Uruguay Crypto Regulation: Complete Guide to Licences, Requirements and Costs

The uruguay crypto regulation framework has matured rapidly following the enactment of Law 20.345, which brought virtual assets and the service providers that trade, custody and transfer them squarely within the supervisory remit of the Central Bank of Uruguay (Banco Central del Uruguay, or BCU). For businesses evaluating a Latin American base, from international crypto exchanges and custodians to token issuers and payment platforms, Uruguay now offers something that was previously scarce in the region: statutory clarity backed by a credible, established financial regulator. Combined with Uruguay’s longstanding fiscal-residency incentives, the jurisdiction has become a serious contender for market entrants seeking legal certainty rather than regulatory grey zones.

This guide is written for operators and founders of crypto exchanges, custody businesses, virtual asset service providers (PSAVs), token issuers and fintech companies that need to understand what the uruguay crypto regulation regime requires in practice. It is also useful for investors and compliance officers mapping market-entry options across LATAM.

In the sections that follow, you will learn how Law 20.345 works, who regulates virtual assets, the eligibility and governance standards for a PSAV licence, a step-by-step application process, realistic costs and timelines, AML/KYC obligations, the tokenisation framework, a side-by-side comparison with Panama, Argentina and Brazil, and the enforcement risks every applicant should anticipate.

The regulatory landscape in Uruguay

Uruguay has historically been one of the most institutionally stable economies in Latin America, with a reputation for the rule of law, a convertible currency and a sophisticated banking sector. The uruguay crypto law environment reflects that same conservatism: rather than improvising through enforcement actions or informal guidance, the Uruguayan legislature chose to codify a dedicated statutory regime for virtual assets. That decision anchors legal certainty for applicants and gives the BCU a clear mandate to supervise the sector.

What is Law 20.345?

Law 20.345 is the Uruguayan statute that formally incorporates virtual assets and virtual asset service providers into the regulated financial perimeter. In plain language, it does three core things. First, it defines virtual assets and the categories of service that constitute regulated activity, including exchange, transfer, custody and administration of virtual assets. Second, it designates the BCU as the competent authority to license and supervise these providers, extending the central bank’s existing financial-services oversight to the crypto sector. Third, it establishes that PSAVs are subject to anti-money-laundering and counter-terrorist-financing obligations consistent with the broader Uruguayan AML/CFT framework.[1]

The practical effect is that activities previously conducted in a legal vacuum now trigger clear licensing and compliance duties. For legitimate operators this is an advantage: a licence under Law 20.345 is a recognisable, defensible regulatory status that banking partners, counterparties and institutional investors understand.

Who regulates virtual assets?

Three authorities matter most under the uruguay crypto regulation regime. The Banco Central del Uruguay (BCU) is the primary prudential and conduct regulator, issuing circulars and supervisory guidance that govern PSAV licensing and ongoing obligations.[2] The national Financial Intelligence Unit (UIAF/SENACLAFT framework) receives suspicious-transaction reports and supervises AML/CFT compliance. The Dirección General Impositiva (DGI) administers tax, including the treatment of crypto income and the fiscal-residency incentives that make Uruguay attractive to individual founders and investors.[3]

Scope, PSAVs vs non-financial virtual assets and tokenisation

Not every activity involving tokens is a licensable PSAV activity. The statute draws a line between regulated virtual asset services, those involving exchange, custody or transfer on behalf of clients, and non-financial uses of distributed-ledger technology. Likewise, asset tokenisation may fall inside or outside financial regulation depending on whether the token represents a security, a payment instrument or a purely utility function. Correct classification is the single most important early decision in any uruguay crypto regulation application.

Key requirements and eligibility for a PSAV licence (what regulators expect)

The BCU approaches PSAV authorisation the way it approaches any regulated financial entity: through the lens of fitness, governance, solvency and controls. Applicants who understand the uruguay crypto regulation expectations before filing dramatically improve their odds of a smooth review. Below are the main pillars the regulator assesses.

Who needs a PSAV licence? (activities that trigger licensing)

You generally require a virtual asset service provider license if you carry on, as a business and on behalf of clients, any of the following:

• Exchange services: converting virtual assets to fiat currency, fiat to virtual assets, or one virtual asset for another.
• Custody and administration: safeguarding virtual assets or the private keys that control them on behalf of third parties.
• Transfer services: moving virtual assets between addresses or accounts for clients.
• Participation in financial services related to issuance: providing or participating in the offer and sale of virtual assets where this crosses into regulated territory.

Purely proprietary trading, non-custodial software provision or developer activity may fall outside the perimeter, but this must be confirmed through classification, not assumed.

