EL SALVADOR Law and Practice Contributed by: Héctor Torres, Annette Herrera and Daniel Leiva, Torres Legal
Grandfathering and Transition The LEAD and DASP Regulation are now in force, and there is no broad ongoing grandfathering regime allow- ing firms to carry out regulated digital asset activities indefinitely without registration. Businesses that were already operating before the current framework were expected to regularise their status with CNAD where their activities fell within the LEAD. In practice, firms should not rely on prior activity, off- shore status or a technology-only characterisation to avoid registration. A business intending to operate as a DASP, issuer or certifier should assess its activity against the LEAD and the DASP Regulation before launching or marketing services in or from El Salvador. 3.2 Set-Up Requirements The process for obtaining authorisation as a DASP is managed by CNAD and generally involves pre-regis- tration, regulatory review and definitive registration. The applicant must submit information on its entity, proposed services, operating model, governance, compliance framework, technology infrastructure and supporting documentation. CNAD may request addi- tional information before issuing its decision. Applicants must demonstrate sufficient corporate substance and operational capacity, including a Sal- vadoran entity or registered presence, clear ownership and governance structure, qualified management, internal policies and the ability to respond to CNAD supervision from El Salvador. A DASP applicant must include a principal Compli- ance Officer and an alternate Compliance Officer responsible for AML/CFT and regulatory compliance, as well as a Chief Information Security Officer (CISO) responsible for cybersecurity, information security and technology risk management. The applicant must also evidence financial, operation- al and technical capacity appropriate to its authorised activities, including the applicable minimum equity requirement under the DASP Regulation, AML/CFT controls, cybersecurity standards, business continuity plans, risk management procedures, custody or seg- regation arrangements, user protection mechanisms and internal controls.
scrutiny of AML/CFT, governance, custody, reporting, business continuity and user protection controls.
3. Licensing and Set-Up Requirements 3.1 Licensing Requirements Triggers for CNAD Registration A blockchain business does not require a licence in El Salvador merely because it uses blockchain tech- nology. Registration is required when the activity falls within the regulated perimeter of the Digital Assets Issuance Law and CNAD regulations. The main trig- gers are: • conducting a public or private offering of digital assets; • acting as an issuer of digital assets; • providing regulated services, such as custody, exchange, transfer, placement, structuring, admin- istration or advisory services related to digital assets. • operating as a DASP; • acting as a certifier; or The CNAD registration process for DASPs is struc- tured in stages, including pre-registration, regulatory evaluation and definitive registration, with require- ments relating to corporate structure, governance, compliance, technology, cybersecurity, AML/CFT controls, risk management and operational capacity. Territorial Nexus The licensing requirement is not limited to companies incorporated in El Salvador. A foreign entity may fall within the CNAD perimeter if it actively promotes, mar- kets or provides digital asset services in El Salvador, or if its offering is directed at Salvadoran investors. Board control from El Salvador is not, by itself, an express licensing trigger. However, local manage- ment, decision-making, personnel, commercial activ- ity, Salvadoran clients, local infrastructure or use of a Salvadoran platform may be relevant in assessing whether there is a sufficient Salvadoran nexus.
207 CHAMBERS.COM
Powered by FlippingBook