Azerbaijan: technology regulation at a glance

Framework: No comprehensive crypto statute in force yet. A draft law 'On the activity of virtual assets and virtual asset service providers' is being prepared by the Central Bank of the Republic of Azerbaijan (CBAR) under the Financial Sector Development Strategy 2024-2026; meanwhile crypto activity is unregulated-but-permitted and taxed under general tax law, with AML/KYC obligations applied via the Financial Monitoring Service.

Crypto is legal to hold, trade and mine in Azerbaijan but sits in a transitional gray zone: there is no dedicated, in-force crypto/VASP law as of May 2026. The CBAR is developing a draft virtual-assets and VASP licensing law as part of its 2024-2026 strategy, and a Governor's decree on 'Rules of operations with virtual assets' has been signed but does not take effect until the VASP legal framework is adopted. In the interim, crypto income (trading, mining) is taxable under general tax rules and AML/KYC requirements apply.

Framework: Artificial Intelligence Strategy of the Republic of Azerbaijan for 2025-2028 (Presidential Decree No. 530, 19 March 2025); Ministry of Digital Development and Transport; AZS ISO/IEC 42001:2025 national AI management standard; Criminal Code amendments on AI-generated deepfakes (2026)

Azerbaijan does not yet have a comprehensive horizontal AI law, but has enacted a national AI Strategy by presidential decree (March 2025) mandating a dedicated legal framework by 2027, adopted ISO-based AI management standards, and passed sectoral Criminal Code amendments criminalising non-consensual AI-generated deepfakes and synthetic media. The overall regulatory architecture remains under construction, with the Ministry of Digital Development and Transport tasked with drafting binding AI legislation.

Framework: Law of the Republic of Azerbaijan on Personal Data No. 998-IIIQ (adopted 11 May 2010, as amended), supervised by the Ministry of Digital Development and Transport; supplemented by the Law on Information, Informatisation and Protection of Information, the Civil Code and the Code of Administrative Offences.

Azerbaijan has a comprehensive, generally-applicable personal data protection regime centered on the 2010 Law on Personal Data (No. 998-IIIQ), which sets out processing principles, data-subject rights, registration of data systems and cross-border transfer rules. The Ministry of Digital Development and Transport acts as the supervisory authority, maintaining a state register of personal data information systems and enforcing the law. The framework predates and is not fully aligned with the EU GDPR, though amendments have moved it incrementally toward international (Council of Europe Convention 108) standards.

Framework: Law No. 987-VIQ 'On Payment Services and Payment Systems' (adopted 14 July 2023, in force 9 November 2023), administered and supervised by the Central Bank of the Republic of Azerbaijan (CBAR)

Azerbaijan operates a dedicated, in-force licensing regime for digital payments and fintech under the 2023 Law on Payment Services and Payment Systems, with the Central Bank (CBAR) as the sole licensing and supervisory authority. Payment institutions and electronic-money (e-money) institutions must hold a CBAR licence (issued for an indefinite term), and several have already been licensed. CBAR also operates the national instant-payment rails and is actively rolling out an open-banking framework, while BNPL has no dedicated standalone regime.

Framework: Law of the Republic of Azerbaijan on the Legal Status of Foreigners and Stateless Persons; State Migration Service (migration.gov.az); ASAN eVisa system (evisa.gov.az); Action Plan for Accelerating Digital Development 2026-2028 (Presidential Decree, February 2026)

Azerbaijan has no dedicated digital nomad or remote-work visa in force as of May 2026. Remote workers currently enter on the eVisa (ASAN Visa) for short stays of up to 30 days (extendable), with longer-term residency only available through employer-sponsored work permits or an investment-based temporary residence permit. President Aliyev signed a decree in February 2026 approving the 2026-2028 Digital Development Action Plan, which explicitly mandates introduction of a 'Digital Nomad Visa' and 'Digital Talent Visa,' but these programs have not yet been launched.

Framework: Law on Information, Informatization and Protection of Information; Media Law (2022); Law on Telecommunications; Presidential Decree on MİRAS Centralized Information and Digital Analytics System (November 2025); Presidential Decree on Children's Online Safety (February 2026), enforced by the Media Development Agency and the State Security Service

Azerbaijan operates a state-directed internet restriction regime rated 'Not Free' by Freedom House in 2025, marked by systematic blocking of critical news websites, throttling of connections, and imprisonment of journalists for online content. The government leverages the 2022 Media Law and the Law on Information to mandate content removal and impose liability, while a new mass-surveillance platform (MİRAS), established by presidential decree in November 2025 and due fully operational by May 2026, consolidates citizen data from multiple agencies under the State Security Service with no judicial oversight. A separate February 2026 presidential decree introduced age-verification requirements for children on social media, mirroring measures adopted in Australia and France.

Framework: Law on Information, Informatization and Protection of Information (as amended by Law No. 539-VIQD, 27 May 2022); Cabinet of Ministers Decision No. 229 (17 July 2023) on CII Security Requirements; Information Security and Cybersecurity Strategy 2023-2027 (Presidential Decree, August 2023); State Service for Special Communication and Information Security (SCIS)

Azerbaijan's cybersecurity regime is built on the Law on Information, Informatization and Protection of Information, significantly strengthened by Law No. 539-VIQD (2022), which introduced a dedicated chapter on Critical Information Infrastructure (CII) security covering public administration, defence, finance, energy, transport and healthcare. Cabinet of Ministers Decision No. 229 (2023) operationalised these provisions with 29 mandatory security requirements for CII operators across seven domains. There is no single standalone comprehensive cybersecurity law equivalent to NIS2; instead the regime is CII-focused and sector-oriented, supplemented by a 2023-2027 national strategy.

Framework: Civil Code of the Republic of Azerbaijan (Chapter on LLC); Law of the Republic of Azerbaijan 'On State Registration of Legal Entities and State Registry'; registration authority: State Tax Service under the Ministry of Economy (taxes.gov.az)

Azerbaijan permits 100% foreign ownership of limited liability companies (LLCs) with no statutory minimum charter capital, making it straightforward for foreigners to establish a business. Registration is handled by the State Tax Service as a single-window authority and is completed in 2-3 business days for a nominal 11 AZN state fee. Sector-specific foreign-ownership caps apply in media, banking, and insurance, and foreign-source incorporation documents must be apostilled and translated into Azerbaijani.