Centralized exchange in Guinea-Bissau
Order-book exchange that takes custody of user assets and matches trades between users.
CEX is conditionally permitted in Guinea-Bissau with a local entity, subject to AML obligations and low licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Low
- Last updated
- 2026-07-13
AML Obligations
- Customer Due Diligence (CDD) required under Law No. 7/2014 and UEMOA Directive No. 003/2021/CM/UEMOA: identification and verification of natural persons (name, address, date of birth, nationality, unique ID number) and legal persons (name, legal form, address, directors, beneficial owners, proof of incorporation).
- Ultimate Beneficial Owner (UBO) identification required for legal persons.
- Ongoing monitoring of business relationships and transaction scrutiny to ensure consistency with customer risk profile.
- Risk-based approach: Simplified CDD (SCDD) permitted for low risk; Enhanced CDD (EDD) required for higher-risk situations including PEPs, high-risk jurisdictions, complex/unusually large transactions, and transactions involving new technologies.
- Suspicious Transaction Reports (STRs) must be filed with the Unidade de Informação Financeira (UIF — Guinea-Bissau Financial Intelligence Unit) for any suspected money laundering or terrorist financing, regardless of transaction amount.
- No-tipping-off prohibition: cannot disclose to customer or third party that an STR has been or will be filed.
- Record-keeping obligations: customer identification data, transaction records (including sender/recipient information for virtual asset transfers — 'Travel Rule' information per FATF standards), analysis of complex/unusual transactions, and copies of STRs.
- The general AML/CFT obligations likely extend to VASPs by virtue of UEMOA Directive No. 003/2021/CM/UEMOA which incorporates FATF Recommendation 15 on virtual assets, though specific VASP designation as reporting entities under domestic law is not fully confirmed.
Key Restrictions
- No specific crypto or VASP licensing framework exists — no Virtual Asset Exchange License, Crypto Custody License, or similar license is available.
- BCEAO has issued warnings against cryptocurrencies and generally prohibits payment services by unauthorized entities, creating a hostile regulatory stance.
- Any entity offering financial services (including what might be construed as digital asset custody) would generally need a license from the BCEAO and/or national financial authorities, but such a license is practically unobtainable for crypto custody.
- No specific segregation-of-client-assets rules exist for digital assets; no cold-storage mandates; no 'qualified custodian' definition for crypto.
- General company registration and standard business licenses from relevant government ministries are required, but these do not constitute crypto-specific authorization.
- If activities fall under traditional financial services (e-money issuance, money remittance, financial intermediation), traditional financial licenses from BCEAO may be required — but these are likely unobtainable for pure crypto activities given the BCEAO stance.
- Local registered office and compliance with local business registration requirements are needed for any company operating in Guinea-Bissau.
Key Risks
- Regulatory uncertainty: High risk of future, potentially retroactive, regulation given the complete absence of a crypto framework.
- BCEAO enforcement risk: The BCEAO has issued public warnings against cryptocurrencies; operating could attract enforcement action under general prohibitions on unauthorized financial services.
- GIABA/FATF pressure: As an FATF-style regional body member, Guinea-Bissau faces pressure to regulate VASPs — future regulation could create compliance gaps or retroactive requirements.
- No legal certainty on custody, listing rules, market conduct, or travel-rule obligations — operator would be operating in a legal grey zone with no clear protections.
- AML/CFT classification risk: It is not fully clear whether VASPs are explicitly designated as 'reporting entities' under Law No. 7/2014, creating ambiguity on whether AML obligations formally attach.
- Banking and payment-rail access likely unavailable or severely restricted due to BCEAO's anti-crypto stance.
- Tax and PR exposure: Operating without a recognized legal framework creates reputational risk and potential tax ambiguity.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Three of the four limbs are right, one is wrong. It is correct that there are no VASP licensing categories, no capital requirements for crypto firms and no application process in Guinea-Bissau - art. 59 of the UMOA loi uniforme of 31 March 2023 defers all PSAV-specific requirements to a competent authority, and Guinea-Bissau has designated none. But it is wrong that virtual assets are undefined: art. 2(2) defines actif virtuel as the digital representation of value that can be exchanged or transferred by digital means (excluding regulated digital representations of fiat currency or securities), art. 2(51) defines prestataire de services d'actifs virtuels to include exchange, transfer and custody of virtual assets, art. 3 makes PSAV assujettis, and art. 58 forbids carrying on PSAV activity without prior agrement. The correct position is a statutory prohibition on unlicensed VASP activity with no authority to apply to - not a legal vacuum.
There is no 'Banco Central da Guine-Bissau'. Guinea-Bissau has had no national central bank since it joined UMOA in 1997; its central bank is the BCEAO, which describes itself as 'l'Institut d'emission commun aux huit (8) Etats membres de l'Union Monetaire Ouest Africaine (UMOA)' and lists Guinee-Bissau among those eight states. The BCEAO operates a Direction Nationale in Bissau, not an autonomous national issuer. The cited domain bancocentralguinebissau.org is not a reachable official source. On the substance, warnings do exist at the regional level, but they come from the BCEAO, and the operative position as of May 2026 is that the BCEAO created the C-CRYPTO committee to draft a framework that does not yet exist.
