← Regulations / Guinea-Bissau / Operating Models / DeFi frontend

DeFi protocol frontend in Guinea-Bissau

Operates a web frontend or aggregator that interacts with permissionless smart contracts on behalf of users. May or may not screen users / restrict regions.

Conditional AI-Generated · Unreviewed

DeFi frontend is conditionally permitted in Guinea-Bissau with a local entity, subject to AML obligations and low licensing burden.

Verdict Details

Permitted
conditional
Local entity required
Yes
Licensing burden
Low
Last updated
2026-07-13

AML Obligations

  • Customer Due Diligence (CDD) — identification and verification of identity (natural persons: name, address, date of birth, nationality, unique identification number; legal persons: name, legal form, address, directors, beneficial owners) — required under Law No. 7/2014 and UEMOA Directive No. 003/2021/CM/UEMOA
  • Beneficial ownership identification — for legal persons, understanding ownership and control structure, identifying the ultimate beneficial owner (UBO)
  • Purpose-and-nature assessment — understanding the purpose and intended nature of the business relationship or transaction
  • Ongoing transaction monitoring — scrutiny of transactions throughout the business relationship to ensure consistency with the customer's profile
  • Record-keeping — maintain customer identification data, transaction records (including travel-rule information), analysis of complex/unusual transactions, and copies of STRs for applicable retention periods
  • Risk-based approach — apply Simplified CDD (SCDD) for lower-risk situations and Enhanced CDD (EDD) for higher-risk situations (PEPs, high-risk jurisdictions, complex/unusual transactions, new technologies)
  • Suspicious Transaction Reporting (STR) — report any suspicious or attempted transaction, regardless of amount, to the Unidade de Informação Financeira (UIF — Financial Intelligence Unit of Guinea-Bissau)
  • No tipping-off — prohibition on disclosing to the customer or any third party that an STR has been or will be filed
  • Travel Rule obligations — sender and recipient information must be recorded for virtual asset transfers, per FATF Recommendation 15 as transposed via UEMOA Directive No. 003/2021/CM/UEMOA

Key Restrictions

  • No specific crypto or VASP licensing framework exists — the operator cannot obtain a license tailored to DeFi frontend activities
  • BCEAO has issued public warnings against cryptocurrencies and generally prohibits unauthorized payment/crypto services by non-licensed entities
  • If the frontend involves fee-taking, it may be reclassified as a financial service requiring a traditional financial license (e.g., e-money, payment services, financial intermediation) from the BCEAO — this is a significant grey-area risk
  • Any entity operating in Guinea-Bissau must incorporate locally with a registered office under general business registration laws
  • UEMOA Directive No. 003/2021/CM/UEMOA transposes FATF Recommendation 15 on virtual assets — VASPs (potentially including DeFi frontends) must comply with AML/CFT obligations even absent specific crypto licensing
  • The BCEAO's stance that cryptocurrencies are not recognized as legal tender or regulated financial instruments creates an ambiguous legal environment for any crypto-touching service

Key Risks

  • Regulatory uncertainty — no specific crypto laws exist but BCEAO warnings suggest active hostility; future regulation (possibly retroactive) is a material risk
  • Fee-taking risk — if the frontend charges fees (swap fees, routing fees), it risks being classified as an unauthorized financial or payment service under BCEAO rules, carrying enforcement exposure
  • Enforcement risk — the FIU (UIF) and Central Bank could scrutinize any entity handling financial flows under general AML/CFT provisions, even without specific VASP rules
  • Travel Rule compliance ambiguity — FATF Recommendation 15 transposed via UEMOA Directive applies to VASPs, but it is unclear how it applies to non-custodial DeFi frontends; compliance expectations are unclear
  • GIABA mutual evaluation risk — Guinea-Bissau's AML/CFT framework deficiencies regarding virtual assets may lead to increased enforcement pressure or sudden regulatory changes
  • Operational grey area — operating a DeFi frontend without explicit legal clarity exposes the operator to potential shutdown orders or reputational damage

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 80% confidence

Three of the four limbs are right, one is wrong. It is correct that there are no VASP licensing categories, no capital requirements for crypto firms and no application process in Guinea-Bissau - art. 59 of the UMOA loi uniforme of 31 March 2023 defers all PSAV-specific requirements to a competent authority, and Guinea-Bissau has designated none. But it is wrong that virtual assets are undefined: art. 2(2) defines actif virtuel as the digital representation of value that can be exchanged or transferred by digital means (excluding regulated digital representations of fiat currency or securities), art. 2(51) defines prestataire de services d'actifs virtuels to include exchange, transfer and custody of virtual assets, art. 3 makes PSAV assujettis, and art. 58 forbids carrying on PSAV activity without prior agrement. The correct position is a statutory prohibition on unlicensed VASP activity with no authority to apply to - not a legal vacuum.

