ArgentinaCNV Cybersecurity Requirements for Virtual Asset Service Providers
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds a virtual asset service provider (proveedor de servicios de activos virtuales) registered with the Comisión Nacional de Valores (reached by declaring that you are a crypto-asset provider). The resolution entered into force on , and its obligations became enforceable against providers already registered from .
- Keep cybersecurity procedures in place at all times, on a risk basis: internal governance of cyber-risks with periodic internal assessments and audits focused on the cyber-resilience of your infrastructure (article 13).
- Run systems able to recognize potential incidents or to detect that a security breach has occurred, with continuous real-time or lowest-latency monitoring for anomalous activity (article 13).
- Keep infrastructure that lets you continue essential functions, restore critical systems after a cyberattack and reduce the systemic risk of an interruption of your activity (article 13).
- Have information security policies approved by your administrative body, describing the systems and procedures used to hold private keys and the types of wallet you use (article 14).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Comisión Nacional de Valores, which applies the sanctions of Chapter I of Title IV of the Ley de Mercado de Capitales 26.831 to a registered virtual asset service provider that breaches the requirements, conditions and obligations it sets (article 40 of the Normas).
Settledness
- As of
- Open questions
- Which of the cybersecurity procedures in article 13 does the Commission treat as mandatory for each category of virtual asset service provider?
What this law does
Resolución General 1058/2025 of the Comisión Nacional de Valores was adopted on and published in the Boletín Oficial on . The resolution enters into force 45 days after its publication. The obligations of the chapter, except those the transitory rules name, become enforceable against virtual asset service providers already registered from .
Article 13 requires virtual asset service providers to establish cybersecurity procedures at all times, on a risk basis. Article 13 requires periodic internal cybersecurity assessments and audits focused on the cyber-resilience of the infrastructure. Article 13 requires systems able to recognize potential incidents or to detect that a security breach has occurred.
Article 13 requires infrastructure that lets the provider continue essential functions and restore critical systems after a cyberattack. Article 14 requires information security policies approved by the provider's administrative body. Breaches of the requirements lead to the sanctions of Chapter I of Title IV of the Ley de Mercado de Capitales 26.831, as article 37 of Ley 27.739 provides.
When LexLint raises it
When your app profile says your app is a crypto-asset provider.