Madagascar has taken an important legal step by defining virtual assets and virtual asset service providers, or VASPs. This development should not be confused with a comprehensive public licensing regime comparable to that of a financial center with an established crypto register. Understanding the framework requires examining what the rules cover, which institutions are involved and what evidence is still needed to verify a provider.
The framework primarily concerns services provided to customers, including exchange, transfers, custody and certain financial services. To assess a company rather than simply read the legislation, it is important to distinguish between registration, licensing and commercial availability.
In brief
- Law No. 2023-026 amends anti-money-laundering Law No. 2018-043 and introduces, among other things, the concepts of virtual assets and VASPs.
- Decree No. 2024-1352 implements the amended AML/CFT framework, according to SAMIFIN’s official index.
- The existence of these texts does not automatically prove that a specific exchange holds an operational license in Madagascar.
A financial reform, not a law approving all cryptocurrencies
The starting point is Law No. 2023-026, available through the CNLEGIS portal. It amends Law No. 2018-043 on combating money laundering and terrorist financing. It does not make Bitcoin legal tender and does not constitute an exchange license.
To assess specific offerings, our crypto platform verification framework separates service availability, the contracting entity and the scope of any potential license.
For a more accessible overview of the questions users face, our guide to buying cryptocurrency with mobile money distinguishes the role of a payment provider from that of a crypto business. A transfer method should not be mistaken for general approval of assets or platforms.
The law adds terminology designed to describe virtual assets and the professionals providing certain services. SAMIFIN’s glossary describes a VASP as an individual or legal entity commercially carrying out, for or on behalf of a customer, operations including exchanges between virtual assets and fiat currency, transfers, custody and certain services related to the offering or sale of virtual assets.
This functional approach is essential. A custody service may require a different analysis from non-custodial software that users keep on their phones. A crypto-to-ariary exchange is not the same as an ordinary purchase of goods. The legal terminology seeks to identify the activity and its risks rather than relying solely on an application’s name.
The legislation does not provide a state guarantee for assets either. It promises neither reimbursement if a platform fails, nor a maintained peg for a private token, nor automatic recovery of a blockchain transfer. These protections must be assessed separately under applicable legislation, contractual terms and the safeguards available from the provider.
The implementing decree details the AML/CFT framework
Decree No. 2024-1352, dated July 3, 2024, is described by SAMIFIN as implementing Law No. 2023-026, which amended the anti-money-laundering framework. SAMIFIN’s official legislation index provides its title and place within the AML/CFT architecture.
The scope matters: customer due diligence, record-keeping and suspicious transaction reporting form part of the system for preventing and detecting illicit flows. They do not all amount to a general commercial authorization. A text defining compliance obligations is not necessarily a crypto licensing form, nor proof that a company has received approval from a supervisor.
The law itself refers to aligning the country with certain Financial Action Task Force recommendations concerning emerging technologies, transfers and financial institutions. This reference helps explain the reform’s logic: improve risk detection and provide institutions with appropriate powers. It does not establish the number of licensed companies, the scope of their licenses or the products available to retail customers.
Companies must therefore classify their activities before launching a service. Exchanging customer assets, holding their keys, operating a transfer platform or marketing a financial product may trigger several sets of rules. Depending on its operating model, a local company may also need to consider banking law, foreign exchange, tax, data protection and payment rules.
What roles should be attributed to SAMIFIN and CSBF?
SAMIFIN is Madagascar’s financial intelligence unit. Its website publishes AML/CFT legislation, glossaries and risk assessments. This role does not automatically make it a register of every crypto company legally authorized to operate. SAMIFIN’s risk assessment page includes an assessment concerning virtual assets and their service providers.
CSBF, meanwhile, supervises banks and financial institutions within the areas assigned to it. That does not mean a foreign platform becomes a Malagasy institution simply because it accepts a local user. The relevant authority depends on the structure, product and service involved. The applicable jurisdictional rules must be read and a specific decision sought, rather than assuming that one institution oversees the entire sector.
A commercial operator may claim registration with a professional body, company registration or technical certification. These documents do not necessarily answer the question of whether it holds a financial license. Always ask: which authority issued the document, to which entity, for what activity and in which country? Then verify the number and scope directly with the cited authority.
An AML registration, where one exists, may also impose compliance obligations without guaranteeing solvency or the safety of customer funds. It does not ensure that the service will repay a balance, that withdrawals will be immediate or that the activity is authorized in every jurisdiction where the application is accessible.
Four statuses that are often conflated
The first status is the company’s legal existence. A commercial register can confirm that an entity exists in a country. On its own, it does not prove that the entity has received a financial mandate.
The second status is authorization to conduct a regulated activity. The license may belong to a company different from the brand name displayed in the application. The contracting entity and the scope of the authorization must be verified.
The third status is AML/CFT compliance. KYC checks and any reporting obligations address customer identification and risk monitoring. Our report on KYC checks, data and remedies explains why a request for identification does not mean that a platform holds a comprehensive license.
The fourth status is the product’s technical availability. A user may be able to access a website without being able to open every product, make a deposit, withdraw funds or benefit from local protections. A French-language interface and a displayed trading pair do not, by themselves, answer the regulatory question.
This distinction also helps assess advertising claims. Terms such as “approved,” “secure,” “registered” or “banking partner” should be supported by precise evidence. A company may legitimately be registered without every crypto activity being licensed. Conversely, a foreign authorization may exist without covering services offered to a Malagasy customer.
How a company should assess its business model
A company seeking to offer a crypto product in Madagascar should map every stage: account opening, collection of ariary, conversion, asset control, blockchain transfers, key custody, local-currency withdrawals and complaint handling. Each stage may involve a different provider, financial flow, jurisdiction and obligation.
It should then identify the entities responsible for each segment and locate the rules applicable to them. A partnership with a mobile wallet does not necessarily create an integrated crypto product. The electronic-money provider may handle only ariary, while a third party manages the token and the exchange. Contracts, financial flows and consumer communications should reflect this separation.
To keep compliance procedures proportionate to risk, they should provide for customer identification where necessary, transaction monitoring, retention of supporting documents and alert management. Every provider handling customer assets should also define its responsibility in the event of loss, an incorrect address or service unavailability. Technical and legal risks do not disappear because the asset operates on a public blockchain.
Finally, teams must keep their monitoring up to date. Publishing a law or decree does not freeze the framework permanently. A CSBF instruction, a new decision, a foreign-exchange circular or case law may change the analysis. Before marketing a product, seeking advice from a qualified local adviser reduces the risk of building a business model on an outdated interpretation.
What individuals should check before trusting a service
Ask for the company’s full legal name, country of establishment, contractual jurisdiction and official support channel. Then look for evidence of a license and compare the product being offered with the authorized activity. The terms and conditions should explain who holds the keys, what happens in the event of a block and how a decision can be challenged.
Check whether the displayed balance can be withdrawn to an address you control. Assets held in an internal account may remain subject to the provider’s procedures. A personal wallet gives users more control but transfers the responsibility for backups to its owner. Our guide to how wallets work and wallet security details these trade-offs.
Reject promises of guaranteed returns, urgent payments to a private wallet and unexpected fees supposedly required by the regulator. Authorities do not ask customers to share their recovery phrase. If a company claims that an account is protected by the state, demand the exact legal text granting that protection.
Madagascar’s framework now recognizes that services involving virtual assets require specific AML/CFT rules. The next step is to clarify supervision and operating conditions for businesses without confusing anti-money-laundering compliance with general authorization. Until more precise official information is published, situations must be assessed case by case and absolute assurances of legal security should be avoided.
