Virtual asset service providers (VASPs) in Uruguay: BCU authorisation

For years crypto exchanges and custodians operated in Uruguay without specific rules. That has changed: since 2026, anyone providing virtual asset services professionally needs Central Bank authorisation. This guide explains what a virtual asset service provider (VASP) is in Uruguay, what the BCU requires, the deadlines and what it means for businesses and users. For the wider picture, see financial regulation in Uruguay.

What is a VASP?

A virtual asset service provider (VASP), PSAV in Spanish, is a business that habitually and professionally provides crypto-asset services to others: an exchange, a custodial wallet, a transfer platform or anyone taking part in a token offering. The concept comes from the FATF recommendations, which require countries to register or license these providers and apply AML rules to them.

The legal framework: Law 20.345 and Circular 2507

Rule	What it did
Law 20.345 (enacted 19 September 2024)	Recognised virtual assets and widened the BCU’s powers, amending its Charter (Law 16.696, Articles 37 and 38) and the Securities Market Law (Law 18.627, Article 14).
BCU Circular 2507 (July 2026)	Added VASPs to the securities market rules: prior authorisation, capital and guarantee requirements, governance, information security, user protection and AML.

Which activities need authorisation?

• Exchange between virtual assets and fiat currency.
• Exchange between virtual assets.
• Transfer of virtual assets on behalf of customers.
• Custody and administration of virtual assets or the instruments that control them (keys).
• Participation in the offer or issuance of virtual assets and related financial services.

What is excluded

• Software development, where the developer does not take part in providing the service.
• Services involving only non-fungible tokens (NFTs), unless used as a means of payment, an investment instrument or a digital representation of a security.
• Buying, selling or holding your own crypto: the rules apply to services for third parties.

Authorisation requirements

1. Structure: a company with registered (not bearer) shares and a shareholder chain identified up to individuals, with a declaration of the lawful origin of capital.
2. Capital and guarantees in favour of the BCU.
3. Fit and proper shareholders, directors and managers.
4. Governance and risk management, including an information security officer with functional independence.
5. Segregation of customer assets from the provider’s own.
6. Cybersecurity and business continuity, with periodic audits.
7. Outsourcing: foreign providers or servers must be reported and BCU access to data guaranteed.
8. User protection: clear information on risks, costs and terms.

Where services are provided through automated terminals (crypto ATMs), the limit is US$1,000 per customer per day.

AML obligations

As BCU-supervised entities, VASPs are financial obliged entities under Uruguay’s AML law: customer and beneficial owner due diligence (see KYC and compliance), originator and beneficiary data on crypto transfers in line with the FATF “travel rule”, transaction monitoring and suspicious activity reporting to the UIAF, plus a compliance officer, manual and training.

Deadlines for VASPs already operating

Date	Milestone
July 2026	Circular 2507 published.
1 September 2026	The BCU starts accepting applications.
31 March 2027	Deadline for existing VASPs to apply; they may keep operating while the application is decided.

Foreign exchanges and users

• Businesses wanting to operate from Uruguay must set up a local entity and obtain authorisation; foreign shareholders are assessed too.
• Users can still hold crypto freely; dealing with an authorised VASP gives them asset segregation, disclosure and supervision.
• Banking: authorised VASPs have a clearer path to bank accounts, long one of the sector’s main hurdles.

FAQ

Does your business provide virtual asset services?

At GlobalTax we assess whether your activity falls within the VASP definition, prepare the BCU authorisation file and build your AML programme, in English, Spanish or Portuguese. See financial licences and regulation or contact us.