Uganda

**Regulator Name:** Bank of Uganda (BoU)

**Entity Targeted:** All Regulated Financial Institutions (e.g., Commercial Banks, Payment Service Providers, Microfinance Deposit-taking Institutions)

**Violation Type:** N/A (this was a pre-emptive prohibition, not an action against a prior violation by a crypto firm)

**Penalty Amount:** N/A (the circular itself did not impose a fine on a crypto entity, but implied penalties for regulated entities that failed to comply with the directive)

**Outcome:** The BoU issued a circular directing all supervised financial institutions to cease facilitating transactions related to virtual currencies. This effectively cut off cryptocurrency exchanges and related businesses from accessing formal banking services in Uganda. The BoU cited concerns over consumer protection, money laundering, terrorism financing, and the lack of specific regulations. This directive has made it extremely challenging, if not impossible, for crypto businesses to operate formally within the Ugandan financial system.

**Bank of Uganda Circular (N. 3 of 2021):** While direct link to the circular might change, news articles widely reported on it and often link to scans of the original.

Bank of Uganda Warns Supervised Entities Against Dealing in Cryptocurrencies - Techweez (reporting on the circular)

Uganda's Central Bank Orders Financial Institutions to Cease All Crypto Transactions - Bitcoin.com News

**Regulator Name:** Bank of Uganda (BoU), Financial Intelligence Authority (FIA)

**Entity Targeted:** The general public and unregulated virtual asset service providers (implicitly)

**Violation Type:** N/A (warnings about risks, not specific violations)

**Date:** Ongoing, but prominent warnings in late 2020, 2021, and subsequent reiterations.

**Outcome:** These warnings emphasize that cryptocurrencies are not legal tender, are not regulated by the BoU, and carry high risks of fraud, money laundering, and loss of funds. The FIA has also highlighted AML/CFT risks. The lack of a specific licensing and regulatory framework for VASPs means that any entity operating with virtual assets does so without official recognition or oversight, increasing their operational risk and exposure to potential future actions should a framework be introduced. This environment largely *prevents* formal enforcement actions against VASPs for regulatory non-compliance because there aren't specific VASP regulations to violate yet, other than general financial laws (e.g., fraud).

**Source URL (example of a reiteration):**

Bank of Uganda reiterates its tough stance on cryptocurrency use - Africanews (2022)

FIA Uganda AML/CFT Guidances (though not crypto-specific, they cover general financial crime) - specific crypto guidance might be harder to find directly, but their mandate covers new financial technologies.

A comprehensive legal and regulatory framework for the licensing and supervision of Virtual Asset Service Providers (VASPs) is still largely absent.

The existing regulatory stance, exemplified by the 2021 circular, has effectively pushed crypto operations out of the formal financial system, making traditional regulatory enforcement challenging.

**Bank of Uganda (BOU) Stance:** The BOU has repeatedly issued advisories clarifying that cryptocurrencies are not recognized as legal tender in Uganda and that the central bank does not regulate or license any cryptocurrency businesses.

**Reference:** *Bank of Uganda, Public Notice on Cryptocurrencies* (various notices, e.g., November 2021, March 2019, generally found in their press release archives). While specific direct URLs for older press releases can be hard to pinpoint consistently, searching "Bank of Uganda cryptocurrencies" on their official website (www.bou.or.ug) will yield relevant advisories.

**National Payment Systems Act, 2020 (NPS Act) and Regulations, 2021:** This is the most relevant piece of legislation for payment services in Uganda.

**National Payment Systems Act, 2020:** https://www.bou.or.ug/bou/docs/NPS%20Act,%202020.pdf

**National Payment Systems Regulations, 2021:** (Often published as a statutory instrument, typically available via the Uganda Legal Information Institute or Ministry of Finance archives).

**Relevance:** The NPS Act and its regulations govern the operation of payment systems and the licensing of payment service providers (PSPs). While it does not explicitly mention cryptocurrencies, an argument could be made that any entity facilitating fiat-to-crypto or crypto-to-fiat transactions, or otherwise dealing with funds in a way that resembles traditional payment services, *might* fall under the purview of these laws. However, the BOU has not clarified how these laws apply to crypto-specific businesses.

