In El Salvador, although there is no specific regulation for fintech companies, regulations exist that allow such entities to operate with a high degree of legal certainty.

These regulations provide fintech companies with the necessary legal framework to conduct the majority of their operations. Additionally, it is worth mentioning that the Secretary of Innovation of the Presidency of the Republic, in its digital agenda to be developed between 2020 and 2030, identifies it as a state priority to support fintech companies in developing their own regulatory framework to strengthen financial services in El Salvador, among other measures to support this sector, which has been deemed essential to increase financial inclusion in the country.

See also 2.4 Variations Between the Regulation of Fintech and Legacy Players.

The main verticals of fintech business models in El Salvador are:

• payment solutions;
• technology companies for financial institutions;
• alternative financing platforms;
• insurtech;
• personal finance management;
• corporate finance management;
• bitcoin service providers; and
• digital asset service providers.

In El Salvador, although there is no specific regulation for fintech companies, the following regulations allow such entities to operate with a high degree of legal certainty:

• the Bitcoin Law;
• the Electronic Signature Law;
• the Electronic Commerce Law;
• the Electronic Securities Law;
• the Law to Facilitate Financial Inclusion; and
• amendments to the Consumer Protection Law concerning electronic commerce providers, the Bitcoin Law and the Digital Assets Issuance Law, among others.

See also 1.1 Evolution of the Fintech Market.

There are no specific standards on compensation models for fintech companies. These are governed by the same rules as other service providers in accordance with the Consumer Protection Law and its Regulations. These rules primarily focus on transparency of information, clarity of direct or indirect charges, and appropriate measures of acceptance by consumers.

Traditional banking institutions, often referred to as legacy players, operate within a highly regulated environment in El Salvador. The regulatory framework imposes stringent measures on these institutions to ensure financial stability, consumer protection, and overall market integrity. Regulatory bodies such as the Central Bank in El Salvador have established comprehensive guidelines covering aspects such as capital adequacy, risk management, and compliance standards.

Legacy players are subject to extensive oversight, necessitating compliance with specific legal and capital requirements to maintain the trust and confidence of the public.

In contrast, the regulatory landscape for fintech participants in El Salvador is currently evolving. There are currently no specific regulations tailored exclusively for fintech companies. Fintech entities, therefore, do not bear the same level of regulatory burden as their traditional counterparts. While they are still subject to general business regulations and consumer protection laws, the absence of industry-specific regulations allows for greater flexibility and innovation within the fintech sector.

However, it is essential to note that the absence of specific regulations does not imply a lack of legal obligations for fintech participants. They are still required to comply with existing laws, such as those pertaining to data protection, anti-money laundering, and consumer rights. As the fintech industry continues to gain prominence, there may be an increased focus on developing a more tailored regulatory framework to address the unique challenges and opportunities presented by this sector.

In summary, the regulation of fintech industry participants in El Salvador differs significantly from the comprehensive regulatory environment governing legacy players. While traditional banking institutions adhere to well-established and rigorous standards, fintech companies operate within a less prescriptive regulatory framework, fostering an environment conducive to innovation and agility.

There is currently no regulatory sandbox in El Salvador. However, through certain studies conducted by the Central Reserve Bank (the “Central Bank”) via technical working groups with relevant stakeholders, the importance of implementing a regulatory sandbox has been emphasised. Therefore, depending on the progress of the system, it may be possible to implement one in the future.

El Salvador has several government entities that exercise some form of supervision and have regulatory competence over activities that include or may include different fintech verticals.

The Central Reserve Bank

The Central Bank is legally responsible for the administration and regulation of the payment system – which includes real-time money transfers – and in this capacity determines which entities can access this system, in addition to financial intermediaries and certain government entities. The Central Bank is also responsible for calculating the maximum interest rates that can be established in the country for credit operations.

The Central Bank is also responsible for maintaining the registry of bitcoin service providers in accordance with the Bitcoin Law and its Regulations.

The Superintendence of the Financial System

In addition to its principal role supervising financial intermediaries, the Superintendence of the Financial System (SSF) also supervises a wide variety of banking, non-banking and financial companies.

The Superintendence of Commercial Obligations

The Superintendence of Commercial Obligations supervises compliance with commercial obligations of all Salvadoran corporations and foreign branches legally registered in El Salvador.