Eligibility criteria, corporate form, local presence, directors, fit & proper

Applicants are expected to operate through an eligible Uruguayan corporate vehicle, most commonly a sociedad anónima (S.A.) or equivalent limited-liability company, with a genuine local presence rather than a shell. The BCU evaluates the fit-and-proper standing of shareholders, directors and senior managers, examining professional experience, financial soundness and the absence of disqualifying criminal or regulatory history. Beneficial ownership must be transparent, and complex opaque structures are viewed unfavourably.[2]

Governance, internal controls and senior management requirements

The regulator expects documented governance appropriate to the scale and risk of the business. In practice this means:

• A clear organisational structure: defined reporting lines, board oversight and segregation of key functions.
• A compliance function: a designated compliance officer and, for AML purposes, a reporting officer responsible for interactions with the FIU.
• Risk-management policies: operational, cyber, custody and conflict-of-interest controls proportionate to the activities undertaken.
• Business continuity and security: safeguarding of client assets, key-management protocols and incident response.

Capital, prudential and net-asset requirements (if any)

The BCU may require evidence of minimum capital or solvency commensurate with the activity and the risk profile of the provider. Custody and exchange activities that hold client assets attract heightened expectations around financial resilience and segregation of client funds. Because the precise figures are set through BCU circulars and application instructions and may be revised, applicants should verify the current thresholds against the operative circular at the time of filing rather than relying on earlier benchmarks.[2] Editor note: specific numeric capital thresholds should be confirmed against the operative BCU circular before publication.

Foreign companies & non-resident applicants (branch vs subsidiary)

Foreign operators are welcome under the uruguay crypto regulation framework. Non-resident groups typically enter either by incorporating a local subsidiary or, where permitted, by registering a branch of the foreign entity. A locally incorporated subsidiary usually offers cleaner governance, ring-fenced liability and a more straightforward supervisory relationship. Regardless of structure, foreign applicants must meet the same fit-and-proper, governance and AML standards as domestic applicants, and foreign corporate and personal documentation must generally be translated into Spanish and legalised or apostilled as required.

Step-by-step licence application process

The PSAV authorisation journey is methodical. Treating it as a structured project, rather than a single filing, is the difference between a licence granted in months and one stalled by repeated requests for information. The checklist below summarises the arc: classify the activity, build the local entity, assemble documentation, evidence your compliance programme, file with the BCU, respond to review queries, and then operate under ongoing supervisory obligations. Each step is expanded in turn.

Step 1: Pre-application assessment & regulatory mapping

Before any corporate or regulatory step, map every intended activity against the Law 20.345 perimeter. Will you custody client assets? Offer fiat on-ramps? Facilitate token issuance? Each answer changes the licence scope, the capital expectations and the compliance build. This classification exercise should produce a written regulatory analysis that underpins the entire application and identifies which activities are licensable PSAV services and which fall outside the regime.[1]

Step 2: Corporate structuring & local presence setup

With the activity scope settled, incorporate the Uruguayan vehicle. This involves selecting the corporate form, appointing directors, establishing the registered office and local representation, and opening operational infrastructure. Beneficial ownership should be documented transparently from day one, because the BCU’s fit-and-proper review reaches through to ultimate owners. Foreign groups should decide at this stage between a subsidiary and a branch and prepare the attendant legalised corporate documentation.

Step 3: Prepare required documentation

Documentation is where most timelines slip. Applicants must assemble a comprehensive dossier that typically includes corporate constitutive documents, ownership and control charts, director and manager CVs and background evidence, financial statements or capital evidence, and a full suite of policies. The AML/KYC manual, risk assessment, custody and key-management procedures and business plan all form part of this package. The table in the AML section below sets out the key documents, their source and the evidentiary standard the regulator looks for.

Step 4: Governance and compliance programme evidence

The BCU wants to see not just written policies but a functioning programme. Evidence here includes the appointment of a qualified compliance/AML officer, a staff training plan, transaction-monitoring tooling, and documented procedures for customer due diligence and suspicious-activity escalation. A credible compliance programme that maps to FATF standards is central to approval.[5]

Step 5: Filing the application with the BCU

The formal application is submitted to the BCU using the prescribed forms and accompanied by the documentary dossier and any applicable fees. Submissions must be complete and internally consistent; gaps and contradictions between the business plan, the policies and the corporate documents invite questions. Confirm the current submission route, forms and fee schedule against the BCU’s published circulars at the time of filing.[2]

Step 6: Regulatory review, follow-ups and requests for information

Once filed, expect an iterative review. The BCU will typically issue requests for additional information or clarification, on beneficial ownership, on the robustness of controls, or on capital and solvency. Responsiveness matters: well-prepared applicants who answer comprehensively and promptly shorten the cycle. Treat each query as an opportunity to demonstrate the maturity of your governance rather than a mere box-ticking exercise.

