Crypto regulation in Zambia changed course in 2026. In March, the Bank of Zambia asked virtual asset service providers to register with it, while specifying that the process did not amount to a licence. Then, on September 18, the Gazette published directives establishing an authorisation regime for companies providing these services in the country.
The change does not mean that every Bitcoin holder must apply for approval. The rules target people conducting certain activities professionally on behalf of others. A distinction must be made between personally holding an asset, accessing an application and commercially providing a regulated service.
In brief
- The September 2026 directives require a licence to provide virtual asset services in or from Zambia, subject to the transition period available to providers already operating.
- The registration requested in March 2026 was neither a licence nor an approval from the Bank of Zambia.
- Supervision covers activities including exchange, transfers and custody for others; instruments resembling securities may fall under the Securities and Exchange Commission.
From March registration to the September licence regime
The BrefCrypto guide to African crypto issues illustrates a recurring difficulty: the rules applying to a holder and those applying to an intermediary are not found in the same place. In Zambia, that distinction changed rapidly during 2026. It is therefore risky to cite only an old warning on virtual currencies or a March notice without examining the more recent text.
The Bank of Zambia’s March 16, 2026 notice asked individuals and companies offering crypto services to Zambians to register by March 27. The central bank also targeted non-resident providers, even those without a local office. It announced that, from March 30, entities it regulated would no longer be able to facilitate transactions to or from unregistered providers.
This initial exercise was intended to map the market and prepare risk-based rules. The central bank explicitly stated that registration did not constitute a licence or an endorsement of a company. Reading “provider registered in March” today as “licensed platform” erases that distinction. Proof that a form was submitted does not show that a service meets the requirements of a subsequent licence.
The Directives on Virtual Assets, 2026 are based on national legislation governing payment systems. Directive 4 prohibits operating a virtual asset service without a licence. Directive 54 sets the effective date as the day of publication in the Gazette, September 18, 2026. Directive 52 gives providers already operating on that date twelve months to submit an application under procedures determined by the bank.
The practical outcome is therefore neither “everyone already has a licence” nor “all existing companies become illegal overnight.” There is a licensing framework and a transitional provision. A provider’s position depends on when it began operating, the steps it has taken and the regulator’s decisions. Readers should not infer an individual authorisation merely from the existence of the transition period.
Which activities fall within the scope?
The text defines a virtual asset service provider by the function it performs as a business activity for another person. It covers exchanges between fiat currency and virtual assets. It also covers exchanges between virtual assets, their transfer, and the custody or administration of instruments that allow them to be controlled. Certain financial services connected to the offer or sale of a virtual asset are included as well.
This definition can cover very different business models. An exchange that receives kwachas in exchange for BTC provides an exchange service. A platform allowing users to convert BTC into USDT provides a crypto-to-crypto exchange, even without involving a bank. A custodian holding clients’ keys provides a custody service. A fintech moving tokens on behalf of companies may provide a transfer service.
The classification depends on what the company actually does, not on what it calls its application. Describing itself as a “community,” “educational tool” or “simple software” does not answer the question if the company receives funds, executes orders or controls keys for others. Conversely, installing a personal wallet and holding one’s own keys does not automatically turn an individual into a commercial service provider. The specific facts remain decisive.
Directive 2 also provides for exclusions. Certain non-convertible rewards, representations of value used within a particular game and categories of NFTs fall outside its scope. This list does not mean that every NFT is exempt from all Zambian laws: depending on its economic structure, a digital asset may be subject to other rules. A token representing a financial security also requires a separate analysis.
Directive 5 assigns the Bank of Zambia responsibility for licence applications for the services covered, except where the services involve securities or investment instruments, in which case the Securities and Exchange Commission exercises the oversight provided under securities law. A hybrid product may therefore require more than a purely technical review of its smart contract.
What the Bank of Zambia requires from a provider
Authorisation is not based on a simple compliance logo. The application required under Directive 5 includes, among other things, the identities of directors and beneficial owners, a business plan, operating projections, a technical description of the products, consumer-protection mechanisms and the source of capital. For established companies, audited financial statements are also among the requested documents.
Applicants must explain how they manage risks involving cybersecurity, liquidity, personal data, business continuity and customer protection. A stablecoin service must detail the fiat funds intended to support its peg and how that parity would operate. Commercial forms promising “a safe digital dollar” do not, by themselves, answer these questions.
