AML/KYC Requirements for a El Salvador Crypto Company

Operating a crypto company in El Salvador requires strict adherence to anti-money laundering (AML) and know-your-customer (KYC) regulations. As of 2026, El Salvador has strengthened its legal framework to align with international standards, especially after adopting Bitcoin as legal tender. This page details the specific AML/KYC requirements for a El Salvador crypto company, helping founders navigate compliance efficiently.

Consulting24 (X24Consulting OU) advises crypto founders on licensing and compliance across multiple jurisdictions. While we directly deliver licenses in Estonia, Lithuania, and Panama, we provide expert coordination for El Salvador. Our team ensures your company meets all regulatory obligations, including AML/KYC policies, without unnecessary delays.

Understanding these requirements is critical for securing a license and maintaining ongoing operations. Below, we break down the essential components, from who needs to comply to step-by-step implementation, costs, and common pitfalls.

What Are AML/KYC Requirements for a El Salvador Crypto Company?

AML (anti-money laundering) and KYC (know-your-customer) requirements are regulatory obligations designed to prevent financial crimes such as money laundering and terrorist financing. For a El Salvador crypto company, these rules mandate verifying customer identities, monitoring transactions, and reporting suspicious activity to the Financial Investigation Unit (FIU) of El Salvador.

The central regulator is the Central Reserve Bank of El Salvador (BCR), which oversees compliance under the Law on Supervision and Regulation of the Bitcoin Ecosystem (Ley Bitcoin) and related AML decrees. Companies must implement a written AML program, appoint a compliance officer, and conduct customer due diligence (CDD) including enhanced due diligence (EDD) for high-risk clients.

Key components of an AML program include:

• Written policies and procedures approved by senior management.
• A designated compliance officer with local residency.
• Ongoing employee training on AML/KYC.
• Independent audit function to test the program annually.

Transaction monitoring systems must flag unusual patterns, such as rapid movements or high-value transfers. For example, a crypto exchange must screen all transactions against sanctions lists maintained by the UN and OFAC. Record-keeping requirements mandate storing customer identification data and transaction records for at least five years. The BCR also expects companies to conduct periodic reviews of their AML programs, at least every 12 months, and to update policies as new risks emerge. Failure to maintain strong AML controls can result in fines up to $500,000 or license revocation.

Who Needs to Comply?

Any entity providing virtual asset services in El Salvador must comply with AML/KYC regulations. This includes:

• Cryptocurrency exchanges (both centralized and decentralized platforms operating within the country).
• Bitcoin wallet providers offering custodial or non-custodial services.
• Payment processors handling crypto transactions.
• ATMs and kiosks dealing in digital assets.
• Any business facilitating the transfer, custody, or exchange of virtual assets.

Even foreign companies targeting El Salvadoran customers may need to register and comply. For instance, a foreign exchange that allows El Salvador residents to trade must either obtain a local license or restrict access. If you are considering other jurisdictions, compare with our Panama or Estonia crypto license options. The BCR has also clarified that decentralized finance (DeFi) platforms that are controlled by a central entity or have a governance token may fall under the definition of a VASP and thus require licensing. Non-custodial wallet providers that do not hold customer funds are generally exempt, but they should still seek legal advice to confirm their status.

License Type and Regulator

In El Salvador, crypto companies must obtain a license from the Central Reserve Bank (BCR) under the Bitcoin Law. The license is specifically for “Virtual Asset Service Providers” (VASPs). The BCR is the primary regulator, assisted by the Financial Investigation Unit (FIU) for AML enforcement.

The license type is a single category covering all crypto activities, but the scope of permitted services is defined in the application. There is no separate exchange or custody license; one license covers all allowed activities. The BCR evaluates applicants based on business model, financial health, and AML controls. As of 2026, the BCR has published detailed guidelines on application requirements, including a mandatory compliance manual. The regulator also conducts on-site inspections for high-risk applicants and may require a personal interview with the compliance officer. For a more structured licensing regime, you may explore our Lithuania crypto license or Czech Republic crypto license options.

Cost and Timeline

Exact pricing depends on the complexity of your business model. Consulting24 can provide a precise quote after an initial consultation. For a fixed-fee alternative, consider our Panama company setup at EUR 6,000.

The timeline can be shorter if your AML program is already compliant with FATF recommendations. However, delays often occur due to incomplete documentation or background checks on beneficial owners. We recommend starting the process with a pre-application review. The BCR has a target of 90 days for processing complete applications, but in practice it can take up to 6 months if clarifications are needed. Ongoing costs include annual compliance audits ($2,000-$5,000), compliance officer salary, and transaction monitoring software fees.

