Custodial wallet / SaaS in Zambia
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in Zambia with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- General AML/CFT obligations under the Anti-Money Laundering and Countering of Terrorism Act, No. 13 of 2010 would apply to any entity providing financial services, but no VASP-specific AML obligations have been defined.
- No Travel Rule obligations currently apply — Zambia has not adopted FATF Recommendation 16 for virtual assets.
- No licensing or registration regime exists for VASPs; the 2019 ESAAMLG Mutual Evaluation Report identified this as a gap.
- Financial Intelligence Centre (FIC) is the AML/CFT supervisor; reporting entities must submit suspicious transaction reports (STRs) under the general AML framework.
- Currently no VASP-specific threshold amounts, reporting cadence, or CDD rules have been defined.
- Entities found to be involved in money laundering using virtual assets would face general penalties under the AML Act (severe fines and imprisonment).
Key Restrictions
- No specific licensing framework exists for crypto custodians — no custody license, qualified-custodian definition, segregation rules, insurance/bonding requirements, or cold-storage mandates are currently in law.
- The Bank of Zambia has repeatedly warned the public that virtual assets are not legal tender and are unregulated; consumers have no investor protection or recourse.
- Any crypto custody service would operate in a legal grey area — no prohibition, but no regulatory pathway either.
- The National Payment Systems Act, 2023 may apply to payment-related crypto services but does not directly regulate custodial wallets or crypto custody.
- If the operator offers services to financial institutions, those institutions may need to comply with general BoZ/SEC licensing requirements, but no crypto-specific license exists.
Key Risks
- Regulatory ambiguity — the BoZ has signaled it intends to regulate virtual assets but no framework has been enacted; operators face sudden regulatory change risk.
- No segregation or proof-of-reserves rules mean custodial clients have no statutory protection in the event of insolvency or hack.
- Enforcement risk from general AML/CFT laws — operators could be investigated for money laundering without a clear regulatory status.
- The 2019 ESAAMLG MER noted Zambia's AML gaps for VASPs, creating FATF compliance pressure that could lead to rushed or restrictive regulation.
- No legal definition of 'qualified custodian' means institutional clients (e.g., Zambian entities) may be unable to satisfy their own custody requirements under foreign law.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Currently, there are no specific licenses for crypto asset custodians in Zambia. Financial institutions dealing with traditional securities or funds require licensing from the Bank of Zambia or the Securities and Exchange Commission, but these licenses do not extend to, nor are there separate licenses for, digital asset custody.
There are no explicit rules for the segregation of client crypto assets. In traditional finance, robust rules exist requiring licensed entities to segregate client funds and assets from their own operational funds. However, these do not specifically apply to crypto assets due to the absence of specific crypto legislation.
No specific insurance or bonding requirements for crypto custodians exist in Zambia. Traditional financial service providers are subject to various capital adequacy and, in some cases, professional indemnity insurance requirements. Without a regulatory framework for crypto custody, these do not apply to virtual asset service providers (VASPs) for their crypto activities.
There are no mandates or specific requirements for cold storage (offline storage) of crypto assets. While cold storage is a widely recognized security best practice in the crypto industry, Zambian regulation does not address such operational or technical requirements for custodians.
There is no legal or regulatory definition of a "qualified custodian" specific to digital assets in Zambia. The concept of a "qualified custodian" is generally found in jurisdictions with developed securities regulations for investment advisers (e.g., in the US, under the Investment Advisers Act). Since digital assets are not explicitly defined as securities requiring such custody in Zambia, the term doesn't apply within the existing framework for crypto.
Unregulated, but Not Banned: Crypto trading and the operation of crypto exchanges in Zambia are not explicitly illegal, but they are also not officially regulated or licensed by any specific framework for virtual assets. This places them in a "grey area."
Regulatory Warnings: The Bank of Zambia has repeatedly issued warnings to the public regarding the risks associated with investing in or trading cryptocurrencies. Key points of these warnings include:
Not Legal Tender: Cryptocurrencies are not recognized as legal tender in Zambia.
No Investor Protection: Since they are unregulated, consumers engaging in crypto transactions do so at their own risk, with no recourse to the BoZ or other regulatory bodies for protection against loss, fraud, or operational failures of exchanges.
National Payment Systems Act, No. 2 of 2023:
No, not specifically for virtual assets and VASPs. Zambia's primary AML/CFT legislation, the Anti-Money Laundering and Countering of Terrorism Act, No. 13 of 2010 (and its amendments), as well as associated regulations, does not explicitly extend to the comprehensive regulation of virtual assets or the oversight of VASPs as financial institutions or Designated Non-Financial Businesses and Professions (DNFBPs).
The ESAAMLG's 2019 Mutual Evaluation Report of Zambia highlighted significant gaps in this area. It noted that virtual assets were not adequately covered by the AML/CFT framework, and there was no specific licensing or registration regime for VASPs.
Currently, none are explicitly covered under a specific regulatory regime for virtual assets. As per the 2019 ESAAMLG MER, Zambia had not identified or defined VASPs under its AML/CFT laws, nor had it imposed AML/CFT obligations on them. Any entity operating with virtual assets in Zambia currently does so in a largely unregulated environment from an AML/CFT perspective, though the Bank of Zambia has issued warnings regarding the risks associated with cryptocurrencies.
Anti-Money Laundering and Countering of Terrorism Act, No. 13 of 2010: This is Zambia's principal AML/CFT legislation. While it is the foundational law, it does not specifically address virtual assets or VASPs. Finding an official, up-to-date government-published link can be challenging, but it forms the basis of the Financial Intelligence Centre's (FIC) operations.
However, if an entity were found to be involved in money laundering or terrorist financing activities using virtual assets, they would be subject to the general penalties under the Anti-Money Laundering and Countering of Terrorism Act, No. 13 of 2010, which include severe fines and imprisonment.
Financial Intelligence Centre (FIC) Zambia: The FIC is Zambia's financial intelligence unit and the primary body for AML/CFT oversight.
Lack of a Specific Regulatory Framework: As of now, there isn't a comprehensive regulatory framework specifically governing cryptocurrency exchanges or services that would allow for detailed enforcement actions akin to those seen in more established crypto jurisdictions.
Caution and Warnings: The Bank of Zambia consistently advises against the use of cryptocurrencies due to risks and their unregulated status.
No Legal Tender Status: Cryptocurrencies are explicitly not recognized as legal tender in Zambia.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — custodial wallet/SaaS services are not explicitly prohibited but operate in a regulatory vacuum with no crypto-specific custody license, no segregation/insurance rules, and no defined AML obligations for VASPs; a local entity would be required under general business law, and operators face high licensing burden due to lack of a clear pathway, while awaiting the Bank of Zambia's anticipated virtual assets framework.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?