← Regulations / Gabon / Operating Models / Self-custodial wallet

Self-custodial wallet / non-custodial software in Gabon

Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.

Conditional AI-Generated · Unreviewed

Self-custodial wallet is conditionally permitted in Gabon without local incorporation, subject to AML obligations and low licensing burden.

Verdict Details

Permitted
conditional
Local entity required
No
Licensing burden
Low
Last updated
2026-07-13

AML Obligations

  • No specific AML obligations attach to non-custodial software publishing because the publisher never holds or controls user funds and does not meet the definition of a VASP/financial institution under CEMAC law.
  • However, if the software is structured to intermediately hold keys or facilitate exchange (i.e., crossing into custody or transfer-agent activity), CEMAC AML Regulation No. 01/16-CEMAC-UMAC-CM would apply, requiring customer identification/KYC (ga.aml.identification-and-verification), ongoing monitoring (ga.aml.conduct-ongoing-due-diligence-on), enhanced due diligence for PEPs and high-risk jurisdictions (ga.aml.enhanced-due-diligence-edd-apply), recordkeeping for 5+ years (ga.aml.duration-records-must-typically-be), and suspicious transaction reporting to Gabon's FIU (ga.aml.obligation-to-report-any-vasp).
  • CENAREF (Gabon's FIU) oversees AML/CFT for financial entities; non-custodial software publishers are not currently designated as reporting entities under this framework (ga.licensing.cenaref-website-while-cenarefs-website).

Key Restrictions

  • The publisher must not hold, control, or have access to user private keys or funds — any deviation into custody or intermediation would trigger unlicensed financial-activity risk.
  • CEMAC Instruction n°001/GR/2021 bans financial institutions (banks) from engaging in crypto activities; however, this does not directly prohibit a non-financial entity from publishing self-custodial software (ga.licensing.instruction-n001gr2021-relating-to-the).
  • If tokens offered through or promoted via the software are classified as 'investment tokens' (securities under COSUMAF jurisdiction), public offering/issuance would require a COSUMAF-approved prospectus (ga.licensing.authorization-requirement-any-public-offering, ga.licensing.information-document-prospectus-issuers-must).
  • Payment token functionality is under BEAC jurisdiction — stablecoin integration or payment features in the wallet could trigger BEAC regulation (ga.licensing.payment-tokens-jetons-de-paiement).

Key Risks

  • Legal grey area — Gabon and CEMAC lack a specific fintech/regulatory sandbox or VASP licensing framework, creating uncertainty for any new crypto-adjacent business model (ga.licensing.the-absence-of-specific-regulations).
  • Future regulatory change risk — CEMAC could move toward a prohibitive stance (ban) or impose strict licensing requirements that could retroactively affect software publishers (ga.licensing.the-potential-for-future-regulatory).
  • Enforcement risk if regulators re-interpret 'financial institution' broadly to capture software publishers that facilitate crypto transactions, even without custody.
  • Consumer protection exposure — no specific disclosure, audit, or security standards exist for non-custodial software, but enforcement could rely on general laws against misleading commercial practices.

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 20% confidence

Instruction n°001/GR/2021 relating to the ban on crypto-assets in the CEMAC zone.

licensing 20% confidence

No specific custodial license for digital assets has been established in Gabon.

licensing 20% confidence

The absence of specific regulations, leading to a legal grey area.

licensing 20% confidence

The potential for future regulatory changes, which could include outright bans, strict licensing, or a more facilitative framework.

licensing 20% confidence

CENAREF Website: While CENAREF's website might not specifically mention "virtual assets" or "VASPs" in its publicly available texts, it is responsible for implementing AML/CFT laws that are generally aligned with FATF recommendations.

licensing 20% confidence

General Principle: If virtual asset service providers (including custodians) were to be explicitly recognized and regulated, they would fall under CENAREF's oversight for AML/CFT purposes. However, without specific designation, the practical application to crypto businesses remains a challenge.

licensing 60% confidence

Investment Tokens (Jetons d'Investissement): These are crypto-assets that "represent financial instruments within the meaning of Article 3 of Regulation No. 01/00-CM-UMAC of December 21, 2000, relating to the harmonization of financial instruments in the CEMAC zone." These are explicitly considered securities. The classification hinges on whether the token confers rights associated with traditional financial assets.

licensing 60% confidence

Payment Tokens (Jetons de Paiement): These are crypto-assets generally accepted by the community as a means of payment. These fall primarily under the jurisdiction of the BEAC, particularly if they function as electronic money (e.g., certain stablecoins). These are not considered securities but are subject to electronic money and payment services regulations.

licensing 60% confidence

Utility Tokens (Jetons d'Usage): These are crypto-assets whose primary purpose is to provide access to a good or service, and which are not acquired with the primary intention of investment. The regulation explicitly states that these are generally not considered financial instruments (securities), unless they subsequently acquire characteristics that make them fall under the definition of financial instruments.

licensing 60% confidence

Authorization Requirement: Any public offering of investment tokens requires prior authorization from COSUMAF (Article 5).

aml 60% confidence

CEMAC Regulation No. 01/16-CEMAC-UMAC-CM on the Prevention and Repression of Money Laundering and Terrorist Financing (2016): This is the cornerstone legislation for AML/CFT in the CEMAC zone, which Gabon has adopted. It sets out the general obligations for all financial institutions and designated non-financial businesses and professions (DNFBPs), including those that might offer virtual asset services, to prevent and combat money laundering and terrorist financing.

aml 60% confidence

Note: While this regulation predates FATF's specific guidance on virtual assets (Recommendation 15 and its Interpretative Note from 2018), its broad scope often means VASPs are expected to comply as "financial institutions" or similar entities if they perform functions akin to traditional financial services.

aml 60% confidence

Identification and Verification:

aml 60% confidence

Conduct ongoing due diligence on the business relationship and scrutiny of transactions undertaken throughout the course of that relationship to ensure that the transactions are consistent with the VASP's knowledge of the customer, their business, and risk profile.

aml 60% confidence

Enhanced Due Diligence (EDD): Apply EDD in situations identified as higher risk, including:

aml 60% confidence

Obligation to Report: Any VASP that suspects or has reasonable grounds to suspect that funds (fiat or virtual assets) are the proceeds of a criminal activity, or are related to terrorist financing, must report its suspicions.

aml 60% confidence

Duration: Records must typically be retained for at least five (5) years after the business relationship has ended or after the date of the occasional transaction.

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
medium

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — publishing non-custodial wallet software in Gabon does not trigger VASP/financial-institution classification or AML obligations so long as the publisher never holds user funds or keys, but the lack of a dedicated legal framework creates regulatory uncertainty; any feature that crosses into custody, exchange intermediation, or issuance of security-like tokens could attract prohibitions or unlicensed-activity risk.

Questions this verdict aims to answer

  • Does software publishing trigger VASP / MSB classification?
  • Do AML obligations attach when no custody exists?
  • What disclosure or consumer-protection rules apply?