Togo’s March 2026 legislation includes specific provisions for virtual asset service providers. Building a robust file means linking each activity to evidence and each control to an applicable rule. This guide provides a method for mapping and verification, without presenting a draft regulatory framework as a license that has already been granted.
In brief
- Law No. 2026-001 requires prior authorization to provide virtual asset services professionally.
- Status, due diligence and operational responsibilities must be checked separately.
- Mobile payment rules and regional initiatives do not replace the crypto service provider’s own file.
Map the services and the parties responsible
Our UEMOA regulatory dossier places regional players in context. For a company operating in Togo, however, the first useful document maps its actual flows. Record where XOF enters the system, who supplies the tokens, how transfers are made and which entity holds the keys. A single brand may operate through several contracts, making the allocation of responsibilities essential.
A wallet interface does not prove how custody works. The provider may leave the keys with the customer or control every withdrawal itself. The contract and architecture must explain the difference. An “individual address” displayed in the application is not enough to demonstrate that the holder has full autonomy. The more practical question is whether the customer can spend without the company’s intervention.
The conversion activity also requires an economic description. Does the service receive its own funds or customer funds? Does it act under a mandate, charge a commission and do so at what frequency? A regular commercial operation does not become personal merely because transactions pass through a messaging service. The classification should follow the facts rather than the terms used to present the model to users.
Partners must appear on the same map. A bank may process an account, a mobile issuer may handle the payment and a platform may deliver the crypto asset. Their involvement does not automatically cover every function. The file must specify each party’s tasks, contracts and the limits of each proof of status. Customers should be able to identify who is responsible for an incident on the part of the service they use.
This mapping must evolve with the product. Adding custody, an international transfer service or an interest-bearing product may change the scope. The launch file should not remain frozen after a commercial change. Before introducing a new feature, reviewing the rules and partners can reveal obligations that were not present in the previous version of the service.
Read national provisions without inferring a license
Law No. 2026-001 of March 2, 2026 defines virtual assets and service providers within its framework for combating illicit flows. Article 58 makes professional activity subject to approval or prior authorization. A company must therefore examine this requirement as part of its operating file, rather than treating technical access to the blockchain as sufficient permission.
Article 59 sets out the relevant provisions, including preventive measures, and provides that the competent authorities will specify the applicable requirements. The analysis should not stop at a customer identification form. Authorization and controls are two separate questions. A company describing its KYC process does not automatically prove its regulatory status, while a status reference does not explain its day-to-day operations.
The Togolese Ministry of Finance documented the final adoption of the text in February 2026. That step, together with its promulgation in March, helps distinguish the law from earlier drafts. For the exact procedure applicable to the planned service, the relevant implementing measures must still be reviewed. This guide does not claim to provide a consolidated review of all those measures.
Proof of status must match the entity, the activity and the territory. A commercial registration identifies a company but does not necessarily replace the required regulatory authorization. A foreign license does not prove that a local subsidiary has all the permissions it needs. The document must therefore be checked beyond its appearance. The name, dates and covered activities matter more than a logo reproduced in a presentation.
The available research does not support publishing an exhaustive list of locally authorized operators. That limitation justifies neither assigning a license without a source nor making a general accusation against every accessible company. When a service claims to be authorized, request its references and appropriate confirmation. An absence from a quick search should remain classified as unconfirmed, not treated as a definitive verdict.
Organize due diligence around consistent records
The KYC and data protection guide explains how to prepare a customer file. Identification should connect the account holder, the account and the economic relationship. For a corporate customer, it is also necessary to understand the authorized individuals and the relevant information about its control. The contact person placing an order is not necessarily the beneficial owner of the service.
Understanding a transaction involves more than its blockchain hash. A contract or invoice may explain why the amount is moving, while the identifier describes its technical path. A consistent history should distinguish between a purchase, a sale, income and a personal transfer. Contradictory records complicate the review. Compliance does not automatically improve when screenshots are accumulated without a method for matching them.
The law includes rules concerning suspicious transactions and their reporting to CENTIF. A professional file must examine the provisions applicable to the relevant status and service. A risk signal does not, by itself, prove an offense. The analysis, its documentation and the required follow-up must be organized. This guide does not provide an automated system that would turn every unusual transaction into an accusation against the customer.
Record-keeping requirements must also be read within their exact scope. A provision expressly targeting one category of institution should not be applied without analysis to every type of business simply because an online table suggests it. The provider should verify cross-references and relevant texts with qualified counsel. Copying a foreign threshold or an isolated retention period can create a false impression of compliance.
Data collection also requires protective measures. Documents should be submitted through authenticated channels and for clearly explained purposes. A secret code or recovery phrase is never useful proof of the source of funds. Customers must be able to provide relevant references without surrendering control of their account. Internal access to sensitive documents requires as much attention as their initial collection.
Distinguish payment, interoperability and virtual asset services
The BCEAO list of electronic money institutions covers the payments sector. It does not constitute a general authorization to provide crypto custody for every application connected to an issuer. A process that accepts Mixx or Flooz must therefore explain conversion and custody separately. Proof relating to one segment must not be transferred to an adjacent segment merely because they are closely connected.
The official pages for Mixx by Yas and Moov Money Flooz describe local services. A crypto company may arrange payment through these methods, subject to the applicable conditions, without the operator becoming the token issuer. The contract must specify who handles a debit without a corresponding credit and who is responsible for the expected delivery.
Our guide to buying crypto with Mobile Money illustrates these different stages. The possibility of an instant payment does not resolve the reconciliation of the crypto order. An intermediary may need to verify the customer or wait for internal processing. Readers should understand this dependency, particularly when marketing presents the entire process as a single immediate transaction with no conditions.
Regional electronic money rules are evolving, but a change in a limit does not create a VASP license. The publication date must be distinguished from the effective date. The operational capacity of an account may still depend on identification and the issuer’s terms. A company should avoid using a future measure in its commercial promises as though all customers could already benefit from it.
Products combining tokens and yield require an additional analysis. The return may come from lending, a protocol or a market strategy. Classifying the custody arrangement does not necessarily resolve the classification of the financial offering. The file must describe how the funds are used and the product’s risks, rather than presenting it as a simple extension of the mobile payment service already familiar to users.
Build ongoing monitoring and operational evidence
The BCEAO announced a committee on the crypto-asset framework in May 2026. This belongs in regulatory monitoring, not on a list of licenses already obtained. An announcement of future work may guide a project without determining all of its future rules. The provider must separate applicable texts from assumptions about how the framework may develop.
Structured monitoring records the official source, date, effective date and affected activities. Earlier versions help explain a transition but should not remain the sole permanent reference. If the service changes a function, reread the provisions that apply to it. An older document may be authentic while no longer describing every obligation attached to the operating model.
The platform selection framework helps customers review this evidence. A fact sheet can bring together identity, confirmed status, custody, fees, withdrawals and complaints. Unknowns should remain visible. Replacing them with an undocumented confidence score would make it impossible to identify the questions that still require answers.
Operations must generate observable records. An order should make it possible to reconcile payment, credit and withdrawal, with separate references where necessary. The recipient’s wallet must support the intended asset and network. A properly drafted contract cannot fix an incorrect address. Operational security must accompany the legal review without replacing it.
Crypto regulation in Togo therefore provides a concrete working framework without offering a public guarantee for every commercial arrangement. A professional approach links each service to a responsible party and each claim about status to evidence. Where implementing measures or an operator’s authorization remain unconfirmed, that should be stated and the relevant documents requested. This precision is more valuable than a slogan simply saying “compliant.”
