Uruguay regulates virtual asset service providers

Circular No. 2507 issued by the Central Bank of Uruguay establishes an authorisation and supervisory framework for virtual asset service providers (VASPs). It covers corporate, capital, operational, accounting, technology, customer protection and anti-money laundering requirements.

Who is covered?

The rules apply to legal entities that professionally provide services such as exchanging virtual assets for traditional currency, transferring virtual assets, custody or administration, and participation in third-party offerings or sales. Software development without active participation in the service is excluded. NFTs are generally outside the framework unless they are used as payment, investment or a representation of value.

Authorisation and customer safeguards

Providers must obtain prior authorisation from the Superintendency of Financial Services and operate through a Uruguayan commercial company or a local branch of a foreign company. Applications must document shareholders, beneficial owners, sources of capital, business model, procedures, contracts, AML controls and technology systems.

Client assets and funds must remain segregated from the provider’s own resources. Providers must clearly disclose risks, costs and fees, identify customers and beneficial owners, review source of funds, monitor transactions and apply the travel rule.

Technology, audit and deadlines

Cybersecurity, key protection, backups, operational continuity and incident recovery policies are required. VASPs must also submit audited financial statements, an independent AML report and a systems audit. Applications may be filed from 1 September 2026. Existing providers have until 31 March 2027 and may continue operating while their application is reviewed.

This material is provided for information only and does not replace professional advice tailored to a particular situation. Read the original Spanish version.