Crypto-asset regulation and tokenization in Uruguay

In Uruguay, a virtual asset business must distinguish provider authorization from issuance of an instrument. Recognition of decentralized-register securities does not turn a VASP license into permission for every investment token or stable asset.

The 2026 framework also distinguishes existing operators from new entrants. That affects the application and adaptation timetable, while asset control and actual functions determine service obligations.

How to distinguish VASP authorization from DLT securities

BCU Circular 2507, which on July 16, 2026, communicated Superintendence resolution 2026-444 adopted six days earlier, implements the virtual asset service provider, VASP, framework. It covers legal entities habitually providing exchange, transfer, custody or administration services, or participation in virtual asset offerings. Article 127.22 includes activities performed through protocols and smart contracts: that architecture does not itself remove the activity from scope.

The same article excludes software development without active involvement in service provision, activities involving specially regulated instruments and certain services exclusively involving non-fungible assets. The NFT exception does not cover payment, investment or securities-representation uses. A token's technical label does not independently determine its regulatory treatment.

Which authority supervises each activity

The Central Bank of Uruguay, BCU, acts through the Financial Services Superintendence, SSF. Article 37 of its Charter, amended by Budget Law 20,446 of December 16, 2025, places virtual asset service providers in paragraph H and stable virtual asset issuers in paragraph C. The amendment removed the reference to services defined as financial, which was the core of the allocation introduced by Law 20,345 and which split providers into two regimes with very different requirements. This matters when consulting analyses published before December 2025, because many still describe that division.

The Financial Information and Analysis Unit, UIAF, receives preventive reports required by BCU rules. Circular 2508 of August 7, 2026, corrects the incorporation of transfer and reporting provisions. Provider authorization, preventive supervision and issuance rules are distinct controls; an application must identify which apply together.

Which permission the business model requires

Articles 127.23 to 127.27 of Circular 2507 require an eligible company or overseas company's branch, prior authorization and information on control, governance, operations and systems. The SSF considers legality, suitability and advisability; submitting documents does not guarantee approval. The official digital procedure confirms the authorization and registration application route.

Applications have been open since September 1, 2026. Existing operators have until March 31, 2027, to apply and may continue while their applications are processed. This transition does not automatically permit a new company to begin trading. General compliance adaptation runs until June 30, 2027, unless a specific deadline applies. FERRERE distinguishes the two access situations.

Applicants must declare the intended services. Adding another service requires prior notification, with additional custody requirements. Article 127.31 provides for overseas premises through notification and documentation concerning the receiving country. This is not a passport: local conditions must be established, and Uruguayan permission does not replace authorizations required in the destination jurisdiction.

How holder rights are documented

Article 14 of Law 18,627, replaced by Article 3 of Law 20,345, divides book-entry securities into two kinds: centralized-register securities, recorded in accounts by a registrar entity, and decentralized-register securities, issued, stored, transferred and traded electronically through distributed ledger technologies. A prior condition determines eligibility before the technology does: the article requires the security to be issued in series, so a single issuance does not fit this category. It requires compliance with relevant statutory provisions and BCU regulation. Specific legal recognition exists, but it does not automatically validate every network, issuer or digital document.

The Securities Market Law retains public-offering, registration and disclosure rules. Private issuances have their own placement and advertising conditions; calling an offering private is insufficient to exclude it. DLT securities fall outside the ordinary VASP license because of their special framework. For a real estate token, the right represented and the formalities of the underlying asset must be documented, without presuming ownership from possession of the token.

Which obligations continue during operations

Articles 151.1.8 to 151.1.11 of Circular 2507 distinguish equity, guarantees and deposits. Custody, administration or control requires minimum equity of one million indexed units, UI. VASPs must also maintain a minimum 600,000 UI guarantee and a 50,000 UI deposit with the BCU. These are separate requirements, subject to calculation and transitional provisions, not a single licensing fee.

The rules require separation of proprietary and customer funds and assets, governance, security, an annual IT audit of systems and outsourcing controls. That separation must be recorded clearly, individually and kept up to date in the provider's records. They prohibit financial intermediation reserved for licensed institutions when carried out with virtual assets, and the use of assets held in custody without express customer authorization, and set a time limit that shapes the design of any on-ramp or platform: customer funds may not remain in the provider's possession for more than forty-eight hours; the period may be longer where specific instructions exist for that purpose and do not distort the operation. Customer consent does not remove other duties or convert custody into permitted bank deposit-taking.

For preventive compliance, Articles 198.2 and 198.3, incorporated by Circular 2508, govern originator and beneficiary identification for outgoing and incoming transfers. Both allow system adaptation until December 31, 2027; the errata added the omitted deadline for incoming transfers. This technical transition does not generally suspend due diligence and reporting obligations.

What to prepare before launching the project

Prepare a service inventory and evidence of prior operation if relying on a transition. Separate required capital, security and deposit, and document custody, outsourcing and responsibility for customer assets.

For tokenized securities, identify issuance, offering and decentralized-register conditions. If using smart contracts, explain who actively participates and controls changes; architecture does not replace provider analysis.

Each project still requires verification of the authorization granted, declared services, transitional conditions and instrument framework. Statutory recognition of DLT securities does not itself establish a specific authorized infrastructure. Nor is VASP permission assumed to authorize stable asset issuance, which belongs to a separate supervisory category.

To understand how this framework applies to your project, discuss your case with our team.