licensing 80% confidence

There is no 'Banco Central da Guine-Bissau'. Guinea-Bissau has had no national central bank since it joined UMOA in 1997; its central bank is the BCEAO, which describes itself as 'l'Institut d'emission commun aux huit (8) Etats membres de l'Union Monetaire Ouest Africaine (UMOA)' and lists Guinee-Bissau among those eight states. The BCEAO operates a Direction Nationale in Bissau, not an autonomous national issuer. The cited domain bancocentralguinebissau.org is not a reachable official source. On the substance, warnings do exist at the regional level, but they come from the BCEAO, and the operative position as of May 2026 is that the BCEAO created the C-CRYPTO committee to draft a framework that does not yet exist.

licensing 30% confidence

General Business Registration: Any entity wishing to operate in Guinea-Bissau, including a business that might involve virtual assets, would still need to comply with general company registration laws and obtain standard business licenses from the relevant government ministries (e.g., Ministry of Economy and Finance, Ministry of Justice) for its operational activities, irrespective of whether those activities involve virtual assets.

licensing 80% confidence

This is the symmetric error: the conclusion that nothing operational exists is right, but the premise that there is no framework at all is wrong. Art. 58 of the UMOA loi uniforme of 31 March 2023 states that no one may carry on the professional activity of prestataire de services d'actifs virtuels without having obtained the prior agrement or authorisation of the competent authority. That prohibition exists on paper. What is missing is the other half: art. 59 leaves the PSAV-specific requirements and the designation of the competent authority to member states, and Guinea-Bissau - like every other UEMOA state - has designated none. So the accurate statement is not 'no regime' but 'a statutory licensing prohibition with no designated authority, no licence categories and no application route', meaning no crypto business can lawfully be authorised in Guinea-Bissau rather than that it is free to operate unregulated.

licensing 80% confidence

Correct that no 'Virtual Asset Exchange Licence', 'Crypto Custody Licence' or 'Crypto Payment Processor Licence' exists or can be obtained in Guinea-Bissau. Incorrect that none is *required*: art. 58 of the UMOA loi uniforme LBC/FT/FP of 31 March 2023 provides that 'Nul ne peut se livrer a l'activite professionnelle de prestataire de services d'actifs virtuels s'il n'a pas obtenu l'agrement ou l'autorisation prealable de l'autorite competente', and art. 59 defers every PSAV-specific requirement to a competent authority that no UMOA member state, Guinea-Bissau included, has designated. The accurate position is: a statutory prohibition on unlicensed PSAV activity exists on paper, but no licence is obtainable and no supervisor is operational.

licensing 30% confidence

Traditional Financial Licenses (Potential Overlap/Future): If a VASP's activities were deemed to fall under the scope of traditional financial services (e.g., money remittance, e-money issuance, or general financial intermediation), then relevant licenses for those traditional activities might be required. However, without specific legal clarity on how virtual assets are classified in relation to existing financial laws, this remains ambiguous. It's more likely that traditional financial services licenses would not implicitly cover virtual asset activities without explicit legislative amendment.

licensing 80% confidence

GIABA membership is correct and verified (Guinea-Bissau appears on GIABA's member-state list and has its own GIABA country page). But the AML/CFT obligation on virtual-asset businesses is not merely 'implicit' and does not flow from soft FATF commitments: the UMOA loi uniforme LBC/FT/FP of 31 March 2023 — binding on Guinea-Bissau as a UMOA member state — defines 'actif virtuel' (art. 2(2)) and 'prestataire de services d'actifs virtuels' expressly including custody (art. 2(51)), and art. 3 lists PSAV among the assujettis alongside institutions financieres and EPNFD. Note also that Guinea-Bissau is not a FATF member; it is a GIABA (FSRB) member.

licensing 80% confidence

At regional level this is not unclear: the UMOA loi uniforme LBC/FT/FP of 31 March 2023 expressly designates prestataires de services d'actifs virtuels as assujettis (art. 3), defines them at art. 2(51) including 'la conservation et l'administration d'actifs virtuels', imposes a ten-year record-retention obligation (art. 23: 'pendant une duree de dix ans'), and requires assujettis to file suspicious-transaction reports with the CENTIF (art. 60). What genuinely could not be established is Guinea-Bissau's own national transposition instrument — no Lusophone transposition law (Lei / Decreto-Lei) of the 2023 uniform law could be located, unlike Cote d'Ivoire (Ordonnance n° 2023-875), Senegal (Loi n° 2024-08), Benin (Loi n° 2024-01) or Burkina Faso (Loi n° 046-2024/ALT).

licensing 80% confidence

Guinea-Bissau does have a financial intelligence unit — GIABA's own country page records that 'The FIU of Guinea-Bissau was installed with the assistance of GIABA and UNODC'. But the name given is not supported: in the UMOA framework each member state's FIU is a CENTIF (Cellule Nationale de Traitement des Informations Financieres), to which art. 60 of the 31 March 2023 uniform law directs all suspicious-transaction reports; the Guinea-Bissau body is referred to as CENTIF-GB. No fetched source corroborates 'Unidade de Informacao Financeira (UIF)' as the Guinea-Bissau FIU's designation — UIF is the designation used by Portugal's FIU. Further, the record's 'might eventually fall under the purview' understates the position: PSAV are already listed as assujettis at art. 3 of the uniform law.

