Self-custodial wallet / non-custodial software in Lesotho
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Lesotho without local incorporation, subject to AML obligations and none licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- None
- Last updated
- 2026-07-13
AML Obligations
- No specific VASP AML obligations are triggered because the publisher never holds custody of funds and is not a 'reporting institution' under existing law.
- If the operator were deemed to be engaged in financial flows by a regulator, the Money Laundering and Proceeds of Crime Act (MLPCA) 2008 would apply generically — CDD, ongoing monitoring, source of funds/wealth checks.
- The FIU would expect any entity involved in financial flows to conduct KYC, monitor transactions, and submit STRs — but this is ambiguous for pure non-custodial software publishers.
- Records must be kept for a minimum of 5 years after termination of the business relationship if AML duties are deemed applicable.
Key Restrictions
- No dedicated VASP regime exists — the business operates in a regulatory void, not under a clear permission.
- The Central Bank of Lesotho has issued public warnings against dealing with cryptocurrencies, creating PR and banking-relationship risks.
- If the software publisher accepts any fiat payment for the software or charges fees routed through Lesotho's financial system, it could trigger traditional financial-services licensing (National Payment Systems Act 2018, Financial Institutions Act 2012).
- Any integration that touches fiat conversion, remittances, or payment processing on behalf of users would likely require licensing.
Key Risks
- Regulatory ambiguity — the FATF Travel Rule and VASP classification expectations for non-custodial software are unresolved globally; Lesotho has no guidance on this.
- Banking risk — local banks may refuse to provide services to any entity associated with crypto due to CBL warnings, even if the entity is a software publisher only.
- Enforcement precedent — no crypto-specific enforcement exists, but the CBL's cautious/warning stance suggests potential future action could be unpredictable.
- FATF pressure — Lesotho is an ESAAMLG member and may adopt VASP-specific legislation, retroactively affecting software publishers.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
No Dedicated VASP Regime: Lesotho has not yet enacted specific legislation to define, license, or regulate virtual assets or virtual asset service providers. There is no specific registration or licensing regime for crypto businesses.
Cautious Stance: The Central Bank of Lesotho (CBL), which is the primary financial regulator, has previously issued public notices warning the public about the risks associated with investing in and transacting with cryptocurrencies. This indicates a cautious "wait-and-see" or risk-averse approach rather than active promotion or regulation.
Indirect Application of Existing Laws (AML/CFT): While there's no specific VASP law, any entity operating within Lesotho that handles funds or facilitates financial transactions (even if virtual) could potentially fall under the scope of existing Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) legislation.
AML/KYC: This is the most critical area. Lesotho is a member of the Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG), which means it is committed to implementing the Financial Action Task Force (FATF) recommendations. FATF Recommendation 15 specifically applies to VASPs, requiring them to be regulated for AML/CFT purposes and supervised.
While VASPs are not explicitly designated as "reporting institutions" under Lesotho's current AML law, the FIU would expect any entity involved in financial flows to conduct customer due diligence (KYC), monitor transactions, and report suspicious activities to prevent money laundering and terrorist financing. Failing to do so could lead to investigations and penalties, especially if illicit activities are facilitated.
Money Laundering and Proceeds of Crime Act (MLPCA) 2008 (as amended): This is the foundational legislation that defines money laundering offenses, establishes reporting obligations, and sets out the framework for combating financial crime. VASPs are expected to comply with the obligations outlined in this Act, particularly if they are classified as financial institutions or DNFBPs under its scope.
Financial Intelligence Act 2011 (as amended): This Act establishes the Financial Intelligence Unit (FIU) of Lesotho, defines its powers, and details the requirements for reporting suspicious transactions.
Report Suspicious Transactions: Report to the FIU any transaction (or attempted transaction) where they have reasonable grounds to suspect that it may involve the proceeds of criminal activity, or relates to money laundering or terrorist financing. This includes suspicious activities in virtual assets.
No specific cryptocurrency custody license currently exists in Lesotho.
Stance on Crypto: The CBL has consistently issued public warnings regarding the risks associated with cryptocurrencies. These warnings emphasize the lack of regulation, price volatility, potential for fraud, money laundering, and consumer protection issues. They have advised the public against dealing with unregulated crypto service providers.
Stance on Crypto: The FIU would be involved in monitoring for illicit financial activities involving cryptocurrencies as part of its broader anti-money laundering and combating the financing of terrorism (AML/CFT) mandate.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a publisher of non-custodial wallet software is not explicitly regulated as a VASP in Lesotho since no dedicated VASP regime exists and the publisher never holds user funds, but AML obligations could theoretically attach under the broad language of existing financial-crimes law, and the Central Bank's public anti-crypto warnings create significant practical and banking-relationship risk.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?