Cryptocurrency ATM operations in Paraguay: a full regulatory assessment

Paraguay has no comprehensive crypto law, but SEPRELAD registration and AML compliance create a workable, if fragile, path to market — three banks are reportedly awaiting central bank approval to serve crypto businesses.

● Grey

Operating a crypto ATM in Paraguay is legal but sits in a pronounced regulatory grey zone — not prohibited, not specifically licensed, yet subject to binding AML obligations. Paraguay lacks a comprehensive virtual assets law after a 2022 bill was vetoed and subsequent proposals stalled in Congress. The only enforceable crypto-specific rules come from SEPRELAD (the financial intelligence unit) through AML/CFT resolutions, and from the DNIT tax reporting mandate that took effect in March 2026.¹⁷ Three banks are reportedly seeking central bank authorization to serve crypto businesses, signaling an inflection point.^21,4 For a prospective operator, the jurisdiction rates as "Possible but Risky" — viable with proper structuring, but demanding tolerance for regulatory ambiguity.

Last updated: September 2026

Legal status: permitted but unregulated by design

Paraguay has no comprehensive cryptocurrency or virtual assets law.² The legal landscape is defined more by what doesn’t exist than what does. The Banco Central del Paraguay (BCP) declared in May 2019, and has reaffirmed since, that cryptocurrencies are not legal tender, carry no mandatory canceling force, and receive no state guarantee.³ This derives from the BCP’s Organic Law, which designates the guaraní as the sole monetary unit.⁴ Critically, this is a warning, not a prohibition — the BCP does not regulate, supervise, or license crypto operations at all.^5,6

No statutory classification exists either. Under SEPRELAD resolutions, digital assets are referenced only as "virtual assets" (activos virtuales), following FATF terminology.⁷ Under the new Securities and Products Market Law (Law 7572/2025, November 2025), tokenized assets representing credit or property rights qualify as securities supervised by the securities regulator — but decentralized cryptocurrencies like Bitcoin are explicitly excluded from that scope.²⁴

The closest attempt at comprehensive regulation failed. A bill covering mining, exchange, custody, and administration of crypto-assets passed both chambers of Congress before President Mario Abdo Benítez vetoed it in August 2022.⁹ The Senate voted to override, but the Chamber of Deputies fell short of the required majority, and the bill was archived in December 2022.¹⁰ A separate proposal for a 180-day blanket ban on crypto activity, introduced by 14 senators in April 2024, was criticized by the competition authority and effectively shelved. The practical legal basis for operating a crypto ATM today rests on three pillars: the absence of any prohibition, mandatory SEPRELAD registration as a VASP, and compliance with AML/CFT obligations — legal, but operating within what Paraguayan legal commentators repeatedly call a "vacío legal" (legal vacuum).¹¹

Licensing: SEPRELAD registration is the de facto license

There is no dedicated crypto or VASP license in Paraguay.¹² No BCP financial services license, no money-transmitter license, and no currency-exchange authorization applies to crypto ATM operations — the regulatory framework reduces to SEPRELAD AML registration plus standard business formalities.

Local incorporation is required: SEPRELAD’s resolution governing virtual-asset AML applies to natural or legal persons constituted or domiciled in Paraguay,¹¹ so a foreign entity cannot register without a local presence. The simplest vehicle is an SRL (Sociedad de Responsabilidad Limitada), which has no minimum capital requirement and takes roughly 30–45 days to incorporate; an SA (Sociedad Anónima) requires meaningfully more capital and 21+ weeks to form.¹³ A locally based, Spanish-speaking Compliance Officer must also be appointed, reporting directly to the entity’s highest authority and with autonomy, independence, and sufficient resources.¹⁴ There is no published minimum capital requirement specific to VASP operations — the vetoed 2022 bill would have set one, but it never took effect.

