DeFi protocol frontend in Lesotho

Lesotho has enacted no virtual-asset statute and operates no virtual-asset service provider licence or registration: the Central Bank of Lesotho's legislation index carries no virtual-asset, crypto-asset or digital-asset instrument, and the September 2023 ESAAMLG mutual evaluation records that Lesotho 'does not have a legal and institutional framework to allow VAs and VASPs activities to be carried out'.

The Central Bank of Lesotho's published position on cryptocurrency consists of two warnings, issued 9 November 2017 and 20 May 2024; the 2024 statement places cryptocurrencies outside the Bank's regulatory perimeter rather than prohibiting them, and Lesotho has never operated a regulatory sandbox or any crypto authorisation pathway.

Lesotho's Money Laundering and Proceeds of Crime Act 2008 (Act 4 of 2008) binds only the accountable institutions listed in its Schedule 1, and the most recent amendment - Legal Notice No. 69 of 2024, gazetted Tuesday 25 June 2024 under section 112 - inserts a single new entry, 'person conducting safekeeping and administration of cash or liquid securities activities on behalf of other persons', so virtual-asset service providers are not accountable institutions in Lesotho and carry no AML/CFT obligation.

Cryptocurrency Exchanges: There are no specific licenses required for a "cryptocurrency exchange" if it deals only with virtual assets. However, if the exchange offers services that involve fiat currency conversion, holds fiat currency for customers, or facilitates remittances in traditional currency, it could potentially be deemed to be conducting activities that fall under existing banking, money transmission, or payment services regulations, which would require a license from the CBL. This is a grey area and depends heavily on the specific nature and integration with traditional financial systems.

Lesotho is a member of the Eastern and Southern Africa Anti-Money Laundering Group, and its second-round mutual evaluation - on-site 21 November to 2 December 2022, adopted September 2023 - rates Lesotho Non-Compliant on FATF Recommendation 15 on new technologies; the FATF standards bind Lesotho only politically through ESAAMLG and have not been transposed into any domestic virtual-asset obligation.

Evidence fact ls.licensing.the-money-laundering-and-proceeds-of not found (may have been renamed).

Virtual-asset service providers owe no customer due diligence, record-keeping or suspicious-transaction reporting duty in Lesotho: those duties under the Money Laundering and Proceeds of Crime Act 2008 attach only to accountable institutions listed in Schedule 1, which after Legal Notice No. 69 of 2024 still contains no virtual-asset activity, and no penalty under that Act can be imposed on a business solely for dealing in virtual assets.

Lesotho imposes no local-presence, local-management or domestic-incorporation requirement on virtual-asset service providers, because it licenses no such providers; presence and management requirements arise only on licensing under the Financial Institutions Act 2012 (Act No. 3 of 2012), which governs deposit-taking and non-deposit-taking institutions carrying on financial activities stipulated in their licence.

The Money Laundering and Proceeds of Crime Act, 2008 (Act No. 4 of 2008) is Lesotho's foundational AML statute, but virtual asset service providers are not accountable institutions under its Schedule 1: the most recent Schedule amendment, Legal Notice No. 69 of 2024 published 25 June 2024 under section 112 of that Act, inserts only a person conducting safekeeping and administration of cash or liquid securities, and no virtual-asset category has ever been added.

Lesotho has no Financial Intelligence Act 2011: the Financial Intelligence Unit is established by section 14 of the Money Laundering and Proceeds of Crime Act, 2008 as a juristic person responsible to the Minister, suspicious transaction reporting arises under section 18 of that Act and the tipping-off prohibition under section 24(1).

Evidence fact ls.aml.identification-and-verification not found (may have been renamed).

For Individuals: Obtaining and verifying name, residential address, date of birth, nationality, and a unique identification number (e.g., national ID, passport). Verification should be done using reliable, independent source documents or data.

For Legal Entities: Obtaining and verifying company name, legal form, proof of incorporation/registration, address of principal place of business, directors' names, and beneficial ownership information.

Understanding the Nature of Business/Purpose of Relationship: VASPs must understand the nature and purpose of the business relationship or occasional transaction.

Ongoing Monitoring: Continuously monitoring the business relationship, including scrutiny of transactions undertaken throughout the course of the relationship, to ensure that the transactions are consistent with the VASP's knowledge of the customer, their business, and risk profile, including, where necessary, the source of funds.

Source of Funds/Wealth: Given the inherent risks of virtual assets, VASPs are expected to obtain information on the source of funds or source of wealth, especially for large transactions or high-risk customers.

Enhanced Due Diligence (EDD): Required for high-risk situations, which typically include:

Politically Exposed Persons (PEPs)

Customers from high-risk geographic areas (as identified by FATF, national authorities, or the VASP's own risk assessment)

Complex or unusual transactions

Transactions involving new technologies or products where the risks have not been fully assessed (which can include certain crypto activities).

Report Suspicious Transactions: Report to the FIU any transaction (or attempted transaction) where they have reasonable grounds to suspect that it may involve the proceeds of criminal activity, or relates to money laundering or terrorist financing. This includes suspicious activities in virtual assets.

No Tipping-Off: Prohibit informing the customer or third parties that an STR has been made (no "tipping-off").

Prompt Reporting: Reports must be made promptly, usually within a few days of the suspicion arising.

Customer Identification Data: Copies of identity documents, verification records.

Transaction Records: All transaction data, including dates, amounts, types of virtual assets, originators, beneficiaries, and payment methods.

Business Correspondence: Relevant correspondence with customers regarding their transactions and relationships.

Analysis of Complex/Unusual Transactions: Records of the background and purpose of any complex, unusual large transactions, and all unusual patterns of transactions.

Section 17(4) of the Money Laundering and Proceeds of Crime Act, 2008 requires records to be kept for at least five years from the date the relevant business or transaction was completed, but that duty binds only the accountable institutions listed in Schedule 1 of the Act, a list that contains no virtual asset service provider category after Legal Notice No. 69 of 2024.

Lesotho's Financial Intelligence Unit is established by section 14 of the Money Laundering and Proceeds of Crime Act, 2008 as a juristic person responsible to the Minister, and receives, analyses and disseminates suspicious transaction reports from the accountable institutions listed in Schedule 1 of that Act, which contains no virtual asset service provider category and gives the Unit no VASP oversight.

The Central Bank of Lesotho has issued two public statements on cryptocurrency, on 9 November 2017 and on 20 May 2024; the 20 May 2024 statement warns that cryptocurrencies fall outside the regulatory purview of the Central Bank of Lesotho and that there is no recourse to the Bank in the event of losses, and that offering cryptocurrencies as investment opportunities exposes promoters to sections 27 and 28 of the Capital Market Regulations 2014, which require investment advisers to be licensed by the Bank.

No Lesotho authority has taken a published crypto enforcement action against any named entity: the Central Bank of Lesotho's crypto output consists of the general public warnings of 9 November 2017 and 20 May 2024, and no fine, sanction, revocation or prosecution concerning virtual assets has been published by the Bank, the Financial Intelligence Unit or the Director of Public Prosecutions.

Lesotho has no National Payment Systems Act 2018; payment systems are governed by the Payment Systems Act 2014, Act No. 11 of 2014, published 12 September 2014, together with the Payment Systems (Issuers of Electronic Payment Instruments) Regulations 2017, and neither instrument mentions virtual assets, crypto-assets or virtual currency.

FATF Recommendations (relevant context for Lesotho's future actions): https://www.fatf-gafi.org/recommendations/