Guinea-Bissau -- AML/CFT Compliance Regulatory Overview

There is no 'UEMOA Directive No. 003/2021/CM/UEMOA'. The UEMOA AML/CFT directive was Directive n° 02/2015/CM/UEMOA, which has been superseded by the UMOA Loi uniforme relative a la LBC/FT/FP du 31 mars 2023. That uniform law - not a 2021 directive - is what brings virtual assets into the UEMOA AML/CFT perimeter: art. 2 defines 'actif virtuel' and 'prestataire de services d'actifs virtuels' (PSAV, expressly including custody and administration of virtual assets), art. 3 makes PSAV assujettis, art. 58 forbids professional PSAV activity without prior agrement or authorisation from the competent authority, art. 59 defers all PSAV-specific requirements to competent authorities, and art. 60 requires suspicious-transaction reports to the CENTIF. Each member state, including Guinea-Bissau, must transpose it nationally; Guinea-Bissau's transposing Lei could not be identified.

Instructions from the Central Bank of West African States (Banque Centrale des États de l'Afrique de l'Ouest - BCEAO): As the common central bank for UEMOA member states, the BCEAO issues regulations and instructions that financial institutions (and by extension, potentially VASPs) must adhere to, particularly concerning electronic money and other financial services. These often implement the UEMOA directives at an operational level.

Obtaining and verifying the identity of the customer (natural persons: name, address, date of birth, nationality, unique identification number; legal persons: name, legal form, address of registered office, directors, beneficial owners, proof of incorporation).

For legal persons, understanding the ownership and control structure, and identifying the ultimate beneficial owner (UBO).

Purpose and Nature of the Business Relationship: Understanding the purpose and intended nature of the business relationship or transaction.

Conducting ongoing monitoring of the business relationship, including scrutiny of transactions undertaken throughout the course of that relationship to ensure that the transactions are consistent with the VASP’s knowledge of the customer, their business, and risk profile, including, where necessary, the source of funds.

Ensuring that documents, data, or information collected under the CDD process are kept up-to-date.

Risk-Based Approach: Applying CDD measures based on a risk assessment. This means:

Simplified CDD (SCDD): Permitted in lower-risk situations.

Enhanced CDD (EDD): Required for higher-risk situations, such as transactions with Politically Exposed Persons (PEPs), customers from high-risk jurisdictions, complex or unusually large transactions, or situations involving new technologies where the risks are not yet known.

Report Suspicious Transactions: Report any transaction (or attempted transaction), regardless of its amount, that they suspect may involve money laundering or terrorist financing. This includes transactions related to virtual assets.

No Tipping-Off: Prohibit the disclosure to the customer or any third party that an STR has been or will be filed.

Reporting Body: Reports must be submitted to the national Financial Intelligence Unit (FIU).

Customer Identification Data: Copies of identity documents, account files, and business correspondence.

Transaction Data: All records necessary to reconstruct individual transactions, including amounts, currencies, dates, and parties involved. This includes sender and recipient information for virtual asset transfers (often referred to as the "Travel Rule" information, even if specific VASP regulations are still developing).

Analysis of Complex Transactions: Records of the background and purpose of complex, unusual large transactions, and all unusual patterns of transactions.

STRs: Copies of all suspicious transaction reports filed.

Role: The central national agency for receiving, analyzing, and disseminating suspicious transaction reports. It also plays a key role in policy development and operational coordination for AML/CFT.

General contact for Ministry of Economy and Finance (where UIF is housed): While a direct UIF website is elusive, information can often be sought via the Ministry of Finance of Guinea-Bissau. (A specific URL for this ministry may vary or be part of the government portal).

Two errors. First, 'UEMOA Directive 003/2021' does not exist (see _idx 2); the operative instrument is the UMOA Loi uniforme LBC/FT/FP du 31 mars 2023. Second, the BCEAO has not been designated as the competent authority for virtual-asset service providers in Guinea-Bissau or anywhere in WAEMU. Art. 58 of the uniform law requires prior agrement or authorisation from 'l'autorite competente' and art. 59 defers all PSAV-specific requirements to competent authorities, but no member state has designated one, so there is no supervisor, no licensing channel and no supervisory programme for PSAV. Sanctions under the uniform law are imposed by the autorite de controle, not by the BCEAO acting as a virtual-asset regulator. The BCEAO does supervise banks and e-money issuers, but that competence does not extend to PSAV.

Other Relevant Bodies: The Ministry of Justice and the Ministry of Interior may also have roles in the broader AML/CFT framework, particularly in enforcement and prosecution.