Step 7: Licence grant, post-licence obligations and reporting cadence

On approval, the PSAV receives its authorisation and enters the supervised population. From that point, obligations are continuous: periodic reporting to the BCU, ongoing AML/CFT reporting to the FIU, maintenance of capital and controls, audit cooperation and prompt notification of material changes. The licence is not a one-time event but the start of a continuing supervisory relationship.

Costs, timelines and realistic expectations

Budgeting accurately for a PSAV authorisation means looking beyond the regulator’s filing fee. The dominant costs are the professional, technological and staffing investments needed to build a compliant operation that will withstand supervisory scrutiny under the uruguay crypto regulation regime.

Typical regulator fees and one-off set-up costs

Direct regulator filing fees in Uruguay are generally modest relative to the overall project. The larger one-off costs are company formation, legal structuring, drafting of the full policy suite, and the regulatory-mapping analysis. Where numeric fee figures are quoted, these should be confirmed against the current BCU fee schedule at the time of application, as they are subject to revision.[2] Editor note: confirm current regulator fee amounts before publication.

Ongoing costs (compliance team, AML tech, audits)

Recurring costs typically exceed the initial outlay. These include salaries for the compliance and AML officers, subscription costs for transaction-monitoring and screening technology, external audit fees, ongoing legal support and the cost of periodic regulatory reporting. Custody-heavy models carry additional security and insurance costs. As an industry-level estimate, first-year all-in costs commonly range from lower five-figures to higher five-figures (USD) depending on scale and activity mix; these are indicative and should be modelled against your specific business plan rather than treated as fixed figures.

Expected timeline: from pre-application to licence

Timelines vary with complexity and regulator workload. As working benchmarks: pre-application readiness commonly takes two to eight weeks; formal BCU review commonly runs three to six months; and remedial information requests can extend matters further. Complex cross-border structures or novel activities sit at the longer end. Applicants who arrive with a complete, coherent dossier tend to land near the best-case timeline.

AML/KYC and ongoing compliance obligations

Anti-money-laundering compliance is the backbone of the uruguay crypto regulation regime. The BCU and the national FIU expect PSAVs to operate controls that are substantively equivalent to those of other regulated financial institutions and aligned with international standards.

AML/CFT requirements under the Uruguay regime and FATF alignment

Uruguay’s AML/CFT obligations for PSAVs are designed to align with the recommendations of the Financial Action Task Force (FATF), including the risk-based approach, customer due diligence, and the so-called “travel rule” expectations for virtual asset transfers.[5] Providers must maintain a documented, risk-based AML programme, conduct enterprise-wide risk assessments and keep those assessments current as products and customer bases evolve.

KYC, transaction monitoring and suspicious activity reporting

Operationally, PSAVs must verify customer identity and beneficial ownership (KYC), screen against sanctions and politically-exposed-person lists, monitor transactions for unusual patterns, and file suspicious-transaction reports with the national Financial Intelligence Unit. Escalation procedures must be clear, and the designated reporting officer is the formal point of contact with the authorities for AML matters.

Recordkeeping, audits and periodic reporting to the regulator

Providers must retain customer, transaction and compliance records for the statutory retention period, submit to internal and external audit, and file periodic regulatory reports to the BCU. The documentary table below summarises the core compliance artefacts the regulator expects to see.

Asset tokenisation and securities interaction

One of the most commercially significant aspects of the uruguay crypto regulation framework is how it accommodates asset tokenisation, the representation of real-world or financial assets as blockchain tokens. For issuers, the decisive question is whether a given token is a regulated financial instrument or sits outside the securities perimeter.

How Law 20.345 treats tokenisation and digital representations of assets

Law 20.345 establishes the legal recognition of virtual assets, including tokens that digitally represent value or rights, and situates the services around them within BCU supervision.[1] This matters because it provides a statutory anchor for tokenisation projects that previously operated without a clear legal footing. The classification of each token, payment token, utility token or investment/security token, determines which regulatory regime applies.

Where securities or investment tokens intersect with financial regulation

Where a token confers rights that resemble a security, a share of profits, a debt claim or a participation in a collective investment, it may fall under securities and market-conduct rules in addition to, or instead of, the PSAV regime. Issuers should analyse token economics against both the virtual-asset framework and Uruguay’s securities regulation to avoid inadvertently conducting an unauthorised public offering. For a deeper treatment, see asset tokenisation in Uruguay, regulatory and securities considerations.

