On-shore VASP in Senegal

The BCEAO publicly cautions against crypto-assets — at its 8 May 2026 international conference the Governor cited volatility, cross-border reach, cybersecurity, consumer protection and AML/CFT risks, and in July 2026 stated crypto 'n'est pas une monnaie, ce n'est pas réglementé' — and only the franc CFA has legal tender status in the UMOA. However, 'not regulated' is imprecise: since the UMOA loi uniforme of 31 March 2023 (transposed in Senegal by Loi n° 2024-08), virtual asset service providers are assujettis (art. 3) and may not operate without agrément or prior authorisation (art. 58). A dedicated prudential framework is still being drafted by the BCEAO's crypto-assets committee (C-CRYPTO, created May 2026).

Since the UMOA loi uniforme LBC/FT/FP of 31 March 2023 — transposed in Senegal by Loi n° 2024-08 du 14 février 2024 — VASP activity is no longer unaddressed: art. 58 provides that 'Nul ne peut se livrer à l'activité professionnelle de prestataire de services d'actifs virtuels s'il n'a pas obtenu l'agrément ou l'autorisation préalable de l'autorité compétente', and art. 3(c) makes PSAV assujettis to AML/CFT obligations. What is still missing is an operative licensing regime: the law does not name the competent authority and the BCEAO's crypto-asset regulatory framework remained in preparation as of mid-2026.

No dedicated exchange licence has yet been created in Senegal/UEMOA, but the conclusion needs a different legal basis: art. 58 of the UMOA loi uniforme of 31 March 2023 (in Senegal, Loi n° 2024-08 du 14 février 2024) prohibits carrying on the professional activity of virtual asset service provider — which expressly includes exchange of virtual assets (art. 2(51)) — without agrément or prior authorisation from the competent authority. Operating is therefore unlawful under the AML/CFT law, not merely 'unauthorised' by default.

No dedicated custody licence exists yet, but custody/administration of virtual assets is within the definition of prestataire de services d'actifs virtuels at art. 2(51) of the UMOA loi uniforme of 31 March 2023, and art. 58 makes it unlawful to carry on that activity without agrément or prior authorisation from the competent authority (transposed in Senegal by Loi n° 2024-08 du 14 février 2024).

The fiat leg does fall under the BCEAO payment framework — Instruction n° 001-01-2024 (payment institutions, siège social required in a UMOA state, art. 14) and Instruction n° 008-05-2015 (e-money issuers) — and neither instrument contemplates virtual-asset operations. However, the virtual-asset leg is not left unregulated: it triggers the PSAV authorisation requirement of art. 58 of the UMOA loi uniforme of 31 March 2023 and full AML/CFT assujettissement under Loi n° 2024-08.

Capital Requirements: For licensed financial institutions (like EMIs or PIs), the BCEAO sets minimum capital requirements to ensure financial stability and solvency. These vary depending on the type of institution and services offered. For instance, EMIs usually require significant initial capital.

Senegal is not a member of the FATF (whose membership is 39 jurisdictions); it is a member of GIABA, the FATF-style regional body for West Africa, and was subject to FATF increased monitoring (grey list) until October 2024. AML/KYC obligations on virtual asset activity are also not merely prospective: the UMOA loi uniforme of 31 March 2023, transposed in Senegal by Loi n° 2024-08 du 14 février 2024, already makes PSAV assujettis (art. 3(c)) with customer due diligence, authorisation (art. 58) and CENTIF reporting (art. 60) duties.

Customer due diligence (identity verification).

Ongoing monitoring of transactions.

Reporting of suspicious transactions to the national financial intelligence unit (CENTIF in Senegal).

Risk-based approach to AML.

Local Presence: For any licensed financial institution, a physical presence, management, and operational infrastructure within Senegal (or another UEMOA member state, with appropriate passporting) would be required.

Governance and Management: Robust corporate governance, fit and proper persons requirements for management and shareholders, and clear organizational structures.

Technology and Security: Secure IT systems, data protection measures, and business continuity plans would be essential.

Pre-application discussions with the BCEAO.

Evidence fact sn.licensing.submission-of-a-comprehensive-application not found (may have been renamed).

Business plan detailing services, target market, and operational model.

Evidence of capital.

AML/CFT policies and procedures.

IT and security framework.

Review and due diligence by the BCEAO.

Not legal tender within the UEMOA zone.

Crypto-assets are not recognised as currency and there is still no BCEAO prudential or market-conduct framework for them (a drafting committee, C-CRYPTO, was set up in May 2026 with AMF-UMOA). However, virtual assets and virtual asset service providers ARE legally defined and regulated for AML/CFT purposes: the UMOA Loi uniforme LBC/FT/FP of 31 March 2023 defines 'actif virtuel' (art. 2) and 'prestataire de services d'actifs virtuels' (art. 2), lists PSAV among the assujettis (art. 3) and requires an agrement or prior authorisation to carry on that activity (art. 58); Senegal transposed it by Loi n° 2024-08 du 14 fevrier 2024.

Status: There are no specific mandates or requirements for the use of cold storage for digital assets.

There is indeed no rule in Senegalese or UEMOA law requiring crypto custodians to segregate client digital assets from their own. But the stated premise - that no regulatory framework at all exists - is inaccurate: since the Loi uniforme LBC/FT/FP of 31 March 2023 (transposed by Loi n° 2024-08 du 14 fevrier 2024), VASPs including custodians are assujettis to AML/CFT obligations and need an agrement or prior authorisation (art. 58). What is absent is a prudential/conduct framework, not any framework.

