By contrast, a message promising a transfer “without checks” or asking for a recovery phrase is not offering privacy protection: it exposes the holder to fraud and theft. Understanding what information is requested, why it is needed and what role each provider plays helps distinguish a compliance procedure from improvised data collection.
In brief
- Angolan Law 11/24 brings virtual asset service providers within the anti-money laundering framework and provides for supervision.
- Transfers may require specific information about the sender and beneficiary when service providers are involved.
- A provider that asks for wallet secrets, codes or remote access cannot justify that request on compliance grounds.
Crypto transfers in Angola: the role of Law 11/24
The Bref Crypto guide to KYC and available remedies provides a reference point for understanding requests for information. For country-specific context, the crypto in Angola report offers additional background.
Law No. 11/24 of 4 July 2024 amends Angolan Law No. 5/20 on the prevention of money laundering, terrorist financing and proliferation financing. It notably introduces Article 10-A concerning virtual asset service providers. The law assigns risk-based supervision of cryptocurrency-related activities to the BNA and supervision of other virtual assets to the CMC.
The law gives the authorities responsibility for monitoring the nature and ownership of assets, identifying operators and implementing preventive measures. It also provides for the authorisation or registration of service providers operating in the country. This framework applies to the businesses concerned; it does not mean that every individual must prepare a regulatory file before reading about or holding digital assets.
Article 10-B introduces rules on occasional transactions and electronic transfers of virtual assets. It requires the relevant providers to apply due-diligence measures and provides for the transmission or retention of information about transfer initiators and beneficiaries, along with risk-based procedures. The text of Law 11/24 published by the Financial Intelligence Unit allows these provisions to be reviewed in context.
The legislation, its implementing regulations and each platform’s internal procedures must be kept separate. A company may request certain documents to meet its obligations, but the process and scope vary. The CMC’s 2026 agenda listed a regulation detailing provider obligations in the fourth quarter. An agenda is not enough to establish the final rule: only a publication in force can confirm the new requirements.
What information a provider may request
A provider subject to customer due-diligence requirements may request information needed to establish a customer’s identity and understand the business relationship. Depending on the service and the level of risk, it may also ask about the purpose of a transfer, the source of funds or the beneficiary’s identity. What is appropriate depends on the legal framework, the relationship, the amount and the circumstances; a general guide cannot set the exact list for every case.
A legitimate request should identify the company and service involved, explain when the information is needed and refer to an accessible privacy policy. Customers should know who processes their data, why it is retained, for how long, and how to exercise their rights or file a complaint. If the request arrives through private messaging, verify the account and sign in through the official domain or application rather than using the link provided.
Neither the law nor compliance procedures justify sharing a recovery phrase, private key, one-time authentication code or account password with an agent. These details may enable someone to take control of the assets or account access. A provider may verify an identity or supporting document, but it does not need to sign on the customer’s behalf using the customer’s personal key.
The Bref Crypto guide to KYC, data and available remedies helps assess a document request: is it connected to the actual entity, the service provided and a clearly stated legal basis? Ask for a written explanation if the request appears disproportionate. Do not send additional documents until the channel has been confirmed.
Originator and beneficiary: why information is shared
Transfer rules are intended to enable providers to identify the parties associated with a transaction and cooperate with authorities where the law requires it. Originator and beneficiary information may accompany the transfer or be retained by the relevant actors. This does not mean that every public blockchain transfer automatically displays the individuals’ legal names: the ledger may show addresses, while custodial services hold account data separately.
When a transfer moves from one platform to another, both providers may apply separate checks. One may request the information before withdrawal; the other may ask for it when the funds arrive. A transaction confirmed on-chain does not require the receiving service to credit an account immediately. It may review the deposit, verify the network, apply its limits or temporarily suspend crediting.
Self-hosted wallets add another distinction. They allow the holder to sign a transaction without a centralised platform, but they do not remove obligations that may apply to a provider at the sending or receiving end. The provider may ask its customer for information about the address or beneficiary. The precise rules depend on the service involved and the law in force. The public nature of a transaction should not be confused with anonymity for all parties.
International compliance standards, such as the information-transfer requirements known in the industry as the “Travel Rule”, are sometimes cited by platforms. A company may apply procedures broader than a jurisdiction’s minimum requirements, subject to applicable law. The local legislation and contract should be checked rather than treating a foreign marketing explanation as an Angolan regulatory decision.