The Consumer Protection Law and its Regulations

Salvadoran corporations and foreign branches legally registered in El Salvador are also subject to the Consumer Protection Law and its Regulations regarding their relationships with consumers, and may be subject to penalties for non-compliance with said regulations.

The National Digital Assets Commission

For providers of digital asset services and issuers of digital assets, the National Digital Assets Commission is the institution responsible for the registration and supervision of their activities.

The scope of action of each of these supervisory entities is generally delimited by their respective organic laws, regulations, norms, and other regulatory bodies.

There is specific regulation for regulated entities called the “Technical Standards for Information Security Management”, which establishes that when a supervised entity outsources an activity or operation related to information technology, they must comply with certain prior requirements. These requirements include comprehensive risk assessments of the provider, robust measures for provider identification including sworn statements indicating the existence of an information security programme or management, business continuity plans, developed tests, test results, and verification of the provider’s ability to recover and resume service in the event of interruptions. Additionally, the provider is required to provide current audit reports associated with the services provided, among other obligations.

In El Salvador, the Central Bank and the Superintendence of the Financial System establish the monitoring requirements for some fintech providers. These requirements mandate that fintech providers specify their manuals, procedures and mechanisms for risk management, cybersecurity, operational due diligence, and other pertinent aspects. Additionally, these entities must periodically request reports detailing suspicious transactions, accounts, customers, and transfers rejected due to insufficient information, ensuring compliance with the Law Against Money Laundering and Assets and Guidelines from the Financial Investigation Unit of the Attorney General’s Office.

Regulated fintech providers bear the responsibility of ensuring that no illicit activities occur on their platforms. The Central Bank and the Superintendence of the Financial System continuously monitor fintech providers to ensure regulatory compliance and to prevent any illegal activities on their platforms.

As part of the National Fintech Strategy for the upcoming years, the creation of the Financial Innovation System is envisioned. Through this system, it is expected to establish adequate governance of the digital financial ecosystem, with responsibility being shared between the Central Bank and the Financial System Superintendence, supported by the Financial Innovation System, with oversight by the National Fintech Strategy.

Additionally, as of this date, there is no specific law regarding fintech. However, for the fulfilment of the objectives of the National Fintech Strategy, this is considered a necessity. Therefore, upon the enactment of said law, it is also expected that the Central Bank will be responsible for issuing the applicable specific regulations.

Essentially, in terms of information privacy and social media management, both legacy players and fintech companies are governed by very similar rules.

However, there are some particularities for cybersecurity and system development issues.

Regulated entities have specific regulations for information security management. Additionally, using, updating or changing the software utilised is also closely monitored by the supervisory entity.       

Fintech companies are required to maintain accounts and undergo external and, in some cases, independent tax auditing like any other company in El Salvador.

Additionally, when they have commercial relationships as providers to entities supervised by the Financial System Superintendence, such as banks and insurance companies, they must comply with several requirements regarding information security, business continuity plans, confidentiality, and prevention of money laundering and terrorist financing. For this purpose, banks or other supervised entities may conduct periodic evaluations to ensure that these fintechs are compliant with their obligations.

From the moment an entity offers a regulated product, it becomes a regulated entity; therefore, every new product or service it brings to the market must adhere to the approval process for new products required by the applicable legislation and/or regulations.

All regulated and non-regulated companies are obliged to comply with the existing Law Against Money Laundering and Assets and with the Guidelines from the Financial Investigation Unit of the Attorney General’s Office.

Technical regulations issued by the financial regulator (the Central Bank) only apply to entities subject to the Financial Supervision and Regulation System.

However, non-regulated fintech companies, which have relationships with banks and other financial entities subject to the Financial Supervision and Regulation System, must implement stronger due diligence measures. Thus, fintech companies are indirectly obliged to have a solid risk management framework.

Banks and regulated financial institutions usually work with Correspondent Banking and, for this reason, many control elements are required for fintech clients and/or suppliers, whether regulated or not.

Finally, the Guidelines from the Financial Investigation Unit of the Attorney General’s Office require that, for the launch of new products involving the development of new technologies, both regulated and non-regulated companies must conduct a prior assessment of money-laundering and asset-laundering risks.

There do not appear to be any local fintech players offering robo-adviser services in El Salvador.

A robo-adviser is regarded as a digital platform, like any other fintech, that provides automated, algorithm-driven financial platform planning services with almost no human supervision, especially regarding investment and stock market operations. When it comes to advising on stock market operations and any other activity related to the stock exchange, a robo-adviser would need to comply with the Securities Market Law, which is the exclusive jurisdiction of brokerage houses. In addition, if a robo-adviser were to provide assessment to invest in digital assets, it would have to comply with the Digital Assets Issuance Law.

