Latin America Crypto Compliance 2026 Travel Rule Outlook for Expats Investors and Businesses

Latin America crypto growth meets compliance momentum

Vibrant, resilient, and inventive—Latin America’s crypto markets have matured from a niche to a mainstream financial channel for payments, savings, and hedging. Inflationary pressure, currency volatility, and gaps in traditional banking infrastructure have accelerated adoption across the region. Chainalysis estimates Latin America received nearly $415 billion in on-chain value between July 2023 and June 2024, equivalent to roughly 9.1% of global activity, with Argentina and Brazil together accounting for the largest national flows in the region. Four to six Latin American countries regularly appear in the global top-20 for grassroots crypto adoption depending on the year and methodology. The growth is real, deep, and increasingly institutional.

Regulators have responded with sharper anti-money-laundering and counter-terrorist-financing (AML/CFT) expectations, converging around the Financial Action Task Force’s payment transparency standard known as the Travel Rule. For expats and international investors, the period to 2026 is decisive: compliant rails will unlock safer access, while non-compliant providers face exclusion from banking partners, counterparties, and cross-border corridors.

What the FATF Travel Rule requires in crypto operations

The Travel Rule extends long-standing wire-transfer transparency to virtual asset transfers. In practice, it obliges Virtual Asset Service Providers (VASPs)—exchanges, custodians, brokers, and similar intermediaries—to obtain, verify, and transmit originator and beneficiary information for qualifying transfers, and to store those records securely for regulatory review. The FATF’s 2021 Updated Guidance clarifies how Recommendation 16 applies in the virtual asset context, including concepts like wallet addresses functioning as “account numbers,” expectations for “immediate and secure” data transmission, and coordination among supervisors.

Data elements and transaction thresholds

While national rules vary, the FATF has recommended a de-minimis threshold of USD/EUR 1,000 for applying full Travel Rule data requirements in the virtual asset context. Many jurisdictions follow that benchmark; others go stricter or broader. At or above the threshold, VASPs must exchange sender and recipient identifying data and maintain audit-ready records. Below the threshold, simplified obligations can apply, but screening and risk management never fall to zero.

Scope of obliged entities and cross-border reach

Obligations apply whenever VASPs send to or receive from another financial intermediary; cross-border transfers are squarely in scope. With self-hosted wallets, the FATF allows risk-based approaches; jurisdictions differ on verification steps, but firms are expected to mitigate counterparty risk and document their controls.

Why this is transformative for crypto

The rule changes how exchanges interoperate. Anonymous transfers between custodial platforms are no longer permissible at scale. Business models and user experiences must adapt, integrating travel-rule messaging, sanctions screening, name screening, and case management into a single, auditable flow. Providers that cannot exchange compliant data with peers risk being geofenced, de-risked by banks, or unable to service fiat on- and off-ramps reliably.

Key timelines to 2026 in Latin America

Across Latin America, implementation is uneven. Several countries have enacted or finalized comprehensive regimes, others are mid-consultation, and some rely on sectoral AML measures while drafting full VASP frameworks. The net effect is a sunrise period: compliant providers must exchange information with counterparts in jurisdictions that may not yet have fully compatible regimes. The 2025 FATF materials and industry analyses consistently highlight uneven global adoption and the resulting operational friction. For investors and expats, this means counterparty selection and documentation matter more than ever.

Peru clarifies a two year runway to Travel Rule enforcement

Peru offers one of the clearest roadmaps in the region. In 2024, the Superintendencia de Banca, Seguros y AFP (SBS) finalized a comprehensive regulation that squarely brings VASPs under AML supervision, registration, and reporting expectations.

Scope and definitions under SBS oversight

Peru’s framework treats as VASPs any firm that exchanges fiat for crypto, swaps one crypto for another, transfers digital assets for customers, provides custody services, or offers financial services tied to the issuance or sale of virtual assets. Domestic providers and branches of foreign companies operating locally fall into scope. Firms must register, appoint a compliance officer, implement risk-based AML/CFT programs, and report suspicious transactions to Peru’s Financial Intelligence Unit (UIF-Perú).

