Developing an AML policy for crypto licensing in El Salvador

A company preparing for regulated operations needs comprehensive internal oversight. Its controls must be designed to identify risks relating to money laundering or financing criminal activity and prevent them from materialising. Developing the policy is therefore a foundational task in meeting AML requirements for crypto companies in El Salvador.

Authorisation depends on demonstrating a viable business model and readiness to fulfil the relevant obligations: anti-money laundering (AML), counter-terrorist financing (CFT) and counter-proliferation financing (CPF). Internal procedures must reflect services, customers, operating countries, technology and risk exposure. The policy must integrate risk assessment, CDD (customer due diligence), KYC (know your customer), EDD (enhanced due diligence) and sanctions checks into a coherent system.

Here I examine the principal policy components and the AML/CFT/CPF obligations relevant to authorisation. The regime discussed is DASP (digital asset service provider) registration. Its supervisor is CNAD (National Commission of Digital Assets).

DASP licensing in El Salvador: the AML policy as the principal application document

For CNAD, the AML system indicates whether the applicant can control the exposures its operations create. A statement that customers undergo verification, or that software checks transactions, is insufficient. The applicant needs to demonstrate how everyday business processes incorporate internal controls.

Preparing the policy constitutes a distinct legal and compliance undertaking within DASP licensing in El Salvador. The document must agree with the corporate structure, organisational chart, business plan, technology architecture, geographical coverage and customer service arrangements.

• Exposure and acceptance: the laundering risks inherent in the company's business model, the customer groups the company intends to serve, and the circumstances calling for standard CDD or EDD.
• People undergoing checks: how identity is established for customers and UBOs (ultimate beneficial owners); how screening covers PEPs (politically exposed persons), those subject to sanctions and other higher-risk categories.
• Transactions: the means of tracking crypto transactions and recognising suspicious transactions; the decision-maker for blocking, restricting or further checking a transaction.
• Regulatory dealings and evidence: responsibility for communicating with competent authorities, retaining information and preserving proof of completed checks.
• Management oversight: how management evaluates whether the AML/CFT/CPF system operates effectively.

CNAD publishes sector guidance on AML/CFT/CPF risks. The guidance expressly requires providers to maintain an AML/CFT/CPF programme. For authorisation, the programme must follow applicable legislation and a risk-based approach, informed by FATF (Financial Action Task Force) standards.

Crypto AML compliance in El Salvador: the regulatory basis

Several regulatory layers must be considered together when determining AML requirements for crypto companies in El Salvador. Their respective roles in policy preparation are set out below. As at 28 October 2026, the principal statute is the 2025 AML/CFT/CPF Special Law, enacted through Legislative Decree No. 426. Article 61 provides for the previous implementing regulation and UIF (Financial Investigation Unit) Instruction to remain in force until replacement instruments are issued, subject to the new law.

The drafting task is to turn those general obligations into precise procedures for the individual company's activities.

Assessing the business and documenting its risks

For an exchange, risks vary across customers, transactions and delivery channels. The task is to identify factors that increase the likelihood of its services being used to launder assets or finance unlawful activity, then adopt proportionate controls. This approach underpins crypto AML compliance in El Salvador. The assessment prepared for registration must cover at least the categories below.

Risks associated with customers

An exchange may serve individuals, companies, investment structures, funds, traders, entrepreneurs and other users. Exposure may increase, for example, where ownership is complicated or opaque, nominee directors are involved, the economic purpose is unclear, a PEP participates, or available information warrants closer investigation. The policy needs criteria for classifying customers and a procedure for reassessing their risk profiles.

Geographical connections

The assessment encompasses the countries and territories linked to customers and their transactions. Relevant connections include nationality, residence for individuals and incorporation for companies, business locations, and the jurisdictions of counterparties. It must also consider where funds originated, the geography of blockchain activity and any links to jurisdictions presenting heightened risk or subject to restrictions.

Finding such a connection must have a defined procedural consequence. The policy must distinguish cases requiring EDD, agreement from the compliance officer, or a restriction on a transaction.

Exposure inherent in each service

Asset exchange involves rapid transfers of funds and many counterparties. With custody, control over access to assets and transaction authorisation is essential. Peer-to-peer (P2P) activity adds concerns about funding provenance and participants whose involvement lacks transparency.

Each product or service needs a description of its risks. The policy must also explain the means of obtaining access, the information collected before service begins, applicable limits and monitoring arrangements. It must identify actions that serve as red flags and specify when further information is needed.

