Uruguay UY

Lead Signal

Uruguays central bank has closed a long-standing supervisory gap around virtual-asset service providers. Banco Central del Uruguay, acting through its Superintendencia de Servicios Financieros, finalised Resolution SSF No. 2026-444, which builds out Title VII-TER of the Compilation of Securities Market Regulations under the authority of Ley N degrees 20.345. The architecture is significant less for its enforcement content than for what it now requires as a precondition of market access: legal entities providing virtual-asset services on a regular and professional basis, where the underlying assets are deemed by the BCU to be financial instruments, must obtain authorisation before they may operate, and that authorisation process itself embeds anti-money-laundering and counter-terrorist-financing compliance documentation as a governance precondition. This is an architecture-over-incident finding in the clearest sense: no single enforcement action drives the signal, the regime itself is the development.

The transitional design matters as much as the substantive requirement. Existing operators may apply for authorisation in the window running from 1 September 2026 to 31 March 2027, and may continue operating while that application is under BCU review; new entrants, by contrast, must secure authorisation before commencing operations at all. This bifurcation of continuity rights between incumbents and new entrants is a structural choice that shapes who bears transitional compliance risk, and it is the kind of design detail that is easy to miss if the finding is read only as a licensing headline.

Other Developments

Standing AML/CTF architecture unchanged. Per IMF Country Report No. 25/287, the BCU had already enhanced its broader AML/CFT framework by approving a new National Strategy for Combating Money Laundering in July 2025, and SENACLAFT published its most recent PEP list update in February 2025. Neither of these is a this-cycle delta; both sit as standing regime context against which the new VASP-specific compliance layer should be read. The national strategy and PEP-list maintenance represent continuity rather than change, and the analytical point is that the new VASP authorisation layer is grafted onto an already-functioning AML/CFT institutional base rather than being built from nothing.

Mutual evaluation status stable. Uruguay is not on the FATF grey list, and its most recent GAFILAT mutual evaluation on-site visit was conducted 6-17 May 2019. That evaluation report covered AML/CFT matters comprehensively, including all categories of designated non-financial businesses and professions. The absence of any grey-list designation, combined with an evaluation record now several years old, forms the backdrop against which the new crypto-specific authorisation architecture is best read: Uruguay is tightening a discrete sector rather than responding to any adverse multilateral finding against its overall regime.

Corroboration gap on the operative resolution. The finding that existing crypto-asset firms may continue operating during the BCU review period, once an application is lodged inside the transitional window, is corroborated only at Probable confidence via law-firm commentary (Ferrere), since the full text of Resolution SSF No. 2026-444 was not independently retrieved this cycle. This is a genuine sourcing gap rather than a substantive uncertainty about the policy itself, and it is flagged as such.

Cross-Monitor Connections

The VASP authorisation architecture sits squarely at the intersection of financial-integrity supervision and payments-market structure, and the underlying finding is one that a payments-focused reader would recognise as a licensing and market-access event as much as an AML/CFT event. The compliance documentation now required for BCU authorisation is explicitly AML/CFT-flavoured, meaning that firms navigating the licensing gate are simultaneously building out the governance infrastructure that domestic and international AML/CFT supervisors will expect to see. This is the kind of dual-purpose regulatory instrument that rewards reading across monitors: a licensing event in payments terms is a compliance-architecture event in financial-integrity terms, and the two readings reinforce rather than duplicate one another.

Outlook

The period through 31 March 2027 is the operative window to watch. Existing operators face a genuine compliance-build task, since general industry practice among unregulated regional virtual-asset firms has typically lagged the kind of formal AML/CFT programme documentation the new regime now expects as a matter of authorisation. Whether the BCU's discretionary criterion for deeming an asset a financial instrument becomes a source of regulatory friction or ambiguity during this window is likely to be the first genuine test of how the architecture, as opposed to the announcement, actually functions once new entrants must clear the bar before commencing operations at all, while incumbents are permitted a longer runway.