Self-custodial wallet / non-custodial software in Gabon
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Gabon without local incorporation, subject to AML obligations and low licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- Low
- Last updated
- 2026-07-13
AML Obligations
- No specific AML obligations attach to non-custodial software publishing because the publisher never holds or controls user funds and does not meet the definition of a VASP/financial institution under CEMAC law.
- However, if the software is structured to intermediately hold keys or facilitate exchange (i.e., crossing into custody or transfer-agent activity), CEMAC AML Regulation No. 01/16-CEMAC-UMAC-CM would apply, requiring customer identification/KYC (ga.aml.identification-and-verification), ongoing monitoring (ga.aml.conduct-ongoing-due-diligence-on), enhanced due diligence for PEPs and high-risk jurisdictions (ga.aml.enhanced-due-diligence-edd-apply), recordkeeping for 5+ years (ga.aml.duration-records-must-typically-be), and suspicious transaction reporting to Gabon's FIU (ga.aml.obligation-to-report-any-vasp).
- CENAREF (Gabon's FIU) oversees AML/CFT for financial entities; non-custodial software publishers are not currently designated as reporting entities under this framework (ga.licensing.cenaref-website-while-cenarefs-website).
Key Restrictions
- The publisher must not hold, control, or have access to user private keys or funds — any deviation into custody or intermediation would trigger unlicensed financial-activity risk.
- CEMAC Instruction n°001/GR/2021 bans financial institutions (banks) from engaging in crypto activities; however, this does not directly prohibit a non-financial entity from publishing self-custodial software (ga.licensing.instruction-n001gr2021-relating-to-the).
- If tokens offered through or promoted via the software are classified as 'investment tokens' (securities under COSUMAF jurisdiction), public offering/issuance would require a COSUMAF-approved prospectus (ga.licensing.authorization-requirement-any-public-offering, ga.licensing.information-document-prospectus-issuers-must).
- Payment token functionality is under BEAC jurisdiction — stablecoin integration or payment features in the wallet could trigger BEAC regulation (ga.licensing.payment-tokens-jetons-de-paiement).
Key Risks
- Legal grey area — Gabon and CEMAC lack a specific fintech/regulatory sandbox or VASP licensing framework, creating uncertainty for any new crypto-adjacent business model (ga.licensing.the-absence-of-specific-regulations).
- Future regulatory change risk — CEMAC could move toward a prohibitive stance (ban) or impose strict licensing requirements that could retroactively affect software publishers (ga.licensing.the-potential-for-future-regulatory).
- Enforcement risk if regulators re-interpret 'financial institution' broadly to capture software publishers that facilitate crypto transactions, even without custody.
- Consumer protection exposure — no specific disclosure, audit, or security standards exist for non-custodial software, but enforcement could rely on general laws against misleading commercial practices.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Instruction n°001/GR/2021 relating to the ban on crypto-assets in the CEMAC zone.
No specific custodial license for digital assets has been established in Gabon.
The absence of specific regulations, leading to a legal grey area.
The potential for future regulatory changes, which could include outright bans, strict licensing, or a more facilitative framework.
CENAREF Website: While CENAREF's website might not specifically mention "virtual assets" or "VASPs" in its publicly available texts, it is responsible for implementing AML/CFT laws that are generally aligned with FATF recommendations.
General Principle: If virtual asset service providers (including custodians) were to be explicitly recognized and regulated, they would fall under CENAREF's oversight for AML/CFT purposes. However, without specific designation, the practical application to crypto businesses remains a challenge.
Investment Tokens (Jetons d'Investissement): These are crypto-assets that "represent financial instruments within the meaning of Article 3 of Regulation No. 01/00-CM-UMAC of December 21, 2000, relating to the harmonization of financial instruments in the CEMAC zone." These are explicitly considered securities. The classification hinges on whether the token confers rights associated with traditional financial assets.
Payment Tokens (Jetons de Paiement): These are crypto-assets generally accepted by the community as a means of payment. These fall primarily under the jurisdiction of the BEAC, particularly if they function as electronic money (e.g., certain stablecoins). These are not considered securities but are subject to electronic money and payment services regulations.
Utility Tokens (Jetons d'Usage): These are crypto-assets whose primary purpose is to provide access to a good or service, and which are not acquired with the primary intention of investment. The regulation explicitly states that these are generally not considered financial instruments (securities), unless they subsequently acquire characteristics that make them fall under the definition of financial instruments.
Authorization Requirement: Any public offering of investment tokens requires prior authorization from COSUMAF (Article 5).
CEMAC Regulation No. 01/16-CEMAC-UMAC-CM on the Prevention and Repression of Money Laundering and Terrorist Financing (2016): This is the cornerstone legislation for AML/CFT in the CEMAC zone, which Gabon has adopted. It sets out the general obligations for all financial institutions and designated non-financial businesses and professions (DNFBPs), including those that might offer virtual asset services, to prevent and combat money laundering and terrorist financing.
Note: While this regulation predates FATF's specific guidance on virtual assets (Recommendation 15 and its Interpretative Note from 2018), its broad scope often means VASPs are expected to comply as "financial institutions" or similar entities if they perform functions akin to traditional financial services.
Conduct ongoing due diligence on the business relationship and scrutiny of transactions undertaken throughout the course of that relationship to ensure that the transactions are consistent with the VASP's knowledge of the customer, their business, and risk profile.
Enhanced Due Diligence (EDD): Apply EDD in situations identified as higher risk, including:
Obligation to Report: Any VASP that suspects or has reasonable grounds to suspect that funds (fiat or virtual assets) are the proceeds of a criminal activity, or are related to terrorist financing, must report its suspicions.
Duration: Records must typically be retained for at least five (5) years after the business relationship has ended or after the date of the occasional transaction.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — publishing non-custodial wallet software in Gabon does not trigger VASP/financial-institution classification or AML obligations so long as the publisher never holds user funds or keys, but the lack of a dedicated legal framework creates regulatory uncertainty; any feature that crosses into custody, exchange intermediation, or issuance of security-like tokens could attract prohibitions or unlicensed-activity risk.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?