**Current Situation:** No specific license. Many operate in a grey area.

**Potential Interpretation:** If an exchange facilitates transactions between fiat currency and virtual assets (or vice versa), it *could* theoretically be deemed to be performing functions similar to a money remitter or payment service provider. In such a scenario, they *might* be required to obtain a **Payment Service Provider (PSP) license** or a **Payment System Operator (PSO) license** under the **National Payment Systems Act, 2020**, regulated by the Bank of Uganda.

**Requirement for a PSP/PSO License (General):** This would entail meeting the requirements for traditional payment service providers.

**Current Situation:** No specific license.

**Potential Interpretation:** Unless the custody service is directly tied to a payment system or involves managing traditional financial assets alongside virtual assets, it is highly unlikely to fall under any existing financial services licensing regime. These entities currently operate without specific oversight.

**Current Situation:** No specific license for crypto-native processing.

If the processing involves converting fiat to crypto, or crypto to fiat for merchants/users, it again *might* be seen as a **Payment Service Provider (PSP)** under the NPS Act.

If the processor only handles crypto-to-crypto payments for merchants (e.g., accepting Bitcoin and paying the merchant in Ethereum), it would likely fall outside current licensing requirements.

**Requirement for a PSP License (General):** As above.

**For Crypto Assets:** Currently, neither a specific licensing nor a specific registration regime exists for virtual asset service providers in Uganda.

**For Traditional Financial Services:** Uganda primarily operates a **licensing regime** for regulated financial institutions and payment service providers, where entities must apply for and obtain a specific license from the relevant regulator (e.g., Bank of Uganda, Uganda Microfinance Regulatory Authority, Capital Markets Authority) before commencing operations. There might be some lighter "registration" requirements for certain categories of smaller financial services providers, but full-fledged financial services typically require a license.

**Current:** No specific capital requirements for crypto businesses.

**Hypothetical (based on PSPs):** For a Payment Service Provider license under the NPS Act, there are minimum paid-up capital requirements (e.g., UGX 100 million for Tier 1 PSPs, UGX 10 billion for Tier 2 PSPs like e-money issuers – these figures are indicative and subject to change by the BOU). A future crypto license would likely have similar or tailored capital requirements depending on the scope of services.

**AML/KYC (Anti-Money Laundering / Know Your Customer):**

**Current:** While there are no specific crypto AML laws, Uganda has a robust **Anti-Money Laundering Act, 2013 (as amended)**.

**Reference:** *Anti-Money Laundering Act, 2013* (and subsequent amendments, available via Uganda Legal Information Institute: https://www.ulii.org/ug/legislation/act/2013/6)

**Relevance:** Financial Institutions and designated non-financial businesses and professions (DNFBPs) are subject to AML obligations. Although VASPs are not explicitly listed as "financial institutions" under the current AML Act, any entity dealing with funds or facilitating financial transactions is expected to implement AML/KYC measures in practice to avoid involvement in illicit activities. Any future VASP regulation would certainly impose strict AML/KYC obligations, including:

Customer Due Diligence (CDD) procedures.

Reporting of suspicious transactions (STRs) to the Financial Intelligence Authority (FIA).

**Current:** No specific requirement for crypto businesses.

**Hypothetical (based on traditional financial services):** For regulated financial services, a local physical presence, local incorporation, and often local management and directors are typically required. This would almost certainly be a requirement for any future VASP license, ensuring local oversight and accountability.

**Initial Consultation:** Informal discussions with the Bank of Uganda.

**Application Submission:** Submitting a formal application to the BOU, including:

Company incorporation documents (must be a Ugandan entity).

Detailed business plan, including services offered, target market, operational procedures.

Technical and security specifications of the platform/technology.

Proof of capital (e.g., audited financial statements, bank statements).

AML/CFT Policy and Compliance Manual.

