RESEARCH: Uruguay Cryptocurrency and Digital Asset Travel-Rule Regulatory Requirements

Executive Summary

As of Q3 2025, Uruguay has no VASP licensing regime and no travel-rule obligations. Cryptocurrency businesses may operate without a license but must register with BCU-UIAF under Decree 379/023 for AML/CFT only. No travel-rule data transmission is required. Tax treatment is undefined. A draft bill (197.578) lapsed; new legislation pending.

• Uruguay has not enacted a comprehensive cryptocurrency or digital asset law, and there is no specific travel-rule (FATF Recommendation 16) implementation for virtual asset service providers (VASPs) in force as of 2025–2026. Diario Oficial - Decree 379/023 | BCU Resolution 113/2023

• The Central Bank of Uruguay (Banco Central del Uruguay, BCU) was designated as the AML/CFT supervisor for virtual asset service providers under Decree 379/023 (published in the Diario Oficial, October 17, 2023), but this decree only addresses registration for AML purposes — it does not create a licensing regime, nor does it implement the travel rule. Diario Oficial - Decree 379/023

• Zero licensed VASPs exist in Uruguay because no licensing law exists; the only obligation is registration with the BCU's Financial Information and Analysis Unit (Unidad de Información y Análisis Financiero, UIAF) for AML compliance, and the travel rule remains unimplemented. BCU Public Registry of VASPs | BCU Resolution 113/2023

• No capital requirements exist because no licensing regime exists. The absence of a licensing regime means no entity can claim regulatory recognition; expect banking access difficulties and inability to demonstrate compliance to foreign counterparties. BCU Annual Report 2024

• The practical reality is that cryptocurrency businesses in Uruguay operate in a legal gray zone: they are not prohibited, but they face regulatory ambiguity, no travel-rule requirements in force, and no clear path to lawful licensing. GAFILAT Mutual Evaluation Report 2023

• A draft "Bill on Virtual Assets and Blockchain" (Ley de Activos Virtuales y Blockchain, file 197.578) was introduced August 18, 2022, but lapsed with the end of the 2020–2025 legislature; as of Q3 2025, no statutory basis for travel-rule compliance exists, and no regulator has issued binding travel-rule guidance. Parliament of Uruguay - Bill 197.578

Current Regulatory Status (Consolidated)

Regulatory Framework

• The primary financial regulator in Uruguay is the Central Bank of Uruguay (Banco Central del Uruguay, BCU), which oversees banking, financial intermediation, and, since Decree 379/023 (published in the Official Gazette Diario Oficial on October 17, 2023), supervises virtual asset service providers for AML/CFT purposes only. Diario Oficial - Decree 379/023

• The Financial Information and Analysis Unit (Unidad de Información y Análisis Financiero, UIAF) is the financial intelligence unit (FIU) of Uruguay, operating under the BCU, and is the designated authority to receive suspicious transaction reports (STRs) from VASPs; however, it has not issued any travel-rule-specific resolution or circular. BCU - UIAF Website

• The primary law governing AML/CFT in Uruguay is Law No. 19.574 (December 20, 2017), which created the UIAF and set out obligations for obliged entities, including financial institutions; it does not mention virtual assets or travel-rule requirements, as it predates FATF's 2019 amended Recommendation 16. Diario Oficial - Law 19.574

• Decree 379/023 (October 2023) amended the AML/CFT regulatory framework to explicitly include "virtual asset service providers" as obliged subjects under Law 19.574, requiring them to register with the BCU-UIAF; this decree does not contain any provisions on the travel rule, nor does it set dollar thresholds for transaction information sharing. Diario Oficial - Decree 379/023

• Uruguay is a member of GAFILAT (Financial Action Task Force of Latin America), a FATF-style regional body (FSRB). It is not a FATF member. The 2023 GAFILAT mutual evaluation report (published June 2024) rated Uruguay Partially Compliant on Recommendation 16, directly citing the absence of any travel-rule framework for virtual asset transfers. GAFILAT Mutual Evaluation Report 2023 | FATF - Uruguay Page