Remote delivery

Remote delivery is particularly significant for crypto firms. Where onboarding and servicing take place wholly online, the policy must provide for remote identification, document authentication, detection of duplicate registrations and measures against identity misuse and other abuse. The provider needs to understand how it verifies customer identity, checks documents, handles discrepancies and records the results.

Digital asset transactions

Conventional banking AML monitoring cannot fully substitute for blockchain analysis. The business model determines the relevant exposures: these may concern addresses, incoming asset sources, the path funds follow, services offering greater anonymity and other factors. The methods for analysing blockchain transactions, and the response to any risks found, must be incorporated into an AML policy for crypto licensing in El Salvador.

The documented assessment

The AML risk assessment ranks among the most important documents submitted for authorisation. Every subsequent procedure must be based on its findings. Preparing it ordinarily involves four stages, in order:

1. Establish which risks are inherent in the particular business.
2. Rate the likelihood of each one materialising.
3. Assess the consequences if it does.
4. Examine the controls already in place.

The next step is to determine residual risk: the exposure left after applying those controls. For example, remote onboarding may be identified as a higher-risk factor. Available responses could include document checks, biometric identification where supported by the technology, liveness confirmation during identification, sanctions and PEP screening, and additional checks for customers presenting high risk.

Regulatory expectations do not call for uniformly low ratings. The assessment must describe actual threats and explain their management. Minimal ratings across almost every exposure invite scrutiny where a Salvadoran crypto business serves overseas customers, onboards remotely and transacts in digital assets.

KYC for crypto companies in El Salvador: customer checks

Identification, verification and ownership

The KYC policy is central to the authorisation documentation. Procedures governing KYC for crypto companies in El Salvador must establish how identification works. Applicable rules and risk govern its timing: before a relationship begins, or during its establishment where permitted.

• name in full, nationality and date of birth;
• the residential address or other information on residence;
• particulars of the identity document;
• any additional information needed for risk profiling.

Enquiries into a corporate customer are substantially broader. Registration details, management, ownership and the persons exercising control all need examination. Identification and verification must remain distinct in the policy. Identification involves gathering customer information; verification involves taking reasonable steps to confirm its reliability.

Documentary standards must be explicit. The policy has to specify acceptable materials, circumstances requiring further documents, and grounds for treating evidence as unreliable or inadequate. Differences in the spelling of a name need a defined review process. The documentation must also explain how compliance decisions are recorded and when onboarding must be paused or discontinued.

The policy needs a procedure that reveals who actually controls a corporate customer. Establishing the UBO is particularly important. The customer's structure determines the evidence required, including:

• its constitutional documents and register extracts;
• shareholder or member registers and evidence of the directors' authority;
• an organisational chart and details of those exercising control;
• identity documents for the beneficial owners;
• an explanation of the proposed relationship's purpose and nature.

If several corporate owners are incorporated in different countries, examining the immediate shareholders is insufficient. Ownership and control must be traced to the individuals who own the entity directly or indirectly or exercise effective control. Failure to establish the UBO reliably calls for EDD or refusal to enter the relationship.

The UIF Instruction provides a fallback in Article 21-A: if neither a UBO nor another controlling individual is identifiable, the procedure must identify and verify the relevant senior managing official. Any opacity and resulting risk still need assessment.

Assigning and reviewing a customer rating

Once identity has been established and verified, the company must assign a rating and create the customer's risk profile. The assessment must consider:

• the category of customer, its activities and ownership arrangements;
• its geographical connections and anticipated transaction volume;
• where funds originate, PEP participation and the history of dealings;
• the characteristics of the digital assets involved and findings from blockchain screening.

A scoring model can generate the rating, but the policy must allow a compliance specialist to reconsider it. This matters especially where the automated classification conflicts with the facts. A high rating requires strict controls, but not necessarily refusal of service.

Circumstances requiring EDD

Mandatory EDD triggers must be explicit. The higher-risk circumstances to address include:

EDD entails obtaining further documents and information to substantiate SOF (source of funds) and SOW (source of wealth), examining the customer's business more deeply and monitoring frequently. When the company implements AML requirements for crypto companies in El Salvador, its policy must specify the EDD steps, the staff performing them, the person approving the decision and the documents retained in the compliance file.

Establishing how funds and wealth originated

Crypto businesses must distinguish SOF from SOW. SOF concerns how the particular money or assets used in a transaction or dealings with the provider were obtained. SOW concerns how the customer accumulated their overall wealth.

AML checks require an explanation of how the assets were acquired. Some cases also require examining the capital that enabled their accumulation. The policy must distinguish circumstances requiring SOF evidence from those calling for a deeper SOW enquiry.

