Law No. 046-2024/ALT of December 30, 2024, contains provisions on virtual asset service providers. These provisions require a national reading distinct from platform announcements and payment-related documents. This guide sets out a professional file-building method covering mapping, proof of status, due diligence, traceability and monitoring. It does not provide an exhaustive licensing procedure or personalized legal advice.
In brief
- VASP classification depends on the commercial activities performed for a client, not solely on the application’s name.
- Prior authorization and preventive measures are two separate requirements that must be assessed independently.
- XOF payments, crypto custody and partners must appear in a verifiable responsibility file.
Mapping crypto services in Burkina Faso
Our UEMOA regulatory dossier outlines the relevant institutions and regional jurisdictions. For a company operating in Burkina Faso, however, the starting point should be a map of the actual operations. Identify who receives the XOF, who supplies the tokens, who holds the keys and who executes withdrawals. This map should follow the contracts and systems involved, not just the commercial names used on presentation pages.
The national law published by the Transitional Legislative Assembly defines a VASP through functions performed commercially for a client or on the client’s behalf. Exchanges, transfers and custody activities fall within this scope. An organization must therefore examine every function it offers. Adding a wallet module or a conversion service may change the analysis even when the brand and website remain the same.
Custody must be described in concrete terms. Can the client authorize a transaction without the company’s intervention? An address displayed in a user account does not, by itself, prove control of the keys. If the provider controls withdrawals, that role must appear in the contract and technical documentation. Communications should not present centralized custody as full user autonomy simply because the interface includes a transfer button.
Our guide to crypto wallets explains this division of control. For a professional file, include authorized personnel, approval procedures and technical dependencies. A subcontractor may operate part of the infrastructure without becoming legally invisible. The client must understand which entity provides the service, while the company must know who can act on the assets during a transaction or incident.
The map must also distinguish company funds from client funds. A company buying an asset for its treasury does not create the same flow as a service receiving money to convert on someone else’s behalf. The mandate, fee and repetition of transactions may help clarify the classification. A messaging channel does not automatically make the activity private. The description must follow the economics of the service, not the medium used.
Building proof of status that matches the business
Article 58 requires prior approval or authorization for professional VASP activity. A company must assess this requirement before marketing its services. The status file should identify the legal entity and the activities covered. A commercial statement saying “compliant” does not provide a verifiable reference. Evidence must be traceable to an authority, a document and a specific scope.
The official fact sheet for Law No. 046-2024/ALT supports traceability of the national text. It does not replace an individual decision concerning a service provider. Distinguish between a document establishing a rule and one demonstrating that a company meets a specific condition. This separation helps prevent a common mistake: submitting a copy of the law in response to a request for authorization of the company itself.
Partners must have their own documented role. The BCEAO list of electronic money institutions includes Orange Money Burkina Faso and local partnerships. These references concern monetary functions. They do not automatically demonstrate that a company converting received funds into cryptoassets is authorized to do so. Each piece of evidence must correspond to the service assumed within the flow, rather than artificially covering the product as a whole.
Our analysis of platforms and their legal statuses also distinguishes foreign licenses from the client contract. An authorization granted to a group company in another country requires a scope analysis. The Burkina Faso file must state what that authorization actually demonstrates. It should neither be assigned universal reach nor dismissed as worthless without examining the functions and relevant rules.
Our editorial team has not compiled an exhaustive register of licensed VASPs in Burkina Faso. This limitation does not prove that no authorization could be issued. Before launching, a company should obtain appropriate confirmation from the competent contacts and local counsel. For a client, verifiable evidence of the claimed status remains necessary. Uncertainty may justify putting a decision on hold rather than treating technical access as a substitute for review.
Organizing due diligence without applying every rule indiscriminately
Article 59 refers to the relevant provisions of the law and preventive measures, with specific requirements to be clarified by the competent authorities. Controls must therefore be linked to the applicable scope. An obligation formulated for a financial institution should not be mechanically applied to every product without analysis. Credible compliance identifies its legal basis and scope instead of accumulating forms that do not establish status.