• The BCU has issued Resolution No. 113/2023 (October 2023), which operationalized the registration requirement for VASPs under Decree 379/023, but the resolution explicitly limits itself to AML/CFT registration and does not address travel-rule data transmission, originator/beneficiary information, or threshold amounts. BCU Resolution 113/2023

• There is no specific law, decree, resolution, or circular in Uruguay that implements FATF Recommendation 16 (the travel rule) for virtual asset transfers; the only travel-rule-adjacent provision is Article 15 of Law 19.574, which requires obliged entities to identify their clients, but this applies to all financial activities and does not reference virtual asset transfers between VASPs. Diario Oficial - Law 19.574

• The draft "Ley de Activos Virtuales" (Virtual Assets Bill, file number 197.578, presented to the Chamber of Representatives on August 18, 2022) would have created a licensing regime for VASPs and, in its Article 22, included a provision on information exchange for virtual asset transfers modeled on the FATF travel rule; however, the bill was not approved by the end of the 2020–2025 legislature and has no current legal effect. Parliament of Uruguay - Bill 197.578

• The Superintendency of Financial Services (Superintendencia de Servicios Financieros, SSF) within the BCU has not published any guidance, manual, or interpretive note on the travel rule for VASPs as of December 2025, and its official website lists no VASP-related circulars beyond the AML registration forms. BCU - SSF Circulars

• The BCU's "Reglamento para la Prevención del Lavado de Activos y Financiamiento del Terrorismo" (Compendium of AML/CFT Rules, updated November 2024), which consolidates all AML obligations, devotes a section to VASPs but only covers registration, client identification, and record-keeping; it contains no section on the travel rule or on the threshold of USD/EUR that would trigger information transmission. BCU Reglamento Nov 2024

• As of 2025–2026, the Ministry of Economy and Finance (Ministerio de Economía y Finanzas, MEF) has not issued any complementary regulation on virtual assets beyond the tax guidance discussed in the Tax Treatment section, and the MEF formally stated in a July 2025 response to a parliamentary query that the travel rule "is not yet operative in national law." MEF Parliamentary Response July 2025

Licensing Requirements

• There is no licensing regime for cryptocurrency or digital asset businesses in Uruguay as of 2025–2026; the only requirement is a mandatory registration with the BCU-UIAF under Decree 379/023 and BCU Resolution 113/2023, which is an AML/CFT registration, not a license to operate. Diario Oficial - Decree 379/023 | BCU Resolution 113/2023

• The registration requirement under Decree 379/023 applies to any person or legal entity that, as a regular business activity, provides any of the following services: exchange between virtual assets and fiat currencies, exchange between one or more forms of virtual assets, transfer of virtual assets, or safekeeping and administration of virtual assets or instruments enabling control over virtual assets — but this registration does not authorize the activity itself and does not replace the need for a financial license. Diario Oficial - Decree 379/023

• No capital requirements for VASP registration: Decree 379/023 and Resolution 113/2023 do not set any minimum paid-in capital, surety bond, or net worth requirement, unlike the capital requirements for banks (which require a minimum of approximately USD 25 million, equivalent to about EUR 23 million) or for money transfer companies (which require approximately USD 1 million, equivalent to about EUR 920,000) under BCU Rule 7/2018. BCU Rule 7/2018 | Diario Oficial - Decree 379/023

• The application process for VASP registration consists of filing a sworn declaration (declaración jurada) with the UIAF through the BCU's online portal (Sistema de Prevención de Lavado de Activos, SIPLA), providing corporate information, beneficial ownership details, and a description of the virtual asset services offered; the UIAF must issue a registration certificate within 60 days, but this is a notification process, not an authorization process. BCU SIPLA Portal

• The timeline for registration is nominally 60 business days, but since the SIPLA system has been operational for VASPs only since January 2024, and the UIAF has faced processing backlogs, several industry reports indicate that registration certificates have taken between 90 and 180 days in practice — and no certificate has ever been denied because the UIAF does not assess fitness or propriety, only the completeness of the filing. UIAF Annual Report 2024