Travel Rule timeline and operational requirements

The regulation’s Chapter VIII on the Travel Rule enters into force two years after the regulation’s 2024 publication, yielding an effective date in 2026. That lead-time is designed to let providers integrate travel-rule messaging, data security controls, and staff training. In line with FATF expectations, VASPs will need to gather and exchange originator and beneficiary names, identifiers, and wallet or account references for qualifying transfers, store the data, and make it available to authorities upon request.

Registration, reporting, and inspections

SBS is empowered to inspect and sanction non-compliant providers, issue supervisory guidance, and coordinate with UIF-Perú. Providers should expect periodic reviews of their KYC standards, transaction monitoring, sanctions screening, and travel-rule connectivity and failover procedures—especially for cross-border transfers and interactions with self-hosted wallets.

Tax and recordkeeping considerations

Peru taxes corporate income at a statutory rate widely cited around 29.5%, with individuals subject to progressive rates that can reach 30% depending on income category and circumstances. Crypto income typically follows general income-tax rules rather than a bespoke crypto tax code, so characterizing activity correctly—trading, business income, or investment gains—matters. In all cases, travel-rule and KYC/AML records should align with tax documentation and be retained for statutory periods.

Brazil advances from foundational law to supervisory rules

Latin America’s largest economy set its foundation with Law 14,478/2022, defining virtual assets and empowering the Central Bank of Brazil (Banco Central do Brasil, BCB) to regulate VASPs. Through 2024–2025, the BCB has channeled this mandate into public consultations and draft resolutions that foreshadow licensing, prudential standards, segregation of client assets, and specific rules for foreign providers serving the Brazilian market.

The legal base and the rulemaking arc

Law 14,478 establishes national guidelines, with the BCB as the lead regulator for VASPs. In November 2024, the BCB launched Public Consultations 109 and 110 to take input on authorization, licensing scope, and the operational framework for virtual asset services, including how other BCB-licensed institutions may offer crypto-related services. Additional consultation materials have addressed how crypto services interact with the foreign-exchange regime.

Travel Rule posture and market expectations

As of late 2025, Brazil continues to translate the consultations into formal rules. Market leaders already operate with robust KYC/AML controls and anticipate a formalized Travel Rule requirement aligned to FATF standards. The thrust is clear: licensing for VASPs, counterparty due diligence, and secure data-sharing with traceability should become table stakes. International providers eyeing Brazil should plan for local representation, possible data-localization nuances, and technical interoperability with domestic institutions and correspondent banks.

Implications for expats and investors

Brazil’s market depth and stablecoin intensity make it attractive for remittances and treasury routing. Yet institutions increasingly expect counterparties to use Travel Rule messaging, maintain segregation of client funds, and evidence robust compliance. For individuals and family offices, onboarding with locally licensed platforms reduces friction on fiat rails and mitigates account-freezing risk.

Argentina accelerates with mandatory registration and UIF controls

Argentina’s economic volatility has driven extraordinary crypto usage, particularly stablecoins. Regulators have matched that growth with mandatory VASP registration via the National Securities Commission (CNV) and strengthened AML obligations through the Financial Intelligence Unit (UIF).

CNV General Resolution 1058 VASP registration and scope

In March 2025, the CNV finalized General Resolution 1058/2025 establishing a formal registry for Proveedores de Servicios de Activos Virtuales (PSAV). Registration is mandatory before operations commence. The rule outlines eligibility, documentation, minimum capital and governance requirements, transparency and cybersecurity obligations, and periodic reporting. Foreign platforms that target Argentine users via local domains, advertising, or commercial arrangements may also be required to register. Self-custody wallet providers and decentralized protocols without an identifiable service provider are expressly carved out.

UIF Resolution 49 2024 AML duties and reporting cadence

UIF Resolution 49/2024 incorporates PSAVs as reporting entities, imposing risk-based programs, customer due diligence, suspicious activity reporting, and systematic monthly reporting of certain activity metrics. The resolution defines virtual assets, sets onboarding standards, and establishes implementation timelines. For VASPs, this elevates documentation burdens and codifies expectations around screening, transaction monitoring, and audit.

