Custodial wallet / SaaS in Togo
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is not permitted in Togo.
Verdict Details
- Permitted
- no
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- KYC/CDD obligations under Loi n° 2018-009 du 22 juin 2018 (Togo's national AML/CFT law) — identify and verify customers and beneficial owners
- Ongoing transaction monitoring for suspicious activity
- Suspicious Transaction Reporting (STRs) to CENTIF (Cellule Nationale de Traitement des Informations Financières), Togo's FIU
- Record-keeping of customer identification and transactions for the period specified under national AML/CFT law
- Screening customers and transactions against the UN Consolidated Sanctions List (binding international law for UN member states)
- Recommend screening against OFAC SDN List if custody service involves USD, U.S. persons, or U.S.-based infrastructure
- Recommend screening against EU Consolidated Financial Sanctions List if service involves EU persons or EU financial system
- FATF Recommendation 15 obligations (Travel Rule) would apply if VASPs are designated as reporting entities under Togo's AML framework
- VASPs would be expected to adhere to FATF principles as financial institutions or DNFBPs under the underlying AML/CFT regime
Key Restrictions
- BCEAO Circular No. 00000002/RB/2020 explicitly prohibits regulated financial institutions (banks, microfinance, payment service providers) in WAEMU from engaging in ANY crypto-related activities including buying, selling, holding, or facilitating transactions
- No custody-license or qualified-custodian framework exists for virtual assets in Togo or WAEMU
- Financial institutions cannot legally provide banking services to crypto custodians, making fiat on/off ramps effectively impossible
- No segregation, insurance, or proof-of-reserves rules exist for crypto custody
- Any custodial wallet/SaaS operation would be unlicensed and unregulated, operating entirely outside the formal financial system
Key Risks
- Complete regulatory vacuum — no license to obtain means no legal pathway to operate as a compliant custodial wallet provider
- Inability to establish banking relationships: BCEAO prohibition means local financial institutions cannot work with crypto entities, making fiat conversion and banking integration impossible
- Enforcement risk from BCEAO warnings and general AML/CFT enforcement — CENTIF could pursue actions under national AML law even without crypto-specific legislation
- No consumer protection or legal recourse for custodial losses given the unregulated status
- Tax/operational ambiguity — no clear framework for corporate structure, tax treatment, or dispute resolution for custodial services
- Reputational risk of operating in a jurisdiction where the central bank has publicly and repeatedly warned against virtual assets
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
'BCEAO Circular No. 00000002/RB/2020 on the Prohibition of the Use of Cryptocurrencies and other Digital Assets in WAEMU Member States' does not exist. No BCEAO instrument prohibits cryptocurrency in UEMOA. The numbering format is also wrong: BCEAO instructions are numbered nnn-mm-yyyy (e.g. Instruction n° 008-05-2015), never with an /RB/ segment. The BCEAO's exhaustive published index of payment-system instruments 2002-2024 contains no such circular, and bceao.int returns nothing on crypto-actifs beyond the 8 May 2026 Dakar conference. The real constraint is art. 58 of the Loi uniforme of 31 March 2023: professional PSAV activity requires prior agrement from a competent authority which no member state has designated.
No BCEAO instrument prohibits banks, microfinance institutions or payment service providers from buying, selling, holding or facilitating cryptocurrency transactions. This is the phantom-BCEAO-ban pattern in its fullest form. What exists is: (i) art. 58 of the Loi uniforme of 31 March 2023 requiring prior agrement for professional PSAV activity, with art. 59 deferring the detail to a competent authority no state has designated; and (ii) verbal caution from BCEAO leadership (Governor Kassi Brou, July 2026). A warning is not a prohibition, and no UEMOA text restricts what financial institutions may do with crypto-assets.
No BCEAO directive prohibits banks, microfinance institutions or payment service providers in Togo from crypto activity — no such instrument exists. The BCEAO's own exhaustive payment-systems register lists 12 instruments from 2002 to 2024 and contains nothing on crypto-actifs or stablecoins; a full-text fetch of Instruction n° 008-05-2015 (e-money) returns zero occurrences of 'crypto', 'actif virtuel', 'stablecoin' or 'blockchain'. As of the 8 May 2026 Dakar conference the BCEAO had only just created the C-CRYPTO drafting committee, and as of July 2026 was still drafting a roadmap. The real constraint is national and different in kind: art. 58 of Loi n° 2026-001 makes professional PSAV activity conditional on a prior agrément from an 'autorité compétente' that art. 59 leaves undesignated — so no agrément can be obtained. That Togolese banks decline crypto counterparties is commercial de-risking, not compliance with a prohibition. The claim's practical conclusion ('you cannot legally buy or sell crypto through traditional banks') therefore lands near the right outcome via a fabricated cause.
