Brunei: technology regulation at a glance

Framework: No dedicated crypto statute. Brunei Darussalam Central Bank (BDCB), formerly AMBD, supervises the financial system under the Brunei Darussalam Central Bank Order 2010; BDCB has publicly stated it is developing a legal and regulatory framework for the licensing and supervision of cryptocurrencies and related activities. AML/CFT guidelines for financial institutions took effect 1 April 2024.

Crypto/digital assets are legal to hold and trade in Brunei but are not legal tender and are currently unregulated, there is no licensing regime for exchanges, stablecoins, custody, or token offerings in force. BDCB has repeatedly warned the public to exercise extreme caution with privately issued cryptocurrencies and has said it is developing a licensing/supervision framework, placing Brunei in a developing rather than fully regulated or banned posture.

Framework: Guide on Artificial Intelligence (AI) Governance and Ethics for Brunei Darussalam (AITI, April 2025), voluntary, principles-based; supported by the Personal Data Protection Order 2025 (binding, private-sector data protection)

Brunei Darussalam's AI governance is led by the Authority for Info-communications Technology Industry (AITI), which published a voluntary, risk-based AI Governance and Ethics Guide in April 2025 built around seven core principles. No binding, comprehensive AI law exists; the country favours a flexible, innovation-friendly approach aligned with the ASEAN regional framework. A national Data and AI Strategy and the next Digital Economy Master Plan (post-2025) are in development, with AI designated as central to both.

Framework: Personal Data Protection Order 2025 (S 1/2025), supervised by the Authority for Info-Communications Technology Industry of Brunei Darussalam (AITI)

Brunei Darussalam enacted its first comprehensive personal data protection statute, the Personal Data Protection Order 2025 (PDPO), gazetted on 8 January 2025, with key operative provisions commencing 1 January 2026 following a one-year grace period. The law applies to private-sector organisations and NGOs, grants data subjects enforceable rights, and designates AITI as the supervisory authority. The public sector remains outside the PDPO's direct scope.

Framework: Brunei Darussalam Central Bank (BDCB) under the BDCB Order, 2010 (s.54(1)); Notice No. PSO/N-1/2020/1 on Requirements for Payment Systems; plus money services licensing and the National QR Code Standard notice.

Brunei has an in-force, dedicated payments regime administered by the Brunei Darussalam Central Bank (BDCB). Companies operating payment systems or offering payment services/instruments must obtain BDCB approval under Notice No. PSO/N-1/2020/1 (issued under s.54(1) of the BDCB Order, 2010), with defined capital and security requirements, while money-remittance and money-changing businesses are separately licensed. Instant payments are live via the national 'tarus' system, but consumer-credit products like BNPL are not yet covered by a dedicated framework.

Framework: Immigration Act (Cap. 17), administered by the Department of Immigration and National Registration (JIPK) under the Ministry of Home Affairs, Brunei Darussalam

Brunei Darussalam has no dedicated digital-nomad or remote-work visa, and no residency-by-investment (golden visa) programme. All work-authorisation pathways are employer-sponsored and require a registered Brunei entity as sponsor, making independent remote work for a foreign employer legally impracticable. A Long-Term Pass introduced on 31 December 2024 covers investors, in-demand professionals, and family-tie holders, but is not designed for, or accessible to, typical location-independent remote workers.

Framework: Multiple overlapping instruments: Computer Misuse Act (Cap. 194, 2007), Telecommunications Order 2001, Broadcasting (Class Licence) Notification 2001 (Internet Code of Practice), Cybersecurity Act (Cap. 272, enacted 2023, revised 2024); overseen by AITI and a multi-agency Content Advisory Council (CAC)

Brunei operates a state-managed internet environment with no constitutional protection for freedom of expression online. ISPs and internet content providers are legally required to comply with an Internet Code of Practice mandating self-censorship, and government authorities actively block websites and monitor online communications. No dedicated comprehensive platform-safety law comparable to the EU DSA or UK OSA exists; control is exercised through a patchwork of criminal, telecommunications, and cybersecurity legislation enforced across multiple agencies.

Framework: Cybersecurity Act, Chapter 272 (S 20/2023, Revised Edition 2024), administered by Cyber Security Brunei (CSB); complemented by the Computer Misuse Act (Chapter 194, 2007) and Personal Data Protection Order (PDPO) 2025

Brunei enacted its standalone Cybersecurity Act via Cybersecurity Order (S 20/2023) on 20 May 2023, consolidated as Chapter 272 in the 2024 Revised Edition. The Act establishes a national cybersecurity oversight regime centred on protecting Critical Information Infrastructure (CII) across ten essential-service sectors, with mandatory incident-reporting duties for CII owners under Section 16. The PDPO 2025 adds a 3-calendar-day data-breach notification requirement for private-sector organizations.

Framework: Companies Act (Cap. 39, 1956, as amended 2021), administered by the Registry of Companies and Business Names (ROCBN) under the Ministry of Finance and Economy (MOFE); online registration via the One Common Portal (OCP)

Brunei permits foreigners to incorporate a private limited company (Sdn. Bhd.) with no minimum paid-up capital and, in most sectors, 100% foreign equity ownership. The principal constraint is a statutory requirement for at least one director to be ordinarily resident in Brunei, and sector-specific rules impose equity ceilings or local-partner requirements in retail, banking, and certain professional services. Registration is online and typically completed within one to two weeks.