Other than that, there is no specific regulation for robo-advisers.

The use of robo-advisers in El Salvador appears to be limited to areas of credit viability analysis regarding loans, collateral and related services. Robo-advisers do not really engage in stock market activities or digital assets issuance.

Legacy players are using AI-powered solutions and a simple form of robo-advisers so that their clients can obtain information regarding products and ongoing processes.

Although it is true that El Salvador does not have regulations applicable to robo-advisers in the development of their activities, robo-advisers must comply with the applicable laws, primarily with the Securities Market Law and the Digital Asset Issuance Law regarding investment matters.

In El Salvador, significant differences exist in the business and regulation of loans tailored to individuals, small businesses, and other entities. These disparities encompass various facets, including credit assessment criteria, loan products, terms, maximum interest rates and the overarching regulatory framework.

Distinct credit assessment criteria are applied based on the type of entity. For individuals, factors like credit history, income stability, and debt levels are pivotal. Small businesses face evaluations centred on business plans, cash flow projections, and financial health. Conversely, larger entities undergo more intricate financial scrutiny, considering market position, industry trends, and risk management strategies.

Furthermore, the regulatory framework factors in the size of a business, the purpose of a loan, and the financing type to establish the maximum interest rate applicable to each sector. This framework encompasses laws against usury, providing differential interest rates and fees tailored to individuals, small businesses, and corporations. Additionally, consumer protection laws impose various penalties for violations by different entities.

El Salvador also has laws promoting financial inclusion and development, aiming to foster equality. These include legislation facilitating access to financial services for underserved populations, and laws stimulating the growth of the financial system. Common laws governing banks, co-operative banks, savings and credit societies, along with credit institutions and their auxiliary organisations, further regulate diverse lending practices across entities.

In the financial landscape, the private offering market stands out as an avenue for entities, particularly banks, to engage in underwriting processes tailored to their specific needs. Within this market, various entities employ distinct underwriting methodologies encompassing credit assessment, risk analysis, income verification, and collateral evaluation. However, the nature and rigour of these processes often vary depending on the type of entity conducting them.

Banks, for instance, adhere to stringent regulatory frameworks governing their underwriting activities. These regulations, designed to ensure financial stability and consumer protection, encompass a spectrum of requirements, including anti-money laundering measures and compliance with norms established by regulatory bodies such as the Superintendence of the Financial System.

On the other hand, other private entities operating in the offering market may have relatively fewer regulatory constraints, affording them greater flexibility in designing and executing underwriting procedures. Nonetheless, irrespective of the entity type, compliance with the applicable regulations is necessary to uphold integrity and trust within the financial ecosystem.

In El Salvador, the primary sources of funds for loans predominantly stem from the private sector, with private financing and banking serving as the principal avenues for accessing capital. These avenues encompass a diverse range of mechanisms, including peer-to-peer lending platforms, traditional bank deposits, and various other private financing channels. While crowdfunding remains unregulated in El Salvador, alternative avenues such as factoring offer viable options for companies seeking a capital infusion. Additionally, intercompany loans and shareholder contributions constitute notable sources of funding, providing entities with internal financing options to support their operational and growth objectives.

In El Salvador, syndicated loans lack specific regulatory frameworks dedicated solely to their governance. Instead, oversight primarily falls under the scope of the SSF, which regulates lending activities and financial operations.

Legal documentation associated with syndicated loans must adhere to Salvadoran laws concerning contracts, securities, and financial transactions. However, the absence of a dedicated law for syndicated loans means that the parties involved must navigate within the existing legal framework without specific guidelines tailored to syndication practices.

Overall, while there is no specific regulatory regime governing syndicated loans in El Salvador, legacy players are subject to financial regulations and legal considerations that govern lending activities and financial operations within the country.

Recently, the Central Bank issued regulations for admission and participation in payment systems administered by said entity, through which it opened up the possibility for all legal entities that provide financial payment services and are interested in participating, to be authorised by the Central Bank.

Additionally, there are other private networks that participants can join.

The Law on Regulation and Supervision of the Financial System of El Salvador establishes that legal entities engaged in systematic or substantive money transfer operations, by any means, nationally or internationally, are subject to supervision by the Financial System Superintendence.

