For TH3Labs, this is an example of the kind of applied R&D worth pursuing: verified education that becomes trusted, portable, and personal.
The problem hiding inside a piece of paper
A diploma is a promise written on paper: that this person learned this, at this place, on this date, and that someone trustworthy stands behind the claim. The difficulty is that paper, and its PDF descendants, keep that promise poorly. Grades are altered, templates cloned, and "universities" that exist only as a web page sell degrees by the thousand. Employers and licensing boards spend weeks chasing registrars to confirm a single transcript.
That friction is close to universal, and here El Salvador already stands out: a country increasingly at the forefront of digital solutions, it gives Salvadorans real tools to prove what they earned, more quickly and easily than many places manage.
The point isn't a broken system to repair so much as strong tools to sharpen, which is exactly the kind of next step the country's innovation narrative invites.
I'm living a mild version of this myself. As I apply to master's programs in cybersecurity and data protection, I've had to produce verified copies of my grades, my university title, and proof that my licenciatura qualifies me to pursue a master's at all. The Salvadoran process is genuinely good: much of it is already digital, the official certifications are free, and in my own case it has moved faster and more smoothly than what friends abroad describe.
That's the point, really. Even a strong, increasingly digital process still leans on reissued documents and repeated steps, and that is exactly what Bitcoin anchoring and AI-assisted verification could sharpen, turning a good experience into a near-instant one without losing any of the rigor.
So this is at once a verification problem, an integrity problem, and an identity problem, and El Salvador happens to be assembling the legal and technological pieces to solve all three.
The future-facing version of credential integrity looks like this: AI-assisted, Bitcoin-anchored, verifiable credentials for education and professional identity. Four layers, each doing one job:
- The AI layer detects fraud, extracts data from messy documents, explains verification results in plain language, and flags suspicious patterns.
- The Bitcoin layer proves integrity, timestamping, and tamper evidence.
- The identity layer proves the issuer, the student, and the verifier.
- The compliance layer handles consent, privacy, revocation, and auditability.
What makes this more than a whiteboard diagram is that the scaffolding already exists here: a pro-innovation AI law with a built-in sandbox, a national Bitcoin narrative, and a data-protection regime to anchor the rules. Here's how the pieces fit.
Why El Salvador, and why now
In February 2025 the Legislative Assembly approved the Law of Promotion of Artificial Intelligence and Technologies (Ley de Fomento de la Inteligencia Artificial y Tecnologías), with implementation beginning that September. It is one of the first AI-specific frameworks in the world, and unlike the more restrictive European model, it is built to encourage builders.
It establishes the Agencia Nacional de Inteligencia Artificial (ANIA) as a single-window authority, protects intellectual property for AI systems developed in the country, and shields research conducted inside controlled testing environments, limiting liability when actors operate in good faith. Its stated principles include transparency and explainability, fairness, security and privacy, and accountability. It is tied to the Law of Protection of Personal Data (Ley de Protección de Datos Personales) and the cybersecurity law, and it tasks ANIA with helping the Ministry of Education bring AI into every level of the school system.
El Salvador also remains Bitcoin Country, and it earned the name by recognizing early what many still miss. The 2021 Bitcoin Law made it the first nation to grant Bitcoin legal tender status, a decision grounded in a clear reading of why Bitcoin works as money: it holds the classic monetary properties (scarcity, durability, portability, divisibility, fungibility, and acceptability) and adds the one Eric Yakes calls the seventh property, immutability, the decentralized production and storage of value that no single actor can alter.
That property rests on a genuine computer-science breakthrough. Bitcoin introduced a practical, permissionless form of Byzantine fault-tolerant consensus through proof-of-work, giving open networks a way to converge on a shared transaction history without a central authority. Its security rests on cryptographic hashing and digital signatures: hashing chains each block to the one before it, so altering any past entry would visibly break everything after it, while signatures prove who authorized what.
The result is a tamper-evident ledger that no one party owns and no one can quietly rewrite, which is what makes Bitcoin trustworthy as a record, not merely as a coin.
That early conviction matters.
El Salvador did not stumble into its Bitcoin identity; it chose to act on a technology thesis before most countries were willing to test it at national scale, and that decision gave the country a global technology position that can now be applied beyond payments.
