Is Crypto Legal in Uganda?

Uganda operates no licensing regime and no supervisory framework for virtual asset service providers and has designated no VASP supervisor, but VASPs are accountable persons under paragraph 16 of Schedule 2 to the Anti-Money Laundering Act, Cap. 118, inserted by SI 136 of 2020, and must register with the Financial Intelligence Authority.

The operative Bank of Uganda measure is the circular of 29 April 2022, signed by Andrew Kawere, Director of National Payments System, which states that the Bank has not licensed any institution to sell or facilitate trade in cryptocurrencies and directs all entities licensed under the National Payment Systems Act, 2020 to desist from facilitating cryptocurrency transactions under sections 13(1)(b) and (f) of that Act; the circular dates from 2022, not 2021.

The Bank of Uganda has not licensed any institution to sell cryptocurrencies or to facilitate trade in cryptocurrencies, and its Governor states that virtual assets are not legal tender in Uganda and that participation is at one's own risk.

Reference: Bank of Uganda, Public Notice on Cryptocurrencies (various notices, e.g., November 2021, March 2019, generally found in their press release archives). While specific direct URLs for older press releases can be hard to pinpoint consistently, searching "Bank of Uganda cryptocurrencies" on their official website (www.bou.or.ug) will yield relevant advisories.

Uganda's payment-services statute is the National Payment Systems Act, 2020 (Act 15 of 2020, Cap. 59), assented on 29 July 2020 and commenced on 4 September 2020, supplemented by the National Payment Systems Regulations, 2021 gazetted on 5 March 2021; the Act carries no reference to virtual assets, cryptocurrency or digital currency.

Uganda's payment-services statute is the National Payment Systems Act, 2020 (Act 15 of 2020, Cap. 59), assented on 29 July 2020 and commenced on 4 September 2020, supplemented by the National Payment Systems Regulations, 2021 gazetted on 5 March 2021; the Act carries no reference to virtual assets, cryptocurrency or digital currency.

National Payment Systems Regulations, 2021: (Often published as a statutory instrument, typically available via the Uganda Legal Information Institute or Ministry of Finance archives).

Relevance: The NPS Act and its regulations govern the operation of payment systems and the licensing of payment service providers (PSPs). While it does not explicitly mention cryptocurrencies, an argument could be made that any entity facilitating fiat-to-crypto or crypto-to-fiat transactions, or otherwise dealing with funds in a way that resembles traditional payment services, might fall under the purview of these laws. However, the BOU has not clarified how these laws apply to crypto-specific businesses.

Current Situation: No specific license. Many operate in a grey area.

Potential Interpretation: If an exchange facilitates transactions between fiat currency and virtual assets (or vice versa), it could theoretically be deemed to be performing functions similar to a money remitter or payment service provider. In such a scenario, they might be required to obtain a Payment Service Provider (PSP) license or a Payment System Operator (PSO) license under the National Payment Systems Act, 2020, regulated by the Bank of Uganda.

Requirement for a PSP/PSO License (General): This would entail meeting the requirements for traditional payment service providers.

Current Situation: No specific license. Many operate in a grey area.

Potential Interpretation: Unless the custody service is directly tied to a payment system or involves managing traditional financial assets alongside virtual assets, it is highly unlikely to fall under any existing financial services licensing regime. These entities currently operate without specific oversight.

Current Situation: No specific license. Many operate in a grey area.

If the processing involves converting fiat to crypto, or crypto to fiat for merchants/users, it again might be seen as a Payment Service Provider (PSP) under the NPS Act.

If the processor only handles crypto-to-crypto payments for merchants (e.g., accepting Bitcoin and paying the merchant in Ethereum), it would likely fall outside current licensing requirements.

Requirement for a PSP License (General): As above.

Uganda operates no licensing regime for virtual asset service providers, but a registration regime does exist: SI 136 of 2020 of 27 November 2020 amended the Second Schedule to the Anti-Money Laundering Act, 2013 to make VASPs accountable persons, and they appear at paragraph 16 of that Schedule with a duty to register with the Financial Intelligence Authority.

Current: No specific capital requirements for crypto businesses.

Hypothetical (based on PSPs): For a Payment Service Provider license under the NPS Act, there are minimum paid-up capital requirements (e.g., UGX 100 million for Tier 1 PSPs, UGX 10 billion for Tier 2 PSPs like e-money issuers – these figures are indicative and subject to change by the BOU). A future crypto license would likely have similar or tailored capital requirements depending on the scope of services.