Practical effects for users and platforms

Expats and investors using unregistered platforms face higher friction and potential service disruptions as local banks and payment providers increasingly enforce registry and AML checks. Registered PSAVs will ask for more comprehensive identity, address, and source-of-funds evidence, and may conduct enhanced due diligence on larger transfers. For businesses, the regime offers clearer rules of the road but raises operational costs—especially around travel-rule integrations and external audits.

Chile implements early Travel Rule enforcement with CMF oversight

Chile has emerged as a regional early mover on travel-rule enforcement. The Comisión para el Mercado Financiero (CMF) published internal AML/CFT standards for its supervised institutions and clarified travel-rule expectations, with enforcement tied to mid-2025. In practice, VASPs serving Chilean users must identify originators and beneficiaries on qualifying transfers, apply robust KYC, and retain transaction records consistent with FATF guidance.

What providers must do now in Chile

Provider identity verification, sanctions screening, risk grading, and recordkeeping are baseline controls. For travel-rule compliance, firms should be able to locate counterpart VASPs, exchange standardized IVMS101 messages, and handle edge cases like transfers to unhosted wallets with risk-based procedures.

Nicaragua introduces a renewed fintech framework covering PSAVs

In 2025, Nicaragua’s Central Bank (BCN) overhauled its fintech regulation, explicitly licensing PSAVs and Payment Service Providers (PSPs). The framework defines PSAV activities—exchange, transfer, custody, and services tied to issuance or sale of virtual assets—and requires authorization, governance, minimum capital, risk management, and AML/CFT controls.

Licensing and supervisory model

Only entities holding the relevant BCN license or registry may operate as PSPs or PSAVs domestically. The framework empowers the BCN to supervise, inspect, and sanction firms and to align prudential oversight with AML obligations. While the regulation does not use the phrase Travel Rule in isolation, the overall architecture anticipates international-standard data exchange and reporting between intermediaries, making travel-rule readiness a practical necessity for cross-border operations.

User level impact

For consumers and businesses, the changes formalize who can safely offer crypto services and should reduce fraud and counterparty risk. Expect more rigorous onboarding, standardized disclosures, and a clearer path for banks and PSAVs to interoperate.

Mexico advances toward alignment with an AML first approach

Mexico’s framework builds on its 2018 Fintech Law, which defines virtual assets for purposes of regulated fintech institutions, and on AML rules that classify certain virtual-asset activities as “vulnerable.” In mid-2025, Mexico approved significant AML reforms to its Federal Law for the Prevention and Identification of Operations with Illicit Proceeds (LFPIORPI), broadening scope and tightening obligations for vulnerable activities, including cryptocurrencies.

The state of Travel Rule alignment

Mexico is actively moving toward fuller Travel Rule alignment. Law-firm briefings on the 2025 reforms discuss duties similar to travel-rule data exchange, including expanded customer identification, ultimate beneficial owner verification, automated monitoring, and enhanced reporting timelines. TRM Labs’ country tracker likewise notes Mexico’s implementation process as ongoing. While final, specific travel-rule messaging obligations are still evolving, VASPs serving Mexican users should proceed as if counterparty due diligence and inter-VASP data exchange will be expected.

Tax and compliance posture

Mexico’s tax treatment relies on general income-tax rules and, where applicable, VAT (for certain domestic supplies). Given the variability across use cases, businesses and individuals should obtain local tax advice and ensure that travel-rule records dovetail with tax substantiation, especially for cross-border transfers and remittances.

Colombia modernizes through reporting rules and pending VASP bill

Colombia has not yet adopted a dedicated VASP licensing statute, but two pillars shape today’s landscape: (1) mandatory reporting by virtual-asset service providers to the Financial Intelligence Unit (UIAF) under Resolution 314/2021, and (2) iterative experimentation and guidance under the Financial Superintendence’s supervisory programs and sandbox initiatives. In 2025, a draft bill to regulate PSAVs was introduced, signaling legislative momentum toward a fuller regime.