Information on key personnel (directors, senior management) – including background checks and fit-and-proper assessments.

**Review and Due Diligence:** The BOU would conduct a thorough review of the application, including site visits, interviews, and technical assessments.

**Provisional Approval:** If satisfactory, the BOU might grant provisional approval.

**Final Approval and Licensing:** Upon meeting all conditions, the BOU would issue the final license.

**Ongoing Compliance:** Licensees would be subject to ongoing supervision, reporting requirements, and compliance audits by the BOU.

**Closely monitor regulatory developments:** The landscape is dynamic, and new laws could emerge.

**Seek legal counsel:** Obtain specific legal advice on how existing laws might apply to their particular business model.

**Implement strong internal controls:** Proactively adopt international best practices for AML/KYC, cybersecurity, and consumer protection, as these will undoubtedly form the foundation of any future regulatory framework.

**No Legal Tender:** Cryptocurrencies are explicitly not recognized as legal tender.

**No Licensing Framework:** There is no framework for licensing Virtual Asset Service Providers (VASPs), including crypto exchanges, custody providers, or issuers of virtual assets.

**Prohibition on Financial Institutions:** Licensed financial institutions are prohibited from facilitating crypto-related transactions or engaging with crypto businesses.

**Warnings to the Public:** The public is repeatedly warned about the risks associated with virtual assets, including volatility, fraud, money laundering, and lack of consumer protection.

**Bank of Uganda (BoU):** This is the primary authority responsible for the regulation, control, and supervision of all financial institutions and the issuance of currency. The BoU has been the most vocal in issuing warnings and clarifying its stance on virtual assets.

**Financial Intelligence Authority (FIA):** As Uganda's central agency for combating money laundering and terrorist financing, the FIA is responsible for ensuring that financial institutions comply with anti-money laundering and combating the financing of terrorism (AML/CFT) laws. While crypto businesses are not licensed, if they operate, they would fall under the purview of AML/CFT obligations.

**Capital Markets Authority (CMA):** While the CMA regulates capital markets, securities, and investment activities, it has not actively regulated cryptocurrencies as securities. Their statements often defer to the BoU regarding virtual assets, unless a specific digital asset falls squarely within the definition of a security under existing laws, which is rare for general cryptocurrencies.

**The Bank of Uganda Act, 2000:** This act establishes the functions of the BoU, including its powers to issue currency and regulate financial institutions. It's the basis for the BoU's pronouncements on non-legal tender status and warnings.

*Reference (via Uganda Legal Information Institute - ULII):* https://www.uli.ug/uganda/legislation/act/2000/5/bank-uganda-act-2000

**The Financial Institutions Act, 2004 (as amended):** This Act empowers the BoU to license, supervise, and control financial institutions. It is the basis for the BoU's directive prohibiting licensed entities from engaging with virtual assets.

**The Anti-Money Laundering Act, 2013 (as amended):** This Act provides the legal framework for combating money laundering and terrorist financing. While virtual assets are not explicitly named, the FIA's mandate extends to any financial transaction or service that could facilitate illicit activities, implying that even unlicensed VASP activities would be subject to its scrutiny.

**Crypto Trading (by individuals):** While there isn't an explicit law making it illegal for individuals to *hold* or *trade* cryptocurrencies, the BoU strongly discourages it due to the inherent risks (volatility, scams, lack of regulatory oversight, no consumer protection). Individuals who engage in trading do so at their own risk, with no legal recourse in case of loss or fraud.

**No Licensing:** Uganda does not license cryptocurrency exchanges or any Virtual Asset Service Providers (VASPs). Any entity attempting to operate as a crypto exchange within Uganda would be doing so without regulatory approval.

**Prohibition on Financial Institution Support:** Licensed banks and payment service providers are explicitly prohibited from facilitating payments to or from crypto exchanges or otherwise engaging with crypto businesses. This makes it extremely difficult for exchanges to operate legally within the traditional financial system.

