Crypto ATM / kiosk operator in Lesotho

No Dedicated VASP Regime: Lesotho has not yet enacted specific legislation to define, license, or regulate virtual assets or virtual asset service providers. There is no specific registration or licensing regime for crypto businesses.

Cautious Stance: The Central Bank of Lesotho (CBL), which is the primary financial regulator, has previously issued public notices warning the public about the risks associated with investing in and transacting with cryptocurrencies. This indicates a cautious "wait-and-see" or risk-averse approach rather than active promotion or regulation.

Indirect Application of Existing Laws (AML/CFT): While there's no specific VASP law, any entity operating within Lesotho that handles funds or facilitates financial transactions (even if virtual) could potentially fall under the scope of existing Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) legislation.

Cryptocurrency Exchanges: There are no specific licenses required for a "cryptocurrency exchange" if it deals only with virtual assets. However, if the exchange offers services that involve fiat currency conversion, holds fiat currency for customers, or facilitates remittances in traditional currency, it could potentially be deemed to be conducting activities that fall under existing banking, money transmission, or payment services regulations, which would require a license from the CBL. This is a grey area and depends heavily on the specific nature and integration with traditional financial systems.

AML/KYC: This is the most critical area. Lesotho is a member of the Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG), which means it is committed to implementing the Financial Action Task Force (FATF) recommendations. FATF Recommendation 15 specifically applies to VASPs, requiring them to be regulated for AML/CFT purposes and supervised.

The Money Laundering and Proceeds of Crime Act, 2008 (as amended) and the oversight of the Financial Intelligence Unit (FIU) Lesotho are the primary instruments for AML/CFT.

While VASPs are not explicitly designated as "reporting institutions" under Lesotho's current AML law, the FIU would expect any entity involved in financial flows to conduct customer due diligence (KYC), monitor transactions, and report suspicious activities to prevent money laundering and terrorist financing. Failing to do so could lead to investigations and penalties, especially if illicit activities are facilitated.

Local Presence: There are no specific local presence requirements for a VASP. However, if a business were to be licensed as a traditional financial institution (e.g., a payment service provider), it would generally require a physical presence and local management in Lesotho.

Capital Requirements: There are no specific capital requirements for VASPs. However, traditional financial institutions (banks, PSPs, etc.) are subject to significant capital requirements set by the CBL. If a crypto business were deemed to fall under such existing categories, these requirements would apply.

Money Laundering and Proceeds of Crime Act (MLPCA) 2008 (as amended): This is the foundational legislation that defines money laundering offenses, establishes reporting obligations, and sets out the framework for combating financial crime. VASPs are expected to comply with the obligations outlined in this Act, particularly if they are classified as financial institutions or DNFBPs under its scope.

Financial Intelligence Act 2011 (as amended): This Act establishes the Financial Intelligence Unit (FIU) of Lesotho, defines its powers, and details the requirements for reporting suspicious transactions.

Identification and Verification:

For Individuals: Obtaining and verifying name, residential address, date of birth, nationality, and a unique identification number (e.g., national ID, passport). Verification should be done using reliable, independent source documents or data.

For Legal Entities: Obtaining and verifying company name, legal form, proof of incorporation/registration, address of principal place of business, directors' names, and beneficial ownership information.

Understanding the Nature of Business/Purpose of Relationship: VASPs must understand the nature and purpose of the business relationship or occasional transaction.

Ongoing Monitoring: Continuously monitoring the business relationship, including scrutiny of transactions undertaken throughout the course of the relationship, to ensure that the transactions are consistent with the VASP's knowledge of the customer, their business, and risk profile, including, where necessary, the source of funds.

Source of Funds/Wealth: Given the inherent risks of virtual assets, VASPs are expected to obtain information on the source of funds or source of wealth, especially for large transactions or high-risk customers.

Enhanced Due Diligence (EDD): Required for high-risk situations, which typically include:

Politically Exposed Persons (PEPs)

Customers from high-risk geographic areas (as identified by FATF, national authorities, or the VASP's own risk assessment)

Complex or unusual transactions

Transactions involving new technologies or products where the risks have not been fully assessed (which can include certain crypto activities).

Report Suspicious Transactions: Report to the FIU any transaction (or attempted transaction) where they have reasonable grounds to suspect that it may involve the proceeds of criminal activity, or relates to money laundering or terrorist financing. This includes suspicious activities in virtual assets.

No Tipping-Off: Prohibit informing the customer or third parties that an STR has been made (no "tipping-off").

Prompt Reporting: Reports must be made promptly, usually within a few days of the suspicion arising.

Customer Identification Data: Copies of identity documents, verification records.

Transaction Records: All transaction data, including dates, amounts, types of virtual assets, originators, beneficiaries, and payment methods.

Business Correspondence: Relevant correspondence with customers regarding their transactions and relationships.

Analysis of Complex/Unusual Transactions: Records of the background and purpose of any complex, unusual large transactions, and all unusual patterns of transactions.

Duration: Records must typically be kept for a minimum period of five (5) years after the business relationship is terminated or after an occasional transaction is completed.

Financial Intelligence Unit (FIU) of Lesotho: The FIU is the central national agency responsible for receiving, analysing, and disseminating suspicious transaction reports. It also provides guidance and exercises oversight on AML/CFT compliance across various sectors, including those that might encompass VASPs.

Stance on Crypto: The CBL has consistently issued public warnings regarding the risks associated with cryptocurrencies. These warnings emphasize the lack of regulation, price volatility, potential for fraud, money laundering, and consumer protection issues. They have advised the public against dealing with unregulated crypto service providers.

Enforcement Actions: While the CBL has issued warnings, these have been general advisories to the public and financial institutions, not specific enforcement actions against targeted entities with disclosed penalties.