Self-custodial wallet / non-custodial software in Gabon
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Gabon without local incorporation, subject to AML obligations and low licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- Low
- Last updated
- 2026-07-13
AML Obligations
- No specific AML obligations attach to non-custodial software publishing because the publisher never holds or controls user funds and does not meet the definition of a VASP/financial institution under CEMAC law.
- However, if the software is structured to intermediately hold keys or facilitate exchange (i.e., crossing into custody or transfer-agent activity), CEMAC AML Regulation No. 01/16-CEMAC-UMAC-CM would apply, requiring customer identification/KYC (ga.aml.identification-and-verification), ongoing monitoring (ga.aml.conduct-ongoing-due-diligence-on), enhanced due diligence for PEPs and high-risk jurisdictions (ga.aml.enhanced-due-diligence-edd-apply), recordkeeping for 5+ years (ga.aml.duration-records-must-typically-be), and suspicious transaction reporting to Gabon's FIU (ga.aml.obligation-to-report-any-vasp).
- CENAREF (Gabon's FIU) oversees AML/CFT for financial entities; non-custodial software publishers are not currently designated as reporting entities under this framework (ga.licensing.cenaref-website-while-cenarefs-website).
Key Restrictions
- The publisher must not hold, control, or have access to user private keys or funds — any deviation into custody or intermediation would trigger unlicensed financial-activity risk.
- CEMAC Instruction n°001/GR/2021 bans financial institutions (banks) from engaging in crypto activities; however, this does not directly prohibit a non-financial entity from publishing self-custodial software (ga.licensing.instruction-n001gr2021-relating-to-the).
- If tokens offered through or promoted via the software are classified as 'investment tokens' (securities under COSUMAF jurisdiction), public offering/issuance would require a COSUMAF-approved prospectus (ga.licensing.authorization-requirement-any-public-offering, ga.licensing.information-document-prospectus-issuers-must).
- Payment token functionality is under BEAC jurisdiction — stablecoin integration or payment features in the wallet could trigger BEAC regulation (ga.licensing.payment-tokens-jetons-de-paiement).
Key Risks
- Legal grey area — Gabon and CEMAC lack a specific fintech/regulatory sandbox or VASP licensing framework, creating uncertainty for any new crypto-adjacent business model (ga.licensing.the-absence-of-specific-regulations).
- Future regulatory change risk — CEMAC could move toward a prohibitive stance (ban) or impose strict licensing requirements that could retroactively affect software publishers (ga.licensing.the-potential-for-future-regulatory).
- Enforcement risk if regulators re-interpret 'financial institution' broadly to capture software publishers that facilitate crypto transactions, even without custody.
- Consumer protection exposure — no specific disclosure, audit, or security standards exist for non-custodial software, but enforcement could rely on general laws against misleading commercial practices.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
BEAC Instruction n° 001/GR/2021 defines the operating procedures of the Centrale des Incidents de Paiement and carries no crypto-asset provision, and BEAC has issued no instruction banning crypto-assets in the CEMAC zone; the CEMAC measure on crypto-assets is Décision COBAC D-2022/071 du 6 mai 2022, which binds only institutions supervised by COBAC.
Custody of digital assets for third parties is a licensed activity in Gabon: article 160 of Règlement n° 01/22/CEMAC/UMAC/CM/COSUMAF du 21 juillet 2022 places prestation de services sur actifs numériques under the COSUMAF regime, article 1 of the Règlement Général COSUMAF du 23 mai 2023 defines the prestataire de services sur actifs numériques by reference to conservation d'actifs numériques, and article 42 of Règlement n° 02/24/CEMAC/UMAC/CM du 20 décembre 2024 forbids carrying on virtual-asset service activity without prior agrément; COSUMAF has issued no PSAN agrément to date.
The absence of specific regulations, leading to a legal grey area.
The potential for future regulatory changes, which could include outright bans, strict licensing, or a more facilitative framework.