The same law grants the Central Bank the authority to develop the technical regulations for the correct application of the law.

The main obligations imposed as a result of the technical regulations applicable to these entities are:

• registration with the Supervisor;
• reporting of operations to the Supervisor;
• confidentiality of information;
• development and implementation of internal policies; and
• strong internal control.

Fund administrators in El Salvador operate within a regulatory framework overseen by the SSF, which is responsible for supervising financial institutions and securities markets. The SSF ensures that fund administrators obtain the necessary licences, it conducts regular supervision to monitor their activities, and it enforces compliance with relevant laws and regulations.

In addition to obtaining licences and undergoing supervision, fund administrators must adhere to various regulatory requirements. These include maintaining adequate capital levels to support their operations, establishing robust governance structures to ensure effective oversight, implementing rigorous management practices to mitigate potential risks, and adopting measures to protect the interests of clients and investors.

Furthermore, fund administrators are obliged to comply with other regulatory provisions, such as anti-money laundering regulations aimed at preventing financial crimes, tax laws governing the reporting and payment of taxes, and securities regulations governing the operation of investment funds.

Fund advisers typically rely on established investment rules and regulatory requirements to ensure the performance and accuracy of fund administrators’ services. While fund advisers may not seek specific contractual terms, they expect fund administrators to adhere to industry standards, regulatory guidelines, and best practices in managing investment funds. These standards encompass various aspects such as risk management, compliance with investment policies, reporting accuracy, and fiduciary responsibilities.

Additionally, fund advisers may engage in thorough due diligence processes before selecting a fund administrator, evaluating factors such as the administrator’s track record, reputation, financial stability, and operational capabilities. Through these assessments, fund advisers aim to mitigate risks and ensure that the chosen administrator can effectively fulfil its duties in managing and administering the fund.

In El Salvador, the regulatory landscape for marketplaces and trading platforms is defined by the Bitcoin Law and Digital Assets Issuance Law. These laws establish a clear framework under which such entities can operate legally, with variations in regulatory requirements.

The Digital Assets Issuance Law

Under the Digital Assets Issuance Law, marketplaces and trading platforms can operate lawfully by fulfilling certain prerequisites. Companies must register and obtain the necessary authorisation as outlined in the legislation. The law permits these entities to function as exchanges for digital assets, facilitating the conversion of cryptocurrencies to fiat currency or other digital assets. This can be executed using the platform’s own capital or that of a third party. Furthermore, the legislation allows for the operation of platforms facilitating the exchange or trading of digital assets and their derivatives.

The Bitcoin Law

Similarly, the Bitcoin Law provides a regulatory framework for marketplaces and trading platforms for bitcoin in El Salvador. Registered companies can operate as trading platforms or exchanges, as long as they meet the regulatory standards established by the law. This includes adherence to specific criteria and obtaining the requisite licences, and ensuring compliance with the legal requirements set forth in the Bitcoin Law.

In essence, both the Digital Assets Issuance Law and the Bitcoin Law offer a structured approach to regulating marketplaces and trading platforms, ensuring that these entities operate within the bounds of the law, fostering transparency and accountability in the burgeoning digital asset landscape of El Salvador.

In El Salvador, the regulation of bitcoin and digital assets follows distinct paths. While bitcoin holds the status of legal tender within the country, its oversight primarily lies with the Superintendence of the Financial System and the Central Bank. On the other hand, digital assets are subject to their own regulatory framework, administered by the National Commission for Digital Assets (Comisión Nacional de Activos Digitales or CNAD).

To offer bitcoin services or operate as a digital asset provider, entities must undergo a registration process. Each registration entails specific requirements for obtaining and maintaining compliance. The Digital Asset Issuance Law mandates a comprehensive set of documentation for registration and renewal, ensuring stringent oversight.

Moreover, El Salvador’s regulatory landscape includes the Electronic Securities Act, governing traditional assets like stocks, bonds and commodities. This legislation addresses the issuance, circulation, acceptance, endorsement, and other electronic exchange transactions involving such assets.

The emergence of cryptocurrency exchanges, whether centralised or decentralised, has not led to any significant impact or changes in regulation. The regulatory landscape for these platforms in El Salvador is well defined by the Digital Assets Law, which comprehensively governs their operation.