AML/KYC: SEPRELAD Resolution 314/2021 controls the field

SEPRELAD is the single most important regulator for crypto ATM operators. Its 2021 AML/CFT resolution is the cornerstone rule,¹⁴ built on Paraguay’s core anti-money-laundering law. All VASPs must register with SEPRELAD and implement a two-part prevention system — a compliance component (policies, procedures, controls) and a risk-management component (identification, evaluation, mitigation and monitoring of ML/TF risk).¹⁵ Obligations include a risk self-assessment at least every two years, a mandatory AML/CFT manual and code of ethics, annual staff training, an annual internal evaluation reported to SEPRELAD within 90 days of fiscal year close, and — for entities above roughly USD 1.2 million in annual billing — an external audit.¹⁴

The framework uses a risk-based approach rather than rigid KYC tiers, but the underlying AML law sets a clear reporting line: every transaction at or above USD 10,000 must be registered and reported, and transactions below that threshold must still be reported if they show signs of structuring to evade it.¹⁷ All clients must be identified — there is no allowance for anonymous transactions. For practical crypto ATM operation, applying the same thresholds used for currency-exchange houses would be prudent: basic ID from the first transaction, with origin-of-funds justification above roughly USD 1,000.¹⁸ Suspicious transactions must be reported to SEPRELAD regardless of amount, and if none occur within three months, a mandatory "negative report" is still due. Penalties for non-compliance are steep — fines reportedly reaching the equivalent of roughly USD 1.62 million for legal entities, plus potential suspension or permanent closure and personal liability for officers.¹⁶

Cash restrictions: no cap, but a reporting trigger that bites

Paraguay has no general legal cap on cash transactions — the economy is heavily cash-based, with informal employment covering more than half the workforce, and there are no EU-style payment ceilings. The operative constraint for crypto ATM operators is the same USD 10,000 SEPRELAD reporting threshold described above,¹⁷ with anti-structuring rules that make deliberately splitting transactions to stay under it a reportable, criminal offense in its own right.

A new layer arrived in March 2026: DNIT (the tax authority) now requires all crypto transactions exceeding USD 5,000 annually per user to be reported with granular detail — wallet addresses, blockchain networks, transaction hashes and USD equivalents — through monthly filings via authorized digital channels.^1,8 There are no crypto-ATM-specific cash limits today, but operators should expect any future comprehensive law to introduce transaction caps at ATMs, in line with global regulatory trends and FATF pressure.

Banking: historically hostile, now cautiously opening

Banking access has been the single greatest operational barrier for crypto businesses in Paraguay. Banks systematically refused to serve VASPs, citing the absence of a comprehensive regulatory framework — as one local OTC platform founder put it publicly, banks treated any unregulated crypto business as an automatic risk, and some VASPs reportedly resorted to storing large cash volumes in private vaults.²⁰

That is shifting in 2026. Three Paraguayan banks are reportedly awaiting central bank approval to serve as fiat-crypto ramps, a development reported by BeInCrypto in March 2026 that would be transformative if confirmed — though the institutions’ names have not been publicly disclosed.^21,4 The formal AML supervision now in place, the securities law’s recognition of DLT, the new DNIT tax framework, and a March 2025 memorandum of understanding between SEPRELAD and El Salvador’s digital-asset regulator all point the same direction: institutional acceptance is building.²² Realistic assessment: banking access remains difficult but no longer impossible. A VASP with full SEPRELAD registration, robust AML/CFT documentation and a clean compliance track record has a reasonable chance of securing a banking relationship in 2026 — operators should budget 3–6 months for account opening and expect enhanced due diligence.

The next 24 months: structured regulation is coming, timing isn’t

The regulatory trajectory clearly points toward structured oversight rather than prohibition, but Congress has repeatedly failed to deliver. Four competing bills were introduced in 2024 alone — ranging from recognizing Bitcoin as "experimental legal tender" to a temporary mining ban — and none advanced to a vote.²³ While Congress stalls, executive agencies are building frameworks aggressively: the DNIT tax-reporting rule, the securities law’s mandate for the market regulator to develop digital-custody and tokenization rules during 2026, and a state Bitcoin-mining initiative deploying tens of thousands of confiscated ASIC miners all signal a government increasingly comfortable treating crypto as a revenue source.^24,8 President Santiago Peña has visited mining operations and publicly endorsed the new securities law, suggesting a more crypto-friendly executive than his predecessor.

Paraguay is a GAFILAT (the FATF-style regional body for Latin America) member and is not currently on the FATF grey list, and maintaining that standing is a primary driver behind SEPRELAD’s progressive crypto regulation and the new DNIT reporting mandate.¹⁹ The most probable scenario for the next 12–24 months is incremental executive regulation — further DNIT taxation phases, securities-market enabling rules, possible SEPRELAD updates — rather than a sweeping Congressional act. If a comprehensive bill does eventually pass, it will likely require VASP licensing, set minimum capital requirements, create a dedicated supervisory authority, and formalize taxation. The direction is structuring, not restricting — but the timeline could easily extend beyond 2027.

