Standing up VASP compliance under a new national framework

Context

Bitso, Latin America’s largest crypto exchange, where I served in-house as Argentina CISO and Information Security PMO Manager. The Argentine operation came under a newly regulated national regime, where a virtual-asset licensing/registration framework (CNV RG 1058/2025) and formal security expectations came into force on fixed regulator deadlines.

Problem

The organization had to translate a fresh regulatory framework into operational controls and produce regulator-ready evidence — while simultaneously pursuing an ISO 27001 certification, and without stalling a fast product-release cadence. Missing the deadlines carried registration and reputational risk.

Approach

Ran the security and compliance workstream as a program: mapped the regulatory requirements to a concrete control set, built the evidence plan, and coordinated cross-functional delivery through a security PMO (Jira workflows, executive cadences, capacity planning). Sequenced the ISO 27001 gap-to-certification effort in parallel so the two programs reinforced rather than blocked each other.

Outcome

Formal evidence packages were delivered within the regulator’s deadlines and the ISO 27001 certification was achieved — with the operating mechanisms lifting cross-functional throughput on security work materially, and without slowing product release velocity.