Custodial wallet / SaaS in Gabon

Instruction n°001/GR/2021 relating to the ban on crypto-assets in the CEMAC zone.

Impact: This means that traditional banks and financial institutions in Gabon (and other CEMAC countries) are generally prohibited from offering crypto custody services.

No specific custodial license for digital assets has been established in Gabon.

Due to the BEAC's prohibitive stance, financial institutions cannot obtain such a license. For non-financial entities, there's no defined licensing regime for crypto custody. Operating a crypto custody service would likely be in an unregulated space, which can expose the entity to future enforcement actions or an inability to access traditional banking services.

No specific rules. Without a dedicated licensing and regulatory framework for digital asset custodians, there are no explicit mandates for the segregation of client digital assets from the custodian's proprietary assets.

No specific requirements. Given the absence of a licensing regime, there are no mandated insurance or bonding requirements for digital asset custodians.

No specific mandates. There are no explicit regulatory requirements for digital asset custodians to use cold storage or specific security protocols for digital assets.

No specific definition. The concept of a "qualified custodian" for digital assets is not defined in Gabonese or CEMAC law.

While global trends (e.g., FATF recommendations) push countries to regulate VASPs, specific implementation in CEMAC countries has been slow regarding a facilitative rather than prohibitory approach.

The absence of specific regulations, leading to a legal grey area.

The potential for future regulatory changes, which could include outright bans, strict licensing, or a more facilitative framework.

Investment Tokens (Jetons d'Investissement): These are crypto-assets that "represent financial instruments within the meaning of Article 3 of Regulation No. 01/00-CM-UMAC of December 21, 2000, relating to the harmonization of financial instruments in the CEMAC zone." These are explicitly considered securities. The classification hinges on whether the token confers rights associated with traditional financial assets.

Utility Tokens (Jetons d'Usage): These are crypto-assets whose primary purpose is to provide access to a good or service, and which are not acquired with the primary intention of investment. The regulation explicitly states that these are generally not considered financial instruments (securities), unless they subsequently acquire characteristics that make them fall under the definition of financial instruments.

Payment Tokens (Jetons de Paiement): These are crypto-assets generally accepted by the community as a means of payment. These fall primarily under the jurisdiction of the BEAC, particularly if they function as electronic money (e.g., certain stablecoins). These are not considered securities but are subject to electronic money and payment services regulations.

Authorization Requirement: Any public offering of investment tokens requires prior authorization from COSUMAF (Article 5).

Information Document (Prospectus): Issuers must prepare and publish an information document (prospectus) approved by COSUMAF. This document must contain comprehensive information about the issuer, the project, the rights attached to the tokens, risks, etc. (Article 5).

General Principle: If virtual asset service providers (including custodians) were to be explicitly recognized and regulated, they would fall under CENAREF's oversight for AML/CFT purposes. However, without specific designation, the practical application to crypto businesses remains a challenge.

CENAREF Website: While CENAREF's website might not specifically mention "virtual assets" or "VASPs" in its publicly available texts, it is responsible for implementing AML/CFT laws that are generally aligned with FATF recommendations.

CEMAC Regulation No. 01/16-CEMAC-UMAC-CM on the Prevention and Repression of Money Laundering and Terrorist Financing (2016): This is the cornerstone legislation for AML/CFT in the CEMAC zone, which Gabon has adopted. It sets out the general obligations for all financial institutions and designated non-financial businesses and professions (DNFBPs), including those that might offer virtual asset services, to prevent and combat money laundering and terrorist financing.

Identification and Verification:

Individuals: Obtain and verify identity using reliable, independent source documents (e.g., national ID cards, passports, driver's licenses) for name, date of birth, place of birth, address, and nationality.

Legal Entities (Companies): Obtain and verify information such as the company's name, legal form, address of registered office, names of directors, and provisions governing the power to bind the company. Identify and verify the identity of the beneficial owners (individuals who ultimately own or control the company) and persons acting on behalf of the company.

Purpose and Nature of the Business Relationship: Understand the purpose and intended nature of the business relationship or the specific transaction.

Conduct ongoing due diligence on the business relationship and scrutiny of transactions undertaken throughout the course of that relationship to ensure that the transactions are consistent with the VASP's knowledge of the customer, their business, and risk profile.

Keep customer identification data up-to-date.

Enhanced Due Diligence (EDD): Apply EDD in situations identified as higher risk, including:

Relationships with Politically Exposed Persons (PEPs).

Transactions involving high-risk jurisdictions.

Complex, unusually large transactions, or unusual patterns of transactions that have no apparent economic or visible lawful purpose.

For virtual assets, this could involve deeper scrutiny of the source of funds/wealth, understanding the origin and destination of virtual assets, and the underlying purpose of transactions.

Obligation to Report: Any VASP that suspects or has reasonable grounds to suspect that funds (fiat or virtual assets) are the proceeds of a criminal activity, or are related to terrorist financing, must report its suspicions.

Recipient: Reports must be made promptly to Gabon's Financial Intelligence Unit (FIU).

No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or to third parties that an STR has been filed.

Duration: Records must typically be retained for at least five (5) years after the business relationship has ended or after the date of the occasional transaction.

Copies of documents used for identification and verification of customers and beneficial owners.

Account files and business correspondence.

Records of transactions, including the amount, currency (fiat and/or virtual asset type and quantity), date, and the identity of the parties involved.

Records of suspicious transaction reports filed.

Purpose: These records must be sufficient to permit the reconstruction of individual transactions and provide evidence for prosecution of criminal activity. They must be made available to competent authorities upon request.