'Unlicensed' is right; 'unregulated' is wrong. Art. 58 of Loi n° 2026-001 du 2 mars 2026 provides that 'Nul ne peut se livrer à l'activité professionnelle de prestataire de services d'actifs virtuels s'il n'a pas obtenu l'agrément ou l'autorisation préalable de l'autorité compétente', and art. 59 defers the specific requirements and sanctions to 'les autorités compétentes' — which Togo has not designated. So any exchange operating in Togo is necessarily unlicensed, and indeed in breach of art. 58, since no licence can be issued. But it is not outside regulation: a PSAV is an assujetti under art. 3, owes customer due diligence and suspicious-transaction reporting to CENTIF-Togo under art. 60, and must retain records for 10 years under art. 23. 'Operating outside the formal financial system' is a description of banking practice, not a legal status.
High Risk and Unregulated: However, the environment is highly risky. There is no consumer protection, no regulatory oversight for exchanges operating in the grey area, and no legal recourse if funds are lost.
Togo is a UEMOA/UMOA member and the BCEAO is the common central bank for the eight member states. However, the BCEAO has issued no formal public communique warning about virtual currencies at the cited URL, which redirects silently to the BCEAO homepage. The BCEAO's documented position as of August 2026 rests on (i) Governor Kassi Brou's July 2026 statement ('Ce n'est pas une monnaie. Ce n'est pas reglementee. Donc soyez prudents.') and (ii) the 8 May 2026 Dakar crypto-asset conference launching the C-CRYPTO drafting committee. The substance of the claim (not legal tender, not regulated by the BCEAO, users bear the risk) is correct; the evidentiary basis ('consistently issued warnings', with a specific communique) is not.
Lack of Specific Crypto Legislation: Like many countries in the region, Togo has not yet enacted comprehensive, standalone legislation specifically regulating virtual assets or cryptocurrency service providers. Discussions are ongoing at the UEMOA level, but concrete national laws and enforcement frameworks are still developing.
Evidence fact tg.enforcement.absence-of-specific-enforcement-actions not found (may have been renamed).
Togo's National AML/CFT Law:
The instrument number and date are wrong, and the substance is outdated. Togo's pre-2026 AML/CFT statute was the loi uniforme n° 2018-004 du 4 mai 2018 relative a la lutte contre le blanchiment de capitaux et le financement du terrorisme — not 'Loi n° 2018-009 du 22 juin 2018'. That 2018 law has been superseded by Loi n° 2026-001 du 2 mars 2026 relative a la lutte contre le blanchiment de capitaux, le financement du terrorisme et de la proliferation des armes de destruction massive (JO n° 71, numero special, 2 mars 2026), which transposes the UMOA loi uniforme du 31 mars 2023. Adoption sequence: Assemblee nationale first reading 29 December 2025, Senat 26 February 2026, Assemblee nationale definitive adoption 27 February 2026, promulgation 2 March 2026. Contrary to the claim, the governing law does NOT rely on 'broad definitions ... interpreted to encompass new technologies': it defines actif virtuel (art. 2(2)) and PSAV (art. 2(51), custody included) explicitly and makes PSAV assujettis at art. 3(c). Record retention is 10 years (art. 23).
VASP Obligations: Under this law, VASPs (once regulated as reporting entities or covered by broad definitions) would be required to:
Compliance Requirement: FATF Recommendation 15 specifically addresses virtual assets and VASPs, requiring countries to regulate VASPs for AML/CFT purposes, license/register them, and apply the "Travel Rule" (requiring VASPs to obtain and transmit originator and beneficiary information for virtual asset transfers).
Outdated framing. Since Loi n° 2026-001 du 2 mars 2026 (JO de la Republique Togolaise n° 71, numero special, 2 mars 2026) — Togo's transposition of the UMOA loi uniforme LBC/FT/FP du 31 mars 2023 — PSAV are EXPRESSLY designated, not merely 'implicitly covered under existing definitions': art. 2(2) defines 'actif virtuel', art. 2(51) defines 'prestataire de services d'actifs virtuels' (including at (d) 'conservation et/ou administration d'actifs virtuels ou d'instruments permettant le controle d'actifs virtuels'), and art. 3(c) lists 'les Prestataires de Services d'Actifs Virtuels' among the assujettis alongside institutions financieres and EPNFD. What remains true is that the regime is not operational: art. 58 prohibits professional PSAV activity without prior agrement or autorisation, but art. 59 defers all PSAV-specific requirements and sanctions to 'les autorites competentes', and Togo — like every other UEMOA state as of August 2026 — has designated no such authority. So no licence can actually be obtained. Also note the obligations flow from Togolese/UEMOA statute, not from 'adherence to FATF principles': Togo is a GIABA member, not a FATF member.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Not permitted — Togo (as a WAEMU member) is subject to BCEAO Circular No. 00000002/RB/2020 which prohibits regulated financial institutions from engaging in crypto activities, there is no custody-license or VASP regulatory framework in place, and any custodial wallet/SaaS operation would be unlicensed, unable to access banking services, and operating in a high-risk legal grey area with no consumer protections.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?