Crypto regulation in Sierra Leone directly affects how a service is structured—not just the wording displayed on its website. As soon as a company handles the purchase, custody or transfer of assets for clients, it must have the classification of its activities and the related obligations reviewed before launching them.
Article 103 of the 2024 law provides an identifiable framework for virtual assets. This guide turns that framework into operational questions: who controls the funds, what information accompanies transfers, who can decide to block a transaction, and what evidence remains available? It does not replace the relevant authorization or legal advice tailored to the business.
In brief
- The provider concerned must, in particular, register and obtain a licence before beginning operations.
- A risk assessment, along with information on the originator and beneficiary, forms part of the framework established by Article 103.
- Outsourcing, a foreign interface and mobile payments do not automatically provide exemptions.
Crypto regulation in Sierra Leone: map the functions
Our guide to the criteria and status of crypto platforms recommends starting with functions rather than brands. An operational map should identify the client, the contracting company, the payment partner, the key holder and the party responsible for delivery. Without this map, obligations can become blurred across several providers.
Consider a hypothetical project: an application receives a request in new leones, transfers the money to a partner, buys tokens and holds them until the client withdraws. This model is not simply about publishing a price. It involves payment, execution and custody, each bringing responsibilities and risks that must be examined separately.
For every function, record who makes the decision and who materially or legally holds the funds. A company may claim that it never holds crypto while still having signing authority or decisive control over a withdrawal instruction. The analysis must follow the facts, not just the marketing description or the name of the outsourcing agreement.
Include agents and anyone involved on the ground. An agent who receives cash or uses their own mobile account creates a different exposure from a payment reconciled directly against the company’s account. Have the legality of the model and each party’s responsibility reviewed before accepting client funds, even during a phase presented as experimental.
The 2024 law published by the FIA defines virtual assets and specifically addresses providers in Article 103. Its definitions, scope and supplementary texts must be read together. A technical prototype or business registration does not, by itself, establish the right to operate all the functions being considered.
Turning Article 103 into verifiable controls
Paragraph 3 of Article 103 provides for measures to identify, assess, manage and mitigate the risks covered by the provision. It also requires registration and licensing before the relevant provider begins operations. The first document in the file should therefore explain the authorized scope, the licensed entity and the activities actually offered to the public.
A risk assessment is not limited to requesting an identity document. It must connect customers, products, channels and flows to possible misuse scenarios. A purchase for one’s own account, a cross-border transaction and repeated transfers for multiple beneficiaries do not necessarily expose the service to the same situations. Controls must be able to justify these differences.
The text also addresses information about the originator and beneficiary in the relevant transfers, its immediate and secure transmission, and its availability to the authorities. This does not mean that personal data must be written in plain text on a public blockchain. The framework must distinguish between the technical movement of the asset and the channel used to transmit the required information.
The principles of KYC and data protection provide a basis for examining this issue: necessary collection, restricted access, identified providers and procedures for handling requests. Define who can view an identity document, who can export it and how unauthorized access will be detected. Copying every document into a shared messaging channel does not provide sufficient control.
Paragraph 8 extends the statutory reporting and monitoring obligations applicable to the relevant entities to the assets and providers covered by the provision. Procedures must therefore identify the decisions to be made, those responsible for them and how they will be traced. A screening tool does not replace a response process or the expertise of the person responsible for reviewing an alert.
Organizing payment, custody and accounting reconciliation
The separation between mobile payments and crypto delivery provides a starting point for operations. A debit reference must be linked to an order and its delivery, without confusing the client’s account, an agent’s account and the company’s account. Discrepancies should appear in a log rather than disappear into an informal conversation.
Use an explicit currency unit in quotations, invoices and reconciliations. In Sierra Leone, older and newer documents may use different scales for the leone. A factor-of-1,000 error distorts amount controls just as much as the accounts themselves. Preserve the original value and the conversion method instead of overwriting a figure without explaining its source.
The method for calculating the total cost of a crypto transaction helps distinguish the company’s own commission, the partner’s fees and network costs. This distinction also serves customer support: a shortfall should not automatically be attributed to the blockchain when it actually results from a margin or a withdrawal fee charged by the service operator.
For custody, document who authorizes a withdrawal, who can change an address and what separation of duties prevents one person from carrying out a sensitive operation alone. An audit log should make it possible to reconstruct decisions without exposing private keys. Backups, restoration and emergency access require procedures tested in an appropriate environment.
Our explanation of crypto wallet risks highlights that control of the keys creates a technical responsibility. A compliance statement cannot protect against a lost backup or an incorrect destination. Conversely, technically robust infrastructure does not replace the authorizations and customer controls required to operate the service.
Preparing for incidents, monitoring and accountability
An incident scenario should specify the authorized actions when a payment arrives without a reference, a withdrawal fails or activity raises suspicion. The service must avoid improvised decisions: refunding another person, changing networks without approval or bypassing controls to speed up delivery. Commercial speed does not justify breaking the audit trail.
Articles 70 and 71 of the 2024 law address the compliance officer and the internal programs of the entities concerned. Reading them helps show that compliance cannot rest solely on a software provider. An organization must define responsibilities, training and controls suited to how it actually operates.
Articles 101 and 102 also address certain responsibilities of employers, principals and directors under the conditions set out in the text. It would be excessive to infer automatic liability for every incident. It would be equally imprudent to assume that an agency agreement or a separate company eliminates all supervisory responsibility.
The 2024 GIABA report identifies progress as well as limitations as of the date under review. An improvement in the technical rating does not attest to the perfect effectiveness of every company’s controls. Nor does the report constitute a licence or a public guarantee granted to a commercial product.
Accordingly, retain evidence of testing: a simulated alert, an incomplete file, a duplicated payment, a compromised account and a partner outage. Document the expected and actual results without initiating real suspicious transactions. A written procedure that the available team cannot execute leaves a tangible gap between the organization described and the protection actually provided to clients.
Defining a launch file and regular review
Before opening, assemble the legal analysis, applicable authorizations, partner agreements, flow mapping and control procedures. Add the client terms, pricing rules and complaints-handling process. This file should describe a specific service, with its limitations, rather than a general concept called a “blockchain platform.”
Plan a review whenever the model changes: a new network, key custody, a new client country or a new payment partner. An authorization covering a limited activity does not necessarily cover the next expansion. Also check whether a more recent directive specifies procedures that the law sets out only at a general level.
For documents and archives, have the applicable retention periods and formats confirmed by a qualified professional. You must be able to reconstruct transactions and protect data without inventing a universal deadline for every document. Organize archive access, restoration and responses to legitimate requests from the authorities according to the rules that actually apply.
Assign an owner to every review action: who confirms the partner’s licence, who checks a contract amendment and who authorizes production deployment? A date and a responsible person make it possible to track a correction. The simple note “to be checked” in a document does not protect the client when the next order is already moving between accounts.
Finally, distinguish launching a financial service from publishing an information guide. Explaining Bitcoin does not automatically mean executing purchases for others; receiving and moving their funds may change the analysis. Crypto regulation in Sierra Leone must be addressed through these concrete functions. The goal is not to accumulate reassuring statements, but to demonstrate who is acting, under what authorization and with which effective controls.