Our crypto KYC guide covers identity, documentation and recourse. A service must know what information it requests, for what purpose and through which channel. An identity document sent to a personal email account does not reflect the same organization as a documented procedure. Controls must protect data while enabling the service to meet relevant requirements.
Risk may vary according to the flows, counterparties and way the service is used. A case file model should avoid treating every client as identical. Atypical transactions must be linkable to the available information and established procedures. This analysis does not justify inventing suspicion based on a single indicator. It requires an organization capable of reviewing situations consistently and with a clear audit trail.
The law also contains obligations concerning suspicious transactions for persons subject to it. A professional framework must define responsibilities, channels and the relevant confidentiality rules. A report or internal procedure cannot be handled like an ordinary customer-service message. Before launching the activity, those responsible must understand their duties and how to submit a file without disclosing information to unauthorized recipients.
Do not confuse due diligence with access to clients’ secrets. Recovery phrases and private keys control assets; they are not merely evidence of the source of funds. A procedure must distinguish public transaction evidence, identity documents and confidential access credentials. When the service itself holds the keys, that responsibility must be stated explicitly in its custody model and operational safeguards.
Linking traceability, costs and incident handling
An evidence trail must connect each payment to the corresponding order. The XOF receipt, quote, internal credit and blockchain identifier describe several stages. The company must be able to explain how they fit together to a client or controller. A screenshot of the final balance does not replace this history. Traceability covers events, their references and the parties responsible, not merely a displayed total.
Our guide to crypto purchases with Mobile Money distinguishes payment from delivery. For an operator, this distinction must be reflected in incident procedures. Who handles an unrecognized debit? Who investigates an unexecuted crypto withdrawal? A partnership must define escalation procedures and the information required. A client should not have to make a second payment simply because the two parties fail to reconcile their references.
The quote should show the fees and the net amount. The crypto cost methodology helps distinguish commissions, exchange-rate margins and withdrawal deductions. Transparent presentation reduces disputes over the amount delivered. The service must also specify the price’s validity conditions. A change between reservation and confirmation requires an explanation consistent with the contract, rather than a new amount announced without context.
A technical outage requires a recovery status. The system must determine whether the payment was debited, whether the order was credited and whether a transfer was actually broadcast. Blind retries can create a duplicate movement. Validation responsibilities must remain clear, supported by dated evidence. This organization protects both the client and the company when an incident prevents the expected process from being completed.
Document retention must follow the relevant obligations and their scope. This guide does not provide a universal retention period applicable to every service. Define data categories, access rights and the conditions for consultation or deletion with reference to the applicable texts. Uncontrolled accumulation can create a data-leak risk. A useful file protects the necessary evidence without treating every technical secret as an ordinary compliance archive.
Maintaining the file as the product evolves
The BCEAO communication on cryptoassets and digital innovation describes regional work. That work is not an individual license or a final rule applicable to every announced function. Monitoring must distinguish proposals, adoption, publication and enforcement. A professional file should not turn a statement of intent into permission to market a new service.
Adding credit, an income-generating product, a network or client custody may change the scope. Initial validation of a model does not automatically cover every future version. The person responsible must review the contracts, authorizations and partners before launching the new function. The ease of a software update does not remove this requirement. Classification follows the service actually offered to users.
Contractual terms must remain consistent with the architecture. A company should not claim that users control their keys when it controls withdrawals, or promise automatic reimbursement when that depends on another provider. Marketing messages, support and internal documents must describe the same operation. The XAF and XOF file also highlights that the currency and territory involved in the user journey must be stated unambiguously in a regional offering.
Prepare a review schedule and a change log. Every new function should be linked to a decision, evidence and an accountable person. Items that remain unconfirmed should stay visible rather than disappearing behind a general compliance statement. For a project in Burkina Faso, local advice based on the actual documents remains necessary when the classification or authorization process cannot be established with certainty.
Ultimately, crypto regulation in Burkina Faso requires a file capable of explaining the service, not merely an interface capable of executing it. Authorization, due diligence, asset protection and traceability serve complementary purposes. A professional outcome links every claim to relevant evidence and every incident to an identified person responsible. This structure provides a stronger foundation than a license displayed out of context or a general promise of security.
