Puerto Rico: technology regulation at a glance

Framework: US federal law (SEC, FinCEN/BSA, IRS) applies territory-wide; Puerto Rico adds Act 273-2012 (International Financial Center Regulatory Act, as amended by Act 44-2024), Act 60-2019 (Incentives Code), and OCIF Regulation 9680 (eff. Aug 21 2025) administered by the Office of the Commissioner of Financial Institutions (OCIF)

Puerto Rico, as a US territory, is fully subject to US federal crypto law, SEC securities rules, FinCEN AML/BSA registration, and IRS property-tax treatment, while layering a distinct local regime. Act 60-2019 grants qualifying bona fide residents 0% capital-gains tax on crypto assets acquired after establishing residency (new applicants from 2026 face a 4% rate); Act 273 IFEs may conduct digital-asset custody, stablecoin services, and tokenized-securities activities under OCIF special permit following 2024 amendments. OCIF Regulation 9680, effective August 21 2025, consolidated the prudential framework for depositary institutions including IFEs, while a pending federal bill (H.R. 2982) threatens to reclassify digital-asset income as non-Puerto Rico-source and override the capital-gains exemption.

Framework: No comprehensive AI law in force. The principal vehicle is Senate Bill 68 ("Ley de Inteligencia Artificial del Gobierno de Puerto Rico"), which passed the Puerto Rico Senate in 2025 but not the House; the Puerto Rico Innovation and Technology Service (PRITS) is the designated lead agency in pending proposals. As a U.S. territory, Puerto Rico is also subject to U.S. federal AI policy.

Puerto Rico has no enacted comprehensive AI statute as of May 2026; instead its Legislative Assembly introduced roughly a dozen AI bills in 2025 aimed mainly at governing AI use within government. The flagship measure, Senate Bill 68, was approved by the Senate but stalled in the House, two related measures were vetoed by Governor Jenniffer González, and only a narrow education-focused joint resolution was enacted. The overall position is therefore one of active proposed legislation rather than a binding framework.

Framework: Sectoral regime anchored by Act No. 111 of 2005 (Citizen Information on Data Banks Security Act, 10 LPRA §§ 4051-4055), enforced by the Puerto Rico Department of Consumer Affairs (DACO), layered on the constitutional right to privacy (Art. II, §8) and sector-specific statutes; a comprehensive GDPR/CCPA-style bill has been proposed but is not in force.

Puerto Rico has no single comprehensive data-protection statute in force; instead it relies on a constitutionally entrenched right to privacy and a set of sector-specific laws, chief among them the 2005 data-breach notification act enforced by DACO. Privacy is a fundamental, self-executing constitutional right enforceable even between private parties. A comprehensive 'Consumer Data and Personal Information Protection' bill (House Bill 1548) modeled on California/GDPR has advanced through the legislature but has not been enacted into law.

Framework: Money services (incl. money transmission and virtual-currency transfer) are licensed by the Puerto Rico Office of the Commissioner of Financial Institutions (OCIF) under the Money Services Business Regulatory Act (codified at 10 L.P.R.A. ch. 303B, originating in Act 136-2010); international/offshore fintech and crypto activities are licensed under Act 273-2012 (International Financial Center Regulatory Act). As a U.S. territory, Puerto Rico also sits under the federal overlay of FinCEN (BSA), the CFPB, and the Federal Reserve payment system.

Puerto Rico has a clear, mandatory licensing regime for digital payments and fintech: OCIF licenses money services businesses (money transmitters, including digital-asset/crypto transfer), while Act 273-2012 International Financial Entities serve cross-border banking, fintech and crypto-custody clients. Because Puerto Rico is a U.S. territory, federal law also applies directly, FinCEN MSB registration and BSA/AML, CFPB consumer-protection rules (Reg E, BNPL, open-banking data rights), and access to U.S. instant-payment rails (FedNow, RTP, ACH) through the Federal Reserve. There is no separate EU-style EMI/payment-institution category or local open-banking statute; those areas are governed by the U.S. federal framework.

Framework: U.S. federal immigration law (Immigration and Nationality Act; administered by USCIS/CBP/DOS) governs entry and residency, Puerto Rico has no immigration power of its own. Local relocation incentives are set by Puerto Rico's Incentives Code (Act 60-2019), administered by the Department of Economic Development and Commerce (DDEC).

Puerto Rico is an unincorporated U.S. territory, so it issues no visa of its own and has no dedicated digital-nomad visa; entry and residency are controlled entirely by U.S. federal immigration law. U.S. citizens (and lawful permanent residents) can relocate and work remotely there freely as a domestic move, while foreign nationals need standard U.S. immigration status. The island's distinctive draw for relocators is its tax regime, Act 60's Individual Resident Investor and Export Services incentives, rather than any special immigration pathway.

Framework: U.S. federal law governs platform liability and online safety (Section 230 of the Communications Act / 47 U.S.C. §230, COPPA, FOSTA-SESTA), supplemented by Puerto Rico's own minor-protection statute (Act 185-2024, Children and Youth Cyber-Privacy Protection Act) and data-privacy/cybersecurity laws. There is no comprehensive online-safety/content-moderation regime comparable to the EU DSA or UK OSA.

As a U.S. territory, Puerto Rico is covered by federal internet rules: Section 230 provides broad platform immunity for third-party content, while there is no comprehensive federal online-safety law in force (KOSA and COPPA 2.0 remain pending in Congress as of 2026). Puerto Rico has enacted its own targeted measures, notably the Children and Youth Cyber-Privacy Protection Act (Act 185-2024, effective March 1, 2025), plus data-privacy and cybersecurity statutes. The overall picture is a patchwork of partial rules rather than a single comprehensive content-moderation/online-safety framework.

Framework: Act 40-2024 ("Cybersecurity Act of the Commonwealth of Puerto Rico," approved Jan 18, 2024), administered by the Puerto Rico Innovation and Technology Service (PRITS); complemented by Act 111-2005 breach-notification law (DACO), sectoral rules, and applicable U.S. federal cybersecurity law (PR is a U.S. territory).

Puerto Rico enacted a comprehensive cybersecurity law, Act 40-2024, establishing minimum cybersecurity standards, a zero-trust approach, and a 48-hour incident-reporting duty for the executive-branch government and any person or entity contracting with or doing business with the Government. This is layered on top of the longstanding Act 111-2005 personal-data breach-notification statute, a sector-specific insurance cybersecurity rule (OCS Rule 108, 2024), and the federal cybersecurity regime that applies because Puerto Rico is a U.S. territory.

Framework: Puerto Rico General Corporations Act (Act No. 164 of 2009), administered by the Puerto Rico Department of State (Registro de Corporaciones); as a U.S. territory, federal law (IRS, immigration) also applies.

Puerto Rico permits 100% foreign ownership of corporations and LLCs with no nationality or residency requirement for owners, and imposes no minimum capital. Domestic entities are formed via online filing with the Department of State (typically processed within ~24 hours), and a Puerto Rico resident agent is required; foreign entities already organized elsewhere file a Certificate of Authorization to do business.