For a project targeting Malabo, Bata or customers across several countries, this mapping should come before advertising. It helps determine which rules to review, which partners to question and which responsibilities to formalize. This guide supports those steps; it does not grant authorization, certify a business structure or replace legal review of the activities actually offered.
In brief
- A monetary function, an investment service and an identity check do not automatically fall under the same institution.
- The company providing the service must identify its own obligations; a partner’s obligations do not become its own through a simple commercial relationship.
- A useful file connects operations, responsible parties, documents and suspension conditions before accepting client funds.
Crypto regulation in Equatorial Guinea: start with the roles
The criteria for the status of crypto platforms provide a starting question: what service is the customer actually buying? Providing software, executing a conversion, holding keys and managing investments are not the same thing. The team must assign each service to an identifiable party and explain the promised outcome.
The questions directed to institutions must then be separated. An inquiry about payments and foreign exchange is not an authorization request for a digital-asset service. A source-of-funds check does not validate the investment for which those funds will be used. Presenting these processes as interchangeable approvals creates a risk of error for both the company and its customers.
The GABAC assessment report on Equatorial Guinea sets out, among other points, the roles of regional and national institutions. Its preface links the observations to a mission conducted from 15 to 26 April 2024. This institutional mapping helps direct questions; the field findings should not be turned into a current, exhaustive list of providers or authorizations.
A process diagram can remain simple: monetary funds enter through one party, an instruction triggers an exchange, another party holds or transfers the tokens, and the customer then requests an exit. At each stage, record the company, country, account or wallet and contract. If a stage is still assigned to “the platform” without a specific entity, the analysis is still missing an accountable party.
This description must reflect the actual powers involved, including those invisible to the customer. A company able to change a destination address or sign a transaction cannot simply claim to provide an interface. The classification must be based on effective control and contractual commitments, not just on a label chosen by the marketing team.
Review currency, foreign exchange and settlement partners
The BEAC outlines its monetary-policy, foreign-exchange and payment responsibilities within its union, of which Equatorial Guinea is a member. The CFA franc used in this framework has the code XAF. An application based abroad does not eliminate questions related to financing and settlement for a service provided to a resident.
Our guide to the two CFA francs, XAF and XOF explains why “Francophone Africa” is not a sufficient monetary category. A partner may serve a country in the other zone without offering the same path in Equatorial Guinea. The currency, account country and beneficiary must therefore appear in the project specifications.
COBAC operates within the scope of the institutions it supervises. Its 6 May 2022 statement on crypto-assets requires restrictions on the relevant transactions to be taken into account. Securing a commercial agreement with an agent does not establish that the monetary institution accepts the described flow or has the power to set those restrictions aside.
Before relying on a bank or payment service, explain the intended use and request the corresponding conditions. An account authorized for certain transactions does not automatically cover the collection of funds intended to finance crypto purchases for customers. The company must also understand the required supporting documents, the grounds for suspension and the processing times actually communicated.
The amount must not become a concealment technique. Splitting payments to avoid a review or using a third party’s account does not clarify the project. On the contrary, such practices may prevent links from being made between contracts, beneficiaries and funds. If an essential condition does not receive a satisfactory answer, the launch of that process must wait.
Verify professional services and their authorizations
COSUMAF describes digital-asset services in its overview of intermediaries. The functions cited include buying and selling, custody and platform operation. A company must compare its actual activity with this scope, then verify the appropriate procedures, without assuming that the status of a technology provider or partner automatically covers its own service.
This review is not limited to the number displayed in a footer. The file must connect the document to its holder, the services covered and the company signing the customer contract. A foreign authorization, business registration or approval covering another activity does not by itself demonstrate the right to carry out the entire proposed project.
The COSUMAF authorization-verification tool provides one avenue for checking. An incomplete search calls for an official exchange based on precise information, rather than an arbitrary confidence score. This investigation did not establish a certified list of authorized operators in Equatorial Guinea. It therefore does not turn either the absence of a result or an advertising claim into a universal conclusion.
Custody requires particular attention. Understanding how crypto wallets work helps distinguish a tool with no access to the keys from an operator able to move customer assets. The team must explain that control, any separation of assets and restitution rights, without promising legal protection that the contracts do not demonstrate.
Finally, document versions must remain traceable. Consultation drafts, adopted regulations and later instructions may use similar wording without having the same effect. Because older links can sometimes be difficult to access, this guide provides no capital threshold or quantified procedure whose final, applicable version has not been verified.
Prepare financial controls without confusing authorization with identity checks
At the national level, the official publication of the 2019 decree updating the organization of Equatorial Guinea’s ANIF describes responsibilities for receiving, processing and forwarding financial information to the competent authorities. This financial-intelligence role must not be presented to customers as a commercial approval of the product they are buying.
This reference explains an institutional role; it does not replace a review of current amendments and procedures. The company must identify the official channel corresponding to its request and the relevant documents. An informal response from an official, taken out of context or concerning another file, must never become a public claim of approval.
The company must clarify its applicable obligations: verifying individuals, understanding transactions, retaining supporting documents and handling anomalies. Our report on crypto KYC, data and remedies points out that a request for documentation does not automatically prove compliance. It is also necessary to know who receives the data and why.
Document protection must accompany collection. Defining restricted access, transmission channels and an incident-handling procedure reduces certain risks. Support employees should not receive all data without a need to do so or have unlimited powers over withdrawals. These design recommendations do not claim to replace the regulatory requirements specific to the service.
An incident should trigger a documented decision: who identifies the anomaly, who reviews the information and who can authorize the next step? The customer should receive useful explanations within the limits compatible with applicable obligations. A promise of instant execution must not lead teams to ignore checks or announce a guaranteed release.
A clear boundary must be maintained between supporting documentation and technical secrets. A private key, recovery phrase or authentication code is not an ordinary compliance document. Asking for it could give a third party control of the account or wallet. The support procedure must explain this boundary and reject practices that blur it.
Formalize a launch decision and its reassessment
A launch file must bring together functional descriptions, qualifications obtained, partner contracts and customer terms in a consistent version. Advertising must not promise more than this file demonstrates. The fees and full cost of crypto transactions deserve particular attention, including a presentation consistent with the quantities actually delivered and any charges that may apply on exit.
Testing can begin with simulated data to reveal an incorrect allocation of roles, a calculation error or a step without an accountable party. A successful technical test does not validate the collection of real funds. Before involving customer funds, the corresponding legal and operational conditions must have been reviewed and the essential answers archived.
The team must also define what triggers a new review: a different customer base, a new country, a replacement partner, added custody or a change to the compensation mechanism. An opinion issued for a limited service cannot be extended to a different model simply through brand continuity. This discipline helps distinguish a genuine change from an old authorization being used too broadly.
Preparation also includes the ability to stop: suspend new requests, monitor ongoing transactions and apply a clear restitution or complaints procedure. In Equatorial Guinea, knowing the relevant institutions is not merely a matter of completing a file. Above all, it makes it possible to assign obligations and prevent institutional uncertainty from turning into customer funds without an accountable party.