Uganda does have crypto-specific anti-money-laundering law: the Anti-Money Laundering Act, 2013 (Act 12 of 2013, Cap. 118) was amended by SI 136 of 2020 to add virtual asset service providers to its Second Schedule as accountable persons, and they must register with the Financial Intelligence Authority and discharge the full accountable-person duties.

Reference: Anti-Money Laundering Act, 2013 (and subsequent amendments, available via Uganda Legal Information Institute: https://www.ulii.org/ug/legislation/act/2013/6)

Relevance: Financial Institutions and designated non-financial businesses and professions (DNFBPs) are subject to AML obligations. Although VASPs are not explicitly listed as "financial institutions" under the current AML Act, any entity dealing with funds or facilitating financial transactions is expected to implement AML/KYC measures in practice to avoid involvement in illicit activities. Any future VASP regulation would certainly impose strict AML/KYC obligations, including:

Customer Due Diligence (CDD) procedures.

Reporting of suspicious transactions (STRs) to the Financial Intelligence Authority (FIA).

Current: No specific requirement for crypto businesses.

Hypothetical (based on traditional financial services): For regulated financial services, a local physical presence, local incorporation, and often local management and directors are typically required. This would almost certainly be a requirement for any future VASP license, ensuring local oversight and accountability.

Initial Consultation: Informal discussions with the Bank of Uganda.

Application Submission: Submitting a formal application to the BOU, including:

Company incorporation documents (must be a Ugandan entity).

Detailed business plan, including services offered, target market, operational procedures.

Technical and security specifications of the platform/technology.

Proof of capital (e.g., audited financial statements, bank statements).

AML/CFT Policy and Compliance Manual.

Information on key personnel (directors, senior management) – including background checks and fit-and-proper assessments.

Review and Due Diligence: The BOU would conduct a thorough review of the application, including site visits, interviews, and technical assessments.

Provisional Approval: If satisfactory, the BOU might grant provisional approval.

Final Approval and Licensing: Upon meeting all conditions, the BOU would issue the final license.

Ongoing Compliance: Licensees would be subject to ongoing supervision, reporting requirements, and compliance audits by the BOU.

Closely monitor regulatory developments: The landscape is dynamic, and new laws could emerge.

Seek legal counsel: Obtain specific legal advice on how existing laws might apply to their particular business model.

Implement strong internal controls: Proactively adopt international best practices for AML/KYC, cybersecurity, and consumer protection, as these will undoubtedly form the foundation of any future regulatory framework.

The Uganda shilling is the sole legal tender under section 23 of the Bank of Uganda Act (Statute 5 of 1993, Chapter 51), and no Ugandan instrument confers legal-tender status on any cryptocurrency; the Bank of Uganda's operative measure is its circular of 29 April 2022 to National Payment Systems Act licensees, which states that the Bank has not licensed any institution to sell cryptocurrencies or to facilitate the trade in cryptocurrencies.

Uganda has no virtual asset service provider licensing regime: the National Payment Systems Act 2020 (Act 15 of 2020) licenses only payment systems, payment service providers and electronic money issuers and never mentions virtual assets, cryptocurrency or digital currency, and the National Payment Systems Regulatory Sandbox Framework 2021 made under section 16 of that Act is equally silent; Ugandan virtual asset service providers are nonetheless accountable persons at paragraph 16 of Schedule 2 to the Anti-Money Laundering Act 2013 and must register with the Financial Intelligence Authority.

The Bank of Uganda's circular of 29 April 2022, signed by Andrew Kawere, Director of National Payments System, directs all entities licensed under the National Payment Systems Act 2020 to desist from facilitating cryptocurrency transactions and invokes sections 13(1)(b) and 13(1)(f) of that Act; the Financial Institutions Act 2004 (Act 2 of 2004, Chapter 57) carries no virtual-asset provision and confers no such prohibition on banks as such.

Bank of Uganda communications on virtual assets comprise a February 2017 statement on One Coin Digital Money operations, a 2019 warning delivered as a speech by Deputy Governor Louis Kasekende at Masaka, and the operative circular of 29 April 2022 addressed to National Payment Systems Act licensees rather than to the public; a speech creates no obligation, and the 2022 circular binds licensees only.

