How Africa actually regulates digital finance: a comparative guide to fintech law

If you set out to find "the fintech law" of an African country, you will usually fail, not because the activity is unregulated, but because there is rarely a single statute to find. Across the ATLPF Library, fintech is governed by a regulatory perimeter assembled piece by piece: a payment-systems Act here, a central-bank directive on electronic money there, a circular on agent networks, a guideline on mobile money, a framework for a regulatory sandbox. The Library currently holds 115 fintech-tagged instruments spread across 40 distinct jurisdiction entries, and the gap between those two numbers is itself the headline finding. Fintech is not regulated one-statute-per-country. It is regulated through layered, accreting bodies of subordinate rules, with several countries carrying five, six or ten separate instruments each.

The composition of those 115 instruments tells the same story. Only 35 are primary legislation (Acts). The remaining 80 are subordinate or quasi-legislative: 36 regulations and 44 items of guidance, circulars, directives, determinations, practice notes, frameworks and licensing guidelines issued by regulators rather than passed by legislatures. In other words, roughly seven in ten fintech instruments in the Library sit below the level of an Act. This is the defining structural feature of the field. A primary payments statute typically establishes the regulator's mandate and the architecture of the national payment system; the actual rules that fintech firms must comply with, who needs a licence, how much capital, what a wallet may hold, what an agent may do, live in the subordinate layer, where they can be issued and revised quickly. Fintech regulation in Africa is, predominantly, central-bank rulemaking.

Who regulates, and how

The dominant regulator across almost every jurisdiction in this dataset is the central bank, not a dedicated fintech authority or a standalone financial-conduct body. Of the 43 fintech-tagged regulators in the Library, the overwhelming majority are national central banks exercising payment-system oversight, and their mandates are strikingly consistent in substance even where the institutions differ in name.

The Central Bank of Nigeria is the clearest example of a central bank acting as the principal fintech regulator. Its mandate extends from monetary policy and currency issuance, including the eNaira central bank digital currency, to the licensing categorisation of payment service providers and the supervision of mobile money, payment service banks, agent banking, open banking and virtual-asset settlement arrangements. The Central Bank of Kenya occupies the same position under the National Payment System Act 2011 ke-npsact-2011, authorising payment service providers and e-money issuers, and since 2022 licensing digital credit providers ke-dcp-2022. The Bank of Ghana, the Bank of Tanzania, the Bank of Uganda, the National Bank of Rwanda, the Reserve Bank of Zimbabwe, the Bank of Zambia, the South African Reserve Bank, Bank Al-Maghrib in Morocco, the Central Bank of Egypt and the Banque d'Algérie all carry materially the same remit: they are the sole or principal overseers of the national payment system, with power to license payment providers and e-money issuers and to issue binding directives.

This concentration of authority in the central bank explains why so much fintech regulation takes the form of guidance and circulars. A central bank supervising payments can act through its own instruments without returning to the legislature, which is why the subordinate layer is so thick. The Reserve Bank of Zimbabwe, for instance, enforces mobile-money interoperability through statutory instruments zw-fintech-si80-2020 zw-fintech-si17-2025 rather than fresh primary law. The Central Bank of Egypt issues licensing, governance and fit-and-proper rules for payment providers eg-psplicensing-2025 eg-psogovernance-2025 under the umbrella of its 2020 banking law eg-cbebankinglaw-2020.

There are genuine institutional exceptions, and they cluster around capital-markets and crypto activity, where a securities or conduct regulator is better placed than a payments supervisor. Mauritius is the most distinctive case in the dataset: it has a separate Financial Services Commission, distinct from the Bank of Mauritius, and the two split the fintech field cleanly. The Bank of Mauritius regulates payment systems and e-money under the National Payment Systems Act 2018 mu-npsact-2018, while the FSC licenses virtual-asset service providers and token offerings mu-vaitos-2021, peer-to-peer lending mu-p2plending-2020 and crowdfunding mu-crowdfunding-2021. This dual-regulator model, a central bank for payments, a separate financial-services commission for investment-type fintech, is the exception, not the norm.

Egypt and South Africa show variants of the same split. In Egypt the Central Bank handles banking-sector fintech while the Financial Regulatory Authority governs fintech in non-banking financial activities eg-nbffintech-2022. In South Africa the SARB administers the national payment system, but it was the Financial Sector Conduct Authority that brought crypto assets within regulation by declaring them a financial product under the FAIS Act za-cryptoasset-2022. Ghana and Kenya have adopted co-regulatory models for crypto, pairing the central bank with the securities regulator gh-vaspact-2025 ke-vaspact-2025. But these are refinements at the edges. For the core of fintech, payments, e-money, mobile money, the central bank is, almost everywhere in this dataset, the regulator.

The regional currency union story

One of the most distinctive features of the African fintech map is that a meaningful share of the continent is not regulated nationally at all for payments, it is regulated supranationally, through two monetary unions whose common central banks issue rules that apply uniformly and directly across all member states.