Cryptocurrency exchanges, both centralised and decentralised, fall under the purview of the Digital Assets Law. This legislation outlines the registration and authorisation processes that these platforms must undergo to operate legally. The regulatory measures are designed to ensure compliance with standards such as AML and KYC requirements, promoting transparency and safeguarding against illicit activities.

Bitcoin service providers, digital asset service providers and digital asset issuers are all required to register with specific regulators prior to commencing their operations. They are subject to principles of good faith, transparency, honesty, market impartiality and professionalism in the provision of their services.

In El Salvador, stringent order handling rules govern the operations of Digital Assets Services Providers (DASPs). These rules mandate that DASPs provide trimestral reports detailing various aspects of their services. These reports include comprehensive information such as the technical specifications and commercial attributes of the digital assets offered, alongside an explanation of inherent risks associated with each product and its management. Additionally, DASPs are mandated to disclose the pricing structure for their services, with details on commissions and any other specific charges levied.

Furthermore, DASPs bear the responsibility of implementing robust mechanisms to forestall price manipulation and uphold market integrity. Regulatory guidelines delineate unacceptable practices and underscore the imperative for DASPs to operate with the utmost good faith and impartiality. Compliance entails the formulation and implementation of manuals, procedures and policies geared towards ensuring equitable treatment of investors and fostering market transparency. Oversight by the National Commission for Digital Assets ensures adherence to these regulations, verifying that all operational aspects are aligned with regulatory standards.

Transparency forms a cornerstone of regulatory expectations, with companies compelled to provide clients with comprehensive insights into their order handling practices and execution policies. Moreover, meticulous record-keeping of client orders is mandated to demonstrate adherence to regulatory requirements, further underscoring the commitment to regulatory compliance and investor protection.

Peer-to-peer trading platforms have a positive impact on both traditional and fintech participants. On one hand, they allow fintech companies to enter the system by offering practical and simple solutions, and on the other hand, they also enable traditional participants to provide their services to clients through these platforms, either directly or by contracting a fintech as a service provider. It is important to highlight that due to the innovation that these platforms entail and the speed of their evolution, they pose significant challenges for regulation, primarily in terms of supervision.

As providers of financial services or products, fintech companies are subject to general consumer protection rules established by local legislation. However, there are cases where, due to the activities carried out by these participants, they are regulated by certain specific government entities that have more stringent requirements, primarily focused on internal control, transparency and supervision.

In the realm of digital asset provision, the landscape concerning payment for order flow (PFOF) lacks specific regulations that either permit or prohibit such practices outright. However, within this dynamic environment, there exist fundamental principles that digital asset providers are expected to adhere to diligently.

Foremost among these principles is the imperative for providers to abstain from engaging in operations solely aimed at acquiring commissions or unscrupulously multiplying them, to the detriment of the clients affected by such transactions. Additionally, DASPs are mandated to operate with impartiality, ensuring that their actions prioritise the interests of their clients above all else.

Moreover, these service providers are required to establish robust policies concerning conflicts of interest across various operational dimensions, including investor relations, employee conduct, and the actions of company officers and agents. Furthermore, a steadfast commitment to the fair treatment of customers must be ingrained within the operational ethos of these providers, serving as a safeguard against potential conflicts of interest and bolstering market integrity.

The principles governing market integrity in regulatory frameworks underscore the paramount importance of good faith and impartiality. Regulators have emphasised the critical obligation incumbent upon companies operating exchange platforms or engaging in exchange-related activities to maintain unwavering impartiality, prioritising the best interests of their clients and the seamless functioning of the digital assets under their purview.

Integral to upholding market integrity are a host of broad regulations that these companies must adhere to diligently. For instance, they are expressly prohibited from instigating artificial fluctuations in the quotations or prices of digital assets traded on their platforms.

Furthermore, these entities are tasked with fostering transparency in market price formation processes, avoiding the dissemination of false, inaccurate, or biased information to the public. Regulators rigorously mandate that these companies institute and rigorously enforce measures aimed at preserving market integrity and preventing market manipulation. Failure to adhere to these standards can result in significant penalties, with fines ranging from USD41,975 to USD111,325 imposed for actions that undermine market integrity.

In El Salvador, there is currently a lack of specific regulations governing the creation and utilisation of high-frequency and algorithmic trading technologies in both the traditional securities market and the emerging digital assets sector. The existing Securities Market Law does not include provisions that directly address these advanced trading techniques, nor does the Digital Assets Law offer specific regulations in this regard.

