Cambodia: technology regulation at a glance

Framework: National Bank of Cambodia (NBC) Prakas B7-024-735 on Transactions Related to Cryptoassets (26 Dec 2024) for banks/payment institutions; and Securities and Exchange Regulator of Cambodia (SERC, under the Non-Bank Financial Services Authority) Prakas No. 093 on the Licensing and Management of Digital Asset Businesses (30 Dec 2025) for investment-purpose digital asset service providers. Builds on the 2018 NBC/SERC/National Police joint warning.

Cambodia has moved from a 2018 stance where unlicensed crypto activity was declared illegal toward a newly enacted, two-pillar licensing framework. The NBC's December 2024 Prakas lets supervised banks and payment institutions handle 'backed' cryptoassets (tokenized assets and stablecoins) subject to strict prudential limits while barring direct exposure to unbacked crypto, and the SERC's December 2025 Prakas 093 creates a sandbox-based licensing regime for investment-focused Digital Asset Service Providers and Agents. The regime is in force on paper but very new and still being operationalized, so the practical market remains nascent and tightly gated.

Framework: Draft National Artificial Intelligence Strategy 2025-2030 (Ministry of Post and Telecommunications); no enacted AI-specific law

Cambodia has no enacted comprehensive AI law or binding AI-specific regulations. The Ministry of Post and Telecommunications (MPTC) has developed a Draft National AI Strategy 2025-2030, which completed public consultation in June 2025 but remained in draft form as of the World Governments Summit in February 2026. Governance work is led by MPTC's AI Working Group, with international support from UNESCO and UN-ESCAP.

Framework: Draft Law on Personal Data Protection (LPDP, July 2025), not yet enacted; existing regime relies on Sub-Decree No. 252 (2021), the E-Commerce Law, and general constitutional/civil/criminal-code privacy provisions. Designated supervisory authority (under draft): Ministry of Post and Telecommunications (MPTC).

Cambodia does not yet have a comprehensive, in-force personal data protection law. A final draft LPDP modelled closely on the EU GDPR was released on 23 July 2025 and was still pending parliamentary promulgation as of May 2026. In the interim, personal data is covered only by fragmented sectoral rules, chiefly Sub-Decree 252 (Ministry of Interior identification data), limited E-Commerce Law provisions, and broad constitutional privacy guarantees.

Framework: National Bank of Cambodia (NBC) under the Law on Banking and Financial Institutions, the Prakas on Management of Payment Transactions Service Institutions (14 June 2017), and subsequent Prakas/circulars on Third-Party Processors and KYC/transaction limits; NBC also operates the Bakong national instant-payment system.

Cambodia has an in-force, NBC-administered licensing regime for digital payments. The 2017 Prakas on Payment Transactions Service Institutions sets out license classes (Payment Service Providers, E-Money Issuers, Third-Party Processors) with minimum capital, KYC, and prudential conditions, while Bakong—the NBC's blockchain-based instant-payment backbone launched in 2020—anchors retail and cross-border QR payments (KHQR with Thailand, Vietnam, Laos, China). There is no dedicated open-banking or BNPL regime; those areas remain governed by general banking/PSP rules.

Framework: Cambodia Immigration Law (Kram NS/RKM/0894/03, 26 August 1994); Sub-Decree on Procedure to Allow Non-Immigrant Foreigners to Enter, Leave, and Reside in the Kingdom of Cambodia (2016); work permits governed by Ministry of Labour and Vocational Training (MLVT) via Foreign Workers Centralized Management System (FWCMS)

Cambodia has no dedicated digital nomad or remote-work visa. Long-term remote workers typically rely on the E-class (Ordinary) Visa, most commonly extended via the Business/Employment (EB) category, which is renewable indefinitely in 1, 3, 6, or 12-month increments. Foreigners performing work on Cambodian soil are legally required to hold an MLVT work permit in addition to a valid visa, with non-compliance penalties reaching approximately USD 12,600.

Framework: Sub-Decree No. 23 on National Internet Gateway (2021); Law on Anti-Technology Fraud (April 2026); Ministry of Information (content blocking); Ministry of Post and Telecommunications (MPTC); draft Law on Cybercrime and draft Law on Cybersecurity (pending)

Cambodia operates a heavily state-restricted internet environment in which the government blocks independent media websites, prosecutes critics for social media posts under broadly worded laws, and is actively advancing a National Internet Gateway that would route all domestic and international traffic through a single government-controlled choke point. In April 2026 the National Assembly passed a first-ever anti-technology-fraud cybercrime law primarily targeting scam operations, while a broader draft cybercrime law whose vague speech provisions have drawn sharp criticism from rights groups remains pending. No comprehensive online safety framework analogous to the EU DSA or UK OSA exists.

Framework: Law on Cybercrime (2015); Law on Combating Technology-based Fraud (promulgated 7 April 2026); Telecommunications Law (2015); Ministry of Post and Telecommunications (MPTC) / Telecommunications Regulator of Cambodia (TRC)

Cambodia's cybersecurity regime rests on a 2015 Cybercrime Law addressing illegal access, data and system interference, and a telecommunications regulatory framework under the MPTC and TRC. In April 2026 a new Law on Combating Technology-based Fraud was promulgated, targeting scam centres, 'pig-butchering' schemes, and crypto-based money laundering. No comprehensive NIS2-style cybersecurity law is in force; a draft Cybersecurity Law and a draft Law on Personal Data Protection (which would introduce 72-hour breach notification) remain unenacted as of May 2026.

Framework: Law on Commercial Enterprises (2005, amended), Law on Investment (2021), and Ministry of Commerce Prakas No. 117 on Simplification of Business Registration (9 December 2025, effective 8 January 2026)

Cambodia permits 100% foreign ownership in most sectors and has no restrictions on capital repatriation under the 2021 Law on Investment. Registration is conducted digitally through the Ministry of Commerce's CamDX single portal, spanning the MoC, General Department of Taxation, and Ministry of Labour, with a combined timeline of roughly 7-21 working days. Prakas No. 117 (effective January 2026) has further streamlined the process with standardised templates, digital signatures, and mandatory third-party director/shareholder due diligence checks.