Today Bitcoin is still legal tender, the community around it keeps growing, and the country continues to develop friendly regulatory frameworks designed to leverage the underlying protocol, its settlement layer, and those very properties. For credentials, the relevant insight is not Bitcoin as a currency rail, but Bitcoin as public trust infrastructure: durable, neutral, and resistant to quiet revision.
There is a quieter third law that turns out to be the financial engine. The Law of Promotion of Innovation and Technology Manufacturing (Ley de Fomento a la Innovación y Manufactura de Tecnologías), grants multi-year tax incentives to companies investing in technology and, in exchange, obligates them to dedicate at least 5% of their operating budget to research, development, and innovation. That creates a recurring, legally required R&D allocation that can be directed toward worthwhile projects.
It is also a regime distinct from the AI law, run by a different authority: the Ministry of Economy, with fiscal oversight from the Ministry of Finance (Ministerio de Hacienda), rather than ANIA.
The two don't merge. But on a careful reading of both regimes, the same R&D activity could, in principle, be structured to count toward the innovation law's 5% and, in parallel, register with ANIA for the AI law's safeguards, provided it satisfies each regime on its own terms, one offering a fiscal incentive, the other protection for liability and intellectual property. We'll come back to it, because it's where my company comes in.
Put these three laws side by side and the thesis is hard to miss. A country that has staked its reputation on Bitcoin, declared itself "AI-first," and legally compels its tech sector to spend on R&D is unusually well placed to anchor its educational trust in the same technologies. Credentials become a flagship use case: useful, exportable, and on-narrative.
The four layers
AI
AI does two jobs.
At issuance, it reads the world's messy reality: OCR and language models over legacy transcripts and handwritten records, pulling out the structured fields (institution, program, dates, grades, credits) and flagging anomalies like inconsistent fonts, altered marks, impossible timelines, or an "issuer" that has emitted ten thousand identical degrees in a month.
At verification, it does something the blockchain can't. A cryptographic check returns true or false; a verifier needs to know why, in human language. "This certificate's anchor matches and the issuer is registered, but the credential was revoked last March."
Explainability isn't a nicety here. It's one of the AI law's named principles.
Bitcoin
The instinct people have is to put the diploma "on the blockchain." You don't. Personal data on a public ledger is a privacy disaster and almost certainly illegal under the data-protection law. Instead you hash each credential, ideally batching many into a single Merkle tree, and anchor only that hash to Bitcoin, for example through OpenTimestamps.
The credential itself stays with the institution and the student.
What you get is small and powerful: tamper evidence (change one character and the hash no longer matches), timestamping (proof it existed at a given moment), and integrity that no later actor, not even the issuer, can quietly rewrite.
This isn't theoretical, and it's worth naming who proved it. My Alma Mater, the University of Nicosia in Cyprus, was the first university in the world to issue academic certificates verifiable on the Bitcoin blockchain, starting in 2015 for its digital-currency MOOC and, from 2017, for all of its diplomas, including its MSc in Blockchain and Digital Currency. Their method is exactly the architecture above: personal data stays on the certificate, and only a unique hash, a digital fingerprint of the document, goes onto the Bitcoin blockchain via the OP_RETURN operator.
Anyone holding the certificate can drop it into a public tool and confirm in seconds that it's authentic and unaltered, no phone call to the registrar required. UNIC released its blockchain-based diploma verification technology on an open-source, free basis, with public tools and instructions for issuing, revoking, and validating self-verifiable PDF credentials anchored to the Bitcoin blockchain.
The approach was later used by other issuers, including the British University in Dubai for its 2017 graduating class. The mechanism has been running for nearly a decade.
El Salvador already adopted a proven mechanism in a small scale and is in the pioneering path of wrapping it in a national legal framework, an AI verification layer, and an issuer registry. UNIC, as a lone issuer, never needed that registry: when a single institution issues only its own diplomas, the verifier already knows who stands behind the credential. On the other hand, a national system spans many universities and certification bodies, so it needs a trusted list of which issuers are accredited and what keys they sign with.
This is no longer only a foreign precedent.
In 2025, El Salvador began anchoring official documents directly on Bitcoin, working with Simple Proof, a firm that uses the OpenTimestamps protocol to register an immutable timestamp without exposing the document itself. The first records protected this way were the academic certificates of CUBO+ graduates, issued through the National Bitcoin Office, and they are described as the first public documents in the country's history secured on Bitcoin.