The Bank of Uganda issues currency under the Bank of Uganda Act (Statute 5 of 1993, Chapter 51) and licenses and supervises financial institutions under the Financial Institutions Act 2004 (Act 2 of 2004, Chapter 57) and payment providers under the National Payment Systems Act 2020, but it does not supervise all financial activity: the Capital Markets Authority licenses securities business under the Capital Markets Authority Act, Chapter 84, and no Ugandan authority is designated to supervise virtual asset service providers.

Ugandan virtual asset service providers are accountable persons at paragraph 16 of Schedule 2 to the Anti-Money Laundering Act 2013 (Act 12 of 2013, Chapter 118), inserted by the Anti-Money Laundering (Amendment of Second Schedule) Instrument 2020 (Statutory Instrument 136 of 2020) with effect from 27 November 2020, and must register with the Financial Intelligence Authority under section 21 of that Act; the duty is express and unconditional rather than contingent on whether a firm holds any licence.

The Capital Markets Authority of Uganda has taken no published position on virtual assets: its regulatory-notices index carries no notice on cryptocurrency, virtual assets or digital assets, and the four applications under review in the sandbox it launched in October 2025 comprise a retail fixed-income platform, an institutional fixed-income platform using blockchain settlement, a crowdfunding platform and one unspecified applicant, with no crypto or virtual-asset firm among them.

Uganda has no Bank of Uganda Act of 2000; the central bank statute is the Bank of Uganda Act, Statute 5 of 1993, commenced 14 May 1993 and consolidated as Chapter 51, and the Bank of Uganda's operative virtual-asset measure rests on sections 13(1)(b) and 13(1)(f) of the National Payment Systems Act 2020, not on the central bank statute.

Reference (via Uganda Legal Information Institute - ULII): https://www.uli.ug/uganda/legislation/act/2000/5/bank-uganda-act-2000

The Financial Institutions Act 2004 (Act 2 of 2004, Chapter 57), commenced 26 March 2004, empowers the Bank of Uganda to license and supervise financial institutions but carries no virtual-asset provision; the Bank of Uganda's circular of 29 April 2022 barring cryptocurrency facilitation was addressed to licensees under the National Payment Systems Act 2020 and invokes sections 13(1)(b) and 13(1)(f) of that Act.

Virtual assets are explicitly named in Uganda's anti-money-laundering law: paragraph 16 of Schedule 2 to the Anti-Money Laundering Act 2013 (Act 12 of 2013, Chapter 118) lists Virtual Asset Service Providers as accountable persons, inserted by the Anti-Money Laundering (Amendment of Second Schedule) Instrument 2020 (Statutory Instrument 136 of 2020) with effect from 27 November 2020, so their obligations rest on express designation rather than on inference from the Financial Intelligence Authority's general mandate.

No Ugandan statute prohibits an individual from holding or trading virtual assets: the National Payment Systems Act 2020, the Financial Institutions Act 2004 and the Bank of Uganda Act contain no such prohibition, and the Bank of Uganda's only operative measure is its circular of 29 April 2022 directing National Payment Systems Act licensees, not individuals, to desist from facilitating cryptocurrency transactions.

Uganda licenses no cryptocurrency exchange or other virtual asset service provider: the Bank of Uganda's circular of 29 April 2022 states that the Bank has not licensed any institution to sell cryptocurrencies or to facilitate the trade in cryptocurrencies, ESAAMLG records that no registration or licensing requirement applies to VASPs before they begin operating, and Governor Michael Atingi-Ego told the Kampala Blockchain Summit on 25 November 2025 that Kenya had begun licensing its first virtual asset service providers while Uganda had none.

The Bank of Uganda's circular of 29 April 2022 directs entities licensed under the National Payment Systems Act 2020 - payment system operators, payment service providers and electronic money issuers - to desist from facilitating cryptocurrency transactions, invoking sections 13(1)(b) and 13(1)(f) of that Act; no Ugandan instrument imposes an equivalent express prohibition on banks licensed under the Financial Institutions Act 2004.

Ugandan virtual asset service providers owe anti-money-laundering duties by express designation rather than by residual scrutiny: paragraph 16 of Schedule 2 to the Anti-Money Laundering Act 2013 lists them as accountable persons, and section 21 of that Act empowers the Financial Intelligence Authority to register accountable persons and to keep a register of them, with registration made mandatory by the Authority's signed January 2024 registration guidelines.

