Afghanistan: technology regulation at a glance

Framework: Taliban government religious edicts (crypto declared 'haram' under Sharia law, 2022); Da Afghanistan Bank (DAB) as central bank authority; no formal statutory crypto legislation

Afghanistan under Taliban rule has imposed a de facto total ban on all cryptocurrency activities since mid-2022, declaring digital assets 'haram' (forbidden under Islamic law) and citing risks of fraud and capital flight. Da Afghanistan Bank supported the prohibition; authorities shut down 16+ exchanges in Herat province in August 2022, arrested operators, and have continued enforcement actions through 2024-2025. No licensing, regulatory, or tax framework for digital assets exists, the only operative policy is prohibition.

Framework: No AI-specific law, strategy, or regulatory body exists; the Ministry of Communications and Information Technology (MCIT) under the Taliban Islamic Emirate oversees general ICT but has issued no AI governance instrument

Afghanistan has no comprehensive AI law, sectoral AI rules, voluntary AI principles, or national AI strategy as of May 2026. Since the Taliban's return to power in August 2021, the legal framework has been grounded in the Taliban's interpretation of Sharia law, and no instrument specifically addressing artificial intelligence governance has been enacted or formally proposed. The AI Policy Portal, which tracks global AI policy initiatives, records zero documented AI policy entries for Afghanistan.

Framework: No comprehensive data protection law; limited sector-specific provisions in the Telecommunications Services Law (Official Gazette No. 863, 2005), the Banking Law, and the Penal Code (amended 2017); no dedicated data protection supervisory authority; Afghanistan Telecom Regulatory Authority (ATRA) handles telecom-sector complaints only

Afghanistan has no omnibus personal data protection law and no independent data protection authority. Privacy-related obligations exist only in scattered sectoral legislation covering telecommunications, banking, and cybercrime. Since the Taliban takeover in August 2021, the 2004 Constitution, which contained limited privacy guarantees, is effectively suspended, and no new data protection framework has been enacted by the Islamic Emirate of Afghanistan.

Framework: Da Afghanistan Bank (DAB), Regulation on Licensing and Oversight of Payment and Settlement Systems (2016); Electronic Money Institutions (EMI) Regulation (2016); Regulation on Domestic Payment Operations

Da Afghanistan Bank formally established licensing frameworks for payment system operators and electronic money institutions in 2016 and operates national infrastructure (RTGS, ACSS/ICPSS, AfPay domestic card scheme) through the Afghanistan Payments System (APS) consortium. Since the Taliban takeover in August 2021, practical functioning is severely curtailed: Afghan banks are cut off from SWIFT, approximately $7 billion in DAB foreign reserves remain frozen, and the Taliban has been reviewing financial laws toward Islamic banking principles. A licensing framework formally exists on paper but operates in an internationally isolated and legally uncertain environment.

Framework: Islamic Emirate of Afghanistan, Ministry of Foreign Affairs visa regime; Economic Commission residency-by-investment proposal (February 2026, unenacted)

Afghanistan under Taliban rule offers no dedicated digital-nomad visa and no established pathway for remote workers or self-employed foreigners to reside and work legally. The only available entry instrument is a 30-day single-entry tourist e-Visa launched in early 2026. A residency-by-investment scheme was approved in principle by the Economic Commission in February 2026 but has not been enacted into law, with no minimum thresholds or implementation timeline published.

Framework: Taliban supreme-leader decrees enforced via the Afghanistan Telecommunications Regulatory Authority (ATRA) and Ministry of Communications & IT; no formal online-safety statute exists

Afghanistan under Taliban rule operates no consumer-protection or online-safety framework comparable to the EU DSA or UK OSA. Internet access is instead controlled through morality-based decrees by supreme leader Hibatullah Akhundzada, which have produced repeated shutdowns, platform blocks, and, as of May 2026, orders to sever residential fibre-optic services in Kabul. The regime's approach is one of state suppression rather than safety regulation.

Framework: Cybercrime Code (2017, part of the Penal Code); National Cybersecurity Strategy (2014); Information Systems Security Directorate (ISSD) under Ministry of Communications and Information Technology (MCIT); Afghanistan CERT (AFCERT); Afghanistan Telecom Regulatory Authority (ATRA)

Afghanistan has a rudimentary cybersecurity framework comprising a 2017 Cybercrime Code (embedded in the Penal Code) and an outdated 2014 National Cybersecurity Strategy. There is no comprehensive cybersecurity law, no breach-notification or incident-reporting regime, and since the Taliban's return to power in August 2021 the pre-existing institutional infrastructure (ISSD, AFCERT) has been severely disrupted; the Taliban has instead focused on internet censorship and connectivity restrictions rather than defensive cybersecurity governance.

Framework: Afghanistan Investment Law 2016 (as amended); Companies Law; Afghanistan Central Business Registry (ACBR) under the Ministry of Commerce and Industries (MoCI); AISA (Afghanistan Investment Support Agency, now integrated into MoCI). Taliban de-facto government has maintained legacy registration structures but operates under international sanctions.

Afghanistan formally permits 100% foreign ownership and imposes no statutory minimum capital for LLC formation under its 2016 Investment Law, but the practical environment for foreign business formation is severely constrained. The Taliban's designation as a Specially Designated National (SDN) by the US Treasury/OFAC creates material sanctions-compliance risk for any foreign entity transacting with Taliban-controlled government bodies, including MoCI and ACBR. Compounded by frozen central bank reserves (~$9 billion), a collapsed international banking linkage, and a GDP that fell an estimated 26% after the 2021 Taliban takeover, effective foreign business entry is highly restricted in practice.