Technical Standards to Facilitate the Participation of Financial Entities in the Bitcoin Ecosystem

CNBCR-12/2021
NRP-29
TECHNICAL STANDARDS TO FACILITATE THE PARTICIPATION OF FINANCIAL ENTITIES IN THE BITCOIN ECOSYSTEM Approval: 09/07/2021 Validity: 09/07/2021

THE COMMITTEE OF STANDARDS OF THE CENTRAL BANK OF RESERVE OF EL SALVADOR,

CONSIDERING:

I. That Article 1 of the Bitcoin Law regulates Bitcoin as legal tender in the territory of El Salvador, defined by its unlimited liberatory power, with voluntary acceptance by natural or legal persons with total private participation only, in any transaction and under any title they may need to carry out. (1)

II. That the approval of the Bitcoin Law makes necessary the entry into operation of various economic agents that allow offering agile, competitive, and inclusive financial services for the general population, considering Bitcoin transactions in the territory of El Salvador. (1)

III. That the Bitcoin Law establishes in its Article 11 that it corresponds to the Central Bank to issue the corresponding regulations.

IV. That Article 99 of the Law for the Supervision and Regulation of the Financial System in its fourth clause establishes that it will correspond to the Central Bank, the approval of other resolutions that, within its competence, are necessary for the proper functioning of the Financial Supervision and Regulation System, as well as for the application of this Law and in other laws applicable to the supervised entities.

V. That technological advances in the financial matter allow the realization of operations and transactions effectively and immediately through various electronic and digital mechanisms, of which it becomes essential to establish rules for their operation.

THEREFORE, by virtue of the regulatory powers conferred by Article 99 of the Law for the Supervision and Regulation of the Financial System, AGREES to issue the following:

CNBCR-12/2021
NRP-29
TECHNICAL STANDARDS TO FACILITATE THE PARTICIPATION OF FINANCIAL ENTITIES IN THE BITCOIN ECOSYSTEM Approval: 09/07/2021 Validity: 09/07/2021

TECHNICAL STANDARDS TO FACILITATE THE PARTICIPATION OF FINANCIAL ENTITIES IN THE BITCOIN ECOSYSTEM

CHAPTER I
OBJECT, SUBJECTS, AND TERMS

Object and Subjects
Art. 1.- These Standards aim to regulate the subjects that offer bitcoin-based services to their clients, whether natural or legal persons, and these services may be offered directly or through a Bitcoin Service Provider. The subjects may participate in the provision of custody or non-custody bitcoin-based wallet services, exchange services, payment processing, among other services, as well as offer the complete set of their banking services to a Bitcoin Service Provider. These Standards do not apply to Bitcoin Service Providers that register in accordance with what is established in Executive Decree No. 27 dated August 27, 2021, which contains the Regulation of the Bitcoin Law, unless these are considered entities under these Standards.

Subjects
Art. 2.- The subjects obliged to comply with the provisions established in these Standards are the following: (2) a) Banks; (2) b) Investment Banks; (2) c) Cooperative Banks and Savings and Credit Societies; and (2) d) Electronic Money Providers. (2)

Terms
Art. 3.- For the purposes of these Standards, the terms indicated below have the following meaning:
a) Central Bank: Central Bank of Reserve of El Salvador; (2) b) Bitcoin: In accordance with what is established in Article 1 of the Bitcoin Law; (2) c) Dollars: United States Dollars; (2) d) Entities: Subjects obliged to comply with these Standards; (1) (2) e) FATF: Financial Action Task Force; (2) f) Bitcoin Service Provider: This term has the meaning attributed to it in Executive Decree No. 27 dated August 27, 2021, which contains the Regulation of the Bitcoin Law; and (2) g) Superintendence: Superintendence of the Financial System.

CNBCR-12/2021
NRP-29
TECHNICAL STANDARDS TO FACILITATE THE PARTICIPATION OF FINANCIAL ENTITIES IN THE BITCOIN ECOSYSTEM Approval: 09/07/2021 Validity: 09/07/2021

CHAPTER II
OBLIGATIONS OF THE ENTITIES

General Obligations
Art. 4.- Entities must comply at all times with the provisions and principles established in the Bitcoin Law and its Regulation, as well as with the applicable regulatory framework for entities subject to these Standards according to the nature of their operations.

Establishment of Contractual Relationships
Art. 5.- Before establishing a contractual relationship with a Bitcoin Service Provider, an entity will carry out due diligence of the Bitcoin Service Provider, given the nature of the services to be provided and the risk associated with said relationship according to each entity's policies. Any entity will carry out enhanced due diligence to preserve the security, solidity, and integrity of the entity and the financial system in general. Due diligence topics, among others, include the commercial qualifications of a Bitcoin Service Provider, financial condition, legal and regulatory compliance, risk management and controls, anti-money laundering and terrorist financing prevention systems, information security, and operational resilience. No entity is obliged to offer financial services to Bitcoin Service Providers. (1)

Regarding the Contract
Art. 6.- An entity may enter into a contract with a Bitcoin Service Provider, for which the entity will execute a written contract incorporating the results of the due diligence carried out by the entity in accordance with Article 5 and the nature of the commercial agreement. At a minimum, said contract must address:
a) Nature of the service provided and its description; b) Contract term; c) Frequency, form, and technical specifications of the services to be provided; d) Commissions and other compensation involved in the commercial agreement; e) Any service provided by a third party on behalf of or in place of the entity; f) Declarations, warranties, and covenants that the Bitcoin Service Provider complies with the Law and will operate in accordance with the Law; g) Capacity of the entity to audit and access the records of the Bitcoin Service Provider related to the services as necessary to evaluate the compliance of the Bitcoin Service Provider with the Law and the contract; h) Process for addressing customer complaints and delivery of information to customers; i) Relevant insurance coverage provided for the services;

