Virtual asset regulation and tokenization in Peru

In Peru, a business exchanging or holding virtual assets must identify preventive duties and permissions for other product functions. Being a VASP reporting to the UIF is not general authorization to take deposits or manage investments.

Authorized testing may be relevant for a novel model, but has its own conditions and limits. Tokenized issuance also requires resolving investor rights and securities treatment, independently of the chosen technology.

How to distinguish preventive controls, tests and financial permissions

SBS Resolution 02648-2024 sets out the preventive framework for virtual asset service providers (VASPs), designated as obliged entities by Supreme Decree 006-2023-JUS. It covers exchange, transfers, custody, administration and specified issuance-related services carried on as a business for others. Articles 1–2 limit its scope to persons domiciled or incorporated in Peru, including branches of foreign entities established and registered locally. It was published on 1 August 2024 and has applied since the following day, except Chapter VIII; its Article Nine gave VASPs up to 120 days to implement it.

The rule expressly does not regulate the underlying technology. Developing software and providing services over customers' assets are different activities. Nor is every overseas platform accessible from Peru automatically covered by this territorial provision. The business model, local presence and other applicable regimes require separate assessment.

Which authority supervises each activity

The Superintendency of Banking, Insurance and Pension Fund Administrators, SBS, issues preventive rules, with the Financial Intelligence Unit, UIF-Peru, exercising the prescribed VASP supervision. The Securities Market Law assigns the Securities Market Superintendency, SMV, responsibilities for issuers, offerings, intermediaries and infrastructure within its remit.

The Central Reserve Bank of Peru, BCRP, regulates payments. Its Circular 0022-2025 of 5 December 2025 approves the new Reglamento General del Sistema Nacional de Pagos (General Regulation of the National Payment System), in force since 1 April 2026. Pérez-Llorca's Chambers analysis distinguishes entities requiring authorization from those subject to registration. That regime is not equated with VASP rules or permission to issue any stablecoin.

Which permission the business model requires

The VASP framework requires a preventive system, the appointment of a compliance officer and mechanisms for communicating with the UIF. Obliged-entity status and assigned codes serve preventive supervision; they do not establish general prudential authorization to accept deposits, manage investments or perform every financial activity. Sector permissions depend on the functions actually performed. SBS Resolution 01015-2026 of 6 April 2026 amended the rules on removing the compliance officer and on corporate compliance officers for economic groups.

SBS Resolution 04142-2025 expanded the sandbox to non-supervised legal entities incorporated in Peru or foreign entities with a local legal representative. Prior authorization, resources, risk management, participant safeguards and an exit plan are required. The SBS may exclude activities on prudential grounds. Article 19.4 specifies that participation does not authorize general operation within supervised systems.

Novel models may ordinarily run for up to eighteen months, with an authorized extension of up to twelve. This temporary route establishes neither the admissibility of every tokenized issuance nor a passport into SMV-regulated activities. The securities-sandbox assessment mentioned by Pérez-Llorca is distinguished from an already enacted operational regime.

How holder rights are documented

Articles 3–5 of the consolidated Securities Market Law define securities and distinguish public from private offerings. Communications to segments of the public can matter even without advertising to the entire population. Articles 19–24 and 51–52 govern registration and intermediation; registration does not certify solvency, quality or absence of risk.

Articles 85 and 204–210 cover certificates, book entries, issuance documents and book-entry transfers. Article 207 allows the SMV to authorize a different registration system subject to conditions. That power does not automatically recognize every blockchain. The effective register, issuer, rights and transfer mechanism must be identified; a token transfer does not itself replace conveyance of represented real estate or other property.

Which obligations continue during operations

Resolution 02648-2024 requires customer and beneficial owner due diligence, risk assessment, retention, records and reporting. Article 27 distinguishes unusual from suspicious operations: suspicious operations must be reported immediately and within twenty-four hours of classification, regardless of amount. It does not require reporting every unusual operation without the prescribed analysis.

Chapter VIII addresses originator and beneficiary information and self-hosted-wallet transfers. However, Article Four of SBS Resolution 01917-2026, published on 22 July 2026, postponed its entry into force until 1 January 2029. Rubio Leguía Normand's analysis confirms the extension's scope. The original PDF's August 2026 date was superseded; the extension does not suspend other VASP duties.

What to prepare before launching the project

Document local presence, services for others, asset control and each entity’s functions. Prepare applicable preventive controls and, if proposing a test, its limits, resources, participant protection and exit.

For issuance, specify the legally effective register, offering route and transfer restrictions. Maintain a timetable for each regulatory chapter: postponing transfer requirements does not automatically suspend the remaining preventive system.

Each model's classification and permissions, effective access and a particular issuance's legal effects require confirmation. The Congress register consulted on 16 October 2026 shows two bills in committee and not approved: bill 1042, the Framework Law on Crypto-Asset Trading (Ley Marco de Comercialización de Criptoactivos), filed in December 2021, and bill 14746, filed on 5 June 2026, on custody and traceability of crypto-assets linked to crimes; neither is law in force. General assertions about SUNAT interpretations unsupported by retrieved evidence are omitted. Preventive compliance and authorized testing alone do not establish a complete comparable overall assessment of services and tokenization.

To understand how this framework applies to your project, discuss your case with our team.