General Business Registration: Any entity wishing to operate in Guinea-Bissau, including a business that might involve virtual assets, would still need to comply with general company registration laws and obtain standard business licenses from the relevant government ministries (e.g., Ministry of Economy and Finance, Ministry of Justice) for its operational activities, irrespective of whether those activities involve virtual assets.
This is the symmetric error: the conclusion that nothing operational exists is right, but the premise that there is no framework at all is wrong. Art. 58 of the UMOA loi uniforme of 31 March 2023 states that no one may carry on the professional activity of prestataire de services d'actifs virtuels without having obtained the prior agrement or authorisation of the competent authority. That prohibition exists on paper. What is missing is the other half: art. 59 leaves the PSAV-specific requirements and the designation of the competent authority to member states, and Guinea-Bissau - like every other UEMOA state - has designated none. So the accurate statement is not 'no regime' but 'a statutory licensing prohibition with no designated authority, no licence categories and no application route', meaning no crypto business can lawfully be authorised in Guinea-Bissau rather than that it is free to operate unregulated.
Correct that no 'Virtual Asset Exchange Licence', 'Crypto Custody Licence' or 'Crypto Payment Processor Licence' exists or can be obtained in Guinea-Bissau. Incorrect that none is *required*: art. 58 of the UMOA loi uniforme LBC/FT/FP of 31 March 2023 provides that 'Nul ne peut se livrer a l'activite professionnelle de prestataire de services d'actifs virtuels s'il n'a pas obtenu l'agrement ou l'autorisation prealable de l'autorite competente', and art. 59 defers every PSAV-specific requirement to a competent authority that no UMOA member state, Guinea-Bissau included, has designated. The accurate position is: a statutory prohibition on unlicensed PSAV activity exists on paper, but no licence is obtainable and no supervisor is operational.
Traditional Financial Licenses (Potential Overlap/Future): If a VASP's activities were deemed to fall under the scope of traditional financial services (e.g., money remittance, e-money issuance, or general financial intermediation), then relevant licenses for those traditional activities might be required. However, without specific legal clarity on how virtual assets are classified in relation to existing financial laws, this remains ambiguous. It's more likely that traditional financial services licenses would not implicitly cover virtual asset activities without explicit legislative amendment.
GIABA membership is correct and verified (Guinea-Bissau appears on GIABA's member-state list and has its own GIABA country page). But the AML/CFT obligation on virtual-asset businesses is not merely 'implicit' and does not flow from soft FATF commitments: the UMOA loi uniforme LBC/FT/FP of 31 March 2023 — binding on Guinea-Bissau as a UMOA member state — defines 'actif virtuel' (art. 2(2)) and 'prestataire de services d'actifs virtuels' expressly including custody (art. 2(51)), and art. 3 lists PSAV among the assujettis alongside institutions financieres and EPNFD. Note also that Guinea-Bissau is not a FATF member; it is a GIABA (FSRB) member.
At regional level this is not unclear: the UMOA loi uniforme LBC/FT/FP of 31 March 2023 expressly designates prestataires de services d'actifs virtuels as assujettis (art. 3), defines them at art. 2(51) including 'la conservation et l'administration d'actifs virtuels', imposes a ten-year record-retention obligation (art. 23: 'pendant une duree de dix ans'), and requires assujettis to file suspicious-transaction reports with the CENTIF (art. 60). What genuinely could not be established is Guinea-Bissau's own national transposition instrument — no Lusophone transposition law (Lei / Decreto-Lei) of the 2023 uniform law could be located, unlike Cote d'Ivoire (Ordonnance n° 2023-875), Senegal (Loi n° 2024-08), Benin (Loi n° 2024-01) or Burkina Faso (Loi n° 046-2024/ALT).
Local Presence: Any company operating in Guinea-Bissau would generally require a registered local office and compliance with local business registration requirements.
General AML/CFT Law: Guinea-Bissau is expected to have legislation aligned with international AML/CFT standards. The most recent comprehensive law would be:
Law No. 5/2023 of April 28, 2023, on the Prevention and Combat of Money Laundering, Terrorist Financing, and Proliferation Financing.
Regulatory Uncertainty: High risk of future, potentially retroactive, regulation.
Increased Scrutiny: Any business involving significant financial flows, especially cross-border, could attract attention from the Central Bank or the FIU under general AML/CFT provisions.
Crypto custody is not outside the framework. Art. 2(51) of the 31 March 2023 UMOA uniform law defines a prestataire de services d'actifs virtuels to expressly include 'la conservation et l'administration d'actifs virtuels', art. 3 makes PSAV assujettis, and art. 58 forbids carrying on that activity without the prior agrement or authorisation of the competent authority. So a crypto custodian in Guinea-Bissau is legally required to be authorised. What genuinely does not exist is any operative licensing regime - art. 59 defers PSAV requirements to a competent authority that Guinea-Bissau has not designated - and any prudential custody rulebook.