UIAF Resolution 314 reporting expectations

Resolution 314 obliges companies and individuals who provide virtual-asset services—exchange, transfer, custody—to submit suspicious transaction reports and certain transaction data to the UIAF. The rule underscores that crypto activity can present financial-crime risks and that providers must implement risk-based controls and maintain adequate records.

Toward Travel Rule interoperability

As Colombia moves from reporting obligations to a full VASP framework, firms should anticipate explicit travel-rule data exchange, counterparty screening, and standardized messaging. Aligning with IVMS101 formats and preparing for regulator-to-regulator cooperation in cross-border cases will ease the transition once the bill becomes law.

The sunrise risk and why interoperability matters

The sunrise issue describes staggered Travel Rule adoption across jurisdictions. When one country enforces travel-rule messaging and its counterparty jurisdiction does not, compliant VASPs struggle to complete transfers without violating rules or exposing themselves to risk. This has spurred a wave of technical standards and trust frameworks so VASPs can locate, authenticate, and exchange data securely.

Messaging standards and trust registries

Key protocols include TRISA, TRUST, OpenVASP, the Travel Rule Protocol (TRP), and VerifyVASP’s network. They generally exchange IVMS101 messages (the common data schema for originator and beneficiary identity fields), often anchored by VASP identity verification via certificate authorities or federated registries. Many providers now support protocol “auto-negotiation,” enabling a sending VASP to discover which protocol a counterparty uses and to fall back gracefully.

Vendor selection and due diligence

When choosing a Travel Rule vendor, VASPs should evaluate: protocol coverage and interoperability; directory accuracy and certificate management; privacy and encryption design; handling of unhosted-wallet scenarios; and evidence of production-scale uptime. Supervisors increasingly expect documented reasoning for vendor choices and periodic performance reviews.

What expats and international investors should do now

Work only with registered or supervised counterparties

In Peru, Argentina, Brazil, Chile, Mexico, Colombia, and Nicaragua, expectations are converging on licensing or at least registration and AML reporting. Select custodians and exchanges that can demonstrate local authorization or recognized supervision and that have bank connectivity inside the country you operate in.

Prepare documentary evidence up front

Expect more frequent requests for identity, address, and source-of-funds documentation—especially for initial onboarding, large remittances, or cross-border transfers. Keep proof of income, corporate resolutions, invoices, and contractual context organized. If you route funds between multiple platforms, maintain a chain of records so travel-rule metadata and bank statements “tell the same story.”

Mind data privacy and storage

Your providers will hold more personal data due to travel-rule messaging. Ask how they encrypt data in transit and at rest, how long they retain it, and where it is stored. Favor providers with privacy-by-design controls, minimal data fields outside legal requirements, and documented breach-response plans.

A practical compliance roadmap for VASPs

Governance and accountability

Appoint a senior compliance officer with authority and resources, define KPIs for AML and travel-rule performance, and give your board regular visibility of program effectiveness. Map all product flows involving virtual assets and identify where travel-rule obligations trigger.

KYC orchestration and cross-border nuance

Integrate document verification, liveness checks, sanctions and PEP screening, and risk scoring into a unified KYC flow. Configure jurisdiction-aware rules: thresholds, acceptable documents, and enhanced due diligence triggers differ by country. Ensure your KYC vendor can handle Latin American document types and language variants reliably.

Transaction monitoring fused with Travel Rule messaging

Unify travel-rule messaging with your monitoring system: a transfer should not leave your platform until required data is attached and screened. Implement fail-over logic for counterparties that cannot receive data, and define playbooks for requesting missing fields, returning funds, or filing reports. Test edge cases such as transfers to self-hosted wallets or to VASPs with different protocols.

Testing, training, and audit

Run tabletop exercises for cross-border cases, simulate regulator inquiries, and conduct annual third-party audits that cover both AML and travel-rule controls. Train support teams on customer communications for travel-rule-related delays or data requests. Document everything—policies, exceptions, compensating controls.