Risk for Users: Users engaging with unlicensed exchanges face significant risks, including the lack of security, potential for fraud, and no legal protection for their funds.

Uganda's Anti-Money Laundering Act, 2013 (Act 12 of 2013), consolidated as Chapter 118, imposes its obligations on accountable persons, defined as any person listed in its Second Schedule, and section 18 establishes the Financial Intelligence Authority; the Act reaches virtual asset service providers by express designation rather than by interpretation, because the Anti-Money Laundering (Amendment of Second Schedule) Instrument, 2020 (Statutory Instrument 136 of 2020) added virtual asset service providers to that Schedule with effect from 27 November 2020, and they stand as paragraph 16 of Schedule 2 in the Financial Intelligence Authority's signed registration guidelines of January 2024, which require every accountable person to register with the Authority.

Uganda's Anti-Money Laundering Regulations, 2015 are Statutory Instrument 75 of 2015, made on 24 December 2015 under the Anti-Money Laundering Act, 2013, and they do carry the implementing detail the claim describes: Part V, regulations 13 to 27, sets out customer due diligence and verification for natural persons, foreign nationals, entities, partnerships and trustees; regulation 42 requires an accountable person to keep transaction and due-diligence records for a minimum of five years from completion of the relevant business or transaction; and regulation 39 governs suspicious transaction reporting to the Financial Intelligence Authority, with regulation 39(3) additionally requiring reports of cash transactions above one thousand currency points.

Uganda has no Financial Intelligence Authority Act, of 2013 or of any year; the Uganda Legal Information Institute's consolidated index of legislation carries no such title. The Financial Intelligence Authority is established by section 18 of the Anti-Money Laundering Act, 2013 (Act 12 of 2013), Chapter 118, which reads 'There is established a Financial Intelligence Authority', and the Authority's functions of receiving, analysing and disseminating financial intelligence flow from that Act rather than from a separate statute.

The Bank of Uganda Act is Chapter 54 under Uganda's current revision, Chapter 51 having been its number only in the Revised Edition of 2000; the Act originates as Statute 5 of 1993, commenced 14 May 1993, and its text contains no provision on virtual assets, cryptocurrency, digital currency or blockchain. The Bank of Uganda's operative virtual-asset instrument is not the Bank of Uganda Act but its circular to National Payment Systems licensees of 29 April 2022, issued under sections 13(1)(b) and (f) of the National Payment Systems Act, 2020, which states that the Bank has licensed no institution to sell or facilitate trade in cryptocurrencies and directs licensees to desist from facilitating cryptocurrency transactions.

Individual Customers: Obtain and verify the customer's full name, permanent address, date of birth, national identification number (e.g., National ID, passport), and other relevant identification documents.

Legal Entities (Companies, etc.): Obtain and verify the company's registered name, legal form, proof of incorporation, physical address, business registration number, tax identification number, and details of directors, beneficial owners, and authorized signatories.

Beneficial Ownership: Identify and verify the identity of the beneficial owner(s) – the natural person(s) who ultimately own or control the customer, or the natural person(s) on whose behalf a transaction is being conducted.

Purpose and Intended Nature of Business Relationship: Understand the purpose and intended nature of the business relationship or the transaction.

Ongoing Monitoring: Continuously monitor the business relationship and transactions undertaken by the customer to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile, including the source of funds where necessary.

Enhanced Due Diligence (EDD): Apply EDD for higher-risk customers, transactions, or business relationships. This includes:

Customers from high-risk jurisdictions (identified by FATF or local authorities)

Transactions involving large amounts or complex structures

Transactions with no apparent economic or lawful purpose.

Simplified Due Diligence (SDD): May be applied in limited circumstances where the risk of money laundering or terrorist financing is lower, as permitted by the regulations.

Report Suspicious Transactions: Report any transaction (attempted or completed) where there is a reasonable suspicion that the funds involved are proceeds of crime, or are linked to money laundering, terrorist financing, or proliferation financing.

Regulation 39 of Uganda's Anti-Money Laundering Regulations, 2015 (Statutory Instrument 75 of 2015) requires an accountable person to report a suspicious transaction to the Financial Intelligence Authority as soon as is practicable and in any case not later than forty-eight hours, on the prescribed form, while section 9(2) of the Anti-Money Laundering Act, 2013 sets the statutory limit as without delay and not later than two working days from the date the suspicion was formed, so the forty-eight-hour figure is the regulation's and the two-working-day figure is the Act's.