CENAREF Website: While CENAREF's website might not specifically mention "virtual assets" or "VASPs" in its publicly available texts, it is responsible for implementing AML/CFT laws that are generally aligned with FATF recommendations.
General Principle: If virtual asset service providers (including custodians) were to be explicitly recognized and regulated, they would fall under CENAREF's oversight for AML/CFT purposes. However, without specific designation, the practical application to crypto businesses remains a challenge.
CEMAC law recognises a single undifferentiated jeton, defined at article 1 of the Règlement Général COSUMAF du 23 mai 2023 as an intangible asset representing one or more rights in digital form issued, recorded, held or transferred through a dispositif d'enregistrement électronique partagé, and it creates no category of jeton d'investissement resting on a 2000 instrument on the harmonisation of financial instruments; article 76 of Règlement n° 01/22/CEMAC/UMAC/CM/COSUMAF du 21 juillet 2022 instead brings jetons numériques within the appel public à l'épargne regime.
CEMAC law contains no category of jeton de paiement and gives BEAC no licensing role over tokens: monnaie électronique under Règlement n° 04/18/CEMAC/UMAC/COBAC du 21 décembre 2018 is monetary value stored electronically representing a claim on the issuing establishment, which a crypto-asset does not create, and it is COBAC that licenses and supervises electronic-money issuers and payment institutions while BEAC approves payment-system solutions.
The Règlement Général COSUMAF du 23 mai 2023 defines jeton functionally without distinguishing utility tokens from other tokens, so no CEMAC text states that jetons d'usage fall outside the definition of financial instruments; every jeton offered to the public engages the appel public à l'épargne regime of article 76 of Règlement n° 01/22/CEMAC/UMAC/CM/COSUMAF and articles 125 to 163 of the Règlement Général.
A public offering of jetons numériques in Gabon does require COSUMAF clearance, but not under any article 5: article 76 of Règlement n° 01/22/CEMAC/UMAC/CM/COSUMAF du 21 juillet 2022 applies the appel public à l'épargne regime to jetons numériques, and the procedure sits at articles 125 to 163 of the Règlement Général COSUMAF du 23 mai 2023, with the visa granted at articles 150 to 161.
Règlement n° 01/16-CEMAC-UMAC-CM du 11 avril 2016 governed AML/CFT in Gabon until the UMAC Ministerial Committee adopted Règlement n° 02/24/CEMAC/UMAC/CM at Libreville on 20 December 2024; the 2024 règlement supersedes it, defines actif virtuel and PSAV at article 2, lists PSAV among the assujettis at article 6 and requires prior agrément plus a virtual-asset travel rule at article 42.
Note: While this regulation predates FATF's specific guidance on virtual assets (Recommendation 15 and its Interpretative Note from 2018), its broad scope often means VASPs are expected to comply as "financial institutions" or similar entities if they perform functions akin to traditional financial services.
Evidence fact ga.aml.identification-and-verification not found (may have been renamed).
Conduct ongoing due diligence on the business relationship and scrutiny of transactions undertaken throughout the course of that relationship to ensure that the transactions are consistent with the VASP's knowledge of the customer, their business, and risk profile.
Enhanced Due Diligence (EDD): Apply EDD in situations identified as higher risk, including:
Obligation to Report: Any VASP that suspects or has reasonable grounds to suspect that funds (fiat or virtual assets) are the proceeds of a criminal activity, or are related to terrorist financing, must report its suspicions.
Article 39 of Règlement n° 02/24/CEMAC/UMAC/CM requires obliged entities in Gabon, including virtual-asset service providers, to keep customer identification documents and transaction records for a minimum of ten years after the account is closed or the business relationship ends, not five years.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — publishing non-custodial wallet software in Gabon does not trigger VASP/financial-institution classification or AML obligations so long as the publisher never holds user funds or keys, but the lack of a dedicated legal framework creates regulatory uncertainty; any feature that crosses into custody, exchange intermediation, or issuance of security-like tokens could attract prohibitions or unlicensed-activity risk.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?