The BCEAO has not issued circulars restricting or prohibiting virtual assets. No prohibitive or crypto-specific BCEAO instrument exists: the BCEAO's AML/CFT page and payment/e-money regulatory index contain no virtual-asset instrument, and Instruction n° 008-05-2015 on electronic money makes no reference to crypto-actifs. The BCEAO's public position is a caution, not a prohibition - the Governor's July 2026 remark that crypto 'n'est pas une monnaie, n'est pas reglemente' is a warning, and the May 2026 C-CRYPTO committee and 8 May 2026 Dakar conference are preparatory work. What actually prevents VASPs from operating formally in Guinea-Bissau is art. 58 of the uniform law (prior agrement required) combined with art. 59 and the absence of any designated competent authority, so no authorisation can be granted - not central-bank circulars.

Since the Travel Rule has not been explicitly adopted or transposed into national law for VASPs, there is no effective date for its implementation in Guinea-Bissau.

Given the lack of specific VASP regulation and Travel Rule adoption, no threshold amounts for transactions requiring originator and beneficiary information have been established.

The FATF's general guidance for the Travel Rule suggests a de minimis threshold of USD/EUR 1,000 for cross-border transfers for non-intermediated transactions, but this is irrelevant in Guinea-Bissau's current context.

Correct that no crypto travel rule binds VASPs in Guinea-Bissau: arts. 39-47 of the 31 March 2023 UMOA uniform law impose originator/beneficiary information duties on 'institutions financieres', which art. 2(41) defines separately from PSAV, so virtual-asset transfers are not caught. But it is wrong that the applicable AML/CFT law does not define or regulate VASPs: the uniform law defines 'actif virtuel' (art. 2(2)) and 'prestataire de services d'actifs virtuels' (art. 2(51), expressly including custody), and art. 3 makes PSAV assujettis. The cited 'Law No. 3/2014' could not be verified in any accessible source; GIABA's own Guinea-Bissau profile identifies the AML uniform law adopted by National Assembly Resolution No. 4/2004 of 2 November 2004, and Guinea-Bissau's national transposition of the 2023 uniform law could not be located.

Exchanges and custodian wallet providers are not operating in a legal vacuum: art. 58 of the 31 March 2023 UMOA uniform law provides that no one may carry on the professional activity of PSAV without the prior agrement or authorisation of the competent authority, and art. 3 makes PSAV assujettis. What is missing is implementation - no member state, Guinea-Bissau included, has designated the competent authority contemplated by art. 59, so no authorisation can in fact be obtained and nothing is enforced. The obstacle is that statutory gap, not a 'BCEAO stance': BCEAO has issued no instrument prohibiting or restricting crypto-assets; its only published position is the 8 May 2026 Dakar conference and the creation of the C-CRYPTO drafting committee.

As there is no legal framework mandating the Travel Rule, there are no technical implementation requirements for VASPs in Guinea-Bissau.

In countries where the Travel Rule is adopted, technical solutions often involve protocols like TRISA, OpenVASP, Sygna, Travel Rule Protocol (TRP), or others, but these are not applicable here.

There are no specific penalties for non-compliance with the FATF Travel Rule in Guinea-Bissau, as the rule itself has not been adopted into national law for VASPs.

The substance is right - money laundering and terrorist financing offences are property-neutral and reach conduct carried out with virtual assets. But the framing is outdated and the citation unverified: since 31 March 2023 the UMOA uniform law does expressly mention virtual assets (art. 2(2)) and virtual-asset service providers (art. 2(51)), so the 'regardless of whether virtual assets are explicitly mentioned' qualifier no longer holds at the regional level. 'Law No. 3/2014' could not be verified; GIABA's Guinea-Bissau profile names the AML uniform law adopted by National Assembly Resolution No. 4/2004 of 2 November 2004, plus a counter-terrorist-financing act then awaiting presidential assent. Guinea-Bissau's transposition of the 2023 uniform law could not be located.

A prior-authorisation requirement does exist and is the correct anchor, but it is art. 58 of the 31 March 2023 UMOA uniform law - no one may professionally provide virtual-asset services without the prior agrement or authorisation of the competent authority - and art. 59 leaves that competent authority to be designated, which Guinea-Bissau has not done. Attributing the authorisation power to 'the BCEAO' is imprecise: the uniform law refers to the competent authority / autorite de controle, and the BCEAO's own LBC/FT instrument index contains no crypto-asset authorisation regime.