Capital Requirement

El Salvador does not impose a statutory minimum capital requirement for crypto licenses. However, the BCR expects companies to have sufficient financial resources to operate and implement AML/KYC controls. A practical minimum is around $50,000 in paid-up capital, but this is not codified. For comparison, EU member states under MiCA require EUR 50,000 to 150,000 depending on service class. Always confirm with your legal advisor.

In practice, the BCR may ask for a business plan demonstrating adequate funding for at least 12 months of operations. This includes salaries, technology costs, and compliance expenses. Some applicants have been asked to provide a bank guarantee or proof of liquid assets. For example, a startup exchange with 5 employees should budget at least $200,000 for the first year, including capital reserves. The BCR also considers the company's ability to cover potential losses from fraud or operational failures. If you prefer a jurisdiction with clear capital requirements, our Poland crypto license or Malta crypto license may be more suitable.

Tax Treatment

El Salvador has no capital gains tax on Bitcoin and other cryptocurrencies, making it attractive for crypto businesses. However, income tax applies at a standard rate of 30% for corporations. VAT is 13% on services, but crypto transactions may be exempt under certain conditions. The government has also introduced a tax amnesty for crypto companies that register before a certain date. Consult a tax expert for your specific situation.

For example, a crypto exchange earning fees from trades would pay 30% corporate income tax on net profits. But if the exchange holds Bitcoin as an investment, any appreciation is not taxed until converted to fiat. This creates a tax-efficient environment for long-term holders. Additionally, dividends paid to shareholders are subject to a 5% withholding tax. The tax amnesty, valid until December 2026, waives penalties for past non-compliance if companies register and pay a reduced fee. However, transfer pricing rules apply to related-party transactions, and the tax authority (DGII) has increased audits of crypto firms. For a jurisdiction with no corporate income tax, consider our Cayman Islands crypto license.

Allowed Activities

Under the Bitcoin Law, licensed companies can perform the following activities:

• Exchange between virtual assets and fiat currency.
• Exchange between one or more forms of virtual assets.
• Transfer of virtual assets.
• Safekeeping and administration of virtual assets.
• Participation in financial services related to virtual assets.

These activities are broadly defined, allowing for innovation. However, any activity not explicitly permitted requires prior approval from the BCR. For instance, operating a crypto derivatives platform may need additional authorization. The BCR has indicated it will issue further guidance on DeFi and staking services in 2026. Also, lending and borrowing of virtual assets are not explicitly covered, so companies must seek a specific ruling. The license does not permit activities that require a banking license, such as accepting deposits. For a more comprehensive list of permitted activities, see our exchange license page.

Step-by-Step Process to Obtain a License

1. Pre-incorporation: Register a company in El Salvador with a legal address and director. This typically takes 1-2 weeks. You will need a local registered agent and a minimum of two directors (one can be a foreign entity).
2. Develop AML/KYC policies: Draft a comprehensive AML program including customer due diligence, transaction monitoring, and reporting procedures. This should be tailored to your business model. The program must cover risk assessment, customer identification, ongoing monitoring, and record keeping.
3. Appoint a compliance officer: This person must be resident in El Salvador and have relevant experience. They will be the point of contact for the BCR. The compliance officer should have at least 3 years of experience in AML compliance and pass a background check.
4. Submit application: File with the BCR, including business plan, AML policies, financial statements, and background checks on directors. The BCR charges a non-refundable fee of approximately $1,000. The application must be in Spanish and include certified translations of foreign documents.
5. Regulatory review: The BCR assesses the application and may request additional information. This stage can take 1-2 months. The BCR may also conduct an interview with the compliance officer and beneficial owners.
6. Approval and licensing: Once approved, you receive the license and can commence operations. You must then register with the FIU for AML supervision and submit an initial compliance report within 30 days.

Consulting24 assists with each step, especially in coordinating with local lawyers. For a smoother process, our Lithuania crypto license offers a faster timeline and clearer capital requirements. We also provide a pre-application checklist to ensure all documents are in order.

Banking and Payment Services

Opening a bank account for a crypto company in El Salvador can be challenging due to perceived risks. Many local banks are cautious. Options include state-owned Banco de Desarrollo de El Salvador (BANDESAL) or private banks like Banco Agrícola. Some companies use payment processors or fintech solutions. Consulting24 can introduce you to banking partners we work with. Alternatively, our Panama jurisdiction offers more straightforward banking.