**AML/CFT Scrutiny:** Even in the absence of a licensing regime, the FIA would still hold such entities accountable for AML/CFT compliance under the Anti-Money Laundering Act, 2013, given that they would be handling transactions that could be used for illicit purposes.

**Risk for Users:** Users engaging with unlicensed exchanges face significant risks, including the lack of security, potential for fraud, and no legal protection for their funds.

**The Anti-Money Laundering Act, 2013 (as amended):** This is the primary AML legislation in Uganda. It defines money laundering, establishes the Financial Intelligence Authority (FIA), and outlines obligations for "reporting persons." While it doesn't explicitly mention "cryptocurrency" or "VASP," the broad definitions of "financial institution," "transaction," and "funds" can be interpreted to encompass activities involving virtual assets.

**The Anti-Money Laundering Regulations, 2015:** These regulations provide more specific details on the implementation of the Act, including customer due diligence, record-keeping, and suspicious transaction reporting.

**The Financial Intelligence Authority Act, 2013:** This Act establishes the FIA as the central national agency responsible for receiving, analyzing, and disseminating financial intelligence related to money laundering, terrorist financing, and proliferation financing.

**Bank of Uganda Act, Cap 51:** While the Bank of Uganda (BOU) has primarily issued warnings about the risks associated with cryptocurrencies due to their unregulated nature, any future licensing or regulation of VASPs that touch upon payment systems or financial services would likely involve the BOU.

**Individual Customers:** Obtain and verify the customer's full name, permanent address, date of birth, national identification number (e.g., National ID, passport), and other relevant identification documents.

**Legal Entities (Companies, etc.):** Obtain and verify the company's registered name, legal form, proof of incorporation, physical address, business registration number, tax identification number, and details of directors, beneficial owners, and authorized signatories.

**Beneficial Ownership:** Identify and verify the identity of the beneficial owner(s) – the natural person(s) who ultimately own or control the customer, or the natural person(s) on whose behalf a transaction is being conducted.

**Purpose and Intended Nature of Business Relationship:** Understand the purpose and intended nature of the business relationship or the transaction.

**Ongoing Monitoring:** Continuously monitor the business relationship and transactions undertaken by the customer to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile, including the source of funds where necessary.

**Enhanced Due Diligence (EDD):** Apply EDD for higher-risk customers, transactions, or business relationships. This includes:

Customers from high-risk jurisdictions (identified by FATF or local authorities)

Transactions involving large amounts or complex structures

Transactions with no apparent economic or lawful purpose.

**Simplified Due Diligence (SDD):** May be applied in limited circumstances where the risk of money laundering or terrorist financing is lower, as permitted by the regulations.

**Report Suspicious Transactions:** Report any transaction (attempted or completed) where there is a reasonable suspicion that the funds involved are proceeds of crime, or are linked to money laundering, terrorist financing, or proliferation financing.

**Report to the FIA:** Such reports must be made to the Financial Intelligence Authority (FIA) promptly, and generally within 48 hours of forming the suspicion.

**No Tipping-Off:** Not disclose to the customer or any third party that a suspicious transaction report has been made or that a money laundering investigation is being conducted.

**Customer Identification Records:** All records obtained during CDD processes (identification documents, verification records, beneficial ownership information).

**Transaction Records:** Records of all domestic and international transactions, including the amount, currency, date, type of transaction, and parties involved. For virtual assets, this would include wallet addresses, transaction hashes, and amounts.

**Business Correspondence:** Records of all relevant business correspondence with customers.

**Retention Period:** Records must be retained for a minimum period of **five (5) years** after the business relationship has ended or after the date of an occasional transaction.

**Bank of Uganda Circular on Virtual Currencies (2022):** While a direct URL for a circular may be ephemeral, the BOU regularly publishes such statements. A general search for "Bank of Uganda virtual currency statement" often yields news articles or official press releases reflecting this stance. For example, a common reference point is the **Bank of Uganda Governor's statements** regarding financial innovation and risks.

