The WAEMU regional framework includes provisions covering virtual asset service providers. Its interpretation here does not amount to validation of current national arrangements or to a comprehensive launch procedure. This guide structures the file to be prepared with the relevant stakeholders, separating technical preparation, legal classification and actual operations before any fundraising.
In brief
- Map funds, keys, contracts and decision-making powers before presenting a service to the public.
- The regional framework sets specific requirements for VASPs; local implementation and the project’s status must be verified.
- A payment partner, a foreign license or a compliance program does not replace a review of all the functions actually offered.
Crypto regulation in Guinea-Bissau: describe the powers that actually exist
Our comparison of platforms and their statuses points out that a single brand may combine several services. For your project, map the customer journey through to the final outcome. Each movement should identify an entity, a currency or asset, a contract and a responsible party. A single interface does not necessarily mean that one authorization covers every step.
Determine who can move assets without receiving a new instruction. Possession of a key, the power to approve a withdrawal or access to a collection account can create significant responsibilities. A service presented as decentralized should explain who actually holds these powers. Marketing language should not conceal control exercised in practice by the company, its employees or a technical provider.
Also specify how the project generates revenue. Compensation through an exchange spread, transfer commission or custody fee describes different functions. Customers must understand what they are buying and whom they are paying. A model that depends on promised returns generated from users’ funds requires separate review; it cannot be treated as a simple payment application.
The customer base and territory are part of the scope. A Guinea-Bissau resident, a company established in another country and a member of the diaspora using a foreign service do not automatically present the same case. Commercial targeting and residency conditions must match the file. A website’s global accessibility does not remove the need to examine the rules of the markets actually being solicited.
Finally, distinguish a prototype from an operating service. An internal test using fictitious data can validate an interface without validating the collection of real funds. Set a launch threshold: classifications confirmed, contracts ready, responsibilities defined and procedures tested. The word “beta” should not turn customers into funders of a framework whose decisive elements remain unknown.
Link the functions to the regional framework and national checks
The WAEMU uniform law on AML/CFT/CPF provides, in Articles 58 and 59, for professional authorization and preventive requirements applicable to VASPs. This reference must be considered alongside national legislation and the rules currently in force. We are not certifying here a national implementation date, an approval authority for every function or an individual authorization.
Prepare a functional note before asking the question. Describe exchange, transfers, custody, payments and any issuance separately. Attach diagrams, proposed contracts and the countries concerned. A response received for one area should not silently be extended to the others. The file must make clear what was actually reviewed, rather than only what the team hopes to launch.
The BCEAO list of authorized payment institutions illustrates why scope matters. Appearing on a payment-services list does not automatically amount to approval for a crypto custody or exchange activity. Verify the holder, function and territory. An agreement with an authorized partner does not necessarily transfer that status to every product offered by your company.
Request written confirmations tailored to the project, with the assistance of qualified counsel where necessary. A commercial conversation or a presentation at an event does not carry the same weight. Public communications should not turn an ongoing process into an authorization already obtained. A provisional document, an administrative registration and an operational authorization must remain clearly distinct.
Also maintain a list of open issues. An unanswered question must not become a favorable assumption hidden in the business plan. If a function depends on an unconfirmed classification, limit the work to the relevant preparation. Software availability or interest from potential customers does not make operations legally authorized and does not justify collecting funds early to accelerate the process.
Build proportionate due diligence and data protection
The KYC, data and recourse guide helps move beyond simply collecting an identity photograph. A useful program links the customer, beneficial owners where relevant, the stated purpose and observed transactions. Its design must be assessed against the applicable obligations, rather than copied from another country or a provider without examining the local model.
Assess the risks specific to the service. Third-party accounts, a change of beneficiary or an inconsistent source of funds may require analysis. A warning sign does not automatically constitute an offense; it should trigger a documented procedure. The organization must avoid both blind acceptance and arbitrary blocking decided by an employee without criteria or an escalation path.
Define roles before an incident occurs. Who gathers the documents, who decides on a suspension and who reviews the regulatory consequences? Support staff must know what they can promise and what they must escalate. A guarantee of immediate release given to a customer may conflict with an ongoing review. Communications must remain accurate, traceable and compliant with applicable confidentiality rules.
Collecting documents creates risks of its own. Limit access, secure transmissions and determine retention periods according to the relevant obligations. An identity file should not circulate freely through a group messaging channel. Technical providers must be identified and their access rights reviewed. Choosing a convenient tool does not automatically resolve the protection of the data it hosts.
Test procedures with fictitious cases before handling real funds. An identity that cannot be verified, a complaint and an account-takeover attempt should each have an assigned owner and a planned response. These operational tests do not replace legal checks. They help identify contradictions between the contract, support scripts and the technical capabilities actually available.
Separate customer obligations from treasury and access controls
The guide to wallets and key control helps map technical powers. Record who can create an address, approve an outgoing transfer and restore access. Prepare for the absence or compromise of a responsible person. A company whose assets all depend on a single phone or individual creates a vulnerability independent of its compliance messaging.
Reconcile customer obligations with available assets. As a teaching example, customer receivables totaling 12,000 units against 11,940 available units reveal a gap of 60 units, or 0.5%. This example does not define any regulatory ratio. It shows why verification must cover quantities and access rights, not merely an aggregated value displayed in a currency.
Assets do not become interchangeable simply because they reference the dollar. A claim on a provider, a stablecoin and a bank balance may be subject to different constraints. Reconciliation must therefore distinguish between asset types and networks. A reserve that cannot be accessed when a withdrawal is requested does not provide the same support as funds that can be mobilized immediately within the promised product.
Set internal limits that match the risks and are approved by the appropriate managers. Their existence does not replace a legal obligation. An exception must be documented and approved, not negotiated informally by a salesperson for an important customer. Without a record, the company loses the ability to explain why a transaction received different treatment during an audit or incident.
The business continuity plan should cover network outages, payment-partner unavailability and key incidents. Test backups and reconciliation after an interruption. Plan how to inform customers without exposing secrets. Normal speed is not a permanent guarantee; the contract and support function should describe honestly the dependencies whose timing the service does not fully control.
Set clear rules for pricing, complaints and service termination
The total crypto cost calculation should be reflected in the project’s quotes. State XOF or another currency explicitly, along with commissions, the net result and timing conditions. A free offer should not conceal a conversion margin or a mandatory withdrawal. Customers must understand the cost before sending funds and be able to compare the result with the quote.
For a telephone-based journey, the crypto and Mobile Money guide distinguishes the services involved. Verify the actual agreement with the operator and the terms governing collection accounts. The ability to send money to a phone number does not prove a right to collect public payments for your model. An announced partnership must match the contracts and the functions actually available.
Complaints should be classified by stage and responsible party. Customers must know which references to provide and how to track their request. Do not promise guaranteed recovery of an irreversible transfer or a payment to a third party. A serious procedure specifies the means of investigation and their limits, without adding improvised fees to preserve an initial promise that cannot be verified.
Also prepare for the cessation or prolonged suspension of the business. Arrangements for restitution, partner dependencies and the people authorized to act should be defined before a crisis. Reliable records and available assets remain essential. A closure cannot be organized properly if the people responsible for accounts and keys shift responsibility that was never clearly assigned.
Crypto regulation in Guinea-Bissau should therefore guide the creation of an evidence file, not a search for reassuring terminology. Link every function to a verified classification, a contract and an organization capable of managing incidents. Until a decisive condition has been clarified, continue preparing without taking public funds. A technically ready service does not replace applicable authorizations or clearly assumed responsibility.