As of 2026, the BCR has encouraged banks to serve licensed VASPs, but due diligence remains thorough. You will need to provide your license, AML program, and proof of compliance. Some crypto companies have successfully opened accounts with international banks in the region, such as those in Switzerland or the Cayman Islands. We recommend starting the banking process early, as it can take 4-8 weeks. Additionally, consider using crypto-friendly payment processors like Stripe or Coinbase Commerce for merchant services. For a jurisdiction with established crypto banking, explore our Switzerland crypto license.

Benefits of an El Salvador Crypto License

• No capital gains tax on Bitcoin.
• Fast licensing process (3-6 months).
• Progressive regulatory environment.
• Access to a growing crypto ecosystem.
• Strategic location for Latin American markets.

These benefits make El Salvador a compelling choice for crypto startups, especially those focused on Bitcoin adoption. The government has also launched initiatives to attract crypto talent, such as visa programs for entrepreneurs. Additionally, the use of Bitcoin as legal tender provides a unique marketing advantage. However, the lack of a minimum capital requirement can be a double-edged sword, as it may lead to undercapitalized competitors. For a more stable regulatory framework, consider our Estonia crypto license or Cyprus crypto license.

Compliance and Trust

Maintaining compliance is an ongoing obligation. You must file suspicious activity reports (SARs) with the FIU within 24 hours of detection, conduct periodic reviews of your AML program, and train staff annually. Non-compliance can lead to fines up to $500,000, license revocation, or criminal charges. Always work with a qualified compliance officer and legal counsel. This guide provides general guidance, not legal advice.

To build trust with regulators and customers, consider obtaining an external audit of your AML controls. Some companies also publish transparency reports. Consulting24 can recommend auditors experienced in crypto compliance. Additionally, the BCR may conduct unannounced inspections, so keep all records accessible. For a jurisdiction with a strong compliance reputation, see our Dubai crypto license.

Common Mistakes

• Inadequate AML policies: Many applicants submit generic policies that do not meet local requirements. The BCR expects detailed procedures tailored to your services.
• Ignoring ongoing compliance: After obtaining the license, some companies neglect reporting obligations. This can lead to fines or revocation.
• Poor record keeping: Failure to maintain records for the required 5 years is a common violation.
• Not appointing a local compliance officer: The BCR requires a resident compliance officer; outsourcing to a foreign firm is not accepted.
• Underestimating costs: Many startups underestimate the total cost of compliance, including software and audits.

Avoid these mistakes by engaging experienced consultants from the start. Consulting24 provides a compliance checklist and ongoing support. For a jurisdiction with a simpler compliance regime, our El Salvador crypto license page has more details.

Alternatives and Comparison

El Salvador offers unique tax advantages, but it is not the only option. Compare with:

• Panama: No corporate income tax on offshore income, flat EUR 6,000 setup fee, and no capital gains tax. Panama does not require a specific crypto license for certain activities, but a company setup is needed. Consulting24 delivers Panama company setup directly.
• Lithuania: Under MiCA, requires EUR 125,000 capital for exchanges, clear AML rules, and EU passporting. Timeline is 3-6 months. Consulting24 delivers Lithuania crypto licenses directly.
• Estonia: Old VASP regime replaced by MiCA; requires EUR 125,000 capital for most services. Fast e-residency process. Consulting24 delivers Estonia crypto licenses directly.

Each jurisdiction has trade-offs. El Salvador is best for Bitcoin-focused businesses, while Panama offers cost efficiency. For a full comparison, see our vs Lithuania page and explore other jurisdictions.

How Consulting24 Can Help

Consulting24 (X24Consulting OU) specializes in crypto licensing and compliance. For El Salvador, we provide expert coordination with local lawyers and regulators. Our services include:

• Pre-application assessment and gap analysis.
• Drafting AML/KYC policies and procedures.
• Assistance with company incorporation and bank account opening.
• Ongoing compliance support and audit preparation.

We directly deliver licenses in Estonia, Lithuania, and Panama, and advise on all other jurisdictions. Our team has helped over 500 clients obtain licenses. Contact us via WhatsApp or book a consultation to discuss your project. For a fixed-fee solution, our Panama company setup at EUR 6,000 is a popular choice.

Official sources

• Banco Central de Reserva de El Salvador

Related jurisdictions

Mardo Soo · CEO, Consulting24Personally advises on jurisdiction selection. 500+ crypto licenses across Estonia, Lithuania & Panama. LinkedIn →

General guidance, not legal advice. Rules and fees evolve — we confirm current requirements for your case.