The absence of regulatory frameworks tailored to high-frequency and algorithmic trading means that market participants engaging in such activities may operate within a relatively open and unregulated environment. Without clear guidelines or oversight specific to these technologies, market participants may face challenges in terms of legal certainty, risk management, and investor protection.

In the absence of specific regulations governing the use of high-frequency and algorithmic trading in El Salvador, there are no distinct requirements imposed on entities seeking to register as market makers, particularly when operating in a principal capacity.

Given the current regulatory landscape, market participants engaging in high-frequency and algorithmic trading activities may not encounter specific registration or compliance obligations directly related to serving as market makers. However, it is essential to note that while there may not be explicit requirements for market maker registration, entities engaging in such trading activities are still subject to broader regulatory frameworks governing securities markets, financial intermediaries, and trading activities.

In El Salvador, due to the absence of specific regulations governing high-frequency and algorithmic trading, there is no differentiation between funds that utilise these strategies and dealers engaged in similar activities. Without regulatory frameworks specifically addressing high-frequency and algorithmic trading, entities employing these strategies, whether they are funds or dealers, operate under the same general regulatory environment.

This lack of distinction means that both funds and dealers engaging in high-frequency and algorithmic trading activities are subject to the same overarching regulatory principles and obligations governing securities trading, market conduct, investor protection, and transparency. While the absence of specific regulations tailored to these trading activities may result in a lack of specialised oversight or requirements for such entities, they are still expected to comply with relevant laws and regulations applicable to financial markets and trading activities.

In El Salvador, there is currently no specific regulation governing programmers who develop and create trading algorithms and other electronic trading tools. As such, individuals engaged in these activities operate within a regulatory vacuum, as there are no established guidelines or requirements tailored to their roles and responsibilities.

Without regulation, programmers in the country enjoy a significant degree of freedom in developing and deploying trading algorithms and electronic trading tools. However, this lack of regulation also means that there are no standardised frameworks or oversight mechanisms in place to ensure the integrity, reliability and ethical use of these tools.

DeFi, or decentralised finance, falls primarily under the regulatory purview of the Digital Assets Issuance Law and its accompanying regulations in El Salvador, as they relate to crypto/digital assets. Companies seeking to engage in DeFi activities involving digital assets must undergo the registration and approval processes mandated by the NCDA. Additionally, the NCDA imposes specific norms and requirements aimed at safeguarding consumer interests and ensuring compliance with regulatory standards.

Moreover, the Superintendence of the Financial System oversees electronic money providers operating within the country. These entities are required to adhere to a set of specific regulations and obtain authorisation from the regulatory authorities to conduct their operations as electronic money providers.

Financial research platforms do not have specific requirements for registration in El Salvador, except for those that provide information services about individuals’ credit history. In this latter case, the platforms must register and are subject to supervision by the Financial System Superintendence under the Law on Regulation of Services Providing Information on Individuals’ Credit History and the applicable technical regulations.

In El Salvador, there is currently no Personal Data Protection Law; however, in 2014, the Constitutional Chamber of the Supreme Court issued a protective ruling recognising the right to “informational self-determination”. Through this ruling, individuals are acknowledged the right to rectify, supplement, or cancel data to ensure its accuracy and access to it, particularly in cases of inaccuracy.

Following the aforementioned ruling, in 2015, the Law on the Regulation of Information Services on Individuals’ Credit History was amended to include rights recognised for individuals to control the use of personal information, both in its collection and in the processing, storage, and transmission of their own data.

Although there may not be specific regulation in some cases for these types of financial research platforms, when it comes to operations in the stock market, they must always adhere to the principles established in the Securities Market Law and applicable regulations, which regulate both pump-and-dump schemes, spreading of inside information, as well as other illicit behaviours.

In the case of platforms related to individuals’ credit history, these have specific regulation and only authorised individuals can access the platform following very solid security processes.

In El Salvador, the provision of risk coverage services outside the Financial Regulation and Supervision System is not permitted. In this case, fintech companies involved in insurance must comply with the requirements for the establishment and operation of an insurance company in accordance with the Insurance Companies Law and its regulations. Another option they may have is through alliances or outsourcing of services within the limits established by the technical regulations for information security.

Insurance companies in El Salvador are classified according to their purpose:

• general insurance includes property, accident and health, bail, and reinsurance and counterguarantees; and
• personal insurance includes life, annuities and reinsurance classes.