Outlook to 2026 scenarios that matter

Base case steady convergence

By 2026, most major Latin American markets either will have fully operational travel-rule requirements or will be in late-stage deployment. Interoperability among major protocols will be common, and banks will increasingly require travel-rule-capable counterparties. For cross-border payments and remittances, compliant corridors will be measurably faster and safer.

Upside path regional harmonization

If supervisors coordinate on thresholds, data fields, and supervisory expectations—and if industry directories mature—VASPs could experience near-frictionless counterparty discovery and message exchange across the region. This would favor institutional participation, enabling trade finance, payroll, and B2B flows to scale on crypto rails with bank partnership.

Downside risk fragmentation and de-risking

If implementation remains patchy, smaller providers could face high integration costs, inconsistent enforcement, and bank de-risking. Users would see more holds and reversals, slower withdrawals, and higher compliance friction. In such a scenario, expats and businesses should concentrate activity with the most compliant, well-banked providers in each jurisdiction.

Country by country quick reference for 2025–2026

Peru

Comprehensive AML/VASP regulation finalized in 2024 with explicit Travel Rule chapter entering into force two years after publication, effectively in 2026. Registration, compliance officers, and UIF reporting are mandatory. Strong supervisory powers for inspections and sanctions. Align your implementation plan and budget for messaging, encryption, and staff upskilling ahead of the effective date.

Brazil

Law 14,478/2022 empowers the BCB to regulate VASPs. Public Consultations 109 and 110 launched in late 2024 outline licensing and operational rules; formal issuances are pending but expected. Firms should prepare for segregation of client funds, local representation, and inter-VASP data exchange. Expect rising expectations from banks and payment institutions even before final rules land.

Argentina

CNV General Resolution 1058/2025 establishes a mandatory PSAV registry and extensive operational requirements; foreign platforms targeting Argentine users may also need to register. UIF Resolution 49/2024 imposes risk-based AML programs, systematic monthly reporting, and suspicious-activity reporting. Travel-rule-style data exchange is functionally required to meet counterpart due diligence and reporting obligations.

Chile

Travel-rule expectations are in force for supervised entities, with enforcement milestones tied to mid-2025. VASPs must identify and retain originator-beneficiary information for qualifying transfers and align records with FATF guidance.

Nicaragua

A renewed BCN framework in 2025 licenses PSAVs and PSPs, sets governance and capital requirements, and aligns AML expectations to international standards. Only licensed or registered entities may operate; plan for travel-rule interoperability as a practical matter for international transfers.

Mexico

Fintech Law provides the definitional base for virtual assets within regulated fintech institutions. AML reforms approved mid-2025 expand obligations for vulnerable activities, including crypto, and point toward enhanced customer identification and monitoring that are travel-rule-consistent. Specific inter-VASP messaging rules are evolving; prudent providers will implement them in anticipation.

Colombia

UIAF Resolution 314/2021 imposes reporting duties on virtual-asset service providers. A 2025 draft bill proposes a PSAV framework; fuller travel-rule obligations are expected to follow. Providers should implement counterparty discovery, messaging capability, and robust CDD now to ease transition once the law passes.

Key takeaways for decision makers

• Latin America’s crypto growth is durable, and adoption is broad across retail and institutions.

• The Travel Rule is becoming a business prerequisite for market access, bank connectivity, and cross-border liquidity.

• Peru, Chile, Argentina, and Nicaragua have taken concrete steps with clear obligations and timelines; Brazil and Mexico are in late-stage rulemaking; Colombia is moving from reporting rules toward a full licensing regime.

• For expats and investors, choose registered, well-banked providers in each country, maintain excellent documentation, and expect more robust identity and funds-source checks.

• For VASPs, build travel-rule messaging into your core payments stack, test cross-border edge cases, and invest in governance, privacy, and auditability now to avoid last-minute scrambles in 2026.

This article is for informational purposes only and does not constitute financial advice or investment recommendations.

Note: All claims in this article are based on the cited sources above, with dates current to September 8, 2025 (Peru/Lima). Where rules are in consultation or transition, we describe them conservatively and recommend local legal advice for implementation details.