**Anti-Money Laundering Act, 2013 (as amended):** This is the cornerstone legislation. It establishes the Financial Intelligence Authority (FIA) as the central national agency responsible for receiving, analyzing, and disseminating financial intelligence. The Act defines "financial institution" broadly, and while it doesn't explicitly mention "Virtual Asset Service Providers" (VASPs), any entity facilitating financial transactions, even in virtual assets, could potentially fall under its purview, especially concerning illicit finance.

**Legal Reference:** The Anti-Money Laundering Act, 2013 (as amended) (PDF hosted by FIA)

**Anti-Terrorism Act, 2002 (as amended):** This Act provides the legal basis for combating terrorism financing, which often goes hand-in-hand with sanctions compliance.

**Legal Reference:** A specific, easily accessible online version of the *amended* Act can be hard to pinpoint. Often, legal databases or government gazettes are the source. A general search for "Uganda Anti-Terrorism Act" will point to its existence.

**Financial Intelligence Authority (FIA):** The FIA is crucial for implementing AML/CTF measures, including those related to sanctions. It issues guidelines, receives suspicious transaction reports (STRs), and works with international bodies.

**Reference:** Financial Intelligence Authority (FIA) Uganda Website

**UN Sanctions:** As a member of the United Nations, Uganda is legally obliged to implement UN Security Council Resolutions, including those imposing sanctions on individuals, entities, and countries. The FIA and other Ugandan authorities enforce these resolutions domestically.

**Requirement for VASPs:** VASPs must screen all their customers and transactions against the **UN Sanctions List** to identify designated individuals or entities and freeze their assets or prevent transactions.

**Legal Reference:** United Nations Security Council Sanctions Committees

**OFAC Sanctions (U.S. Department of the Treasury's Office of Foreign Assets Control):**

**Extraterritorial Reach:** OFAC sanctions have significant extraterritorial reach. Any VASP that uses US dollar clearing, has US customers, servers, or any operational nexus with the US, is directly subject to OFAC regulations, regardless of where they are incorporated. This effectively includes most globally connected VASPs.

**Requirement for VASPs:** VASPs must screen all customers, beneficial owners, and transaction counterparties against OFAC's **Specially Designated Nationals And Blocked Persons List (SDN List)** and other sanctions lists (e.g., Sectoral Sanctions Identifications List, Non-SDN Palestinian Legislative Council List, etc.). They must block funds and prohibit transactions involving sanctioned parties or jurisdictions.

**Legal Reference:** OFAC's Sanctions Programs and Country Information

**Guidance on Virtual Currency:** OFAC has issued specific guidance on applying sanctions to virtual currency, emphasizing that its regulations apply to virtual currency just as they do to traditional fiat currency.

**Legal Reference:** OFAC's A Framework for OFAC Compliance Commitments (2019) (PDF, refers to virtual currency obligations) and various FAQs.

**Jurisdictional Reach:** EU sanctions apply to all EU nationals and entities, regardless of where they operate, and to non-EU entities conducting business within the EU. Given global financial interconnectivity, VASPs with any European nexus (customers, partners, funding) must comply.

**Requirement for VASPs:** VASPs must screen against the **EU Consolidated List of persons, groups and entities subject to EU financial sanctions**.

**Legal Reference:** EU Financial Sanctions Map

**Implement Robust KYC/CDD:** Conduct thorough Know Your Customer (KYC) and Customer Due Diligence (CDD) procedures to identify all parties involved in a transaction.

**Screen Against Sanctions Lists:** Regularly screen all customers, beneficial owners, and transaction counterparties against:

OFAC's **SDN List** and other relevant OFAC lists.

**Geographic Screening:** Identify and flag transactions involving high-risk or sanctioned jurisdictions.

**Transaction Monitoring:** Implement systems to monitor transactions for patterns indicative of sanctions evasion or illicit activity (e.g., unusual transaction sizes, rapid movements of funds to high-risk areas).

**Reporting Obligations:** Report any detected suspicious transactions or potential sanctions violations to the FIA and, if applicable, to relevant international authorities (e.g., OFAC for US persons).