Legislation addressing virtual-asset custody already existed when this was written: the UMOA Council of Ministers adopted the Loi uniforme LBC/FT/FP on 31 March 2023, whose art. 2 brings 'la conservation et l'administration d'actifs virtuels' within the PSAV definition and whose art. 58 requires an agrement or prior authorisation; Senegal enacted the transposing Loi n° 2024-08 on 14 February 2024. Separately, the BCEAO announced in May 2026 that it had set up a committee (C-CRYPTO) to draft a dedicated regional crypto-asset framework with AMF-UMOA; no publication date has been announced.

A Travel Rule exists in Senegal for electronic funds transfers, but not via a BCEAO instruction and not (yet) for virtual assets. It comes from the UMOA Loi uniforme LBC/FT/FP adopted by the UMOA Council of Ministers on 31 March 2023, transposed nationally as Loi n° 2024-08 du 14 février 2024, arts. 39-47 — cross-border transfers must carry originator and beneficiary information regardless of amount (GIABA rates R.16 Largely Compliant). For virtual assets there is no operative Travel Rule: art. 59 of the uniform law leaves PSAV-specific requirements to be 'précisées par les autorités compétentes', and as of July 2026 BCEAO had still not issued a crypto-asset framework, having only created a drafting committee (C-CRYPTO) in May 2026.

There is no 'Instruction n° 15/2021/CM/UEMOA'. The identifier is malformed: the UEMOA/UMOA Council of Ministers (CM) issues Règlements, Directives and Décisions, while BCEAO issues Instructions under a different numbering scheme (e.g. Instruction n° 001-03-2025 du 18 mars 2025). No instrument dated 18 June 2021 governs AML/CFT or transfer information in UEMOA. The applicable instruments are the Loi uniforme LBC/FT/FP adopted 31 March 2023, Senegal's Loi n° 2024-08 du 14 février 2024, Décision n° 021 du 21/12/2023/CM/UMOA and Décision n° 003 du 28/03/2024/CM on thresholds, and BCEAO Instructions n° 001-03-2025, n° 002-03-2025 and n° 003-03-2025 of 18 March 2025.

PSAV (prestataires de services d'actifs virtuels) are listed as assujettis at art. 3 of the UMOA uniform law, transposed by Loi n° 2024-08, so general CDD (arts. 18-20), ongoing vigilance (art. 20) and 10-year record retention (art. 23) do bind them. But the originator/beneficiary information articles (arts. 39-47) are drafted for 'institutions financières', a category defined at art. 2(41) that does not include PSAV (defined separately at art. 2(51)); art. 59 states that the specific requirements and sanctions applicable to PSAV 'sont précisées par les autorités compétentes', and those implementing rules have not been issued. In practice no VASP is licensed or supervised in Senegal — art. 58 requires prior agrément from a competent authority that has not been designated, and BCEAO's crypto framework was still in preparation as of July 2026.

The 'Instruction' referred to does not exist (see sn.travel-rule.effective-date-the-instruction-n). Under Senegal's actual regime, Loi n° 2024-08 arts. 39-47 require originator and beneficiary information on cross-border electronic funds transfers regardless of amount — there is no EUR/USD 1,000 de minimis in the Senegalese text; the FATF R.16 USD/EUR 1,000 figure is an international standard, not the domestic rule. Thresholds for other obligations are set separately by Décision n° 021 du 21/12/2023/CM/UMOA and Décision n° 003 du 28/03/2024/CM. No BCEAO framework yet extends any of this to virtual asset transfers.

Evidence fact sn.travel-rule.information-collection not found (may have been renamed).

Evidence fact sn.travel-rule.record-keeping not found (may have been renamed).

Transaction Monitoring: Systems to monitor transactions for suspicious activities.

The obligation toward the FIU is real and explicit: art. 24 of the UMOA uniform law (transposed in Loi n° 2024-08) requires assujettis to communicate retained records to judicial authorities, State agents and the CENTIF on request, and art. 40 requires collected transfer information to be made available within three working days of a request. The VASP-to-VASP leg is not law in Senegal: it is not implied by any instrument in force, because PSAV-specific requirements under art. 59 have not been issued and no crypto Travel Rule applies.

Data Security and Privacy: Protection of collected data.

Administrative Sanctions: Imposed by the BCEAO, such as:

Criminal liability for money laundering, terrorist financing and proliferation financing in Senegal now arises under Loi n° 2024-08 du 14 février 2024 (LBC/FT/PADM), which repealed Loi n° 2018-03 du 23 février 2018; the 2018 law had already replaced Loi n° 2004-09. Loi n° 2024-08 transposes the UMOA uniform law of 31 March 2023 and, unlike its predecessors, extends the AML/CFT perimeter to prestataires de services d'actifs virtuels (PSAV). Penalties include imprisonment, fines and confiscation of assets (uniform-law arts. 75-82, confiscation defined at art. 22).

Imprisonment for responsible individuals.

Confiscation of assets.

No 'Instruction n° 15/2021/CM/UEMOA' on crypto-asset service providers exists. The instrument appears to be fabricated: the identifier mixes two incompatible conventions (UEMOA Council of Ministers acts are Règlements/Directives/Décisions numbered .../CM/UEMOA; BCEAO Instructions use the form n°001-01-2024). BCEAO's own AML/CFT register lists no such text, and as of the BCEAO's May 2026 international conference and July 2026 statements a crypto-asset framework for the UMOA is still only in preparation (a C-CRYPTO committee was set up in May 2026). The only binding UMOA text touching crypto-asset providers is the uniform AML/CFT law of 31 March 2023 (arts. 58-59 on PSAV).