CNBCR-12/2021
NRP-29
TECHNICAL STANDARDS TO FACILITATE THE PARTICIPATION OF FINANCIAL ENTITIES IN THE BITCOIN ECOSYSTEM Approval: 09/07/2021 Validity: 09/07/2021

j) Terms related to any use of the entity's facilities, equipment, systems, or employees; k) Obligation of the Bitcoin Service Provider to cooperate jointly with the entity in case of an inspection of the entity by the Superintendence or another authority; especially regarding the Bitcoin Service Provider's knowledge of the service provided and its respective operational and accounting records; l) Responsibilities and prohibitions of each of the parties; m) Detail of the activities and functions of each of the parties in the provision of the service; n) Indemnification provisions that consider the adequate distribution of risks between the parties; and o) Other elements considered necessary or appropriate to address in said contract. Before entering into said contract, the Board of Directors of the entity, or a delegate of the Board, will review the contract to ensure it complies with these Standards. The Board of Directors of the entity must authorize the start of the commercial relationship with the Bitcoin Service Provider and its eventual termination for justified causes.

Limits and Liability
Art. 7.- An entity must avoid providing services to a Bitcoin Service Provider that, according to its reasonable determination, is not operating legally; likewise, the Bitcoin Service Provider, and not the entity, will be responsible at all times for its own compliance with Applicable Laws and Regulations. Similarly, an entity cannot delegate its own compliance with Applicable Laws and Regulations to a Bitcoin Service Provider. Notwithstanding, at all times the parties will comply with what is established in the service contract.

Regarding Operational Capacity
Art. 8.- Prior to providing services to a Bitcoin Service Provider, an entity will ensure that it has sufficient operational capacities to do so, which include personnel, equipment, systems, technological platforms, financial resources, administrative control systems, security applications, information security, and business continuity, cybersecurity policies, appropriate business plans, manuals, procedures, policies, and internal controls to ensure the correct functioning and resilience of the services and their compliance with the Bitcoin Law and its Regulation.

CNBCR-12/2021
NRP-29
TECHNICAL STANDARDS TO FACILITATE THE PARTICIPATION OF FINANCIAL ENTITIES IN THE BITCOIN ECOSYSTEM Approval: 09/07/2021 Validity: 09/07/2021

Supervision
Art. 9.- Entities will be subject to the supervision of the Superintendence, who will review the operations, books, and records of said entity and its compliance with respect to the Bitcoin Law and its Regulation, as well as what is established in these Standards.

CHAPTER III
REGISTRATION, TRACEABILITY, REPORTS, AND RECORD KEEPING

Registration
Art. 10.- Bitcoin Service Providers or entities providing these services must register with the Central Bank in the Register of Bitcoin Providers created for such purposes, in accordance with what is established in the Regulation of the Bitcoin Law.

Traceability
Art. 11.- For any fund transfer that is greater than or equal to one thousand dollars or its equivalent in Bitcoin, measured at the time of the transaction, for which an entity is involved in the payment flow, said entity must obtain the following information:

Entity Category Level of Requirement Originator Information Name Required Account Number Required Address When available Financial Institution Identification Required Negotiated Amount Required Execution Date Required Beneficiary Information Name Required Address When available Financial Institution Identification Required Account Number Required Any other beneficiary identification information When available

Entities will establish policies and procedures based on best practices, including FATF recommendations and the Special Law for the Prevention, Control, and Punishment of Money Laundering, Terrorist Financing, and Financing of the Proliferation of Weapons of Mass Destruction. (2)

Suspicious Transaction Report
Art. 12.- Entities must report to the Financial Investigation Unit of the Attorney General's Office a Suspicious Transaction Report in accordance with laws, instructions, and regulations currently in force related to the prevention, detection, and control of money laundering, terrorist financing, and financing of the proliferation of weapons of mass destruction. The entity will maintain the confidentiality of the content of said Suspicious Transaction Report. (2)

Record Keeping
Art. 13.- Entities must retain records related to their bitcoin-based services for a period of fifteen years from the date of the transaction.

CHAPTER IV
OTHER PROVISIONS AND VALIDITY

Sanctions
Art. 14.- Non-compliance with the provisions contained in these Standards will be sanctioned by the Superintendence in accordance with what is provided in the Law for the Supervision and Regulation of the Financial System.

Unforeseen Aspects
Art. 15.- Unforeseen aspects in regulatory matters in these Standards will be resolved by the Central Bank through its Committee of Standards.

Validity
Art. 16.- These Technical Standards will enter into force as of September 7, two thousand twenty-one.

MODIFICATIONS:
(1) Modifications in the considerations I and II, and in Articles 3 and 5, approved by the Central Bank through its Committee of Standards, in Session No. CN-03/2025, on May 30, two thousand twenty-five, in consistency with reforms contained in Legislative Decree No. 199 to the Bitcoin Law, with effect from June 16, two thousand twenty-five.

CNBCR-12/2021
NRP-29
TECHNICAL STANDARDS TO FACILITATE THE PARTICIPATION OF FINANCIAL ENTITIES IN THE BITCOIN ECOSYSTEM Approval: 09/07/2021 Validity: 09/07/2021

(2) Modifications in Articles 2, 3, 11, and 12, approved by the Central Bank through its Committee of Standards, in Session No. CN-09/2025, on November 10, two thousand twenty-five, with effect from November 25, two thousand twenty-five.