**Sanctioned Countries:** Countries comprehensively sanctioned by the UN, OFAC (e.g., Cuba, Iran, North Korea, Syria), or the EU.

**High-Risk Jurisdictions:** Jurisdictions identified by FATF or other bodies as having strategic AML/CTF deficiencies.

**Under the Anti-Money Laundering Act, 2013:**

**Individuals:** Fines (e.g., up to UGX 2 billion / ~USD 500,000) and/or imprisonment (e.g., up to 15 years).

**Institutions:** Substantial fines (e.g., up to UGX 10 billion / ~USD 2.5 million), revocation of licenses (if applicable), and reputational damage.

**Asset Forfeiture:** Proceeds of crime, including virtual assets, can be frozen and forfeited.

**Under the Anti-Terrorism Act, 2002:**

Even harsher penalties, including lengthy imprisonment, apply for financing terrorism.

**International Penalties:** Non-compliance with OFAC or EU sanctions can lead to massive fines (billions of USD/EUR), criminal charges, and exclusion from international financial systems, regardless of the VASP's Ugandan operations.

Cryptocurrencies are **not legal tender** in Uganda.

The BoU does not regulate, license, or supervise virtual assets or virtual asset service providers (VASPs).

Regulated financial institutions (banks, payment service providers, etc.) are **prohibited** from dealing in cryptocurrencies, facilitating crypto transactions, or holding crypto on behalf of clients.

There are **no specific licenses** for cryptocurrency/digital asset custody in Uganda.

This is because regulated financial institutions are currently prohibited from engaging in these activities. Any entity attempting to provide such services would operate in an unregulated space, with potential legal and operational risks.

General licenses under the **National Payment Systems Act, 2020** or the **Financial Institutions Act, 2004 (as amended)** do not cover cryptocurrency custody.

**National Payment Systems Act, 2020:** https://ulii.org/ug/legislation/act/2020/8 (This Act governs traditional payment service providers and e-money issuers, but not digital asset custodians.)

**Financial Institutions Act, 2004:** https://ulii.org/ug/legislation/act/2004/2 (This governs traditional banking institutions.)

**Segregation of Client Assets Rules:**

There are **no specific rules** for the segregation of client digital assets, as the activity itself is not formally recognized or permitted for regulated entities.

Traditional financial regulations (under the Financial Institutions Act or National Payment Systems Act) do contain rules for segregating client funds from institutional funds for regulated entities, but these do not extend to cryptocurrencies.

There are **no specific insurance or bonding requirements** for cryptocurrency/digital asset custodians.

General capital adequacy and prudential requirements exist for traditional financial institutions, but these would not cover losses related to digital asset custody, as they are not permitted to hold such assets.

There are **no specific mandates or requirements** for cold storage (offline storage) of digital assets.

There is **no official definition** of a "qualified custodian" specific to digital assets in Uganda's regulatory framework. This term typically emerges in jurisdictions that have established specific licensing and oversight for crypto custodians.

As of now, there is **no publicly available or widely reported pending legislation specifically focused on cryptocurrency/digital asset custody** in Uganda.

However, like many countries, Uganda is likely exploring broader fintech and digital asset policy. Discussions around a "National Digital Transformation Agenda" or reviews of financial sector laws might eventually lead to the consideration of digital assets.

Any future regulation of digital assets, including custody, would likely require amendments to existing laws like the **National Payment Systems Act, 2020**, or the creation of entirely new frameworks. The BoU has expressed a desire to understand emerging technologies better, and there might be sandbox initiatives in the future, but these do not constitute comprehensive custody regulations.

**Anti-Money Laundering (AML) and Combating the Financing of Terrorism (CFT):** Uganda does have an AML/CFT framework, primarily the **Anti-Money Laundering Act, 2013 (as amended)**: https://ulii.org/ug/legislation/act/2013/1. While this framework would apply to any licensed VASP if they were to become regulated, it does not currently impose specific custody requirements for digital assets. The Financial Intelligence Authority (FIA) is the body responsible for AML/CFT oversight.