Regtech providers remains unregulated in El Salvador. Currently, there are no specific regulatory frameworks or guidelines governing the activities of regtech providers within the country. This lack of regulation means that regtech firms operate without explicit oversight or compliance requirements mandated by regulatory authorities.

Financial service firms typically impose standards on technology providers to ensure performance and accuracy, aligning with industry norms rather than specific contractual terms. These standards often revolve around adherence to regulatory requirements relevant to the services being provided. Rather than outlining detailed contractual obligations, financial firms prioritise the fulfilment of regulatory mandates governing the technology solutions they employ.

While contractual agreements may not specify detailed performance criteria for technology providers, they typically incorporate clauses mandating compliance with applicable laws and regulations. This ensures that technology solutions meet regulatory standards and safeguard the interests of both the financial service firm and its clients. By prioritising regulatory compliance within contractual arrangements, financial firms mitigate risks associated with non-compliance and promote trust and accountability in their technology partnerships.

With the enactment of the Bitcoin Law and the Digital Assets Issuance Law, the possibility of using blockchain technology arises, but this is focused on cryptocurrencies or digital assets. However, the use of blockchain in financial services opens up many possibilities not only for cryptocurrencies. Currently, there is more acceptance of blockchain on the part of legacy players, but the implementation of blockchain technology in financial services is still in process.

The regulators’ stance on blockchain technology has significantly improved in recent years, marking a pivotal shift in the financial landscape. This evolution is exemplified by legislative measures, such as the recognition of bitcoin as legal tender. El Salvador has embraced blockchain technology by enacting the Digital Assets Issuance Law, a comprehensive framework that not only legitimises the use of cryptocurrencies but also facilitates trading, tokenisation, and other related activities.

Within the digital assets law, blockchain is defined as a sophisticated database system that enables decentralised record-keeping across a distributed network of nodes. Moreover, a technical norm issued by the Central Bank elaborates on blockchain’s role, describing it as a set of protocols and infrastructure that facilitate decentralised transaction processing and record updates.

Following bitcoin’s regulatory approval, there has been a concerted effort to develop a broader regulatory framework for blockchain technology. This includes the introduction of new regulations and norms aimed at fostering innovation while ensuring compliance and consumer protection.

The Digital Asset Issuance Law establishes that a digital asset will be considered one that uses digital representation, capable of being stored and transferred, using distributed ledger technology (which includes blockchain), or similar or analogous technology. However, the law does not provide a structured distinction regarding the classification of digital assets, or whether all will be considered as regulated financial instruments.

In El Salvador, the regulation of digital assets is governed by the Digital Assets Issuance Law, which outlines specific requirements for issuers of digital assets. According to this law, issuers are defined as entities that create or promote the offering of digital assets to the public, or those seeking to manage digital assets for the purpose of selling or trading them on exchange platforms.

Issuers are required to undergo a registration process to issue blockchain assets and offer them for sale. This process involves providing detailed information about the digital asset, its underlying technology, the issuing entity, and other relevant details. Additionally, issuers must adhere to specific regulations governing public offers of blockchain assets.

For public offers of blockchain assets, issuers are mandated to provide a relevant information document (RID) and obtain certification from an official certificator. These documents serve to inform potential investors about the nature of the digital asset, associated risks, and other pertinent information necessary for making informed investment decisions.

El Salvador has robust regulations concerning issuers and the sale of blockchain assets, aimed at ensuring investor protection, market integrity, and compliance with financial laws. These regulations emphasise the importance of issuers being duly registered and providing comprehensive information to investors regarding blockchain assets and their associated risks.

The regulation of blockchain assets trading platforms falls under the purview of various regulatory bodies, primarily the National Commission of Digital Assets, alongside the Superintendence of the Financial System and the Central Bank. While the NCDA oversees trading platforms involving digital assets, the Superintendence of the Financial System and the Central Bank focus on those involving bitcoin.

Under the oversight of the Central Bank, entities engaging in bitcoin transactions must adhere to local regulations and international best practices for preventing money laundering. They are also required to provide digital receipts detailing transaction costs to individuals involved in bitcoin transactions.

Additionally, the Digital Assets Issuance Law permits companies to exchange digital assets for fiat money or equivalent, whether using their own capital or that of a third party. This law also allows for the operation of exchange or trading platforms for digital assets or derivative digital assets. Companies acting on behalf of third parties can receive and transmit orders for the purchase or sale of digital assets and execute such orders.