The method is exactly the one above: only a hash goes on-chain, any graduate can verify their diploma against the network without an intermediary, and each student chooses whether to attach their name to the proof or keep it private. Pilots are already underway to extend the approach to other government records.
So the proof of concept now exists on both sides: abroad, in UNIC's decade of Bitcoin-anchored diplomas, and at home, in Salvadoran certificates already living on the chain. The anchoring layer, in other words, is no longer the hard part or the differentiator. It works, and El Salvador has shown it works here.
What turns a timestamping demo into a national credential system is everything layered on top, and this is where AI becomes decisive.
Anchoring proves a document existed and has not changed; AI reads messy records at scale, explains a verification result in plain language, flags the patterns a hash check never could, and turns a verified credential into a personalized skills pathway.
Bitcoin supplies the integrity, AI supplies the intelligence, and sharpening both toward education is where the real differentiation lies.
A pragmatic identity and privacy path
This is the layer where ambition usually outruns delivery, so it's worth being disciplined. The first version shouldn't try to solve every identity problem at once. The pilot can begin with a simpler, safer architecture: verified institutional issuers, digitally signed credentials, Bitcoin anchoring for integrity, and a controlled status registry for revocation.
In this first stage, the institution, not the student, is the main identity actor. Each participating university or certification body gets a verified issuer profile and a registered public signing key. A verifier doesn't need to understand the whole identity stack.
It only needs to confirm four things: the credential was signed by an authorized issuer, the document hasn't been altered, the Bitcoin timestamp matches, and the credential hasn't been revoked.
Student identity should be handled with more care than systems like this usually show. Official identity documents can be used during issuance to confirm the credential is going to the right person, but national ID numbers shouldn't be placed on-chain, baked into public verification pages, or exposed to employers by default. Data minimization from day one: disclose only what the verifier actually needs.
Zero-knowledge proofs belong in stage two, not as a dependency for the first pilot. The initial version can rely on consent-based presentation and selective disclosure, which is enough to prove the core value. Later, for more sensitive cases, the platform can let a holder prove a statement like "I hold a valid degree from an accredited institution" or "I completed the required credits" without revealing the full transcript, grades, date of birth, or ID number.
The design principle is compatibility without dependency. The system should be built to work with decentralized identifiers (DIDs), selective disclosure, zero-knowledge proofs, and a national issuer registry, but the first pilot should prove the simpler core: verified issuers, signed credentials, Bitcoin anchoring, revocation, consent, and AI-assisted verification.
That phasing keeps the project realistic. It proves tamper-resistant, instantly verifiable credentials first, and leaves room to grow into full decentralized identity and privacy-preserving verification as the ecosystem matures.
A fair question follows: if only the hash lives on Bitcoin, where does the credential itself live, and what happens if the service that anchored it disappears?
The key is that the anchoring service is not the custodian. A tool like Simple Proof timestamps a hash; it never holds the document. The credential is a self-verifiable file kept by the holder and the issuer, and because the anchoring runs on open tooling over the public chain, anyone with the file and its small proof can re-verify it forever, with or without the original service.
The failure that actually matters, then, is not the vendor vanishing but no one retaining a copy, which makes storage a first-class problem, not an afterthought: the holder's copy first, the issuer's archive and a national repository as encrypted backups, with the right to erasure handled deliberately.
And there is a sharper reason to get this right. Anchoring alone proves a document is genuine; without an availability layer, actually obtaining it still means a manual request. Integrity and retrieval have to be solved together, or the system is only half-built.
One more piece sits underneath all of this: auditability.
ANIA and education regulators should get tamper-evident logs of which institution issued what, which keys signed, and what was revoked and when.
That's how a sandbox experiment earns the right to scale.
Where mandatory R&D meets the AI sandbox
Now for the thread I left hanging. The innovation law requires beneficiary companies to spend at least 5% of their budgets on R&D; the AI law offers a protected, supervised sandbox, with limited liability for good-faith experimentation, run through ANIA. As noted, these remain two distinct regimes under two authorities.
In principle, though, the same R&D activity could be structured to interact with both, counting toward the innovation law's R&D requirement while being registered with ANIA for the AI law's protections, provided it satisfies each regime's requirements separately. Read that way, the two laws form a single on-ramp.
