Virtual asset regulation and tokenization in Guatemala

In Guatemala, a virtual asset service project must assess the new 2026 preventive framework and activity-specific permissions. Including VASPs as obliged persons requires identifying functions and controls, but does not create a universal crypto-product licence.

For tokenized issuance, analysis continues under securities rules and formalities for the represented right. The business must distinguish anti-money-laundering documentation from what permits offering, transfer or custody of a particular instrument.

How to separate new preventive registration from product permissions

Decree 15-2026, the comprehensive law for preventing and repressing money laundering and terrorism financing, took effect on 17 September 2026. It unifies the earlier preventive and criminal framework and adds virtual asset service providers, VASPs, as obliged persons. The change makes a description based solely on historical cryptocurrency warnings insufficient.

Article 2.i, examined in a copy of the text, requires habitual business activity for third parties. Beyond exchange, transfer and custody, it covers specified financial, lending, return-generation and determinative critical-infrastructure services. This breadth requires examining functions and actual control; it does not establish that every software developer working with a blockchain network is a VASP.

Which authority supervises each activity

The Superintendency of Banks, SIB, acts through the Special Verification Intendency, IVE, for preventive registration and supervision. Articles 5–7 distinguish registration, information and enquiries about obliged persons. Access to that information does not remove the independent diligence obligations of someone dealing with a provider.

The Securities and Commodities Market Registry, RMVM, within the Ministry of Economy, administers securities offerings and participants. Competence follows activity: preventive virtual asset controls and public-offering registration have different purposes. IVE involvement does not make a token an RMVM-approved product.

Which permission the business model requires

Article 5 expressly states that preventive registration does not remove requirements for other activity-specific authorisations, licences or registrations and does not determine lawfulness. Failure to register does not excuse compliance either. Accordingly, this guide does not offer a cryptocurrency licensing process unsupported by the reviewed evidence or equate preventive registration with prudential permission.

Transition and implementation provisions require attention. Articles 117, 118 and 127 distinguish already registered persons, adaptation of controls and preparation of implementing rules. The six-month period for preparing and submitting those rules does not itself suspend the Act or establish that every form is already available. This review did not retrieve final implementing rules resolving those conditions.

For an exchange-traded public securities offering, the RMVM procedure requires prior processing by the relevant exchange and a registry application containing corporate, financial and issuance documentation. This includes the exchange decision, legal opinion and prospectus. Electronic receipt is not registration, and electronic document signing does not establish that an issuance can trade through any DLT protocol.

How holder rights are documented

The Securities and Commodities Market Law, Decree 34-96, recognises securities representing ownership, credit or participation rights and contemplates book entries. Articles 3 and 4 delimit public offerings and registration. Classification requires examining rights and placement, with applicable amendments, without assuming that calling an instrument a token removes it from this regime.

A regulated book entry is not automatically equivalent to a blockchain address. The register establishing holder entitlement, transfer, restrictions and relationship with the issuer or vehicle require examination. The reviewed sources establish neither automatic real estate transfer by token nor universally effective authorised DLT infrastructure. General securities rules do not answer these questions for every product.

Which obligations continue during operations

Consortium Legal's September 2026 analysis identifies VASP consequences: risk management, customer diligence, monitoring, reporting and record retention. Its reading of infrastructure services requires assessing their determinative role in third-party operations; a reference to external data is not converted into automatic coverage of every information provider.

Articles 8–12 establish proportionality to nature, volume and complexity, documented methodology and assessment before new products or technologies. A project should identify who decides movements, holds keys, deals with customers and retains evidence. Mapping these roles helps identify obligations but does not replace supervisory interpretation or verification of implementing rules.

What to prepare before launching the project

Map services for others: exchange, keys, transfers and infrastructure functions actually controlled. Check registration, responsible persons and control adaptation against applicable instructions.

Before offering tokens, identify whether the instrument and placement require an RMVM file and which register establishes investor status. Keep procedures or implementing rules open where a final version has not been recovered.

Implementing rules and new-VASP procedures, additional model-specific permissions and the effectiveness of tokenized representation remain to be confirmed. The reform updates the preventive perimeter but does not establish comparable operational access across all services. The overall score therefore remains pending, without treating missing evidence as a general prohibition or implied permission.

To understand how this framework applies to your project, discuss your case with our team.