In francophone West Africa, the eight members of the West African Economic and Monetary Union (WAEMU/UEMOA), Benin, Burkina Faso, Côte d'Ivoire, Guinea-Bissau, Mali, Niger, Senegal and Togo, share a single payments regime set by the Banque Centrale des États de l'Afrique de l'Ouest (BCEAO). The Library captures this through three instruments: the foundational Regulation No. 15/2002 on payment systems [waemu-fintech-paymentsystems-2002], the 2015 BCEAO Instruction governing electronic money issuers [waemu-fintech-emoney-2015], and the comprehensive 2024 Instruction on payment services [waemu-fintech-paymentservices-2024], described in the data as the most significant fintech-payments reform in WAEMU in a decade. Crucially, these are Council-of-Ministers regulations and BCEAO instructions that are directly applicable in every member state without national transposition. A mobile-money operator in Senegal and one in Togo are governed by the same rulebook, the same licensing thresholds, and the same safeguarding requirements, for instance the requirement under the 2015 e-money instruction that outstanding e-money be backed at all times by equivalent funds, at least 75% held in sight deposits with banks.

Central Africa mirrors this. The six members of the Central African Economic and Monetary Community (CEMAC), Cameroon, Chad, Congo (Republic), Equatorial Guinea, Gabon and the Central African Republic, share payment regulation set by the Banque des États de l'Afrique Centrale (BEAC) together with the regional banking commission COBAC. The Library holds the 2016 Regulation on payment systems, means and incidents [cemac-fintech-paymentsystems-2016] and the 2018 Regulation on payment services [cemac-fintech-paymentservices-2018]. The latter is the legal basis on which mobile-money and e-wallet services are licensed across all six states, bringing funds transmission outside a bank account and the issuance of electronic money within the regulatory perimeter.

It is worth being precise about how this consolidation actually appears in the data, because it diverges from a naïve "one country, one set of entries" model. The WAEMU instruments are recorded once, under Côte d'Ivoire (the Union's largest economy); the CEMAC instruments are recorded once, under Cameroon (BEAC's headquarters and the largest CEMAC economy). The instrument summaries state this explicitly, the records are kept once "to avoid six near-identical entries", and confirm that each applies region-wide. This has a direct consequence for reading the Library's jurisdiction counts. The 40 distinct jurisdiction entries understate the true country coverage for payments, because twelve additional member states (the seven other WAEMU members and the five other CEMAC members) are covered through the consolidated regional instruments without appearing as separate fintech jurisdictions. In other words, when Benin or Gabon does not show its own payment-services instrument, that is not a regulatory gap: it is supranational regulation, captured upstream. Any analysis that simply counts instruments per country will therefore misread the francophone zones, where the regulatory action sits at the union level rather than the national one.

What's actually being regulated

Beneath the institutional patterns, the substantive coverage in the Library clusters into a recognisable set of areas, and the same areas recur across very different jurisdictions, which is itself evidence of a converging regulatory agenda.

Payment systems and PSP licensing form the foundation almost everywhere. Most jurisdictions begin with a national payment systems Act that establishes the central bank's oversight and a licensing regime for payment providers, South Africa's National Payment System Act of 1998 za-npsact-1998 is among the oldest, with Tanzania tz-npsact-2015, Uganda ug-npsact-2020 and Rwanda rw-paymentsystemlaw-2021 representing the more recent generation. Nigeria layered a detailed licensing categorisation on top of its base regime, sorting providers into defined tiers ng-pspcategorisation-2020, while WAEMU's 2024 instruction created a new "établissement de paiement" category with capital thresholds scaled to the services offered [waemu-fintech-paymentservices-2024].

E-money issuance is the second near-universal area, and the rules are remarkably consistent: dedicated licensing for e-money issuers, mandatory safeguarding of customer funds in segregated bank deposits, and prohibitions on lending and on paying interest on balances. Kenya's E-Money Regulations ke-emoney-2013, Tanzania's tz-emoney-2015, Rwanda's rw-emoney-2022, Ghana's e-money guidelines gh-emoney-2015 and Zambia's directives zm-fintech-emoney-directives-2023 all follow this template, as does the WAEMU e-money instruction [waemu-fintech-emoney-2015].

Mobile money is frequently regulated as its own category, reflecting its outsized role in African financial inclusion. The Library holds dedicated mobile-money frameworks in Nigeria ng-mobilemoney-2021, Liberia lr-fintech-mobilemoney-2014 and Somalia so-mobilemoney-2019, the last bringing a large, telecom-driven sector into a formal AML/CFT framework for the first time, alongside Morocco's domestic mobile-payment framework ma-fintech-mobilepay-2018.

Agent banking and agent networks, the last-mile infrastructure of financial inclusion, are increasingly regulated in their own right. Nigeria's 2025 agent-banking guidelines ng-agentbanking-2025 are a notable example of the subordinate layer being actively revised: they supersede the 2013 rules and add requirements such as card neutrality and a dedicated agent transaction code for monitoring. Ghana issued an agency-banking guideline in 2025 gh-agencybanking-2025, Uganda regulates agents by dedicated regulation ug-nps-agents-2021, and the WAEMU and CEMAC regimes address distributors and agents at the regional level.