licensing 30% confidence

Local Presence: Any company operating in Guinea-Bissau would generally require a registered local office and compliance with local business registration requirements.

licensing 30% confidence

General AML/CFT Law: Guinea-Bissau is expected to have legislation aligned with international AML/CFT standards. The most recent comprehensive law would be:

licensing 50% confidence

Law No. 5/2023 of April 28, 2023, on the Prevention and Combat of Money Laundering, Terrorist Financing, and Proliferation Financing.

licensing 80% confidence

There is no 'Banco Central da Guine-Bissau'. Guinea-Bissau has no national central bank: it is one of the eight member states of the UMOA — BCEAO's own page states 'Les huit (8) Etats membres de l'UMOA sont : le Benin, le Burkina, la Cote d'Ivoire, la Guinee-Bissau, le Mali, le Niger, le Senegal et le Togo' — and the BCEAO is 'l'Institut d'emission commun aux Etats membres de l'Union Monetaire Ouest Africaine', exercising monetary and banking-regulatory functions for Guinea-Bissau through its national directorate in Bissau. Any future crypto-asset framework would emanate from the BCEAO/UMOA Council of Ministers (the BCEAO C-CRYPTO drafting committee established May 2026), not from a national central bank.

aml 50% confidence

Law No. 7/2014 of 30th May 2014 on the Prevention and Combat of Money Laundering and Terrorist Financing: This is the overarching national AML/CFT law. It defines reporting entities, establishes the Financial Intelligence Unit (FIU), and outlines general obligations.

aml 80% confidence

There is no 'UEMOA Directive No. 003/2021/CM/UEMOA'. The UEMOA AML/CFT directive was Directive n° 02/2015/CM/UEMOA, which has been superseded by the UMOA Loi uniforme relative a la LBC/FT/FP du 31 mars 2023. That uniform law - not a 2021 directive - is what brings virtual assets into the UEMOA AML/CFT perimeter: art. 2 defines 'actif virtuel' and 'prestataire de services d'actifs virtuels' (PSAV, expressly including custody and administration of virtual assets), art. 3 makes PSAV assujettis, art. 58 forbids professional PSAV activity without prior agrement or authorisation from the competent authority, art. 59 defers all PSAV-specific requirements to competent authorities, and art. 60 requires suspicious-transaction reports to the CENTIF. Each member state, including Guinea-Bissau, must transpose it nationally; Guinea-Bissau's transposing Lei could not be identified.

Evidence fact gw.aml.identification-and-verification not found (may have been renamed).

aml 80% confidence

Purpose and Nature of the Business Relationship: Understanding the purpose and intended nature of the business relationship or transaction.

aml 80% confidence

Conducting ongoing monitoring of the business relationship, including scrutiny of transactions undertaken throughout the course of that relationship to ensure that the transactions are consistent with the VASP’s knowledge of the customer, their business, and risk profile, including, where necessary, the source of funds.

aml 80% confidence

Risk-Based Approach: Applying CDD measures based on a risk assessment. This means:

aml 80% confidence

Report Suspicious Transactions: Report any transaction (or attempted transaction), regardless of its amount, that they suspect may involve money laundering or terrorist financing. This includes transactions related to virtual assets.

aml 80% confidence

Reporting Body: Reports must be submitted to the national Financial Intelligence Unit (FIU).

Evidence fact gw.aml.unidade-de-informao-financeira-uif not found (may have been renamed).

custody 80% confidence

The conclusion is right but the cause is wrong. No crypto custody authorisation can be obtained in Guinea-Bissau, and unauthorised provision is unlawful - but that follows from art. 58 of the 31 March 2023 UMOA uniform law combined with art. 59's deferral to a competent authority that has never been designated, not from any BCEAO refusal or non-recognition. BCEAO has issued no instrument recognising, refusing to recognise, or prohibiting crypto-assets; its published position is the 8 May 2026 Dakar conference and the C-CRYPTO drafting committee, and its LBC/FT instrument index contains no crypto item.

Evidence fact gw.custody.central-bank-of-west-african not found (may have been renamed).

Evidence fact gw.custody.bceao-communiqus-on-cryptocurrencies-example not found (may have been renamed).

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
medium

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — a DeFi protocol frontend can operate in Guinea-Bissau only in a high-risk grey area: no specific crypto licensing exists, but general AML/CFT obligations (including FATF Recommendation 15 via UEMOA Directive) may apply; fee-taking risks reclassification as an unauthorized financial service under BCEAO rules; local incorporation is required for any entity presence, and the BCEAO's anti-crypto stance creates material enforcement exposure.

Questions this verdict aims to answer

  • Is operating the frontend a regulated activity even if the protocol is decentralized?
  • What geofencing or KYC obligations apply?
  • Does fee-taking change classification?