Custodial wallet / SaaS in Botswana

Section 5: Prohibits any person from carrying on a virtual asset business or virtual assets service without a license issued by NBFIRA.

Section 3 (Definitions): Defines a "virtual asset service provider" (VASP) to include any person who, as a business, "provides custody or administration of virtual assets or instruments enabling control over virtual assets."

Sections 6-10: Outline the application process for a license, including requirements such as:

Section 15: Requires a licensed VASP to "at all times maintain adequate and appropriate systems of control and procedures for the proper administration of its affairs." This provision is broad enough to encompass requirements for client asset segregation to prevent co-mingling and protect client funds in case of VASP insolvency.

Section 15(1)(a): Requires a licensed VASP to "implement appropriate measures to safeguard the virtual assets under its custody or control against theft, loss, or damage."

Section 15(1)(b): Requires a VASP to "implement a robust information technology framework to manage risks, including cybersecurity and operational resilience."

Section 15(1)(d): Requires a VASP to "at all times maintain adequate financial resources for the proper performance of its functions." While not directly mandating insurance, adequate financial resources could implicitly cover potential liabilities.

Section 18: Grants NBFIRA the power to issue directives and practice notes to VASPs concerning various matters, which would include detailed operational requirements like asset segregation.

NBFIRA Directives, Regulations, and Guidelines: NBFIRA is mandated by the Act to develop and issue subsidiary legislation, directives, and guidelines to fully implement its provisions. These future instruments are expected to provide the granular detail for aspects like:

Detailed operational requirements (e.g., specific security measures for private keys, possibly including cold storage ratios).

Further clarification on client asset protection and segregation.

Specific capital adequacy or insurance requirements.

The Botswana Cybersecurity Bill, 2025, establishes specific, legally enforceable requirements for risk management in custody, including cybersecurity and disaster recovery, for financial services and critical infrastructure.

Legal Entity and Local Presence:

Applicants must be a company incorporated in Botswana under the Companies Act.

They must maintain a physical office in Botswana.

Senior management and key personnel are expected to be based in Botswana or demonstrate sufficient local oversight.

Principal VASP License: BWP 500,000 (Botswana Pula) in unimpaired capital. This typically covers the full range of VASP activities.

Limited VASP License: BWP 200,000 in unimpaired capital. This may be for VASPs with a narrower scope of activities or those determined by NBFIRA to pose lower risk.

In addition to capital, NBFIRA may require a security deposit or other financial guarantees to protect clients.

AML/CFT Compliance Officer: Appointment of a qualified and experienced AML/CFT Compliance Officer, approved by NBFIRA, who reports to senior management and the Board.

Customer Due Diligence (CDD): Implementing strong CDD measures for all customers, including identifying and verifying the identity of natural and legal persons, and beneficial owners.

Enhanced Due Diligence (EDD): Applying EDD for higher-risk customers or transactions.

Record Keeping: Maintaining records of customer identification data, transaction data, and business correspondence for at least 5 years.

Botswana is actively tightening its AML/CFT financial sanctions regime to address identified weaknesses, indicating the framework is being reformed rather than remaining a stable cornerstone already fully aligned with FATF standards.

Financial Intelligence Act (FIA), No. 17 of 2019: This Act establishes the Financial Intelligence Agency (FIA) and outlines the obligations of accountable institutions (which now explicitly include VASPs) regarding customer due diligence, record-keeping, and suspicious transaction reporting. It replaced the 2009 Act.

Proceeds of Serious Crime Act (POCA), Cap 08:06: This is the overarching legislation that criminalizes money laundering and terrorist financing, and provides for the confiscation of proceeds of crime.

NBFIRA's Virtual Assets Business Regulatory Framework and Guidance Notes: NBFIRA has issued a comprehensive framework and specific guidance notes, such as the "Guidance Notes on Anti-Money Laundering and Combating the Financing of Terrorism for Virtual Asset Service Providers" (e.g., published in November 2022), which directly detail AML/CFT obligations for VASPs. These are crucial for specific requirements.

Identification and Verification of Customers:

National identity number (e.g., Omang for citizens), passport number, or other official identification document number.

Source of funds and source of wealth (especially for high-risk customers or large transactions).

Legal Entities/Arrangements (e.g., companies, trusts):

Beneficial Ownership Identification:

For legal persons, this typically means identifying individuals who ultimately own or control 25% or more of the shares or voting rights, or otherwise exercise control over the entity.

Ongoing Due Diligence and Monitoring:

Monitoring the business relationship and transactions undertaken throughout the course of the relationship to ensure they are consistent with the VASP's knowledge of the customer, their business, risk profile, and, where necessary, the source of funds.

NBFIRA Advisory on Virtual Assets and Virtual Asset Service Providers (July 2021): https://www.nbfira.org.bw/news-media/media-releases/advisory-virtual-assets-and-virtual-asset-service-providers

Legal Basis: This obligation is implicitly enforced through the FIA Act (mandating AML/CFT compliance) and the various regulations issued by the Ministry responsible for foreign affairs, which give effect to international obligations.