No Tipping-Off: Not disclose to the customer or any third party that a suspicious transaction report has been made or that a money laundering investigation is being conducted.

Customer Identification Records: All records obtained during CDD processes (identification documents, verification records, beneficial ownership information).

Transaction Records: Records of all domestic and international transactions, including the amount, currency, date, type of transaction, and parties involved. For virtual assets, this would include wallet addresses, transaction hashes, and amounts.

Section 7(2)(a) of Uganda's Anti-Money Laundering Act 2013 requires an accountable person to keep account files and business correspondence, including the results of any analysis undertaken and copies of documents evidencing the identities of customers and beneficial owners.

Uganda's Anti-Money Laundering Act 2013 s. 7(3) requires records to be kept for a minimum period of ten years from the date on which the evidence of identity of a person was obtained, the date of any transaction or correspondence, or the date on which the account is closed or the business relationship ceases, whichever is the later.

Bank of Uganda Circular on Virtual Currencies (2022): While a direct URL for a circular may be ephemeral, the BOU regularly publishes such statements. A general search for "Bank of Uganda virtual currency statement" often yields news articles or official press releases reflecting this stance. For example, a common reference point is the Bank of Uganda Governor's statements regarding financial innovation and risks.

Virtual asset service providers are accountable persons under Uganda's Anti-Money Laundering Act 2013: Statutory Instrument 136 of 2020, effective 27 November 2020, amended the Second Schedule to add them, they appear as paragraph 16 of Schedule 2 in the FIA's signed January 2024 registration guidelines, and they must register with the Financial Intelligence Authority.

Legal Reference: The Anti-Money Laundering Act, 2013 (as amended) (PDF hosted by FIA)

Uganda's Anti-Terrorism Act, 2002 is Act 14 of 2002, assented on 21 May 2002 and commenced on 7 June 2002 and amended in 2015, 2016 and 2017; Part V criminalises financial assistance for terrorism, and the Anti-Terrorism Regulations 2025 made under it implement United Nations Security Council targeted financial sanctions in Uganda.

Legal Reference: A specific, easily accessible online version of the amended Act can be hard to pinpoint. Often, legal databases or government gazettes are the source. A general search for "Uganda Anti-Terrorism Act" will point to its existence.

Uganda's Financial Intelligence Authority receives suspicious transaction reports from accountable persons under s. 9(1) of the Anti-Money Laundering Act 2013 and issues guidelines to them, including the signed Online Registration Guidelines for Accountable Persons of January 2024 that require registration with the Authority.

Reference: Financial Intelligence Authority (FIA) Uganda Website

Uganda implements United Nations Security Council targeted financial sanctions through the Anti-Terrorism Regulations 2025 made under the Anti-Terrorism Act 2002, under which the Financial Intelligence Authority circulates designations to accountable persons within four hours and freezing is required without delay, without prior notice to the designated party, and within twenty-four hours.

Ugandan virtual asset service providers must screen customers and transactions against United Nations designations and freeze the funds of designated persons because SI 136 of 2020 made them accountable persons at paragraph 16 of Schedule 2 to the Anti-Money Laundering Act 2013, and the Anti-Terrorism Regulations 2025 impose the freezing and dealing prohibition on accountable persons.

Legal Reference: United Nations Security Council Sanctions Committees

OFAC Sanctions (U.S. Department of the Treasury's Office of Foreign Assets Control):

Extraterritorial Reach: OFAC sanctions have significant extraterritorial reach. Any VASP that uses US dollar clearing, has US customers, servers, or any operational nexus with the US, is directly subject to OFAC regulations, regardless of where they are incorporated. This effectively includes most globally connected VASPs.

Ugandan virtual asset service providers must screen customers and transactions against United Nations designations and freeze the funds of designated persons because SI 136 of 2020 made them accountable persons at paragraph 16 of Schedule 2 to the Anti-Money Laundering Act 2013, and the Anti-Terrorism Regulations 2025 impose the freezing and dealing prohibition on accountable persons.

Legal Reference: OFAC's Sanctions Programs and Country Information

Guidance on Virtual Currency: OFAC has issued specific guidance on applying sanctions to virtual currency, emphasizing that its regulations apply to virtual currency just as they do to traditional fiat currency.