The conclusion is right but the cause is wrong. No crypto custody authorisation can be obtained in Guinea-Bissau, and unauthorised provision is unlawful - but that follows from art. 58 of the 31 March 2023 UMOA uniform law combined with art. 59's deferral to a competent authority that has never been designated, not from any BCEAO refusal or non-recognition. BCEAO has issued no instrument recognising, refusing to recognise, or prohibiting crypto-assets; its published position is the 8 May 2026 Dakar conference and the C-CRYPTO drafting committee, and its LBC/FT instrument index contains no crypto item.
No Specific Rules: Since there is no specific regulatory framework for digital asset custody, there are no explicit rules in Guinea-Bissau mandating the segregation of client digital assets from the custodian's proprietary assets.
Lack of Regulatory Recognition: This absence is directly linked to the lack of a defined regulatory category for such services.
No Specific Mandates: There are no specific regulatory mandates for the use of cold storage or other security measures for digital assets under custody.
No Specific Definition: Guinea-Bissau's legal and regulatory framework does not currently define what constitutes a "qualified custodian" in the context of digital assets.
Guinea-Bissau is not a FATF member; it is a member of GIABA, the FATF-style regional body for West Africa, and is assessed against the FATF standards through GIABA. FATF Recommendation 15 has already been transposed at regional level and applies in Guinea-Bissau: the UMOA uniform law of 31 March 2023 defines 'actif virtuel' (art. 2(2)), defines 'prestataire de services d'actifs virtuels' to include 'la conservation et/ou administration d'actifs virtuels' (art. 2(51)), makes PSAV assujettis (art. 3), imposes a 10-year record-retention duty (art. 23) and prohibits professional PSAV activity without prior agrement or authorisation (art. 58). What has not occurred is the operational step: art. 59 leaves PSAV-specific requirements and sanctions to 'les autorites competentes', and no such authority has been designated, so no licence can actually be applied for or granted.
Evidence fact gw.custody.bceao-communiqus-on-cryptocurrencies-example not found (may have been renamed).
Law No. 7/2014 of 30th May 2014 on the Prevention and Combat of Money Laundering and Terrorist Financing: This is the overarching national AML/CFT law. It defines reporting entities, establishes the Financial Intelligence Unit (FIU), and outlines general obligations.
There is no 'UEMOA Directive No. 003/2021/CM/UEMOA'. The UEMOA AML/CFT directive was Directive n° 02/2015/CM/UEMOA, which has been superseded by the UMOA Loi uniforme relative a la LBC/FT/FP du 31 mars 2023. That uniform law - not a 2021 directive - is what brings virtual assets into the UEMOA AML/CFT perimeter: art. 2 defines 'actif virtuel' and 'prestataire de services d'actifs virtuels' (PSAV, expressly including custody and administration of virtual assets), art. 3 makes PSAV assujettis, art. 58 forbids professional PSAV activity without prior agrement or authorisation from the competent authority, art. 59 defers all PSAV-specific requirements to competent authorities, and art. 60 requires suspicious-transaction reports to the CENTIF. Each member state, including Guinea-Bissau, must transpose it nationally; Guinea-Bissau's transposing Lei could not be identified.
Evidence fact gw.aml.identification-and-verification not found (may have been renamed).
For legal persons, understanding the ownership and control structure, and identifying the ultimate beneficial owner (UBO).
Purpose and Nature of the Business Relationship: Understanding the purpose and intended nature of the business relationship or transaction.
Conducting ongoing monitoring of the business relationship, including scrutiny of transactions undertaken throughout the course of that relationship to ensure that the transactions are consistent with the VASP’s knowledge of the customer, their business, and risk profile, including, where necessary, the source of funds.
Risk-Based Approach: Applying CDD measures based on a risk assessment. This means:
Report Suspicious Transactions: Report any transaction (or attempted transaction), regardless of its amount, that they suspect may involve money laundering or terrorist financing. This includes transactions related to virtual assets.
Reporting Body: Reports must be submitted to the national Financial Intelligence Unit (FIU).
Customer Identification Data: Copies of identity documents, account files, and business correspondence.
Transaction Data: All records necessary to reconstruct individual transactions, including amounts, currencies, dates, and parties involved. This includes sender and recipient information for virtual asset transfers (often referred to as the "Travel Rule" information, even if specific VASP regulations are still developing).
Evidence fact gw.aml.unidade-de-informao-financeira-uif not found (may have been renamed).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- low
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a centralized exchange is practically inoperable in Guinea-Bissau due to the complete absence of a crypto-specific licensing framework, BCEAO hostility toward cryptocurrencies, and the lack of legal clarity on custody, travel-rule, and market-conduct obligations; it may only be structured as a general business entity under commercial laws while operating in a legal grey zone, subject to general AML/CFT obligations under Law No. 7/2014 and UEMOA Directive No. 003/2021.
Questions this verdict aims to answer
- What exchange / VASP license applies?
- What custody segregation rules apply to user assets?
- What market-conduct and listing rules apply?
- What travel-rule obligations apply on withdrawals?