On-shore VASP in Uruguay

BCU Stance: The BCU has issued communications clarifying its position. While it acknowledges virtual assets, it has explicitly stated that they are not considered legal tender in Uruguay and virtual asset activities generally do not fall under the traditional financial intermediation framework (e.g., banking law) unless they involve activities that would traditionally require BCU authorization (e.g., taking public deposits, issuing e-money as a payment institution). The BCU monitors the sector and indicates the possibility of future, more specific regulation.

UIAF Role: The UIAF is the key authority for AML/CFT oversight of VASPs. VASPs are required to register with the UIAF and comply with AML/CFT regulations.

Requirement: Registration with the UIAF is mandatory for virtual asset exchanges operating in Uruguay. They are considered "obligated subjects" under AML/CFT law.

Nature: This is an AML/CFT registration, not a financial license from the BCU to operate an exchange per se.

BCU Consideration: If an exchange offers services that cross into traditional financial activities (e.g., offering interest-bearing accounts in fiat, acting as a payment institution for fiat, issuing regulated financial instruments), it would likely require specific authorization from the BCU in addition to UIAF registration.

For UIAF Registration (VASPs): There is no specific minimum capital requirement directly tied to UIAF AML/CFT registration for VASPs.

For BCU Authorization (e.g., IPEs/PSPs): If an entity's activities fall under the BCU's existing regulatory framework for financial institutions (like Payment Service Providers or Electronic Payment Institutions), then significant minimum capital requirements apply. These are determined by BCU regulations for those specific activities and can be substantial (e.g., tens of thousands to hundreds of thousands of USD equivalent, depending on the scope of activities).

Risk Assessment: Develop and implement a robust, risk-based AML/CFT program.

Customer Due Diligence (CDD):

Identify and verify the identity of customers (KYC - Know Your Customer).

Identify beneficial owners.

Understand the purpose and nature of the business relationship.

Ongoing monitoring of transactions and relationships.

Enhanced Due Diligence (EDD) for high-risk customers or transactions.

Suspicious Activity Reporting (SARs): Report suspicious transactions to the UIAF without delay.

Record-Keeping: Maintain records of customer identification, transactions, and AML/CFT analysis for at least five years.

Internal Controls: Establish internal policies, procedures, and controls to prevent money laundering and terrorist financing.

If processing payments involving Fiat Currency (e.g., facilitating fiat deposits/withdrawals, enabling merchants to accept crypto but receive fiat):

Ley N° 19.574 (Integral Law Against Money Laundering and Terrorism Financing), dated December 20, 2017: This is the cornerstone legislation that established the general AML/CFT regime, identified obligated subjects, and set out the core requirements for prevention, detection, and punishment of money laundering and terrorism financing.

Decreto N° 379/020 (Regulation of Non-Financial Obligated Subjects and Activities Regulated by Law N° 19.574), dated December 23, 2020: This crucial decree explicitly includes "providers of virtual asset services" (proveedores de servicios de activos virtuales) as obligated subjects (sujetos obligados) under the AML/CFT framework. This brought VASPs directly under the regulatory scope, requiring them to comply with the same AML/CFT obligations as traditional financial institutions and other designated non-financial businesses and professions (DNFBPs).

Exchange between virtual assets and fiat currencies.

Exchange between one or more forms of virtual assets.

Transfer of virtual assets.

Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets.

Participation in and provision of financial services related to an issuer’s offer and/or sale of a virtual asset.

Enhanced Due Diligence (EDD): Apply EDD measures for high-risk customers, relationships, or transactions. This includes, but is not limited to:

Politically Exposed Persons (PEPs).

Clients from high-risk jurisdictions.

What to Report: Any transaction, attempted transaction, or operation, regardless of the amount, that the VASP suspects or has reasonable grounds to suspect is related to money laundering, terrorism financing, or underlying criminal activity.

To Whom: Reports must be submitted to the Secretaría Nacional para la Lucha contra el Lavado de Activos y el Financiamiento del Terrorismo (SEGPRE), Uruguay's FIU.

No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or third parties that a suspicious transaction report has been or will be submitted, or that an investigation is being conducted.

Customer Identification Data: All documents and information obtained during the CDD process (e.g., copies of identification documents, corporate registration documents, beneficial ownership information).

Transaction Data: Records of all transactions, including amounts, currencies, dates, types of virtual assets, parties involved (originator and beneficiary information), and any other relevant details.

Analysis and Decision-Making: Records of the analysis undertaken for suspicious activity and the decisions made regarding reporting or non-reporting.

Source of Funds and Source of Wealth (SoF/SoW): Especially for high-risk customers or transactions, VASPs must take reasonable measures to establish the source of funds or source of wealth involved.

Issuing warnings and general guidance: Advising the public on risks and clarifying that virtual assets are not legal tender.

Developing a regulatory framework: The BCU presented a preliminary proposal for regulating Virtual Asset Service Providers (VASPs) in 2021, and work is ongoing.

Applying existing AML/CFT rules: Emphasizing that entities dealing with virtual assets are subject to existing anti-money laundering and counter-terrorist financing (AML/CFT) regulations, even without specific crypto legislation.

BCU Communication (Comunicación No. 2021/200): https://www.bcu.gub.uy/Comunicados/comunicado200211.pdf

Outcome: The UIAF's mandate includes monitoring and investigating suspicious transactions, including those involving virtual assets. While specific cases against crypto firms aren't widely publicized, the UIAF would be the body to investigate and refer for prosecution any AML/CFT violations in the crypto space. They issue guidelines and requirements that apply.

FATF Mutual Evaluation Report for Uruguay (mentions UIAF's role in VAs, though specific enforcement data is limited publicly): https://www.fatf-gafi.org/content/dam/fatf-gafi/mer/MER-Uruguay-2019.pdf (While 2019, it sets the context for ongoing obligations)