I'll be direct about where I'm writing from. TH3Labs is a Salvadoran company that operates under the innovation law, which means we already carry that 5% R&D obligation. We don't treat it as a cost to minimize; we treat it as a chance to build something that matters. Credentialing isn't the only direction we could take that budget, but it's one of the most attractive options on the table, and it's worth saying why.
It's technically deep, legally intricate, and capable of real public benefit, and it lands precisely on the overlap our company was built around: AI, Bitcoin, and the kind of applied research this legal framework now rewards.
The mechanics are straightforward. Rather than letting an R&D obligation become a compliance checkbox, a company can direct a slice of it into a credentialing project, run that project inside the AI sandbox, and register it with ANIA. The innovation law supplies the money and the obligation; the AI law supplies the legal cover and the guardrails; ANIA's registry supplies the traceability that lets a regulator watch without smothering.
The AI law fits this work almost too neatly, and the fit is precise rather than rhetorical. Its experimental safeguards are written for exactly this kind of activity: non-commercial research, conducted in a controlled environment, on data you own or that is openly available, which is what a sandbox pilot is.
That places it in ANIA's voluntary safeguards track rather than the mandatory one. Education is also a sensitive domain under the law, so the moment such a system became a commercial product making consequential decisions about students, it would rightly cross into the mandatory registry and an algorithmic impact assessment.
Keeping a first effort non-commercial and controlled isn't a loophole; it's staying inside the part of the law designed to protect early research. None of this exempts the work from the data-protection law, and it shouldn't, since it handles real student data.
What it means is that the experimentation itself is protected, the compliance path is navigable rather than punitive, and a small Salvadoran team can do serious R&D without the regulatory drag that would make the same project impossible elsewhere.
The natural first target is education.
The AI law already points ANIA toward the Ministry of Education, so an education pilot moves in the direction the law is already facing. The harm is concrete and locally felt: fake diplomas, slow verification, graduates who can't easily prove their qualifications abroad. And a university issuing diplomas to a known cohort is a bounded, well-understood process, which is exactly what a sandbox wants before the same rails extend to professional licensing, technical and vocational certificates, and corporate training.
Start small, then widen the circle
So what does the first run look like? Keep it small on purpose: one or two universities, a single graduating cohort, a defined set of credential types, supervised by ANIA and MINEDUCYT, with the data-protection authority involved from the start. Inside that boundary you can prove the cryptography, tune the AI fraud-detection and explanation models on real Salvadoran documents, test consent-based disclosure with actual employers, and exercise revocation, with liability limited by the AI law and the work funded by the innovation law's R&D mandate. You find out what breaks before a million students depend on it. Then you widen the circle.
What this does to education
The immediate win is trust at near-zero cost. Verifying a credential drops from reissued documents, repeated steps, and cross-border formalities to seconds of checking, and the answer comes with a plain-language explanation. Diploma mills lose their market, because a fake degree can't produce a valid issuer signature or a matching Bitcoin anchor.
The bigger win is portability for people. In a country where so many households depend on family working abroad, a Salvadoran nurse, welder, or developer carrying internationally verifiable credentials can prove their qualifications to a foreign employer or university instantly. The diaspora's skills become recognized, mobile assets, and El Salvador's educational exports gain the kind of credibility Bitcoin gave the country's financial profile.
It also lays the rails for lifelong learning. Once credentials are structured, verifiable, and owned by the learner, every course, bootcamp, and on-the-job certification can become a portable micro-credential: a continuous record of growth rather than a single sheet frozen at age 22.
From verified credentials to personalized skills pathways
The credential layer should not stop at proving that a diploma is real. Once learning records are structured, verified, and controlled by the learner, they become the foundation for something more useful: personalized skills development.
This is where El Salvador's national AI education push becomes strategically relevant. In December 2025, the government and xAI announced a two-year initiative to deploy Grok across more than 5,000 public schools and reach over one million students through personalized, curriculum-aligned AI tutoring.
A tutor like that can help students learn at their own pace. A credential system does the complementary job: it proves what they completed, organizes that learning into a verified skills profile, and points to what should come next. The tutor supports the learning; the credential infrastructure turns learning into portable evidence.
