El Salvador -- Custody Regulations Regulatory Overview

El Salvador has established a unique regulatory framework for digital assets, primarily through two key pieces of legislation: the Bitcoin Law (Ley Bitcoin) and the more comprehensive Digital Assets Issuance Law (Ley de Emisión de Activos Digitales). The latter is the primary source of regulation for digital asset service providers, including those offering custody services.

The regulatory body responsible for overseeing the digital asset market and issuing licenses is the National Commission of Digital Assets (Comisión Nacional de Activos Digitales - CNAD), established by the Digital Assets Issuance Law.

Here’s a breakdown of the cryptocurrency/digital asset custody regulations in El Salvador:

1. Overall Regulatory Framework

• Ley Bitcoin (Bitcoin Law) - Enacted September 7, 2021:

  • This law made Bitcoin legal tender in El Salvador. While it mandates businesses to accept Bitcoin, it does not extensively regulate third-party digital asset custody providers. Its focus is more on the adoption and use of Bitcoin within the national economy.
  • Reference: Ley Bitcoin (Official Text - Spanish) (Page 13, Decreto No. 57)

• Ley de Emisión de Activos Digitales (Digital Assets Issuance Law) - Enacted January 10, 2023:

  • This is the cornerstone for regulating digital asset issuance, trading, and services, including custody. It creates the legal framework for the issuance of digital assets by the state and private entities, and for the operation of Digital Asset Service Providers (PSAD).
  • Reference: Ley de Emisión de Activos Digitales (Official Text - Spanish)

2. Specific Custody Regulations

a. Custodial License Requirements

• Who: Any entity intending to provide "custody services" for digital assets to third parties must be licensed as a Digital Asset Service Provider (Proveedor de Servicios de Activos Digitales - PSAD).
• Regulator: The CNAD is responsible for granting, denying, suspending, and revoking these licenses.
• Requirements: Applicants must meet several criteria, including:
  • Legal constitution in El Salvador.
  • Minimum capital requirements (to be defined by CNAD norms).
  • Robust governance, risk management, and internal control systems.
  • Fit and proper requirements for directors and management.
  • Adherence to anti-money laundering (AML) and combating the financing of terrorism (CFT) obligations.
• Specific Reference:
  • Digital Assets Issuance Law, Article 12: States that "Digital Asset Service Providers may offer, among others, the following services: ... b) Custody services of Digital Assets owned by third parties."
  • Digital Assets Issuance Law, Article 13: Mandates that "Any person who intends to provide Digital Asset Services must obtain a license issued by the CNAD."
  • Digital Assets Issuance Law, Articles 14-17: Detail the application process, requirements for applicants, and powers of the CNAD in licensing.

b. Segregation of Client Assets Rules

• Mandate: Digital Asset Service Providers offering custody services are explicitly required to keep client assets separate from their own proprietary assets.
• Specific Reference:
  • Digital Assets Issuance Law, Article 20, Paragraph 2: "Those who provide custody services for digital assets belonging to third parties shall adopt adequate technical and organizational measures to safeguard the digital assets held on behalf of their clients and shall ensure that they are kept separated and clearly identified from their own assets."
  • Digital Assets Issuance Law, Article 21: Establishes a fiduciary duty for custodians, requiring them to act in the best interest of their clients and to safeguard their digital assets "with the diligence of a good merchant."

c. Insurance/Bonding Requirements

• Mandate: Custodians are required to establish mechanisms to protect client assets against various risks.
• Specific Reference:
  • Digital Assets Issuance Law, Article 22: "Digital Asset Service Providers must implement mechanisms for financial guarantee or insurance funds, for the benefit of their clients, to cover potential losses or damages derived from their operations, including those related to the custody of Digital Assets."
• Details: The specific amounts, types of guarantees, and conditions for these insurance or guarantee funds are expected to be elaborated in subsequent technical norms (Normas Técnicas) issued by the CNAD.

d. Cold Storage Mandates

• Specific Reference:
  • Digital Assets Issuance Law, Article 20, Paragraph 2: "Custodians... shall adopt adequate technical and organizational measures to safeguard the digital assets held on behalf of their clients, including the protection of private keys, against theft, loss, damage, unauthorized access, or any other risk."
• Interpretation: While the law does not explicitly use the term "cold storage," the mandate for "adequate technical and organizational measures" and "protection of private keys" strongly implies the use of highly secure storage solutions. Industry best practices widely recognize cold storage as a critical component for secure digital asset custody, especially for a significant portion of client assets. Detailed technical requirements are likely to be specified in the CNAD's forthcoming norms.

e. Qualified Custodian Definitions

• Definition: In El Salvador, a "qualified custodian" for digital assets is essentially a Digital Asset Service Provider (PSAD) that has obtained the necessary license from the CNAD to offer custody services.
• Specific Reference:
  • Digital Assets Issuance Law, Article 12: Categorizes "custody services" as one of the services offered by PSADs.
  • Digital Assets Issuance Law, Article 13: Establishes that only licensed entities can provide these services.
• Qualifications: The qualification comes from the rigorous licensing process, which evaluates the applicant's financial stability, technological infrastructure, security protocols, governance, and compliance with AML/CFT regulations.

f. Any Pending Custody Legislation

• CNAD Normas Técnicas: The Digital Assets Issuance Law frequently references the need for the CNAD to issue "Normas Técnicas" (Technical Norms or Regulations). These norms will provide the granular detail and specific operational requirements for all aspects of the law, including custody.
• Areas to be covered by Normas Técnicas:
  • Minimum capital requirements for PSADs.
  • Specific security requirements for the safeguarding of digital assets and private keys (which would likely include detailed cold/hot storage configurations).
  • Detailed requirements for governance, internal controls, risk management, and cybersecurity.
  • Specifics regarding the financial guarantee/insurance funds (amounts, types, conditions).
  • Reporting obligations for licensed entities.
  • Detailed AML/CFT procedures specific to digital asset service providers.
• Status: As of the knowledge cutoff, many of these detailed norms are still in the process of being developed or are newly emerging. The Digital Assets Issuance Law provides the high-level framework, but the practical implementation details are largely left to these upcoming CNAD regulations.

Disclaimer: Regulatory landscapes are dynamic. This information is based on the current understanding of the laws in El Salvador. Entities engaged in or planning to engage in digital asset custody in El Salvador should consult with legal and regulatory professionals for the most up-to-date and specific guidance.