Legal Reference: OFAC's A Framework for OFAC Compliance Commitments (2019) (PDF, refers to virtual currency obligations) and various FAQs.

Jurisdictional Reach: EU sanctions apply to all EU nationals and entities, regardless of where they operate, and to non-EU entities conducting business within the EU. Given global financial interconnectivity, VASPs with any European nexus (customers, partners, funding) must comply.

Ugandan virtual asset service providers must screen customers and transactions against United Nations designations and freeze the funds of designated persons because SI 136 of 2020 made them accountable persons at paragraph 16 of Schedule 2 to the Anti-Money Laundering Act 2013, and the Anti-Terrorism Regulations 2025 impose the freezing and dealing prohibition on accountable persons.

Legal Reference: EU Financial Sanctions Map

Implement Robust KYC/CDD: Conduct thorough Know Your Customer (KYC) and Customer Due Diligence (CDD) procedures to identify all parties involved in a transaction.

Screen Against Sanctions Lists: Regularly screen all customers, beneficial owners, and transaction counterparties against:

OFAC's SDN List and other relevant OFAC lists.

Geographic Screening: Identify and flag transactions involving high-risk or sanctioned jurisdictions.

Transaction Monitoring: Implement systems to monitor transactions for patterns indicative of sanctions evasion or illicit activity (e.g., unusual transaction sizes, rapid movements of funds to high-risk areas).

An accountable person in Uganda must report a suspicious transaction to the Financial Intelligence Authority under s. 9(1) of the Anti-Money Laundering Act 2013 regardless of the value of the transaction, without delay and not later than two working days from the date the suspicion was formed, and s. 9(6) bars disclosing to the customer or any other person that a report has been or will be made.

Sanctioned Countries: Countries comprehensively sanctioned by the UN, OFAC (e.g., Cuba, Iran, North Korea, Syria), or the EU.

High-Risk Jurisdictions: Jurisdictions identified by FATF or other bodies as having strategic AML/CTF deficiencies.

Under the Anti-Money Laundering Act, 2013:

Uganda's Anti-Money Laundering Act, 2013 (Act 12 of 2013) provides for search and seizure of tainted property (sections 61, 66 and 67), restraining orders (sections 71 to 82) and confiscation on conviction (sections 83 and 86), and its interpretation section defines property as assets of every kind whether corporeal or incorporeal, wide enough to reach virtual assets, while the Act itself creates no virtual-asset category and no virtual-asset freezing power.

Under the Anti-Terrorism Act, 2002:

Even harsher penalties, including lengthy imprisonment, apply for financing terrorism.

International Penalties: Non-compliance with OFAC or EU sanctions can lead to massive fines (billions of USD/EUR), criminal charges, and exclusion from international financial systems, regardless of the VASP's Ugandan operations.

Virtual assets are not legal tender in Uganda: Bank of Uganda Governor Michael Atingi-Ego confirmed at the Blockchain Summit in Kampala on 25 November 2025 that the central bank 'stated publicly that virtual assets are not legal tender and that participation is at one's own risk'.

The Bank of Uganda neither licenses nor supervises virtual assets or virtual asset service providers: its circular of 29 April 2022 states that it 'has not licensed any institution to sell cryptocurrencies or to facilitate the trade in crypto-currencies', and ESAAMLG's 7th Follow-Up Report of September 2021 records that Uganda has no designated supervisory authority for VASPs. Ugandan VASPs are nonetheless accountable persons at paragraph 16 of Schedule 2 to the Anti-Money Laundering Act, 2013 and must register with the Financial Intelligence Authority.

The Bank of Uganda's circular of 29 April 2022, signed by Andrew Kawere, Director of National Payments System, and invoking sections 13(1)(b) and (f) of the National Payment Systems Act, 2020, directs entities licensed under that Act to desist from facilitating cryptocurrency transactions; it is addressed to payment system licensees rather than to banks generally, and it imposes no rule on holding virtual assets on behalf of clients.

Uganda operates no licence, authorisation or registration category for virtual-asset or digital-asset custody; ESAAMLG's 7th Follow-Up Report of September 2021 records that 'there is no registration or licensing requirements for VASPs before they start operating their business in Uganda', and the position was unchanged when the Governor of the Bank of Uganda called for a licensing framework on 25 November 2025.

