Bhutan: technology regulation at a glance

Framework: Gelephu Mindfulness City (GMC) / Gelephu Financial Services Office (GFSO) special-administrative-zone licensing regime; Royal Monetary Authority of Bhutan (RMA) for mainland financial oversight

Bhutan operates a deliberate dual-track system: crypto-related activities (mining, exchange, custody) are legally permitted only within the Gelephu Mindfulness City special administrative zone under GFSO licensing, while on-ramping through RMA-regulated domestic banks remains restricted for the general public. The sovereign state has been a significant Bitcoin miner since 2019 via state-owned Druk Holding & Investments, and in May 2026 GMC launched a fast-track licensing pathway actively attracting globally regulated crypto firms. No comprehensive nationwide crypto law exists; the regulatory architecture is still being built around the GMC sandbox.

Framework: Bhutan National AI Strategy 2025 (NAIS 2025) and GovTech Guideline for Generative AI Usage in the Civil Service (2024), both issued by the Government Technology Agency (GovTech) under the Royal Government of Bhutan

Bhutan has no enacted AI legislation; its governance posture rests on a non-binding National AI Strategy 2025 anchored in Gross National Happiness (GNH) values and a 2024 civil-service generative-AI usage guideline. The 2024 UNDP AI Readiness Assessment explicitly identified the absence of a comprehensive ethical AI framework as a critical gap, and binding regulation remains a planned future enabler within the strategy rather than current law.

Framework: Information, Communications and Media Act (ICMA) 2018 administered by Bhutan InfoComm and Media Authority (BICMA); supplemented by Royal Monetary Authority (RMA) Guidelines on Data Privacy and Data Protection 2021 (financial sector) and National Digital Identity Act 2023

Bhutan has no standalone comprehensive data protection law and no dedicated Data Protection Authority. Privacy obligations are fragmented across sector-specific instruments: the ICMA 2018 provides minimal online-privacy and payment-security provisions for ICT/media services, the RMA's 2021 Guidelines impose data protection requirements on financial institutions, and the National Digital Identity Act 2023 introduces a self-sovereign identity model with built-in personal-data controls. Bhutan's National Cybersecurity Strategy 2024-2029 formally identifies the absence of a dedicated data privacy law as a legal gap requiring legislative action.

Framework: Payment and Settlement Systems Rules and Regulations 2018, issued by the Royal Monetary Authority (RMA) of Bhutan under the RMA Act 2010 and the Financial Services Act of Bhutan 2011.

Bhutan has an in-force licensing regime for digital payments administered by the central bank, the Royal Monetary Authority (RMA). The Payment and Settlement Systems Rules and Regulations 2018 prohibit any person other than the RMA from operating a payment system or providing payment services without an RMA license, and a small number of banks and telecom-backed e-money/e-wallet providers operate under this framework. Instant payments run on RMA-operated rails (Bhutan Immediate Payment Service / Bhutan Financial Switch), while open banking and BNPL are not yet covered by dedicated rules.

Framework: Gelephu Mindfulness City Authority (GMCA) Digital Nomad Residence Programme, operated in partnership with NomadClub; national immigration governed by Department of Immigration, Ministry of Home Affairs (doi.gov.bt)

Bhutan launched a dedicated Digital Nomad Residence Programme in February 2026 through the Gelephu Mindfulness City (GMC) Special Administrative Zone. It is the world's first blockchain-backed digital nomad visa, requiring a refundable US$10,000 deposit in the sovereign gold-backed TER token on the Solana blockchain plus a US$2,800 non-refundable annual fee. Holders may live and work remotely within the GMC zone for up to 24 months, with travel throughout Bhutan, but may not work for Bhutanese employers.

Framework: Information, Communications and Media Act 2018 (ICMA 2018); Bhutan InfoComm and Media Authority (BICMA); Rules and Regulations on Content 2019

Bhutan regulates online content primarily through the ICMA 2018 and its subordinate Rules and Regulations on Content 2019, administered by BICMA. The regime covers unlawful online content, cybercrime-adjacent offences, and broadcasting/media, but Bhutan lacks a dedicated cybercrime law, a standalone data protection act, and any comprehensive online safety statute comparable to the EU DSA or UK OSA. The National Assembly called in 2024-2025 for stronger enforcement and possible ICMA amendments to address harmful digital content.

Framework: Information, Communications and Media Act (ICMA) 2018 (enforced by BICMA); Penal Code cyber-offence provisions; National Cybersecurity Strategy 2024-2029 (GovTech/BtCIRT)

Bhutan has no single comprehensive cybersecurity statute; cybersecurity obligations are distributed across the ICMA 2018, which criminalises cybercrime and mandates breach notification through BICMA, and relevant Penal Code provisions. The Government Technology Agency (GovTech) launched the inaugural National Cybersecurity Strategy 2024-2029 in October 2024, which explicitly identifies the absence of a dedicated cybersecurity law as a gap and calls for a new legislative framework as one of its four core goals. A review of the ICMA to bolster cybersecurity has been announced but no standalone law is yet in force.

Framework: Foreign Direct Investment Rules and Regulations 2025 (effective 18 July 2025), Companies Act of Bhutan 2016; administered by the Ministry of Industry, Commerce & Employment (MoICE) and InvestBhutan (investbhutan.gov.bt)

Bhutan's FDI Rules and Regulations 2025, which replaced the 2019 policy, introduced a tiered ownership framework: 100% foreign ownership is permitted in priority sectors (IT, luxury hospitality, healthcare, R&D, infrastructure via PPP), while other sectors cap foreign equity at 74% and a Schedule III negative list bars FDI entirely from areas such as retail trade, raw mineral mining, and 3-star-and-below hotels. Company formation requires multi-step registration through MoICE and compliance with sector-specific minimum investment thresholds, making the overall environment moderate in ease for foreign entrants.