Digital-only and inclusion-focused banking appears most prominently in Nigeria's Payment Service Bank model ng-psb-2020, a digitally-focused, deposit-taking licence designed to reach the unbanked, and the route by which major telecommunications operators entered Nigerian financial services. Egypt's 2020 banking law created the basis for licensing digital banks alongside conventional ones eg-cbebankinglaw-2020.

Open banking is, so far, a Nigerian specialism within the dataset: the CBN's 2021 framework ng-openbankingframework-2021 made Nigeria one of the first African jurisdictions with a regulator-led open-banking regime, operationalised by detailed 2023 guidelines ng-openbanking-2023 governing customer-permissioned data sharing through standardised APIs.

Crypto-assets and virtual-asset service providers are the newest and fastest-moving area. South Africa moved first, by regulatory declaration za-cryptoasset-2022; Mauritius enacted a dedicated VASP statute in 2021 mu-vaitos-2021; and 2025 - 2026 has seen a wave of primary legislation, Ghana's Virtual Asset Service Providers Act gh-vaspact-2025, Kenya's ke-vaspact-2025 and Rwanda's law regulating virtual-asset business rw-vasplaw-2026. Nigeria, by contrast, has so far addressed the sector through guidance on banking arrangements for VASPs ng-vasp-2023 rather than a standalone Act. Regulatory sandboxes, controlled environments for testing fintech innovations, round out the picture, with dedicated frameworks in Egypt eg-sandbox-2019, Nigeria ng-sandbox-2021, Rwanda rw-sandbox-2022 and Uganda ug-nps-sandbox-2021.

Maturity and gaps

The depth of fintech regulatory infrastructure varies enormously across the Library, and the raw instrument-count distribution is the most direct measure. Nigeria is the clear outlier with ten fintech instruments, reflecting a regulator that has built out payments, mobile money, payment service banks, open banking, agent banking, a CBDC and sandbox provisions as distinct, separately-documented regimes. Egypt follows with six, and a cluster of jurisdictions, South Africa, Kenya, Rwanda and Mauritius, each carry five, representing mature, multi-layered frameworks. Below them sits a broad middle tier of jurisdictions with three to four instruments, including Ghana, Uganda, Zambia, Zimbabwe, Morocco, Ethiopia, Tanzania, Namibia, Malawi, Madagascar and Botswana.

At the other end, nine jurisdictions appear in the dataset with only a single fintech instrument: Comoros, Djibouti, Gambia, Guinea, Mauritania, Seychelles, Somalia, South Sudan and Sudan. Here a note of caution is essential. A single instrument, or none, may reflect either a genuine regulatory gap or simply a research gap, and the two should not be conflated. Some of these countries plainly have nascent regimes: South Sudan's e-money rules sit alongside near-total absence of broader digital-finance law. Others may have rules the Library has not yet captured. The dataset also includes very recent entrants that signal active development rather than maturity, such as Sudan's 2026 directive on new payment instruments sd-fintech-newpayment-controls-2026 and Mozambique's 2026 instant-payments regulation mz-fintech-spim-2026, issued even where the surrounding framework is thin.

The Jurisdictions database carries a Coverage Score, but it should be read with care in this context: it is a general, ATLPF-wide measure of how completely a jurisdiction's tech-law environment is documented, and its accompanying gap notes are oriented largely toward data-protection coverage rather than fintech specifically. It is therefore a useful proxy for overall documentation depth, Kenya, Nigeria and Egypt score highest at 85, but it is not a fintech-maturity index, and the instrument-count distribution is the better guide to where fintech regulatory infrastructure is genuinely deep. What both measures share is an honest acknowledgement built into the data itself: many records flag that subsidiary instruments "are not separately documented on file," and several jurisdiction notes concede that newer regulators have limited enforcement track records. The Library does not claim to have found everything that exists.

The francophone monetary unions complicate the maturity picture in a productive way. A country like Niger or Gabon may show little or nothing under its own name, yet its payment providers operate under a sophisticated, decade-deep regional regime. Reading maturity at the national level alone would badly understate the regulatory environment those firms actually face.

What the density tells us

Fintech is, on the evidence of the Library, the most intensively regulated digital-policy topic it tracks, and the pattern of that regulation is distinctive. Where other digital domains tend to be anchored by a single comprehensive statute per country, fintech is governed by dense, layered, fast-revising bodies of central-bank rulemaking, supplemented in the franc zones by directly-applicable supranational regulation. The sheer volume, 115 instruments and counting, concentrated in payments and e-money but expanding rapidly into agent banking, open banking and virtual assets, signals how central digital finance has become to African economic policy, and how comfortable monetary authorities have become acting as the continent's de facto fintech regulators.

It is also the area most likely to date quickly. A striking share of these instruments carry 2024, 2025 and even 2026 effective dates, and several supersede rules only a few years old. New virtual-asset statutes are arriving in successive legislative sessions; agent-banking and open-banking rules are being rewritten; instant-payment systems are going live. This guide reflects the Library as it currently stands, but fintech is the topic where "currently" has the shortest shelf life. It will need refreshing more often than most, and readers should treat the absence of a recent instrument less as a settled fact than as an invitation to check whether the regulator has moved again.