That is the breadth play, and there is a depth play to match it. El Salvador also runs CUBO, a government training initiative that has built Bitcoin and blockchain skills in Salvadorans and now extends the same model to AI through CUBO AI, with expert-led courses for students and professionals.
Programs like these issue certifications of their own, which is the point: whether a skill is built in a Grok-tutored classroom or a CUBO cohort, it produces a credential worth verifying and anchoring, and a verified record can later steer a learner toward exactly these programs as a next step.
It helps to be honest about what a credential actually contains. A diploma rarely arrives pre-cut into tidy skill badges. What a student usually holds is a degree, the transcript behind it, the grades earned subject by subject, standardized test results, and sometimes vocational or diagnostic information. That texture is the point.
Personalization should not run on the diploma and a stated goal alone. It should read the grain of the record: where someone did their strongest work, where they struggled, which subjects they kept gravitating toward, and what they say they actually want to become. The most human version of this advice begins from a person's strengths and preferences, not only from a target someone else picked for them.
El Salvador's national exit evaluation is a good example of a record that already exists and could be made more useful. For more than two decades, the country relied on PAES; since 2020, AVANZO has served as the evaluation applied to students completing Educación Media as part of the process for obtaining the Bachiller title.
AVANZO evaluates core academic areas and also includes vocational information on interests and occupational aptitudes. Anchored as a verified credential and, with the student's consent, connected to a skills profile, the same record could do more than certify that someone completed the requirement. It could surface the areas where the student performed best, reveal where they need reinforcement, and feed those signals into what comes next.
The numbers make the case sharper, but they should be read carefully. In 2023, only about one in ten AVANZO participants reached the superior performance level, with Language and Literature showing the strongest performance and Mathematics the weakest. In 2024, just over half of participating students landed in the intermediate level, while Mathematics again showed the lowest performance, with students answering roughly half of the math items correctly on average.
Those are exactly the patterns an AI tutor is built to address: targeted practice in the subjects where students, schools, or cohorts are struggling, rather than generic remediation.
Once those results are settled into a verified, anchored record, they stop being only a number in a reporting system. A university abroad weighing a Salvadoran applicant, a local institution granting credit, or an employer screening a candidate could confirm in seconds that the record is authentic and unaltered.
Anchoring will not fix how an exam was administered, and that limitation should be acknowledged, especially when remote or unsupervised testing has been questioned. But it can guarantee that the result downstream users see is the same result the student earned and the institution issued.
Verification is the defensive half of all this. The generative half is a layer worth naming: verified skills pathways. A student could ask, "What do I need to become a junior software developer?" and get a plan built not on self-declared ability but on evidence of what they've already done and where they're strong. The system could point out the competencies they're missing, recommend courses or micro-credentials to close the gap, suggest practice projects that lean on their stronger subjects, and revise the pathway each time a new achievement lands. Someone whose record shows a real knack for math and logic but who has never written a line of code gets a different, more realistic route than a generic checklist would ever give them. And because the goal comes from the student, the same engine can hold two people with near-identical transcripts on completely different paths, one toward nursing, one toward data work, without flattening either of them into an average.
I'll use myself as the example, because my own path was anything but a straight line. I went into law in no small part because I was bad at pre-calculus, and somewhere along the way I'd decided that meant numbers and I weren't going to get along. What changed it wasn't a curriculum. It was reading, a few good mentors, and plain curiosity. Around 2015 I stumbled into the literature on smart contracts, and shortly after that into Bitcoin, which took me a while longer to actually understand.
During the pandemic I made the deliberate choice to go technical to complement the law: I took programming courses, read Bitcoin properly this time, and worked through the use cases of distributed ledgers in general, Turing-complete or not.
None of that was visible to any system.
There was no profile that could look at a law student fascinated by cryptography and say, here is the bridge, here are the three things to learn next. I had to assemble that bridge by hand, slowly, from scattered sources.
A verified-skills-pathway built on a real record of my interests and strengths might have spotted that intersection years earlier, or at least made the detour legible instead of improvised.
Today I'm a lawyer specialized in digital-assets regulation, with a technical understanding of DLTs and their applications, specially under Salvadoran regulatory framework, that is theoretical, practical, and certified rather than self-declared.
The pathway worked. It just took longer than it should have.
It should stay advisory, never determinative.