Supporting documents may concern business income, property sales, investments, dividends, salary or other lawful sources. Their relevance must be assessed against the customer's particular profile and intended transactions.

Sanctions and PEP screening

A dedicated policy section must identify the screening lists, the stages at which checks occur and the intervals between repeat checks. It must explain the treatment of potential matches, allocate authority over alerts requiring closer examination and specify how decisions are documented.

PEP status calls for particular attention, assessment of heightened risk and appropriate safeguards. It does not by itself bar the person from service. Checks must also cover related categories of people where required by the applicable rules and internal policy.

A false match can arise in automated screening. Basing a decision entirely on an automated result is a common mistake. The procedure must provide for a manual review that confirms or rules out the risk; each decision must be recorded.

Operating the controls: monitoring, decisions and accountability

Monitoring transactions and blockchain activity

A DASP must analyse customer-provided information alongside relevant distributed-ledger data. Using both sources distinguishes its monitoring from conventional financial monitoring. Procedures must reflect the services actually delivered; transaction analysis is among the more demanding elements of crypto AML compliance in El Salvador.

• activity that falls outside the profile supplied by the customer;
• a marked change in transaction volumes or frequency;
• assets passing quickly through a series of addresses;
• use of addresses presenting heightened risk;
• incoming assets whose provenance needs further examination;
• efforts to break transactions into smaller amounts;
• unusual outward transfers directly after an account receives funds;
• a transaction with no evident economic purpose;
• several accounts or connected people being used to evade limits.

For every indicator, the procedure must explain how it is detected (manually or automatically), who receives the notification after risk review, when the initial review is due and what additional information may be requested. It must also specify when an authorised employee undertakes a deeper investigation and who decides the outcome.

Traceability and analytical tools also form part of digital asset controls. CNAD places emphasis on analysing transactions, tracing assets and making controls proportionate to risk.

The possibility of using specialist blockchain analytics must be considered during policy preparation. Merely having access to software does not demonstrate compliance. Where such tools are used, the documentation must explain:

• which networks are analysed and which address types and transactions are checked;
• when screening occurs and how the system categorises risk;
• who has authority to alter screening parameters;
• how results are stored;
• what measures apply if the analytics service becomes unavailable.

The policy must address whether heightened risk attached to an address is sufficient by itself to determine the outcome. A well-designed system generally examines the evidence as a whole. Address risk matters, but a specialist must also consider the transaction's context and other available data. The policy must not allow alerts to be dismissed without justification or automated decisions to be made without adequate examination.

From an alert to a documented decision

The policy requires a complete process for detecting potentially suspicious transactions. Its stages must be distinguished:

Confidentiality requirements and restrictions on access to this information must form part of the policy. An employee must not independently tell a customer about a possible internal investigation if such disclosure would contravene the law or the procedures of a competent authority.

Personnel, authority and independence

Responsibilities must be clearly assigned for DASP licensing in El Salvador. Article 20 of the 2025 Special Law requires a CNAD-supervised company to establish a compliance function. The board, or equivalent governing body, must appoint a principal compliance officer and an alternate. The first two roles in the list below are mandatory; the need for the remaining roles depends on the structure and scale of the business and the volume of its activity:

• the employee responsible for AML work and the associated reporting;
• that employee's alternate;
• a specialist dealing with compliance matters;
• a specialist assigned to transaction monitoring;
• the manager of the compliance department.

The responsible officer needs sufficient independence to fulfil the role, the necessary information and a route for escalating issues to management. The policy must specify the qualifications required, the extent of the officer's powers and the arrangements for appointment and replacement. It must also cover access to systems and data, reporting to management, involvement in approvals concerning high-risk customers, dealings with competent authorities and examination of suspicious transactions.

Smaller firms commonly appoint an officer on paper without giving that person effective authority. Regulatory readiness requires an organisational structure that functions in practice.

The AML policy must affirm the principle of independent control. A person motivated to increase sales or accept as many customers as possible must not make decisions about compliance risks alone. Where feasible, sales, onboarding, internal control checks, transaction monitoring and high-risk decisions should be allocated separately.

Smaller businesses may be unable to staff a large standalone department. They must nevertheless retain the required compliance function and officers, with authority distributed so that decisions receive an additional check. For instance, accepting a high-risk customer requires agreement from more than one authorised person, including senior management approval wherever the applicable rules require it.

Evidence, retention and policy review

Proper retention is mandatory. A separate policy or an AML policy section must identify the documents to keep, their storage locations and those allowed access. Protection against unauthorised alteration, applicable retention periods and secure deletion once the mandatory period expires must also be covered.

