My thesis is simple: a licence does not guarantee your assets are safe, but it does give you clear rules, a supervisor and somewhere to turn. That is why, before choosing a virtual asset service provider (VASP), the first thing a risk and compliance team should verify is where it is regulated and what that regulator requires of it.

Regulations exist, among other reasons, so that those who provide a service or sell a product meet a minimum: standards and sound control practices appropriate to their sector.

Regulation is already advancing in Europe, the United States and Latin America

In digital assets, several countries and regions have moved significantly. The European Union is one of the leaders, with the MiCA Regulation (Markets in Crypto-Assets) of 2023, applicable since 2024. The United States, for its part, passed the GENIUS Act on payment stablecoins in July 2025, which takes effect in January 2027.

In Latin America, El Salvador has been at the forefront. First with its Bitcoin Law of 2021, amended in January 2025, when bitcoin ceased to be legal tender that merchants had to accept. Then with the Digital Asset Issuance Law of 2023, which created the National Digital Assets Commission (CNAD). Brazil follows, with Law 14.478 enacted in December 2022 and the Central Bank of Brazil as its supervisor.

Other countries in the region have also moved. Argentina and Peru established supervision rules for virtual asset service providers in 2024 and 2023 respectively, in Peru’s case through Supreme Decree No. 006-2023-JUS. Uruguay implemented a general framework in late 2024 and Chile has had its Fintech Law since 2023. And there are countries such as Guatemala that, while they have no sector-specific law, issued rules in 2026 for anti-money laundering in the field of digital assets.

The real risk sits off the blockchain

Broadly, these rules aim to protect users of digital asset platforms. The blockchain is hard to alter and makes transactions traceable, but the main risks to the user usually sit off the chain: in custody services, digital wallet management, prepaid cards, investments and other linked products.

That is where the issues the rules address appear: the duty to disclose the volatility of assets such as bitcoin, the backing required of companies that provide virtual asset services, and the prevention of money laundering, extortion, corruption and other local and cross-border crimes.

A recurring theme in these regulations is consumer protection. The point is to make regulators reachable when there is a complaint: over breaches of privacy or data protection rules, over breaches of contract in general, or over deficiencies in the services the provider delivers.

As regulations become more robust, control requirements stricter and regulators more expert, user confidence in a sector that still has plenty of room to grow will keep rising.

Regulation helps, but the strength of the sector also depends on its operators. Before working with a provider, it is worth reviewing its soundness, its track record, whether it is regulated in any jurisdiction and whether it maintains good practices or standards applicable to its activities.

Growing transaction volumes draw regulators’ attention

Global stablecoin market figures show strong growth in recent years, and Latin American countries are not far behind. That growth helps explain why governments across the region have launched regulatory initiatives to protect users and the market at large.

Brazil is the most visible case: it received more than US$250 billion in digital asset value during 2026. At those volumes, it is no surprise that regulators are paying attention.

What to check before working with a provider

If you are currently a client of a virtual asset service provider, check whether it is regulated and in which jurisdictions.

efy is regulated in El Salvador by the National Digital Assets Commission (CNAD) and the Superintendency of the Financial System (SSF), and in Bolivia as a digital asset service provider by the Financial System Supervisory Authority (ASFI). In the other jurisdictions where it operates, it applies the same standards and controls in relation to its clients’ digital assets.

Efinti Tecnología S.A., a company of Efinti Holdings, is approved to operate in the territory of Bolivia.

Carlos R. Poveda leads efy’s regulatory compliance in El Salvador, Bolivia and other countries in the region.

Sources

  • Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA)
  • GENIUS Act on payment stablecoins, United States, July 2025
  • Bitcoin Law of El Salvador, 2021, amended January 2025
  • Digital Asset Issuance Law of El Salvador, 2023
  • Law 14.478 of Brazil, December 2022
  • Supreme Decree No. 006-2023-JUS, Peru
  • Chainalysis, data presented at Nodes Panamá, 29 September 2026

This article is for informational purposes and does not constitute legal, tax or investment advice. Virtual asset regulation changes often and varies by jurisdiction, and every operation should be assessed with your own advisers, taking into account the specific circumstances of each case.