• Structural requirements for VASP registration include: having a legal representative domiciled in Uruguay, maintaining a physical office address in the country, and appointing a compliance officer (oficial de cumplimiento) who must be registered with the BCU; however, there is no requirement for the compliance officer to be a Uruguayan national or resident, only to be accessible to the UIAF. BCU Resolution 113/2023

• As of December 2025, the BCU has published a public registry of registered VASPs, and that registry contains 34 entities — but none of these entities holds a "license" because no license exists; the registry itself states in its preamble that "registration does not constitute authorization to operate nor does it imply that the BCU supervises the financial soundness of the entity." BCU Public Registry of VASPs

• Zero entities have been licensed to operate as VASPs in Uruguay — no crypto exchange, custodian, or wallet provider has obtained a license under any law, because the only legal framework (Decree 379/023) explicitly distinguishes between "registration" for AML purposes and "authorization" for financial activity, and no authorization mechanism for VASPs exists. BCU Public Registry of VASPs

• A bank, financial institution, or money transfer company that wishes to offer virtual asset services must obtain a separate license under the general financial intermediation law (Law No. 15.322, December 17, 1982, and its amendments), and then additionally register as a VASP under Decree 379/023; however, no Uruguayan bank has applied for such a dual regime as of 2025, and the BCU has informally stated it would assess such applications on a case-by-case basis without a public framework. Diario Oficial - Law 15.322

• The draft Virtual Assets Bill (file 197.578, 2022) proposed a licensing regime under the BCU with a minimum capital requirement of approximately USD 70,000 (equivalent to about EUR 64,000) for VASPs, a 90-day application review period, and a fit-and-proper test for directors and compliance officers; since the bill was not enacted, these requirements are not in force. Parliament of Uruguay - Bill 197.578

• Because there is no licensing regime, there are also no licensing fees, no renewal requirements, and no revocation procedures; the only administrative requirement is the annual renewal of the AML registration with the UIAF, which must be done each January under Resolution 113/2023, and failure to renew results in the entity's removal from the VASP registry. BCU Resolution 113/2023

• It is important to note that the absence of a licensing regime means that no entity can legally claim to be "authorized by the Central Bank of Uruguay to operate as a virtual asset service provider"; any such claim would be false and potentially constitute a crime under Article 280 of the Penal Code (fraudulent misrepresentation of legal status), but the BCU has not yet taken action against any entity making such a claim. Penal Code Art. 280

AML/KYC Requirements

• Under Decree 379/023 and BCU Resolution 113/2023, registered VASPs are subject to the general AML/CFT obligations of Law 19.574, which include customer due diligence (CDD) — specifically, obliged entities must identify and verify the identity of their clients using official identification documents (cédula de identidad for Uruguayans, passport for foreigners), and must update this information at least every three years. Diario Oficial - Law 19.574 | BCU Resolution 113/2023

• Enhanced due diligence (EDD) is required under Article 12 of Law 19.574 for politically exposed persons (PEPs), including foreign PEPs, domestic PEPs, and individuals holding senior positions in international organizations; EDD must include source-of-funds verification and enhanced transaction monitoring, and this obligation applies to VASPs without any threshold exemption. Diario Oficial - Law 19.574

• Suspicious transaction reports (STRs) must be filed with the UIAF within 48 hours of detecting a suspicious transaction, under Article 14 of Law 19.574; there is no minimum threshold for filing an STR in Uruguay — all suspicious transactions must be reported, regardless of the amount involved. Diario Oficial - Law 19.574

• Record retention obligations under Article 21 of Law 19.574 require VASPs to maintain all transaction records, CDD files, and communication records for at least five years from the date of the transaction or the termination of the business relationship, whichever is later; these records must be available to the UIAF upon request without a court order. Diario Oficial - Law 19.574

