Virtual asset regulation and tokenization in Ecuador

In Ecuador, a business must distinguish virtual asset services from using those assets as payment. A provider’s preventive obligations do not lift the monetary restrictions identified by the central bank.

A project representing economic rights through tokens must also assess securities rules and asset formalities. A wallet entry does not alone answer who holds the right or against whom it can be enforced.

How to distinguish restricted payments, services and tokenized rights

The Central Bank of Ecuador, BCE, states that crypto-assets are neither legal tender nor authorized means of payment. Its communication of 12 August 2024 relies on the Organic Monetary and Financial Code, COMF, and monetary resolutions from 2022–2023, recalls the prohibition on using unauthorized means of payment and states that identified cases will be referred to prosecutors. Those resolutions were replaced by the codification of 16 July 2025, which defines means of payment as the instruments authorized by the Board, classifies them as physical, electronic and electronic wallets, and tasks the BCE with monitoring that no others are used.

That perimeter does not establish a general ban on software development or asset holdings. The anti-money-laundering law published in July 2024 defines virtual assets and providers and treats VASPs as a distinct category of obliged entities. Its definition excludes digital representations of fiat currency, securities and other financial assets: not every tokenized instrument receives identical treatment.

Which authority supervises each activity

The BCE oversees payment systems and publishes auxiliary payment system authorization requirements. The Superintendency of Companies, Securities and Insurance, SCVS, supervises securities markets. For anti-money-laundering purposes, the preventive law vests policy leadership in the Financial Policy and Regulation Board, now the Financial and Monetary Policy and Regulation Board (Article 5), and tasks the Superintendency of Banks with overseeing VASP compliance (Article 65). The Financial and Economic Analysis Unit, UAFE, issues the registration code, receives reports and imposes penalties for breaches relating to both (Articles 56 and 82).

Resolution UAFE-DG-2022-0131 brought within its scope individuals and legal entities providing virtual asset services on behalf of others. It lists exchange, transfers, custody, administration and offering-related services, among other activities. It does not make the UAFE an authority approving each token's economic merits or granting a general prudential license.

Which permission the business model requires

Articles 4–5 of the 2022 resolution require a preventive system, registration code and a compliance officer qualified by the supervisory body and registered with the UAFE, distinguishing a manual for legal entities from basic guidance for individuals. Individuals may act as their own officer (Seventh General Provision). The registration code is now governed by Article 56 of the 2024 law, and registration and reporting must be read with that law and subsequent instructions, rather than as a process frozen in 2022.

The preventive law requires obliged entities to be licensed or registered and empowers each supervisor to grant licenses or registrations (Articles 64 and 66). The sources consulted do not show a Superintendency of Banks rule implementing that route for VASPs, nor a general authorization that indiscriminately permits fundraising, financial intermediation or payments. Each function requires examining its regime and BCE restrictions. Flor Bustamante Pizarro & Hurtado's Chambers analysis distinguishes foreign corporate access from sector permissions: incorporating or holding shares does not replace the authorizations required for the business itself.

The Assembly documents the shelving of the blockchain technology bill in October 2025, so it does not constitute a framework in force. On 30 May 2025 the Financial Policy and Regulation Board approved a regulatory sandbox rule for the financial, securities and insurance systems, excluding matters reserved to monetary policy and the BCE. Its temporary operating license lasts up to one year, renewable for another year, and is granted by the relevant supervisor: it is not a general exception for tokenization, custody or virtual asset payments.

How holder rights are documented

COMF Book II, Article 2 defines securities by reference to their negotiable economic rights and governs their transfer. For book entries, legal effects attach to registration within the system operated by a clearing and settlement depository under the law. A wallet or private distributed ledger does not automatically replace that entry. Since the December 2022 reform, Title XIV of the same Book recognizes the development of blockchain or DLT solutions for the securities market as a securities-market technology service, provided by corporations under SCVS oversight (Articles 73.1 to 73.6); the law keeps book entries, clearing and settlement as depository functions.

Articles 11–12 address offers to the public or particular segments of it, authorization, prospectuses and registration of issuers and securities. They provide for dematerialization subject to exceptions. A platform marketing economic rights must assess classification before advertising issuance; calling them tokens does not avoid offering rules or intermediaries' permissions.

For non-financial assets, documentation must identify the right granted, the obligor and the transfer mechanism. A token is not presumed to confer real-estate ownership or corporate participation by itself. The underlying asset's registers and formalities, and their relationship with the contract and digital representation, require verification.

Which obligations continue during operations

Articles 26, 31 and 52 of the preventive law subject VASPs to a risk-based approach and transfer-information obligations. Classification requires examining regular business activity, customers and effective asset control. Absence of payment use does not remove a covered provider's preventive duties; complying with them does not lift a monetary restriction either.

Current UAFE reporting guidance refers to Article 57 of the law and Resolution 2026-0007, effective from 29 April 2026: a suspicious transaction report on a completed or attempted operation must be filed within five days of awareness, regardless of amount, with a possible reasoned extension of up to three days. The original 2022 resolution's four-day period should not be reproduced as current. The law also requires reporting operations of USD 10,000 or more within the first fifteen days of each month and recording the absence of reports within ten days after each month end (Articles 58 and 59).

What to prepare before launching the project

Describe acquisition, transfer, custody and payments separately, including what the merchant receives and who settles. Assess payments against BCE rules and preventive information against applicable UAFE instructions.

For issuance, identify the right, obligor and record establishing holder status. Prepare current controls and reporting deadlines: a historical resolution must be read with amendments and later legislation.

Each service's classification, relevant operational instructions, cross-border access and tokenized structure require confirmation. Documentation distinguishes restricted payments, VASP obligations and the general securities regime; it does not support a complete comparable access and custody score. The overall assessment remains pending without treating uncertainty as a general prohibition.

To understand how this framework applies to your project, discuss your case with our team.