On-shore VASP in Uganda

Bank of Uganda Circular (N. 3 of 2021): While direct link to the circular might change, news articles widely reported on it and often link to scans of the original.

Bank of Uganda Warns Supervised Entities Against Dealing in Cryptocurrencies - Techweez (reporting on the circular)

Uganda's Central Bank Orders Financial Institutions to Cease All Crypto Transactions - Bitcoin.com News

Bank of Uganda reiterates its tough stance on cryptocurrency use - Africanews (2022)

A comprehensive legal and regulatory framework for the licensing and supervision of Virtual Asset Service Providers (VASPs) is still largely absent.

Bank of Uganda (BOU) Stance: The BOU has repeatedly issued advisories clarifying that cryptocurrencies are not recognized as legal tender in Uganda and that the central bank does not regulate or license any cryptocurrency businesses.

National Payment Systems Act, 2020 (NPS Act) and Regulations, 2021: This is the most relevant piece of legislation for payment services in Uganda.

National Payment Systems Regulations, 2021: (Often published as a statutory instrument, typically available via the Uganda Legal Information Institute or Ministry of Finance archives).

Current Situation: No specific license. Many operate in a grey area.

Potential Interpretation: If an exchange facilitates transactions between fiat currency and virtual assets (or vice versa), it could theoretically be deemed to be performing functions similar to a money remitter or payment service provider. In such a scenario, they might be required to obtain a Payment Service Provider (PSP) license or a Payment System Operator (PSO) license under the National Payment Systems Act, 2020, regulated by the Bank of Uganda.

Requirement for a PSP/PSO License (General): This would entail meeting the requirements for traditional payment service providers.

The Anti-Money Laundering Act, 2013 (as amended): This is the primary AML legislation in Uganda. It defines money laundering, establishes the Financial Intelligence Authority (FIA), and outlines obligations for "reporting persons." While it doesn't explicitly mention "cryptocurrency" or "VASP," the broad definitions of "financial institution," "transaction," and "funds" can be interpreted to encompass activities involving virtual assets.

The Anti-Money Laundering Regulations, 2015: These regulations provide more specific details on the implementation of the Act, including customer due diligence, record-keeping, and suspicious transaction reporting.

The Financial Intelligence Authority Act, 2013: This Act establishes the FIA as the central national agency responsible for receiving, analyzing, and disseminating financial intelligence related to money laundering, terrorist financing, and proliferation financing.

Identification and Verification:

Beneficial Ownership: Identify and verify the identity of the beneficial owner(s) – the natural person(s) who ultimately own or control the customer, or the natural person(s) on whose behalf a transaction is being conducted.

Ongoing Monitoring: Continuously monitor the business relationship and transactions undertaken by the customer to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile, including the source of funds where necessary.

Enhanced Due Diligence (EDD): Apply EDD for higher-risk customers, transactions, or business relationships. This includes:

Report Suspicious Transactions: Report any transaction (attempted or completed) where there is a reasonable suspicion that the funds involved are proceeds of crime, or are linked to money laundering, terrorist financing, or proliferation financing.

Report to the FIA: Such reports must be made to the Financial Intelligence Authority (FIA) promptly, and generally within 48 hours of forming the suspicion.

No Tipping-Off: Not disclose to the customer or any third party that a suspicious transaction report has been made or that a money laundering investigation is being conducted.

Customer Identification Records: All records obtained during CDD processes (identification documents, verification records, beneficial ownership information).

Transaction Records: Records of all domestic and international transactions, including the amount, currency, date, type of transaction, and parties involved. For virtual assets, this would include wallet addresses, transaction hashes, and amounts.

Retention Period: Records must be retained for a minimum period of five (5) years after the business relationship has ended or after the date of an occasional transaction.

Financial Intelligence Authority (FIA)

Cryptocurrencies are not legal tender in Uganda.

The BoU does not regulate, license, or supervise virtual assets or virtual asset service providers (VASPs).

Regulated financial institutions (banks, payment service providers, etc.) are prohibited from dealing in cryptocurrencies, facilitating crypto transactions, or holding crypto on behalf of clients.

There are no specific licenses for cryptocurrency/digital asset custody in Uganda.

There are no specific rules for the segregation of client digital assets, as the activity itself is not formally recognized or permitted for regulated entities.

There are no specific insurance or bonding requirements for cryptocurrency/digital asset custodians.

There are no specific mandates or requirements for cold storage (offline storage) of digital assets.

There is no official definition of a "qualified custodian" specific to digital assets in Uganda's regulatory framework. This term typically emerges in jurisdictions that have established specific licensing and oversight for crypto custodians.

Entity Targeted: All Regulated Financial Institutions (e.g., Commercial Banks, Payment Service Providers, Microfinance Deposit-taking Institutions). Violation Type: N/A (this was a pre-emptive prohibition, not an action against a prior violation by a crypto firm). Penalty Amount: N/A (the circular itself did not impose a fine on a crypto entity, but implied penalties for regulated entities that failed to comply with the directive). Outcome: The BoU issued a circular directing all supervised financial institutions to cease facilitating transactions related to virtual currencies. This effectively cut off cryptocurrency exchanges and related businesses from accessing formal banking services in Uganda. The BoU cited concerns over consumer protection, money laundering, terrorism financing, and the lack of specific regulations. This directive has made it extremely challenging, if not impossible, for crypto businesses to operate formally within the Ugandan financial system.

Entity Targeted: The general public and unregulated virtual asset service providers (implicitly). Violation Type: N/A (warnings about risks, not specific violations). Penalty Amount: N/A. Outcome: These warnings emphasize that cryptocurrencies are not legal tender, are not regulated by the BoU, and carry high risks of fraud, money laundering, and loss of funds. The FIA has also highlighted AML/CFT risks. The lack of a specific licensing and regulatory framework for VASPs means that any entity operating with virtual assets does so without official recognition or oversight, increasing their operational risk and exposure to potential future actions should a framework be introduced. This environment largely prevents formal enforcement actions against VASPs for regulatory non-compliance because there aren't specific VASP regulations to violate yet, other than general financial laws (e.g., fraud).

Outcome: These warnings emphasize that cryptocurrencies are not legal tender, are not regulated by the BoU, and carry high risks of fraud, money laundering, and loss of funds. The FIA has also highlighted AML/CFT risks. The lack of a specific licensing and regulatory framework for VASPs means that any entity operating with virtual assets does so without official recognition or oversight, increasing their operational risk and exposure to potential future actions should a framework be introduced. This environment largely prevents formal enforcement actions against VASPs for regulatory non-compliance because there aren't specific VASP regulations to violate yet, other than general financial laws (e.g., fraud).

For Individuals: If an individual disposes of crypto assets that result in a gain, this gain would typically be added to their other income and taxed at the standard individual income tax rates.

For Businesses (Companies): Gains derived by a company from the disposal of crypto assets would be included in its assessable income and taxed at the standard corporate income tax rate.

Corporate Income Tax Rate: 30%

Services Related to Crypto: If a business provides services related to cryptocurrency (e.g., exchange services, wallet services, advisory services), the fees charged for these services would likely be subject to VAT. For example, the commission charged by a crypto exchange for facilitating a trade would probably be VATable.