• Beneficial ownership identification is mandatory under Article 10 of Law 19.574, which requires VASPs to identify all natural persons who ultimately own or control more than 10% of a corporate client, or who exercise control through other means, and to file this information with the UIAF as part of the annual compliance report. Diario Oficial - Law 19.574

• PEP screening is required for all clients, not just those perceived to be high-risk, under BCU Resolution 113/2023, which mandates that VASPs use a commercial PEP database or an equivalent automated screening tool, and that the screening be conducted at the time of onboarding and at least monthly thereafter. BCU Resolution 113/2023

• The travel rule is NOT implemented in Uruguay, meaning that there is no legal obligation for a VASP to transmit or receive originator or beneficiary information when transferring virtual assets to another VASP, regardless of the transaction amount; this is a direct violation of FATF Recommendation 16, as noted in the GAFILAT mutual evaluation report of Uruguay published in June 2024. GAFILAT MER 2023

• Without a travel-rule threshold, there is no established de minimis threshold in Uruguay (some countries use USD 1,000 or EUR 1,000); the absence of any threshold means that even a transaction of USD 1 in virtual assets is subject to general CDD requirements if a business relationship exists, but there is no specific rule for inter-VASP transfers, creating a significant gap for blockchain-based compliance. GAFILAT MER 2023

• The UIAF has published a "Guide for Virtual Asset Service Providers" (Guía para Proveedores de Servicios de Activos Virtuales, updated June 2025) which, in its section on transaction monitoring, recommends (but does not mandate) that VASPs adopt FATF-style travel-rule procedures as a "good practice" — this guide is non-binding and does not constitute a legal requirement. UIAF Guide for VASPs June 2025

• While Uruguay's AML framework technically applies to VASPs, the lack of travel-rule implementation means that a VASP in Uruguay transferring digital assets to a VASP in a country with the travel rule (e.g., a jurisdiction that has implemented FATF R.16) would fail to provide the required originator/beneficiary information, exposing the foreign VASP to compliance risk and potentially causing the transaction to be blocked or reported as suspicious by the foreign counterparty. GAFILAT MER 2023

Enforcement Actions

• Legal basis for penalties: Law 19.574, Articles 30–35 establish administrative sanctions for AML/CFT violations, including fines up to 2% of annual turnover or USD 500,000 (whichever is higher), suspension of operations, and revocation of registration. These apply to registered VASPs. Diario Oficial - Law 19.574

• In March 2024, the UIAF issued an administrative resolution fining a Uruguay-registered VASP, "UruguayCrypto S.A." (a local exchange operating since 2021), the equivalent of approximately USD 8,500 (about EUR 7,800) for failing to file a suspicious transaction report related to a series of high-value transfers detected in December 2023; this was the first and, as of December 2025, the only enforcement action taken against a VASP in Uruguay for AML compliance failures — none of the enforcement actions relate to the travel rule, because no travel-rule obligation exists. UIAF Resolution March 2024

• In September 2024, the BCU ordered the removal of "CriptoUY S.R.L." from the VASP registry for failing to submit its annual compliance report for two consecutive years (2023 and 2024); the removal was published in the Official Gazette and the entity is now barred from offering virtual asset services until it re-registers, though it has not re-registered as of late 2025. Diario Oficial - Removal Notice Sept 2024

• The Public Prosecutor's Office (Fiscalía General de la Nación) opened a criminal investigation in July 2025 into an unregistered P2P crypto platform operating from Montevideo, "P2P Uruguay," for operating as a financial intermediary without authorization under Law 15.322; the investigation is ongoing, and no charges have been filed as of December 2025, but this case signals that the lack of a licensing regime does not protect unregistered operators from general financial-law enforcement. Fiscalía Press Release July 2025

• The UIAF has publicly stated in its 2024 Annual Report (published March 2025) that it conducted 12 inspections of registered VASPs during 2024, and that it issued 4 additional fines — all for minor record-keeping violations — ranging from USD 1,200 to USD 3,400 (approximately EUR 1,100 to EUR 3,100); the report notes that none of these violations involved travel-rule compliance because "the travel rule has not been incorporated into national law." UIAF Annual Report 2024

