Paraguay logs 11 bank sanctions, new crypto rule

A review of the Central Bank of Paraguay’s Public Sanctions Registry identified 11 administrative cases that ended in sanctions against seven banks operating in Paraguay. The cases involve anti-money laundering, fiduciary management, credit risk, provisions, accounting records and reporting to the supervisor, although the coverage does not present them as sanctions specifically related to cybersecurity.

What did the BCP say about those sanctions?

Santiago Peña said a distinction must be made between an investigation or administrative proceeding and a sanctioning decision. He added that other financial entities also went through processes, some of which ended in sanctions. At the same time, the BCP said there is no ongoing or planned intervention in entities in the financial system and described its response to Congress as institutional and routine.

Parliamentary coverage also noted an important point for reading the administrative register: some of the BCP’s sanctioning records were challenged in court, and some decisions were later annulled by the judiciary. In that context, La Nación also reported that the supervisor attributed some fraud complaints involving Itaú to stolen customer credentials, not to failures in the bank’s systems. That coverage said Itaú has no cybersecurity sanctions on record.

What changed with General Resolution 47/2026?

General Resolution No. 47/2026 from the National Tax Revenue Directorate established an information-reporting obligation for cryptoasset transactions, a move the Paraguayan Fintech Chamber is questioning over its impact on legal certainty. The agency said the rule does not create a new tax and that any taxation of gains remains subject to the general rules of the IRE and IRP.

According to ABC Color’s coverage, the obligation applies, in principle, to owners, administrators or those responsible for digital asset platforms operating in Paraguay, as well as certain taxpayers who exceed $5,000 a year in transactions under the described assumptions. DNIT said the Informative Affidavit for Cryptoassets must be filed annually through the Marangatu system, in the third month after the close of the reported fiscal year.

Affected taxpayers must also register obligation 959 in the Single Taxpayer Registry. The Paraguayan Fintech Chamber maintains its objections to the measure, but the coverage does not report any official changes to the resolution based on that position.