Legitimate checks and fraud can look alike
Both may ask for a name, a document or a confirmation. The difference lies in the identity of the requester, the channel and the scope. A legitimate alert appears in the service’s authenticated area, identifies the entity and provides an explanation. A fraudster, by contrast, may imitate the process through WhatsApp, use a platform’s logo and demand payment or a code under pressure.
A fake support agent may claim that an account has been blocked for money-laundering reasons and demand a “verification fee” sent to a personal wallet. Another scam promises to release the funds after a second payment. Regulatory checks do not justify paying an unknown individual to make a balance appear or recover a transaction. If a fee exists, it should be documented in the contract and displayed through the official channel.
Fake advisers sometimes ask for a wallet screenshot and then exploit a phrase or code visible in the background. Before sending a document, hide data that has not been requested and check the domain. Do not allow balances, a home address, phone number or security details to appear in a public screenshot.
The Bref Crypto guide to verifying a platform recommends confirming the legal entity and its authorisations. The security guidance from Bitcoin.org recalls the principles of key protection. The two approaches are complementary: a secure wallet does not prove that an intermediary complies with the law, and an authorised operator cannot eliminate the risk of sending funds to the wrong address.
How to prepare a transfer without bypassing the rules
Before a transaction, identify who is sending, who is receiving and which providers control the sending and receiving sides. Check the exact name, address or identifier, selected network, net amount, fees and timing. If the provider requests beneficiary information, obtain it from the person concerned and make sure the channel is authentic. Do not fabricate an answer or supporting document to speed up processing.
Keep receipts, platform references, the transaction ID, dates and communications. These records may help explain a transfer or report a problem. They do not guarantee recovery, but an accurate timeline is better than a series of incomplete screenshots.
If the requested information is unclear, contact the service through its official channel and ask for the legal basis, purpose, data recipients and complaints procedure. If the provider refuses to identify the entity or pressures you to bypass a check, stop the transaction and seek legal advice. The Bref Crypto guide to the total cost of transfers can help compare fees without attempting to conceal the amount or beneficiary.
Angolan framework: distinguishing mining from transfers
Law 3/24 prohibits the mining of cryptocurrencies and other virtual assets and provides for offences linked to equipment and electricity. Its subject is not the same as the anti-money-laundering framework for providers. The CMC publishes Law 3/24 in its legislative register. The mining ban should therefore not be used as an automatic explanation for every question concerning a transfer.
Law 11/24 addresses providers and certain transaction-monitoring requirements. Its application depends on the parties’ roles and the type of activity. An individual controlling their own wallet does not necessarily occupy the same position as a company exchanging, holding or transferring assets for customers. This distinction does not, however, amount to an opinion on the legality of any particular transaction.
The CMC’s 2026 agenda announced a text implementing anti-money-laundering obligations and rules for providers in the fourth quarter. The final content, publication and effective date must be checked again. For a business, a cross-border transaction or a dispute, advice from an Angolan lawyer specialising in financial law and compliance is appropriate.
Privacy and transparency can coexist
The Bref Crypto guide to wallet security also covers the protection of personal keys.
Protecting your data does not mean hiding it from a provider legally required to collect it. It means verifying the requester’s identity, submitting only what is required through the designated channel and understanding how the data is retained. Users should avoid publishing addresses linked to a real-world identity, complete receipts or transaction habits on social media.
Public blockchains can be explored. An address is not necessarily anonymous if it is linked to an identified account, a payment or a personal post. Blockchain analytics can aggregate movements and produce assumptions that are not always accurate. Both promises of invisibility and the idea that every address automatically reveals its owner’s name should therefore be avoided.
Technical protection includes keeping devices up to date, using a unique password, enabling strong authentication for hosted accounts and maintaining a protected backup for personal wallets. These measures do not replace provider checks or legal advice. They nevertheless limit exposure to people who claim to be helping with a regulatory procedure in order to obtain access to funds.
Transfer rules are intended to circulate information needed for risk controls, not to authorise the seizure of personal secrets. If a request asks for a code or recovery phrase, the best response is to suspend the exchange. Properly understood compliance and rigorous wallet security serve two distinct purposes and should remain complementary.
