Centralized exchange in Lesotho

No Dedicated VASP Regime: Lesotho has not yet enacted specific legislation to define, license, or regulate virtual assets or virtual asset service providers. There is no specific registration or licensing regime for crypto businesses.

Cautious Stance: The Central Bank of Lesotho (CBL), which is the primary financial regulator, has previously issued public notices warning the public about the risks associated with investing in and transacting with cryptocurrencies. This indicates a cautious "wait-and-see" or risk-averse approach rather than active promotion or regulation.

Indirect Application of Existing Laws (AML/CFT): While there's no specific VASP law, any entity operating within Lesotho that handles funds or facilitates financial transactions (even if virtual) could potentially fall under the scope of existing Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) legislation.

Cryptocurrency Exchanges: There are no specific licenses required for a "cryptocurrency exchange" if it deals only with virtual assets. However, if the exchange offers services that involve fiat currency conversion, holds fiat currency for customers, or facilitates remittances in traditional currency, it could potentially be deemed to be conducting activities that fall under existing banking, money transmission, or payment services regulations, which would require a license from the CBL. This is a grey area and depends heavily on the specific nature and integration with traditional financial systems.

Custody Providers: Similarly, there are no specific licenses for "virtual asset custody providers." If the custody provider also provides traditional financial services (e.g., managing fiat bank accounts, lending fiat against crypto), then existing financial services licenses might be required.

Capital Requirements: There are no specific capital requirements for VASPs. However, traditional financial institutions (banks, PSPs, etc.) are subject to significant capital requirements set by the CBL. If a crypto business were deemed to fall under such existing categories, these requirements would apply.

AML/KYC: This is the most critical area. Lesotho is a member of the Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG), which means it is committed to implementing the Financial Action Task Force (FATF) recommendations. FATF Recommendation 15 specifically applies to VASPs, requiring them to be regulated for AML/CFT purposes and supervised.

The Money Laundering and Proceeds of Crime Act, 2008 (as amended) and the oversight of the Financial Intelligence Unit (FIU) Lesotho are the primary instruments for AML/CFT.

While VASPs are not explicitly designated as "reporting institutions" under Lesotho's current AML law, the FIU would expect any entity involved in financial flows to conduct customer due diligence (KYC), monitor transactions, and report suspicious activities to prevent money laundering and terrorist financing. Failing to do so could lead to investigations and penalties, especially if illicit activities are facilitated.

Local Presence: There are no specific local presence requirements for a VASP. However, if a business were to be licensed as a traditional financial institution (e.g., a payment service provider), it would generally require a physical presence and local management in Lesotho.

No specific cryptocurrency custody license currently exists in Lesotho.

There are no specific rules in Lesotho mandating the segregation of client digital assets from the custodian's own assets.

There are no specific mandates for digital asset custodians regarding cold storage or other specific security measures.

There is no specific definition of a "qualified custodian" for digital assets in Lesotho.

Money Laundering and Proceeds of Crime Act (MLPCA) 2008 (as amended): This is the foundational legislation that defines money laundering offenses, establishes reporting obligations, and sets out the framework for combating financial crime. VASPs are expected to comply with the obligations outlined in this Act, particularly if they are classified as financial institutions or DNFBPs under its scope.

Identification and Verification:

Ongoing Monitoring: Continuously monitoring the business relationship, including scrutiny of transactions undertaken throughout the course of the relationship, to ensure that the transactions are consistent with the VASP's knowledge of the customer, their business, and risk profile, including, where necessary, the source of funds.

Source of Funds/Wealth: Given the inherent risks of virtual assets, VASPs are expected to obtain information on the source of funds or source of wealth, especially for large transactions or high-risk customers.

Enhanced Due Diligence (EDD): Required for high-risk situations, which typically include:

Report Suspicious Transactions: Report to the FIU any transaction (or attempted transaction) where they have reasonable grounds to suspect that it may involve the proceeds of criminal activity, or relates to money laundering or terrorist financing. This includes suspicious activities in virtual assets.

Duration: Records must typically be kept for a minimum period of five (5) years after the business relationship is terminated or after an occasional transaction is completed.

Stance on Crypto: The CBL has consistently issued public warnings regarding the risks associated with cryptocurrencies. These warnings emphasize the lack of regulation, price volatility, potential for fraud, money laundering, and consumer protection issues. They have advised the public against dealing with unregulated crypto service providers.

Enforcement Actions: While the CBL has issued warnings, these have been general advisories to the public and financial institutions, not specific enforcement actions against targeted entities with disclosed penalties.