Practical steps for token issuers operating in Uruguay

Practical token issuers should: (1) obtain a written legal classification of the token before marketing; (2) design disclosure documentation proportionate to the token’s risk and investor base; (3) build AML/KYC into the issuance and secondary-transfer process; and (4) confirm the tax treatment of issuance proceeds and holder gains with reference to DGI guidance.[3]

Comparison, Uruguay vs selected LATAM alternatives

Market entrants rarely consider Uruguay in isolation. The table below sets out an indicative, high-level comparison of the uruguay crypto regulation regime against Panama, Argentina and Brazil across the factors that most influence market-entry strategy. The figures are directional and should be verified against current local sources before any decision.

Uruguay stands out where an operator values two things above all: regulatory clarity and personal fiscal incentives. The PSAV licence sits within an established central-bank supervisory culture, which banking partners and institutional counterparties trust. Meanwhile, Uruguay’s fiscal-residency incentive, which can offer new residents a temporary exemption from tax on certain foreign-source income for a multi-year window, is attractive to founders relocating alongside their business.[3] Where speed-to-market in a very large domestic user base is the priority, Brazil may appeal; where minimal formal supervision is the goal, operators sometimes look to lighter-touch jurisdictions, but the trade-off is weaker legal certainty and harder banking access.

Risks, enforcement and supervisory practice

Operating under the uruguay crypto regulation regime carries real enforcement exposure for those who cut corners. Typical breaches include operating licensable PSAV activity without authorisation, deficient AML/KYC controls, failure to file suspicious-transaction reports, inadequate safeguarding of client assets, and failure to maintain required capital or reporting. Sanctions can range from remedial directions and fines to suspension or revocation of a licence, with the most serious AML failings carrying the potential for broader criminal exposure under the national AML/CFT framework.[5]

To mitigate regulator concerns, applicants and licensees should treat compliance as an operating discipline rather than a documentation exercise: keep the risk assessment live, test controls, train staff, and maintain proactive, transparent engagement with the BCU and FIU. Supervisors tend to respond constructively to firms that self-identify issues and remediate quickly, and far less so to those that are opaque or reactive.

Next steps for applicants

For organisations preparing to engage with the uruguay crypto regulation regime, the immediate priorities are legal and compliance due diligence and pre-filing readiness. A disciplined pre-filing workstream prevents the most common cause of delay: an incomplete or inconsistent application. Recommended first actions include:

• Classify your activities: produce a written regulatory-mapping analysis against Law 20.345 before incorporating anything.
• Standardise documentation: prepare corporate, governance and policy documents to a consistent, review-ready standard, see our step-by-step PSAV licence application (create this).
• Build the AML programme early: use an AML/KYC checklist for virtual asset service providers (create this) to evidence FATF-aligned controls.
• Model the economics: factor set-up, staffing and ongoing costs, and assess the tax treatment and residency incentives for crypto businesses in Uruguay (create this).
• Benchmark alternatives: review the cross-border comparison of Uruguay vs Panama, Argentina and Brazil (create this) before committing.

Conclusion

The uruguay crypto regulation regime offers a rare combination in Latin America: a dedicated statute in Law 20.345, supervision by an established and credible central bank, FATF-aligned AML standards and a genuinely attractive fiscal-residency incentive. For serious operators, that clarity is a competitive asset, it unlocks banking relationships, institutional trust and defensible regulatory status. The immediate compliance priorities are straightforward in principle and demanding in execution: classify your activities precisely, build a local entity with transparent ownership, stand up an FATF-aligned AML programme, and assemble a complete, coherent application before engaging the BCU. Approached methodically, uruguay crypto regulation rewards well-prepared applicants with one of the region’s clearest routes to a licensed, bankable virtual asset business.

This article is for general information only and does not constitute legal advice. Regulatory references, fees and timelines evolve; verify all figures against the operative official texts before acting. Last reviewed: 28 October 2026.

Sources

• [1] Parlamento del Uruguay / Diario Oficial, Law No. 20.345 (official text): parlamento.gub.uy
• [2] Banco Central del Uruguay (BCU), circulars, PSAV guidance and supervisory rules: bcu.gub.uy
• [3] Dirección General Impositiva (DGI), tax and residency guidance: dgi.gub.uy
• [4] Ministerio de Economía y Finanzas (MEF), economic and tax policy context: gub.uy/ministerio-economia-finanzas
• [5] Financial Action Task Force (FATF), recommendations and virtual-asset AML/CFT standards: fatf-gafi.org