This is because regulated financial institutions are currently prohibited from engaging in these activities. Any entity attempting to provide such services would operate in an unregulated space, with potential legal and operational risks.

Licences issued under Uganda's National Payment Systems Act, 2020 (Act 15 of 2020, Chapter 59) and the Financial Institutions Act, 2004 (Act 2 of 2004, Chapter 57) confer no authority over virtual-asset custody: neither statute mentions virtual assets, cryptocurrency or digital assets, and the Bank of Uganda's circular of 29 April 2022 directs National Payment Systems Act licensees away from cryptocurrency altogether.

National Payment Systems Act, 2020: https://ulii.org/ug/legislation/act/2020/8 (This Act governs traditional payment service providers and e-money issuers, but not digital asset custodians.)

Financial Institutions Act, 2004: https://ulii.org/ug/legislation/act/2004/2 (This governs traditional banking institutions.)

Segregation of Client Assets Rules:

Uganda imposes no segregation requirement on client virtual assets and recognises no virtual-asset custodian in any instrument; virtual asset service providers nevertheless operate lawfully and are accountable persons at paragraph 16 of Schedule 2 to the Anti-Money Laundering Act, 2013, so the absence of a segregation rule reflects the absence of any prudential regime rather than a prohibition on the activity.

Uganda's National Payment Systems Act, 2020 requires payment service providers and electronic money issuers to hold customer funds in trust accounts, at sections 49 to 52 covering trust accounts, duties of trustees, special accounts and protection of trust and special accounts, and the Financial Institutions Act, 2004 governs banks; neither regime extends to virtual assets, so no Ugandan segregation duty attaches to client crypto holdings.

Uganda imposes no insurance, bonding or indemnity requirement on virtual-asset custodians, because no Ugandan instrument creates a virtual-asset custodian category at all; the National Payment Systems Act, 2020 and the Bank of Uganda's National Payment Systems Regulatory Sandbox Framework, 2021 are both silent on virtual assets, and ESAAMLG records that Uganda has no VASP registration, licensing or supervisory regime.

Capital adequacy and prudential requirements under Uganda's Financial Institutions Act, 2004 and the National Payment Systems Act, 2020 bind only licensed banks and payment institutions and address no virtual-asset exposure, while virtual asset service providers in Uganda owe no capital, liquidity or prudential requirement of any kind, since Uganda has designated no prudential supervisor for them.

No Ugandan instrument mandates cold storage, hot-wallet limits or any key-management standard for virtual assets; the only official Ugandan text that discusses cold storage is the Financial Intelligence Authority's Virtual Assets Working Document of February 2023, which describes offline, paper and hardware wallets in explanatory terms and imposes nothing.

Ugandan law defines no 'qualified custodian' for digital assets; the expression belongs to United States securities regulation and has no standing in Uganda, whose only virtual-asset legal category is the virtual asset service provider listed at paragraph 16 of Schedule 2 to the Anti-Money Laundering Act, 2013, a category that carries anti-money-laundering registration duties and no custody standard.

Uganda has no bill before Parliament dedicated to virtual-asset custody, but the direction of travel is now on the record: Bank of Uganda Governor Michael Atingi-Ego proposed a licensing framework on 25 November 2025 under which 'Providers must segregate client assets, maintain adequate capital, and prevent the use of customer funds for proprietary trading', split between the Bank of Uganda for payments and the Capital Markets Authority for investments, and that proposal has not been enacted or published as a bill.

However, like many countries, Uganda is likely exploring broader fintech and digital asset policy. Discussions around a "National Digital Transformation Agenda" or reviews of financial sector laws might eventually lead to the consideration of digital assets.

Any future regulation of digital assets, including custody, would likely require amendments to existing laws like the National Payment Systems Act, 2020, or the creation of entirely new frameworks. The BoU has expressed a desire to understand emerging technologies better, and there might be sandbox initiatives in the future, but these do not constitute comprehensive custody regulations.

Uganda's Anti-Money Laundering Act, 2013 (Act 12 of 2013) already binds virtual asset service providers: Statutory Instrument 136 of 2020, effective 27 November 2020, added VASPs to Schedule 2, where they stand at paragraph 16, and section 21(pb) of the Act requires every accountable person so listed to register with the Financial Intelligence Authority. That duty is in force now and is not conditional on any future licensing, while the Act imposes no custody, segregation or safekeeping standard for digital assets.