This guide structures that preparation without claiming to provide an exhaustive list of rules or grant authorization. The documentary research was reviewed on October 19, 2026. It distinguishes verifiable institutional texts from commercial conditions and issues that still require an official response or a legal analysis tailored to the project.
In brief
- A project must describe its actual functions, its flows and the people who control the assets.
- BCSTP has financial and monetary responsibilities; applying them to a specific arrangement requires documented qualification.
- A foreign license, a published application and a bank account do not replace a local analysis of the service being offered.
Crypto regulation in São Tomé and Príncipe: mapping the service
Map the customer journey in full before drafting a sales pitch. Our crypto platform assessment helps distinguish the visible company from the entity that holds the funds or executes the order. The file must name each participant, explain how it is paid and specify what it actually promises the end customer.
An information service can take on a different scope if it receives funds or makes investment decisions on behalf of others. Describe the actions available in the interface and the powers granted to staff. Who selects the asset, who signs off on the transfer and who can change the withdrawal address? These answers document how the service works more effectively than vague phrases such as digital support or community solution.
Also distinguish sales for one’s own account from intermediation. A seller providing its own assets does not necessarily perform the same functions as an operator that holds a balance for customers. The commission amount alone is not enough to classify the service. The analysis must examine the contracts, obligations and actual movement of funds, including what happens if something goes wrong.
The territory deserves a separate file. Where do the customers live? From which country does the company solicit the public? Who contracts with the banks and technical providers? A company incorporated abroad may still face requirements linked to its local customer base. Do not infer marketing freedom solely from the location of the server or the domain name.
Finally, document the differences between an experimental phase and a public offering. A technical trial involving no customer funds does not show that a commercial service can begin without further steps. Before any expansion, update the map and have the new functions reviewed. A subtle application change can alter the risks without changing the wording used on the homepage.
Identify the institutions and limit your conclusions
BCSTP Organic Law No. 03/2025 assigns the central bank, among other responsibilities, functions relating to payments, financial institutions and foreign exchange. This institutional basis helps direct inquiries. On its own, however, it does not provide general validation for every model involving cryptoassets or privately issued tokens.
Ask a precise question rather than seeking abstract approval. A submission can ask which institution reviews the described service, which texts should be consulted and whether a specific procedure applies. Attach the functions, partners and flow diagram. Keep the complete response, including any reservations: quoting an extract out of context can significantly change the meaning received.
A response concerning a bank account does not settle every question about crypto custody. A response concerning currency does not automatically determine the tax treatment. Attribute each conclusion to its proper scope. Where several areas of responsibility are involved, build a list of the required steps and evidence, without presenting a private partner’s agreement as a waiver of the other checks required for the project.
Check official references through the BCSTP website and the authentic documents available there. Contact details provided by a salesperson should be independently verified. A letter bearing a familiar logo may be forged. If the reference number or recipient appears suspicious, do not immediately send identity documents, financial information or technical details that could enable funds to be moved.
The absence of a quick response does not amount to demonstrated tacit authorization. The project timeline should allow for this documentary delay. In the meantime, limit work to activities whose scope remains controlled, without collecting customer funds to accelerate progress. An early launch can create commitments that are difficult to cancel even if the technology works perfectly.
Assess banking, payments and custody separately
A banking partnership must be confirmed by the relevant institution for the exact service being considered. The existence of an account or banking application does not prove that the bank approves cryptoasset trading. The official BISTP Mobile listing describes mobile banking features; it is not a distribution agreement or authorization to provide crypto custody.
Reviewing mobile payments linked to a crypto purchase helps identify breaks in responsibility. A payment may be executed while the purchase order remains pending. The contract must explain who reconciles the transactions, who bears reference errors and how to handle money received without a corresponding delivery, particularly during a service outage.
Custody requires an independent analysis of the interface. If your company controls the keys, it has power over the assets. If a provider controls them, document the contract and the return conditions. A wallet bearing the customer’s name does not necessarily demonstrate signing autonomy. Verify, both technically and contractually, who can block, move or recover the balance.
Our crypto wallet guide explains this distinction in control. For a collective project, also set out staff access rules and internal approvals. A single person able to move all the funds creates significant operational dependence. Multiple signatures can reduce certain risks, but they do not replace an examination of responsibilities or business continuity and restitution procedures.
Finally, prepare a wind-down plan. How will funds be returned if the technical provider ceases operations or the banking partner rejects the model? The arrangement must provide for customer notifications, contact details and reimbursement records. Commingled funds or incomplete documentation can turn a manageable interruption into a lasting dispute with users.
Prepare compliance, data protection and customer information
Compliance checks should not be limited to requesting an identity document. Define the purpose of each document, who is authorized to access it and the legally justified retention period. KYC and data protection issues require a coherent organization. Excessive collection can create an additional risk without addressing a properly identified obligation.
Explain to customers the contracting entity, fees and withdrawal conditions in a language they understand. A French-language journey should not conceal that the decisive contract is written in another language. Where a translation could alter an important right, have the passage reviewed. Useful information should explain a possible loss and the incident procedure, not merely help the customer complete registration.
Fee disclosures deserve verifiable examples. Crypto costs can combine a commercial rate, a fixed commission and a network fee. Advertising zero commission while applying an undisclosed margin may mislead customers. The summary must distinguish the promised quantity, deductions and quantity available, with a clearly stated price-fixing point.
In an internal organization simulation, twenty orders should not become one total that cannot be allocated. Assign an identifier to each order, link the payment to the delivery and document exceptions. This method does not claim to define a mandatory local standard. It provides a practical way to show what happened when a customer or partner asks a specific question.
Do not promise a guaranteed return without identifying the debtor and the contractual mechanism. An investment, a lending transaction and simple custody do not carry the same risks. If the model pays earlier customers with new deposits, better presentation will not solve the problem. Have the arrangement reviewed before any collection of funds or public promotion.
Build a file that can withstand a change of partner
Organize the documentation into four groups: description of the functions, institutional evidence, private contracts and operational controls. This separation prevents a public authorization from being confused with temporary commercial access. Each item should state its date, author and scope. Keeping a copy preserves traceability when web pages or provider terms change after launch.
Add a register of unresolved assumptions. A statement such as local withdrawals possible must be based on a documented offer compatible with the customer’s situation. If that possibility disappears, the service can no longer present it as a given. Define the events that require a new review: a change of entity, a new currency, a new country or a different delegation of key control.
Complaint handling must remain accessible without requiring another payment. Define how to receive a report, verify the requester’s identity proportionately and retrieve the order. A ticket number and written response make follow-up easier. No support team should request the recovery phrase of a personal wallet to examine a disputed proof of delivery.
The objective is not to accumulate decorative certificates. It is to be able to explain, for every function, the legal basis invoked, the entity responsible and the corresponding evidence. If an essential question remains unanswered, the project should preserve that limitation in its communications. A credible regulatory framework begins by acknowledging precisely what has not yet been confirmed.