Under Directive 6, the bank has ninety calendar days from receipt of a duly completed application to make a decision. This deadline does not guarantee that an incomplete application will receive a licence after three months. Nor does it justify a platform claiming that approval is “imminent” as though that were already a legal status.
Directive 18 provides for a register of providers that the public can inspect. It must include, among other details, the name, address, authorised services and conditions attached to the licence. For users, this register or direct confirmation from the Bank of Zambia carries more weight than a screenshot supplied by a seller. The trading name, contracting entity and name entered in the register should match.
The obligations do not end once a licence is issued. The text provides for inspections, reporting, complaint procedures and the possibility of suspending or revoking an authorisation. This does not eliminate every risk of failure. Regulatory supervision guarantees neither Bitcoin’s future value nor a token’s liquidity. It does, however, establish an identifiable party responsible for meeting specific requirements.
Client funds, custody and fraud prevention
One frequently overlooked issue concerns ownership of the assets. Directive 22 requires a provider holding assets for clients to maintain enough of each asset type to cover its obligations. It also provides for client assets to be separated from the provider’s own assets and protected from the provider’s creditors. Directive 24, meanwhile, addresses accounts intended to receive client funds and their separation from operating funds.
These rules address a very practical question: when an application displays a BTC balance, where are the BTC, and what could happen if the company fails? Users cannot verify all of a company’s internal accounting, but they can look for its custody policy, withdrawal terms, published audits and contractual remedies. BrefCrypto’s crypto guides on wallets and security help distinguish intermediary risk from the responsibilities that come with self-custody.
The directives also require controls against money laundering and illicit financing. Directive 31 provides for customer identity verification before the service is provided, in accordance with the applicable rules. Directive 21 concerns certain information that must be collected for transfers above a prescribed threshold. The rules may require monitoring without meaning that every private transaction becomes an offence.
Consumer protection is less spectacular, but probably more useful in everyday life. Directive 33 requires risks, costs and fees to be disclosed before a transaction, together with a complaints mechanism. It provides for information to be displayed on the website or application and for an escalation channel. A service that refuses to provide its legal identity, fees or complaints address would run counter to the spirit of these obligations.
A practical limitation remains: the existence of a rule does not prove that every provider is already complying with it or that all users know what remedies are available to them. The transition period makes comparisons even more difficult. Readers should verify the status of a specific company on the date of their transaction rather than applying the word “regulated” uniformly to the entire Zambian market.
The crypto licence does not change the kwacha’s status
The Bank of Zambia notes in its explanatory currency guidance that domestic transaction payments are settled in kwachas, subject to the stated exemptions. The crypto directives regulate a category of service provider. They do not replace monetary rules or make Bitcoin legal tender. A local merchant should not infer from an exchange’s licence that it can invoice and collect payment for any domestic sale in USDT.
This interaction between the rules makes the situation more complex than the slogan “Bitcoin legalised.” Exchange services may operate within an authorised framework while the national currency retains its role in domestic settlements. BrefCrypto’s stablecoin feature explains why a dollar-pegged token also raises questions about foreign exchange and redemption.
For international transfers, the analysis may differ. But the existence of a cross-border transaction does not remove the need to examine foreign-exchange, tax, anti-money-laundering and provider-status rules. An application may technically move units within seconds without, by itself, providing a complete legal answer.
The next stage of Zambia’s regulatory framework will have to be assessed through the Bank of Zambia’s actual decisions and register: which licences are granted, for which services and under what conditions? Until that information is established for a given platform, professional reporting should describe the framework while leaving its individual status open. The new law provides a method of verification, not an automatic list of the “best exchanges.”
Sources and checks to maintain
- Bank of Zambia, Public Notice: Registration of Virtual Asset Service Providers, March 16, 2026.
- Bank of Zambia, Directives on Virtual Assets, 2026, published in the Gazette on September 18 (a reproduction of the Gazette text by a third-party website), primarily Directives 2, 4 to 7, 18, 21 to 24, 30 to 33, 52 and 54.
- Bank of Zambia, Explanatory Notes on the Currency Directives 2025.
The public licensing register was not accessible during this verification. No named provider is therefore presented here as licensed. Any commercial recommendation would require additional individual verification.