Correct that GIABA is the FATF-style regional body for West Africa and that Guinea-Bissau is an assessed member state: GIABA's 3rd-round Mutual Evaluation Report of Guinea Bissau (on-site visit 18 January - 5 February 2021, post-plenary version published June 2023) and an accompanying Mutual Evaluation Action Plan (5 May 2023) both exist. The generalisation that these reports 'typically highlight the deficiencies in VASP regulation' is not supported: nothing in GIABA's published Guinea-Bissau material addresses virtual assets or Recommendation 15, and the report text itself is behind a gated viewer.

GIABA Mutual Evaluation Report of Guinea-Bissau: The latest available reports (e.g., 2018 or subsequent follow-up reports) would indicate the country's low level of compliance with FATF Recommendation 15 (Virtual Assets and VASPs). You would typically find these on the GIABA website: https://www.giaba.org/ (Navigate to "Mutual Evaluations" and search for Guinea-Bissau).

BCEAO has issued no circular, instruction or decision on crypto-assets. Its own consolidated LBC/FT regulation index lists only Instructions 001-03-2025 to 003-03-2025 (18 March 2025), the uniform law, Decisions 021 (2023) and 003 (2024) on thresholds, the 2017 instructions, and Directives 02/2015 and 04/2007 - none of which mention crypto-assets. BCEAO's only published crypto position is non-binding: the 8 May 2026 Dakar international conference on crypto-assets and the creation of the C-CRYPTO committee tasked with drafting future UMOA crypto rules. Public warnings and press releases are not legally binding on the financial sector.

BCEAO Communiqués/Circulars: Look for announcements on the BCEAO website, which typically advise caution or prohibit financial institutions from dealing with crypto-assets. For example, communiqués warning against crypto-currencies are common.

BCEAO official website: https://www.bceao.int/ (Search for "crypto-monnaie" or "actifs virtuels").

Guinea-Bissau, the state, is a member of GIABA, the FATF-style regional body for West Africa; its national financial intelligence unit is not itself 'part of' GIABA. The FIU is a domestic body (a CENTIF on the UMOA uniform-law model, referred to as CENTIF-GB) which under art. 60 of the 31 March 2023 uniform law receives suspicious transaction reports. GIABA records that the unit was installed with GIABA and UNODC assistance but remains largely ineffective, with minimal STR flow and weak government funding.

No crypto-specific national law was found for Guinea-Bissau, and no operational crypto framework exists anywhere in UMOA. But the AML/CFT rules applicable in Guinea-Bissau are not confined to conventional financial institutions: the 31 March 2023 UMOA uniform law defines actif virtuel (art. 2(2)) and PSAV including custody (art. 2(51)), makes PSAV assujettis (art. 3), and bars unauthorised PSAV activity (art. 58). The correct statement is that virtual assets are inside the AML/CFT perimeter on paper but nothing is operational, because art. 59 leaves the competent authority to be designated and none has been.

The first half is right, and for a reason the record does not give: art. 58 of the 31 March 2023 UMOA uniform law forbids professional virtual-asset service provision without prior agrement or authorisation, while art. 59 defers the specification of PSAV requirements to a competent authority that no UMOA state has designated - so no licence can be applied for, granted or held. The second half is now overstated: BCEAO established the C-CRYPTO committee to draft UMOA crypto-asset regulation and convened an international conference on crypto-assets in Dakar on 8 May 2026, so a pathway is under construction even though none is available today.

CDD is not limited to 'certain high-risk customers': under the 31 March 2023 UMOA uniform law all assujettis (art. 3 - financial institutions, DNFBPs and PSAV) owe identification and due-diligence duties, with records kept 10 years (art. 23), and BCEAO Instruction 003-03-2025 of 18 March 2025 sets the identification and know-your-customer modalities. Enhanced due diligence is the risk-based overlay for higher-risk situations, not the baseline. The 'scope limited by resource constraints' observation describes implementation rather than legal scope and is directionally consistent with GIABA's assessment of weak Guinea-Bissau implementation, but is not separately evidenced for CDD.

The first two hold: no crypto-specific national legislation was found for Guinea-Bissau, and GIABA records that the FIU, installed with GIABA/UNODC assistance, remains largely ineffective for want of government support. The third is wrong: a targeted-financial-sanctions and asset-freezing framework does exist in law - Title V of the 31 March 2023 UMOA uniform law contains the freezing provisions (around arts. 175-181), including publication of freezing decisions on the FIU's website. The defect in Guinea-Bissau is non-implementation of that framework, not its absence.

Guinea-Bissau sanctions framework - DFAT

Guinea Bissau's measures to combat money laundering and terrorist financing