The Digital Asset Issuance Law establishes requirements for providers, issuers, and issuances of digital assets, but does not address elements regarding digital asset investors; consequently, specific elements regarding the investment of funds in digital assets are not developed in Salvadoran regulation.

Virtual currencies are subject to distinct regulatory frameworks, often categorised into two main classifications: bitcoin and other virtual currencies. Bitcoin, being a pioneering digital currency and recognised legal tender in El Salvador, is subject to specialised regulatory measures that distinguish it from other virtual currencies.

Digital assets encompass a broad spectrum of digital representations, defined as entities that can be stored and transferred electronically through DLT. Additionally, the regulatory landscape extends to encompass various types of virtual currencies beyond bitcoin. For instance, stable coins are digital assets engineered to mitigate price volatility, typically backed by tangible assets or a basket of assets. Digital derivative assets, including futures contracts, options and swaps, represent another facet of virtual currency regulation, constituting contracts settled in digital assets.

These comprehensive definitions and regulatory frameworks ensure adequate oversight and governance of virtual currencies, safeguarding market integrity and investor interests in the rapidly evolving digital economy.

Although there is no legal or regulatory definition of “DeFi” in El Salvador, starting from the enactment of the Bitcoin Law in 2021 and the Digital Assets Issuance Law in 2023, certain requirements have been established for providers of both bitcoin services and digital asset services, each subject to registration and supervision by different government entities.

In El Salvador, the regulatory landscape surrounding non-fungible tokens (NFTs) and the platforms facilitating their trade are primarily regulated by the Digital Assets Issuance Law. Under this legal framework, NFTs are classified as digital assets, subjecting them to regulation and oversight by the NCDA.

Upon successful registration of a company and approval of its operations by the NCDA, NFT platforms are granted the authorisation to conduct business. This approval signals the green light for individuals to participate in various activities related to NFTs, including buying, selling, and utilising them for various purposes.

Once the necessary regulatory requirements are met, NFT platforms can begin their operations, providing a secure and compliant environment where users can explore and transact in the flourishing NFT market. This regulatory framework ensures the protection of investors and consumers while fostering creativity and growth within the digital asset ecosystem.

At present, Salvadoran legislation inhibits open banking given that, under the Banks Law, banks and their employees must keep information about the operations and services they provide to their clients secret, unless there is a legal or judicial requirement by an authority, which must be duly authorised by the Superintendence of the Financial System. The only exception to the confidentiality obligation is with the Superintendence of the Financial System, the tax authorities, the financial intelligence unit, the credit bureaus, and other entities authorised by law.

However, users of traditional financial products can voluntarily share their financial data with third parties to expedite the process of acquiring financial products.

As stated before, Salvadoran legislation currently does not allow open banking to function; therefore, there are no risks related to this topic.

In El Salvador, regulations governing financial services and fintech encompass various aspects of fraud prevention and compliance. Apart from anti-money laundering regulations, specific mandates are in place to ensure that companies operating in these sectors adhere to stringent standards. Regulators maintain ongoing oversight of fintech players, regularly requesting updated information to assess compliance with regulatory requirements.

For instance, DASPs and bitcoin service providers are obliged to implement robust measures such as a code of ethics, comprehensive operative due diligence processes, risk mitigation strategies, and robust cybersecurity protocols. These requirements are essential for safeguarding against fraudulent activities and ensuring the integrity of financial transactions conducted through these platforms.

Failure to comply with regulatory mandates can result in significant penalties and fines for non-compliant entities. Regulators impose hefty sanctions to deter fraudulent practices and maintain the integrity and stability of the financial system. Consequently, fintech companies operating in El Salvador must prioritise adherence to regulatory requirements to avoid punitive measures and uphold the trust and confidence of consumers.

Regulatory priorities vary depending on the sector, but in El Salvador, AML regulations are a significant focus for regulators across different areas of financial services. Additionally, regulators prioritise efforts to combat market manipulation and safeguard the interests of clients. This includes protecting clients from potential harm, such as unauthorised disclosure of confidential information or the mismanagement of their assets.

Regulators are actively involved in monitoring and enforcing compliance with AML regulations to prevent illicit financial activities and ensure the integrity of the financial system. They also implement measures to detect and deter market manipulation practices that could undermine market stability and investor confidence. Moreover, regulatory frameworks are designed to establish safeguards that promote transparency, fairness, and accountability in financial transactions, thereby enhancing consumer protection and trust in the financial system.