.
- Political and reputational risk: El Salvador's high-profile Bitcoin adoption has attracted international scrutiny (IMF, FATF); regulatory changes or international pressure could shift the operating environment.
- Chivo Wallet problems (fraud, identity theft, technical glitches) demonstrate that even the government struggles with custody/operational security, increasing the compliance burden on private custodians (sv.enforcement.chivo-wallet-issues-internal-controls).
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Ley Bitcoin (Bitcoin Law) - Enacted September 7, 2021:
This law made Bitcoin legal tender in El Salvador. While it mandates businesses to accept Bitcoin, it does not extensively regulate third-party digital asset custody providers. Its focus is more on the adoption and use of Bitcoin within the national economy.
Ley de Emisión de Activos Digitales (Digital Assets Issuance Law) - Enacted January 10, 2023:
Who: Any entity intending to provide "custody services" for digital assets to third parties must be licensed as a Digital Asset Service Provider (Proveedor de Servicios de Activos Digitales - PSAD).
Regulator: The CNAD is responsible for granting, denying, suspending, and revoking these licenses.
Legal constitution in El Salvador.
Minimum capital requirements (to be defined by CNAD norms).
Digital Assets Issuance Law, Article 12: States that "Digital Asset Service Providers may offer, among others, the following services: ... b) Custody services of Digital Assets owned by third parties."
Digital Assets Issuance Law, Article 12: States that "Digital Asset Service Providers may offer, among others, the following services: ... b) Custody services of Digital Assets owned by third parties."
Digital Assets Issuance Law, Articles 14-17: Detail the application process, requirements for applicants, and powers of the CNAD in licensing.
Mandate: Digital Asset Service Providers offering custody services are explicitly required to keep client assets separate from their own proprietary assets.
Digital Assets Issuance Law, Article 12: States that "Digital Asset Service Providers may offer, among others, the following services: ... b) Custody services of Digital Assets owned by third parties."
Digital Assets Issuance Law, Article 12: States that "Digital Asset Service Providers may offer, among others, the following services: ... b) Custody services of Digital Assets owned by third parties."
Digital Assets Issuance Law, Article 12: States that "Digital Asset Service Providers may offer, among others, the following services: ... b) Custody services of Digital Assets owned by third parties."
Details: The specific amounts, types of guarantees, and conditions for these insurance or guarantee funds are expected to be elaborated in subsequent technical norms (Normas Técnicas) issued by the CNAD.
Interpretation: While the law does not explicitly use the term "cold storage," the mandate for "adequate technical and organizational measures" and "protection of private keys" strongly implies the use of highly secure storage solutions. Industry best practices widely recognize cold storage as a critical component for secure digital asset custody, especially for a significant portion of client assets. Detailed technical requirements are likely to be specified in the CNAD's forthcoming norms.
Definition: In El Salvador, a "qualified custodian" for digital assets is essentially a Digital Asset Service Provider (PSAD) that has obtained the necessary license from the CNAD to offer custody services.
Comisión Nacional de Activos Digitales (CNAD): (National Commission of Digital Assets)
Ley de Emisión de Activos Digitales (Digital Assets Issuance Law)
Ley Contra el Lavado de Dinero y de Activos (LCLDA)
Purpose: This is the foundational AML/CFT law in El Salvador, applicable to a wide range of obliged entities. VASPs fall under its scope, requiring them to implement robust AML/CFT programs.
Ley de Regulación de los Proveedores de Servicios de Activos Virtuales (LRPVAS)
Purpose: This is the most specific and comprehensive law directly addressing VASPs. It establishes a licensing regime for VASPs and explicitly lays out their AML/CFT obligations, consumer protection measures, and prudential requirements. It covers services such as virtual asset exchange, transfer, custody, and participation in financial services related to virtual asset issuance.
Normas para la Prevención del Lavado de Dinero y Activos y del Financiamiento del Terrorismo (NPLDFT)
Purpose: These norms provide detailed requirements for supervised entities (including those handling virtual assets under the SSF's purview) regarding the implementation of AML/CFT policies, procedures, and controls.
Identification and Verification:
Natural Persons: Obtain and verify identity using reliable independent source documents (e.g., valid national identity card, passport). This includes full name, date of birth, nationality, address, and unique identification number.
Legal Entities: Obtain and verify legal name, legal form, address, proof of incorporation, articles of association, names of directors and beneficial owners, and authorized signatories.
Beneficial Ownership: Identify and verify the identity of beneficial owners (individuals who ultimately own or control 25% or more of the entity) for legal entities.
VASPs must classify customers based on their AML/CFT risk (low, medium, high) and apply enhanced due diligence (EDD) measures for higher-risk customers.
EDD measures may include obtaining additional identifying information, requiring more frequent updates, verifying the source of funds/wealth, and obtaining senior management approval for the relationship.
Politically Exposed Persons (PEPs) are always considered high-risk and require EDD, including senior management approval and establishing the source of wealth/funds.
Regularly review the customer relationship to ensure that transactions are consistent with the VASP's knowledge of the customer, their business, and risk profile.
Keep customer information up-to-date, especially for high-risk customers.
Monitor for changes in beneficial ownership or customer risk profile.
Comisión Nacional de Activos Digitales (CNAD) - National Commission of Digital Assets:
New Laws, New Regulation: The most significant development is the creation of the Digital Assets Issuance Law and the CNAD in early 2023. This law establishes licensing requirements for digital asset service providers. Enforcement will primarily occur as the CNAD begins to fully implement its mandate, licenses entities, and addresses non-compliance with these new rules.
Chivo Wallet Issues & Internal Controls:
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — custodial wallet / SaaS operators must obtain a PSAD license from the CNAD, incorporate locally in El Salvador, segregate client assets, implement a financial guarantee or insurance mechanism (specifics pending technical norms), and comply with the full AML/CFT regime under the LCLDA, LRPVAS, and SSF norms, with the key risk being that CNAD technical standards are not yet finalized.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?