Comoros: technology regulation at a glance

Framework: Banque Centrale des Comores (BCC) holds sole legitimate regulatory authority under Union law; no enacted Union-level crypto or digital-asset law exists. Autonomous islands Anjouan (AOFA) and Mwali (MISA) sell offshore crypto licenses that the Union government and international bodies do not recognise.

The Union of Comoros has no enacted national legislation specifically governing cryptocurrency or digital assets. The Banque Centrale des Comores has repeatedly warned that licenses issued by the autonomous islands' offshore authorities (AOFA and MISA) are fictitious and legally invalid, a position reaffirmed in December 2025. There is no formal licensing, tax, or investor-protection regime for crypto at the Union level.

Framework: No dedicated AI law or AI-specific framework; general digital governance falls under ANRTIC (Decree 065/2009) and the 'Comores Numérique 2028' national digital strategy (2019). Comoros is an AU member state subject to the non-binding Continental AI Strategy (July 2024).

As of May 2026, the Union of the Comoros has no national AI legislation, no sectoral AI rules, no published national AI guidelines, and no formally tabled AI bill. Digital governance is handled by the ICT regulator ANRTIC under a 2009 decree and a general 2019 digital-economy strategy. The country is investing in foundational digital infrastructure, including a new national data centre and a planned personal-data protection authority, through a 2024 AfDB-funded project, but none of these instruments specifically govern artificial intelligence.

Framework: Law of 26 June 2014 on the Protection of Personal Data (Loi du 26 juin 2014 portant protection des données à caractère personnel); supplemented by Electronic Communications Law No. 14-031/AU (2014, amended 2024) and Cybersecurity Law 21-012/AU (2021). Supervisory body: National Authority for the Protection of Personal Data (ANPDP), established in law but not yet operational.

The Union of the Comoros enacted a standalone personal data protection law in June 2014, published on the official Ministry of Justice portal, making it one of the earlier comprehensive data protection statutes in the Indian Ocean region. The law creates an independent supervisory authority (ANPDP), but that body had not been formally constituted or made operational as of mid-2024. A 2024 African Development Bank digital-development grant explicitly includes funding to operationalize the ANPDP, signalling that enforcement capacity remains the outstanding gap.

Framework: Law No. 20-005 AU on Payment Services and Payment Service Providers; Regulation 01/2017 on Electronic Money Issuers; supervised by Banque Centrale des Comores (BCC)

Comoros has a foundational but still-maturing licensing regime for digital payments: the BCC regulates payment service providers and electronic money institutions under Law 20-005 AU and Regulation 01/2017, with several EMI approvals already granted. A new 'Decentralised Digital Financial Institution' (IFDD) licence category was introduced in early 2026, and a national interbank payment infrastructure (Komor Pay) went live in April 2026 with World Bank support. Open banking, BNPL, and instant-retail-payment frameworks remain absent or undeveloped.

Framework: General Comorian immigration law administered by the Direction Générale de la Sûreté du Territoire / immigration authorities: visa-on-arrival (45 days), long-stay visas, and temporary/long-term residence permits. No remote-work-specific statute.

Comoros has no dedicated digital-nomad or remote-work visa and is absent from all 2026 digital-nomad visa indexes. Relocators must use general immigration routes: a 45-day single-entry visa-on-arrival, a long-stay visa obtained via embassy, and temporary residence permits (up to one year, renewable) tied to work, study, family reunification, retirement, or investment. The former citizenship-by-investment program is closed, so there is no residency-by-investment pathway today.

Framework: Law 21-012/AU on Cybersecurity and the Fight against Cybercrime (2021); Personal Data Protection Law (2019); 2014 Communications Act; regulated by ANRTIC (telecoms) and ANADEN (cybersecurity)

Comoros has enacted a patchwork of partial digital laws, a 2021 cybersecurity/cybercrime law, a 2019 personal data protection law, and a 2014 Communications Act, but has no comprehensive online safety legislation equivalent to the EU DSA or UK Online Safety Act. There is no dedicated content-moderation, platform-liability, or age-verification regime. Authorities have additionally demonstrated willingness to impose internet shutdowns, including a documented shutdown during the January 2024 post-election protests.

Framework: Law No. 21-012/AU on Cybersecurity and the Fight Against Cybercrime (Union of Comoros), promulgated by Decree No. 22-003/PR (18 January 2022); supplemented by the Personal Data Protection Law (2021) and Penal Code Chapter IV (Articles 449-505 on cybercriminality); administered by ANADEN (National Agency for Digital Development)

Comoros enacted a standalone, comprehensive cybersecurity and cybercrime law in 2021-2022 (Law 21-012/AU), covering critical infrastructure protection, cybercrime offences, and designating ANADEN as the national cybersecurity authority. A separate Personal Data Protection Law was enacted simultaneously, but the data protection supervisory body had not been formally constituted as of mid-2024. Implementation capacity remains limited: no operational national CIRT exists and the country scored 37.50/100 on the NCSI, ranking 92nd globally.

Framework: Investment Code 2020 (adopted 28 December 2020, superseding Law N°07-0010/AU of 2007), administered by the National Agency for Investment Promotion (ANPI) via a Guichet Unique (one-stop shop); company law follows OHADA commercial law principles

Comoros permits 100% foreign ownership in most sectors under its 2020 Investment Code and channels all registration through the ANPI's single-window authority. The formal process involves roughly 5 procedures and can range from approximately 16 days for basic company registration to up to 30 days for full investment-approval decisions, with a modest minimum share capital for a standard SARL. Practical capacity constraints and underdeveloped infrastructure temper the overall ease despite ongoing legislative reforms.