Virtual asset regulation and licensing in Cuba

A business using virtual assets in Cuba should first distinguish its own operations from services for third parties. BCC grants individual permissions: authorisation to make overseas payments through a licensed provider does not turn the business into a VASP.

For a tokenized investment, another preliminary question is which right is created and under which rules it may be offered. Virtual asset resolutions exclude certain financial instruments and do not establish a general route for tokenizing every share or property. Technology should be designed after that treatment is clarified.

Which services the framework covers and which permissions are individual

Central Bank of Cuba Resolution 89/2022 develops licensing for virtual asset service providers, VASPs, operating in or from the country. It follows Resolution 215/2021. The perimeter includes exchange, transfers, custody and issuance-related services, while excluding digital representations of fiat currency, securities and other traditional financial assets.

Each licence determines permitted operations and assets. It is therefore not a generic permission for every business using DLT. Resolution 4/2026 illustrates a different instrument: permission for ten named legal entities to make cross-border payments connected with their corporate purposes, through licensed providers. The beneficiary businesses do not thereby obtain licences to provide services to third parties.

What BCC decides and what DGIOF supervises

The Central Bank, BCC, assesses applications, consults the Cryptoassets Group and determines individual conditions. Resolution 89/2022 requires agreement from the General Directorate for the Investigation of Financial Operations, DGIOF. Beyond technical and organisational documentation, the decision considers suitability and socioeconomic interest. This discretion matters to predictability even where authorised providers exist.

Resolution 76/2023 assigns VASP registration and supervision concerning money laundering, terrorism financing and proliferation financing to the DGIOF. The obliged-entity register serves this specific function. It does not replace licensing or automatically turn the provider into a bank or financial institution registered under a different category.

What entry requires and what the EBIORO licence demonstrates

Resolution 89/2022 contemplates Cuban legal entities, individuals and foreign entities. For foreign legal entities it starts from home-jurisdiction licensing, with an exception based on state interest. Applications describe activities, technology, organisation, controls and resources; the BCC may differentiate requirements by service. Experimental licences last one year, extendable for a second, and operational or ownership changes require approval.

Positive evidence of access exists: Resolution 134/2025, published in February 2026, renews the licence of Lithuanian entity EBIORO UAB. Its one-year validity begins on 28 January 2026. Activities include exchange, custody, transfers and specified issuance-related services. This individual permission establishes neither eligibility for every applicant nor automatic recognition of a foreign licence.

What remains to be resolved for a tokenized issuance

The VASP perimeter distinguishes virtual assets from financial securities. Consequently, permission to participate in virtual asset issuance does not establish permission to issue tokenized shares, real estate interests or debt instruments. The reviewed documentation does not establish a general route resolving issuance, trading, ownership and third-party effects for those products.

A project must identify the represented right, the person owing it and applicable transfer or registration formalities. These are separate legal questions from whether a platform can hold or transfer tokens. This guide records that evidence gap as an analytical limit, without converting it into a ban on all tokenization or an implied permission.

Which controls and limits accompany authorised operations

Resolution 76/2023 requires risk assessment before new products, customer due diligence, sanctions controls and suspicious-transaction reporting. GAFILAT's 2024 follow-up report examines those requirements and technical-compliance gaps. It provides international AML scrutiny, not certification of solvency, investment protection or ease of doing business.

EBIORO's licence adds risk warnings, cybersecurity, technical audits, approved transaction limits and accounting, operational and asset separation from services outside the Cuban regulatory scope. External quarterly audits of that separation are required. This individual condition is not extrapolated to every future licence or presented as a guarantee of full recovery of each client's assets.

Businesses permitted to make cross-border payments may only use assets allowed for their provider and must report quarterly to the BCC. Direct operations outside authorised platforms are prohibited, and other uses require new permission. Business authorisation lasts one year from signature, with renewal requested beforehand; that period is distinct from the resolution's publication date.

What to check before providing services or making payments

Identify whether the business seeks to provide services, use assets for its own payments or issue an investment right. Assemble the applicable resolution, authorised entity, permitted assets and validity conditions. For a provider, evidence must match the contracted services; for a user business, the authorised payment purpose.

Before implementing an issuance, confirm its legal basis and rights against the issuer and underlying asset. The Gazette copies reviewed document specific permissions but do not resolve a universal tokenization route or later amendments. Keep those limits explicit and verify official texts and individual status before committing to launch.

To understand how this framework applies to your project, discuss your case with our team.