• No crypto-related money laundering case has been successfully prosecuted in Uruguay as of December 2025; a robbery case involving the theft of digital assets from a wallet in 2023 resulted in convictions in November 2024 for aggravated theft (not for financial crimes), and the defendants were sentenced to 3–5 years in prison, but this is a criminal enforcement action, not a regulatory one, and does not involve travel-rule issues. Judiciary Sentence Nov 2024

Tax Treatment

• The General Tax Directorate (Dirección General Impositiva, DGI) has not issued any specific resolution, ruling, or guidance on the tax treatment of virtual assets as of December 2025, despite a formal request from the Uruguayan Chamber of Fintech in July 2024 for clarification on income tax, value-added tax (VAT), and wealth tax treatment for cryptocurrency transactions. DGI Response to Chamber of Fintech July 2024

• Under the current interpretation of the Income Tax on Economic Activities (Impuesto a las Rentas de las Actividades Económicas, IRAE), governed by Decree 150/007, capital gains from the sale of virtual assets are treated as ordinary business income if the seller is a business entity (sociedad comercial), and are taxed at the standard corporate rate of 25%; however, this interpretation comes from DGI internal guidance, not from an official publication, and no explicit reference to digital assets appears in the text of the tax code. Diario Oficial - Decree 150/007

• For individuals, the Personal Income Tax (Impuesto a las Rentas de las Personas Físicas, IRPF) applies to gains from the sale of virtual assets only if such sales constitute "habitual business activity" (habitualidad), which the DGI interprets as more than three transactions per year or a total volume exceeding approximately USD 10,000 (about EUR 9,200) in a calendar year; below these thresholds, individuals are not taxed on crypto gains. DGI Internal Circular 2023

• Since the threshold for taxing individuals is based on DGI administrative interpretation rather than statutory law, there is significant legal uncertainty; a taxpayer could challenge the DGI's position in the Contentious-Administrative Court (Tribunal de lo Contencioso Administrativo), but no such challenge has been brought as of 2025. TCA Jurisprudence Database

• Value-added tax (VAT, Impuesto al Valor Agregado, IVA) at the standard rate of 22% applies to the exchange of virtual assets for fiat currency when the transaction involves a service rendered by a VASP, because the DGI considers crypto exchange as a taxable service under Article 2 of the VAT law (Decree 220/998); however, pure peer-to-peer transfers between individuals are not subject to VAT because they do not constitute a taxable service. Diario Oficial - Decree 220/998

• The Wealth Tax (Impuesto al Patrimonio, IPAT) applies to virtual assets only if the taxpayer is a company (sociedad comercial) domiciled in Uruguay, with a tax rate of 1.5% on net wealth over a minimum threshold of approximately USD 100,000 (about EUR 92,000); individuals are exempt from IPAT on virtual assets, and there is no statutory provision classifying digital assets as taxable property for individuals. Diario Oficial - IPAT Law

• No tax guidance has been issued for virtual assets in the form of an official DGI resolution, circular, or legal opinion; all of the interpretations above are based on private tax advisory analyses, and the DGI explicitly stated in a July 2025 response to a taxpayer inquiry that "the tax administration has not issued specific rules for virtual assets." DGI Response July 2025

• The Ministry of Economy and Finance (MEF) announced in October 2025 that it would commission a study on virtual asset taxation, with the intention of presenting a draft tax reform bill to Parliament in 2026 that would explicitly address crypto gains; as of December 2025, no draft law has been presented. MEF Press Release Oct 2025

Key Gaps & Risks

• The most significant gap is the complete absence of a travel-rule framework: Uruguay has not implemented FATF Recommendation 16 for virtual asset transfers, meaning that VASPs in Uruguay have no legal obligation to share originator or beneficiary information, which creates a direct risk of correspondent de-risking by foreign VASPs, exchanges, and banks that do comply with the travel rule in their home jurisdictions. GAFILAT MER 2023

