Self-custodial wallet / non-custodial software in Lesotho
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Lesotho without local incorporation, subject to AML obligations and none licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- None
- Last updated
- 2026-07-13
AML Obligations
- No specific VASP AML obligations are triggered because the publisher never holds custody of funds and is not a 'reporting institution' under existing law.
- If the operator were deemed to be engaged in financial flows by a regulator, the Money Laundering and Proceeds of Crime Act (MLPCA) 2008 would apply generically — CDD, ongoing monitoring, source of funds/wealth checks.
- The FIU would expect any entity involved in financial flows to conduct KYC, monitor transactions, and submit STRs — but this is ambiguous for pure non-custodial software publishers.
- Records must be kept for a minimum of 5 years after termination of the business relationship if AML duties are deemed applicable.
Key Restrictions
- No dedicated VASP regime exists — the business operates in a regulatory void, not under a clear permission.
- The Central Bank of Lesotho has issued public warnings against dealing with cryptocurrencies, creating PR and banking-relationship risks.
- If the software publisher accepts any fiat payment for the software or charges fees routed through Lesotho's financial system, it could trigger traditional financial-services licensing (National Payment Systems Act 2018, Financial Institutions Act 2012).
- Any integration that touches fiat conversion, remittances, or payment processing on behalf of users would likely require licensing.
Key Risks
- Regulatory ambiguity — the FATF Travel Rule and VASP classification expectations for non-custodial software are unresolved globally; Lesotho has no guidance on this.
- Banking risk — local banks may refuse to provide services to any entity associated with crypto due to CBL warnings, even if the entity is a software publisher only.
- Enforcement precedent — no crypto-specific enforcement exists, but the CBL's cautious/warning stance suggests potential future action could be unpredictable.
- FATF pressure — Lesotho is an ESAAMLG member and may adopt VASP-specific legislation, retroactively affecting software publishers.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Lesotho has enacted no virtual-asset statute and operates no virtual-asset service provider licence or registration: the Central Bank of Lesotho's legislation index carries no virtual-asset, crypto-asset or digital-asset instrument, and the September 2023 ESAAMLG mutual evaluation records that Lesotho 'does not have a legal and institutional framework to allow VAs and VASPs activities to be carried out'.
The Central Bank of Lesotho's published position on cryptocurrency consists of two warnings, issued 9 November 2017 and 20 May 2024; the 2024 statement places cryptocurrencies outside the Bank's regulatory perimeter rather than prohibiting them, and Lesotho has never operated a regulatory sandbox or any crypto authorisation pathway.
Lesotho's Money Laundering and Proceeds of Crime Act 2008 (Act 4 of 2008) binds only the accountable institutions listed in its Schedule 1, and the most recent amendment - Legal Notice No. 69 of 2024, gazetted Tuesday 25 June 2024 under section 112 - inserts a single new entry, 'person conducting safekeeping and administration of cash or liquid securities activities on behalf of other persons', so virtual-asset service providers are not accountable institutions in Lesotho and carry no AML/CFT obligation.
Lesotho is a member of the Eastern and Southern Africa Anti-Money Laundering Group, and its second-round mutual evaluation - on-site 21 November to 2 December 2022, adopted September 2023 - rates Lesotho Non-Compliant on FATF Recommendation 15 on new technologies; the FATF standards bind Lesotho only politically through ESAAMLG and have not been transposed into any domestic virtual-asset obligation.
Virtual-asset service providers owe no customer due diligence, record-keeping or suspicious-transaction reporting duty in Lesotho: those duties under the Money Laundering and Proceeds of Crime Act 2008 attach only to accountable institutions listed in Schedule 1, which after Legal Notice No. 69 of 2024 still contains no virtual-asset activity, and no penalty under that Act can be imposed on a business solely for dealing in virtual assets.
The Money Laundering and Proceeds of Crime Act, 2008 (Act No. 4 of 2008) is Lesotho's foundational AML statute, but virtual asset service providers are not accountable institutions under its Schedule 1: the most recent Schedule amendment, Legal Notice No. 69 of 2024 published 25 June 2024 under section 112 of that Act, inserts only a person conducting safekeeping and administration of cash or liquid securities, and no virtual-asset category has ever been added.
Lesotho has no Financial Intelligence Act 2011: the Financial Intelligence Unit is established by section 14 of the Money Laundering and Proceeds of Crime Act, 2008 as a juristic person responsible to the Minister, suspicious transaction reporting arises under section 18 of that Act and the tipping-off prohibition under section 24(1).
Report Suspicious Transactions: Report to the FIU any transaction (or attempted transaction) where they have reasonable grounds to suspect that it may involve the proceeds of criminal activity, or relates to money laundering or terrorist financing. This includes suspicious activities in virtual assets.
Lesotho operates no cryptocurrency custody licence and no virtual-asset licensing regime of any kind: the Central Bank of Lesotho legislation index lists no virtual-asset instrument, the Bank's press statement of 20 May 2024 places cryptocurrencies outside its regulatory perimeter, and the ESAAMLG mutual evaluation adopted in September 2023 rated Recommendation 15 Non-Compliant.
The Central Bank of Lesotho has issued two public statements on cryptocurrency, on 9 November 2017 and on 20 May 2024; the 20 May 2024 statement warns that cryptocurrencies fall outside the regulatory purview of the Central Bank of Lesotho and that there is no recourse to the Bank in the event of losses, and that offering cryptocurrencies as investment opportunities exposes promoters to sections 27 and 28 of the Capital Market Regulations 2014, which require investment advisers to be licensed by the Bank.
Stance on Crypto: The FIU would be involved in monitoring for illicit financial activities involving cryptocurrencies as part of its broader anti-money laundering and combating the financing of terrorism (AML/CFT) mandate.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a publisher of non-custodial wallet software is not explicitly regulated as a VASP in Lesotho since no dedicated VASP regime exists and the publisher never holds user funds, but AML obligations could theoretically attach under the broad language of existing financial-crimes law, and the Central Bank's public anti-crypto warnings create significant practical and banking-relationship risk.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?