AI suggests, explains, and personalizes; teachers, institutions, students, and families keep control of the decisions.
Done this way, the system connects three priorities that usually live in separate offices: AI-assisted learning, verifiable credentials, and workforce development. A verified record stops being a backward-looking certificate and starts working as a guide.
At national scale, the same data supports planning that still respects the individual. Aggregate, privacy-preserving views of verified skills against market demand can show the country where its talent gaps are, while each person keeps ownership of their own record and decides how it's used.
Verification stops being only defensive and starts building careers.
The shape of the bet
El Salvador has already made two unusual bets, on Bitcoin and on AI. Credentials are where they reinforce each other.
The AI law gives the sandbox, the principles, and the data-protection backbone. Bitcoin gives what is, in my opinion, the most credible timestamp on earth, and a brand the world already watches.
The innovation law could create a funding logic for the experiment. Together they could make a Salvadoran diploma one of the hardest documents anywhere to fake and the easiest to verify, and turn that trust into opportunity for the people who earned it.
This is the kind of work we'd be glad to point our R&D toward at TH3Labs, and the reason is partly personal.
The system I had to improvise my way into, the bridge between a legal mind and a technical one, is the one we'd like to help build so the next person's detour is shorter and the proof of what they learned travels with them.
The four layers are the architecture.
The sandbox is the on-ramp.
Education is the proving ground.
And if it works, the payoff isn't only diplomas that can't lie.
It's a generation whose verified learning becomes a map of where they can go next.
Sources
- AI law and ANIA — Ley de Fomento de la Inteligencia Artificial y Tecnologías, approved by the Asamblea Legislativa February 2025. Asamblea Legislativa: https://www.asamblea.gob.sv/node/13492 and https://www.asamblea.gob.sv/node/13490. Decree text (Decreto N.º 234): https://www.asamblea.gob.sv/sites/default/files/documents/decretos/277EFC88-1C8D-4ACD-BE44-9DAFD64C6797.pdf
- Innovation law — Ley de Fomento a la Innovación y Manufactura de Tecnologías, Decreto Legislativo N.º 722 (18 April 2023). Asamblea Legislativa: https://www.asamblea.gob.sv/node/12756. Decree text: https://www.asamblea.gob.sv/sites/default/files/documents/decretos/C4062E8E-154F-4F82-9835-7C1D16EF4616.pdf
- National AI education program (Grok) — xAI and the Government of El Salvador, announced 11 December 2025. xAI: https://x.ai/news/el-salvador-partnership
- University of Nicosia blockchain-based certifications — First university to issue academic certificates verifiable on the Bitcoin blockchain. https://www.unic.ac.cy/iff/research/blockchain-crypto-assets/blockchain-based-certifications/
- AVANZO results — Ministry of Education (MINEDUCYT). 2023: https://diario.elmundo.sv/nacionales/el-79-de-los-estudiantes-saco-nivel-intermedio-en-prueba-avanzo-2023 — 2024: https://diario.elmundo.sv/nacionales/el-54-de-los-bachilleres-saco-un-nivel-intermedio-en-prueba-avanzo-2024-matematicas-registro-el-menor-rendimiento
- Bitcoin Law and 2025 reform — El Salvador adopted Bitcoin as legal tender in 2021. https://cryptobriefing.com/el-salvador-bitcoin-law-amendment/
- CUBO+ and CUBO AI — developer and AI training academies run by El Salvador's National Bitcoin Office (ONBTC). https://cointelegraph.com/news/cathie-wood-kick-off-el-salvador-ai-education-program and https://nearshoreamericas.com/el-salvador-to-bring-foreign-experts-to-train-students-in-ai/
- El Salvador anchoring official documents on Bitcoin — in 2025 El Salvador began securing official documents on the Bitcoin blockchain via Simple Proof (OpenTimestamps). https://diarioelsalvador.com/dedinero/el-salvador-inicia-registro-de-documentos-oficiales-en-la-blockchain-de-bitcoin/711316
- Eric Yakes, The 7th Property: Bitcoin and the Monetary Revolution (2021), for the "seventh property".
- Satoshi Nakamoto's description of the proof-of-work chain in relation to the Byzantine Generals' Problem — https://satoshi.nakamotoinstitute.org/quotes/proof-of-work/