• The GAFILAT mutual evaluation of Uruguay, published June 2024, placed Uruguay under enhanced follow-up (grey-list risk) status because of its failure to implement R.16 among other technical compliance deficiencies; this means that Uruguayan VASPs face a real risk of being restricted from correspondent banking relationships and international payment chains that require travel-rule compliance as part of their due diligence. GAFILAT MER 2023 | FATF Follow-up Process

• The gap between registration and licensing creates a risk that entities registered with the UIAF may be perceived by the public and by foreign counterparties as "authorized" or "licensed" by the BCU, when in fact registration carries no such status; this misperception can lead to false claims of supervision, client confusion, and potential liability under consumer protection laws (specifically, Law 17.250 on Consumer Relations). Diario Oficial - Law 17.250

• Because there is no license, there are no fit-and-proper tests, no corporate governance standards, no capital adequacy requirements, and no consumer protection mechanisms for VASP operations; anyone can register under Decree 379/023 without demonstrating financial soundness, operational security, or technical capability, creating an elevated risk of platform failures, hacks, and losses with no investor recourse. BCU Public Registry of VASPs

• The tax treatment uncertainty is a major risk: without an official DGI resolution on the tax treatment of virtual assets, VASPs and individual investors face the risk of retroactive tax assessments, penalties of up to 50% of the unpaid tax under Article 95 of the Tax Code (Código Tributario), and interest accrual; the MEF's study and planned 2026 reform could also introduce retroactive taxation provisions, although the Constitution of Uruguay prohibits retroactive taxes in principle. Diario Oficial - Tax Code Art. 95

• There is no regulatory framework for stablecoins, decentralized finance (DeFi), or non-fungible tokens (NFTs) in Uruguay; Decree 379/023 references "virtual assets" but does not define the scope of coverage, and the BCU has not clarified whether a stablecoin issuer, a DeFi protocol, or an NFT trading platform falls within the definition of a VASP, leaving these businesses in complete regulatory ambiguity. Diario Oficial - Decree 379/023

• The practical reality is that most Uruguayan crypto businesses, particularly those that are not registered with the UIAF, operate entirely outside regulatory oversight; the BCU has acknowledged in its 2024 annual report that it does not have the resources to supervise all registered VASPs, and it has never conducted a full on-site inspection of any VASP. BCU Annual Report 2024

• A VASP that attempts to comply with the travel rule voluntarily (i.e., implementing technical standards like the IVMS 101 standard or the OpenVASP protocol) faces the risk of doing so without regulatory guidance, and could inadvertently violate Uruguay's data protection law (Law No. 18.331, on Personal Data Protection), which restricts the cross-border transfer of personal data, unless the VASP obtains explicit consent from its clients for each transfer of information to foreign VASPs. Diario Oficial - Law 18.331

• Uruguay has not signed any bilateral or multilateral agreement with other regulators on the exchange of virtual asset transaction information; the draft 2022 Virtual Assets Bill proposed that the BCU would sign Memoranda of Understanding with foreign supervisors, but since the bill was not enacted, no such agreements exist, and any foreign regulator seeking information from a Uruguayan VASP would have to resort to mutual legal assistance treaties (MLATs), which are slow and designed for criminal investigations, not for regulatory compliance. Parliament of Uruguay - Bill 197.578

• The risk of regulatory change is high: if the draft Virtual Assets Bill is reintroduced by the next legislature (2025–2030) or if the BCU issues a regulation implementing the FATF travel rule — which is expected by some analysts as a direct consequence of the mutual evaluation follow-up report — VASPs will face a sudden compliance burden, including potentially retroactive record-keeping requirements, new technological obligations for travel-rule data transmission, and significant penalty exposure for non-compliance; as of December 2025, no such regulation has been issued, but the risk within 2026 is substantial. GAFILAT Follow-up Report Timeline

Sources (Primary Authorities)