• evidence obtained through customer identification and verification;
• findings from sanctions screening and searches of other databases;
• UBO information and risk assessment results;
• documents explaining how money and assets were obtained and how wealth was accumulated;
• EDD findings;
• the history of examinations concerning identified risks and suspicious transactions;
• internal decisions and conclusions of responsible staff;
• information on completed transactions;
• other evidence that the prescribed controls were performed.

Records of checks and decisions must be complete. They must establish when a check took place, who performed it, what information was used and the evidential basis for the decision.

Policies also need periodic review. Even carefully prepared documentation can become detached from actual operations as services, countries, customers and technology change. Updates are appropriate when a new product is introduced, a new market is entered, or the customer base changes substantially. Changes in legislation and material weaknesses in the system are further triggers. Internal or independent audit findings should also inform updates.

An effectiveness review must examine the actual application of the procedures. If the policy requires EDD for PEPs, the audit must establish whether the system properly identifies them, whether the checks are documented and whether the stipulated additional controls are applied.

Common defects in AML documentation

A policy borrowed from a bank, a payment institution or a crypto business operating elsewhere may express sound principles. Its provisions can still be unsuitable for the applicant's model or Salvadoran law. Reusing such a document is a common mistake.

The application must be internally consistent for DASP licensing in El Salvador. If the business plan describes serving overseas corporate customers, a policy dealing only with individuals contradicts it. Similar discrepancies can concern limits on transactions, geographical coverage, assets or products. Every document in the application has to agree with the others.

Risk assessment can also become a formal exercise in assigning low ratings. Objective evidence of higher exposure must instead be reflected in the classification of the relevant activity, customer group, transaction or jurisdiction. The record must explain the controls used to reduce and properly manage those risks.

Simply stating that EDD is performed leaves the procedure undefined. The policy must specify the triggers and additional safeguards, explain how authorised staff approve the measures, and set intervals for reviewing customers again.

Generic warning signs give employees inadequate guidance for applying the policy. The indicators must suit the actual business, its services, its digital assets and its operating model.

An external analytics service creates another potential mismatch. Policy provisions must describe the functions actually available in the software being used. They cannot claim that it checks data or performs controls beyond its capabilities.

Developing and implementing the documentation

Professional work on an AML policy for crypto licensing in El Salvador ordinarily follows the stages below.

Examining the business model

The starting analysis covers services, customer groups, operating countries, asset types, ways of accepting customers, payment flows and technology infrastructure.

Establishing what remains to be developed

The applicable requirements are reviewed to establish which procedures already exist and which remain to be developed. For example, a global AML policy may already exist while a separate procedure for monitoring blockchain transactions remains absent.

Mapping the risks

The next stage produces a risk map identifying inherent exposure, existing controls and residual risk. Its findings underpin both the main AML/CFT/CPF policy and the supporting documents.

Translating the policy into working procedures

Responsible staff are appointed and reporting lines established. Authority to agree and approve decisions must be allocated. The policy is then put into effect through practical procedures and documents, including:

• customer acceptance checklists;
• forms for identification and verification;
• EDD forms;
• forms documenting the review of identified risks;
• forms referring suspicious activity for further examination;
• a register of internal control measures and decisions.

Checking the application for contradictions

Before filing, the package must be checked for inconsistencies and contradictions. The review covers corporate records and the business plan; it also compares the AML policy, documented risk assessment and organisational chart. Descriptions of technology and infrastructure must be checked alongside security procedures and the remaining documents intended for regulatory submission.

Where the model involves transfers between regulated providers, applicable information-sharing duties need separate examination. These are known as Travel Rule requirements. CNAD requires the relevant transfer details to be collected and retained irrespective of amount.

The policy must specify the data required for originators and beneficiaries, triggers for additional checks and methods for establishing counterparty status. It must explain information exchange, confidentiality and data protection, the response to missing details, and when to suspend a transaction or refer it for the compliance officer's review.

Conclusion

Policy development establishes a coherent system for managing financial risks. A provider must properly understand its activities and their particular characteristics. It needs the capability to establish customer and UBO identities, recognise and assess relevant exposures, apply enhanced safeguards, monitor transactions and maintain adequate records of its decisions.

For registration or authorisation, the compliance documentation must be consistent throughout. The business plan, proposed services, corporate structure, technology infrastructure and actual capabilities must all be reflected in its procedures. Professional assistance with an AML policy for crypto licensing in El Salvador requires current analysis of applicable legislation and regulatory requirements, and an individual assessment of the particular company's business model and risks.