Importing crypto ATM equipment from the EU

Bitcoin ATMs most likely fall under HS 8472.90 ("other office machines") within the MERCOSUR Common Nomenclature, though the exact 8-digit code must be confirmed with Paraguay’s customs authority, since misclassification carries penalties. If the machine qualifies under MERCOSUR’s capital-goods or IT/telecommunications lists, the duty drops to 0–2%; otherwise the MERCOSUR common external tariff for Chapter 84 machinery ranges 0–14%, with Paraguay’s average applied tariff around 7.2%.²⁵ A Paraguayan legal entity with an active tax ID is mandatory — foreign companies cannot import directly — and commercial documents must be legalized by a Paraguayan consulate in the EU country of export, with a licensed customs agent preparing the import declaration. Paraguay is landlocked, so goods arrive via the Paraguay-Paraná waterway or overland through Argentina or Brazil, with routine customs clearance taking about 3 business days.

If the ATM contains any wireless module — WiFi, Bluetooth, 4G/LTE, which virtually all modern units do — type approval from Paraguay’s telecommunications regulator (CONATEL) is mandatory before import or sale. CONATEL accepts EU RED (2014/53/EU) test reports, eliminating the need for separate in-country testing; a local representative must file the application, processing takes about 5 weeks, and certification is valid for 5 years. The EU-Mercosur Interim Trade Agreement was formally signed in January 2026, and while Argentina and Uruguay have ratified it domestically, Brazil and Paraguay are still completing ratification, so preferential tariff rates are not yet in force — standard MERCOSUR rates apply for now.²⁶

Practical market entry snapshot

Paraguay offers genuine advantages: no explicit prohibition on crypto ATMs, relatively low compliance costs compared to fully regulated jurisdictions, a functioning AML registration pathway via SEPRELAD, improving banking prospects, no cash transaction caps, and an active crypto-mining ecosystem.²³ The government’s trajectory points toward structured regulation rather than restriction, and FATF-related compliance pressure keeps pushing toward legitimization.

The absence of a comprehensive virtual-assets law remains the core deficiency. Without it, operators lack legal certainty on licensing, taxation and consumer protection, the BCP’s persistent skepticism toward crypto creates institutional friction, and banking access — while improving — remains unreliable. The legislative track record, one comprehensive bill vetoed and four subsequent bills stalled, offers no confidence in near-term clarity, and any future law could impose retroactive requirements or new licensing costs that alter the business case.

Sources and references

1. RDN — rdn.com.py
2. Cryptowisser — cryptowisser.com
3. Investing.com — investing.com
4. Vouga Abogados — vouga.com.py
5. Freeman Law — freemanlaw.com
6. Altra Legal — altra.com.py
7. Vouga Abogados — vouga.com.py
8. Bitcoin Magazine — bitcoinmagazine.com
9. Bitcoinist — bitcoinist.com
10. BeInCrypto — beincrypto.com
11. Livieresg — livieresg.com.py
12. Metlabs — metlabs.io
13. Multiplier — usemultiplier.com
14. Ferrere — ferrere.com
15. Ferrere — ferrere.com
16. Seprelad — seprelad.gov.py
17. La Nación — lanacion.com.py
18. Bacn (Ley 1015/97) — bacn.gov.py
19. Bitkonga — bitkonga.com
20. Clubdeejecutivos — clubdeejecutivos.org.py
21. BeInCrypto — es.beincrypto.com
22. CoinDesk — coindesk.com
23. TEDIC — tedic.org
24. La Tribuna — latribuna.com.py
25. International Trade Administration — trade.gov
26. White & Case LLP — whitecase.com

Legal Disclaimer: This overview is for general informational purposes only and does not constitute legal, tax, or financial advice. Paraguay's crypto-specific rules are evolving rapidly through executive resolutions rather than settled legislation; operators should verify current requirements with SEPRELAD, DNIT, and qualified local counsel before making business decisions. Some figures in this article (including the identity of the banks reportedly seeking central bank approval to serve crypto businesses) are drawn from press reporting that has not been independently confirmed by GENERAL BYTES.