Congo: technology regulation at a glance

Framework: Democratic Republic of Congo: Banque Centrale du Congo (BCC); Ordonnance-Loi No. 23/010 of 13 March 2023 (Digital Code); draft Digital-Asset Law (2025, under inter-ministerial review). Republic of Congo (Brazzaville): CEMAC zone, COBAC Decision D-2022/071 of 6 May 2022; BEAC monetary authority.

Note: 'Congo' refers to two distinct states. The Democratic Republic of Congo (DRC) has no dedicated crypto-specific legislation in force; the Banque Centrale du Congo (BCC) warns citizens of risks and has banned unauthorized crypto operators, but permits personal holding and trading. A draft Digital-Asset Law was under inter-ministerial review in 2025 and a 5% withholding tax on crypto-to-fiat conversions above USD 5,000 was announced. The Republic of Congo (Brazzaville), a CEMAC-zone member, operates under COBAC Decision D-2022/071, which prohibits all COBAC-supervised financial institutions from holding, exchanging, or settling in any cryptocurrency, though retail personal use is not explicitly criminalized.

Framework: Vision Congo Digital 2025 national digital strategy; African Research Centre for Artificial Intelligence (ARCAI) established with UNECA support; no AI-specific binding legislation in force; telecoms regulator ARPCE developing AI governance roadmap

The Republic of Congo has no binding AI-specific legislation. The country's AI governance rests on the 'Vision Congo Digital 2025' national digital strategy, which lists AI as a cross-cutting priority, and on the ARCAI research centre inaugurated in Brazzaville in February 2022, Africa's first AI research centre, co-established with the UN Economic Commission for Africa. In January 2026, the telecoms regulator ARPCE convened a five-day strategic seminar on digital regulation and AI governance to develop a national regulatory roadmap, signalling that formal rulemaking is being actively prepared but has not yet produced binding rules.

Framework: Loi n° 29-2019 du 10 octobre 2019 portant protection des données à caractère personnel; supervisory authority: Commission Nationale de Protection des Données à Caractère Personnel (CNPD)

The Republic of Congo (Congo-Brazzaville) has a standalone comprehensive personal-data protection law, Law No. 29-2019, which entered into force on 25 November 2020 and replaced the earlier Law No. 4-2009 of 2009. It follows the Francophone-African model, requiring prior notification to the CNPD before processing, and grants data subjects a full set of rights. The CNPD is the designated independent supervisory authority, though its operational capacity and enforcement activity remain limited in practice.

Framework: Banque Centrale du Congo (BCC) under Loi n°18/027 on monetary and financial organisation; BCC Instructions on electronic money (No. 24), PSP licensing (No. 53), and payment-system interoperability (No. 58, September 2024); ARPTC digital-services authorisation framework enacted March 2026

The Democratic Republic of Congo (DRC) has a functioning but incomplete digital-payments licensing regime anchored in the Banque Centrale du Congo (BCC), which authorises banks, electronic-money institutions (EMIs), and payment-service providers (PSPs). Key building blocks are in place, including BCC Instruction No. 24 for e-money establishments and BCC Instruction No. 58 (2024) mandating full interoperability via a National Monetary Switch, yet a national interbank instant-payment platform was still pending launch as of early 2026, open banking lacks a formal framework, and a crypto/digital-asset licensing law remained in draft. Note: 'Congo' is ambiguous, the Republic of Congo (Brazzaville) is a separate jurisdiction regulated under the regional BEAC/COBAC framework within CEMAC.

Framework: Republic of the Congo (Brazzaville) general immigration law administered by the Direction Générale de Surveillance du Territoire / immigration services and Ministry of Interior; no domain-specific remote-work statute.

The Republic of the Congo has no dedicated digital-nomad or remote-work visa and no remote-work category in its immigration law. Relocators can stay long-term only through general routes, a long-stay visa (3+ months) obtained before travel and a foreigner's resident card (carte de séjour) issued for up to 1, 3, or 5 years, but these are oriented to tourism, business, family, or locally-contracted employment rather than to people earning from a foreign employer. There is currently no residency-by-investment / golden-visa programme.

Framework: Ordonnance-Loi No. 23/010 of 13 March 2023 (Digital Code), administered by the Autorité de régulation du numérique (ARN) and the Agence nationale de cybersécurité (ANC), Democratic Republic of Congo (DRC)

The Democratic Republic of Congo enacted a broad Digital Code in March 2023 covering cybersecurity, electronic transactions, content restrictions, and data protection in a single instrument, but most implementing decrees remain unissued and enforcement capacity is weak. The government supplements sparse formal regulation with ad-hoc internet and social media shutdowns, most recently blocking TikTok, X (Twitter), and the Google Play Store during the January-February 2025 Goma military crisis. No dedicated, comprehensive online-safety law comparable to the EU DSA or UK OSA exists.

Framework: Ordinance-Law No. 23/010 of 13 March 2023 (Code du Numérique / Digital Code); National Cybersecurity Strategy 2022; ARPTIC (Autorité de Régulation des Postes, Télécommunications et Technologies de l'Information et de la Communication, est. Decree 23/13 of 3 March 2023)

The Democratic Republic of Congo enacted a comprehensive Digital Code (Ordinance-Law No. 23/010) on 13 March 2023, consolidating cybersecurity, cybercrime, cryptology, data protection, and electronic transactions into one omnibus law. A National Cybersecurity Strategy was adopted in 2022, and the DRC formally ratified the African Union Malabo Convention on Cyber Security and Personal Data Protection in March 2025. Operators of essential services and digital service providers bear statutory incident-reporting obligations to designated government authorities, while a mandated Data Protection Authority is to enforce data-breach notification rules.

Framework: OHADA Uniform Act on Commercial Companies (revised 2014); Law n°16-2017 of 30 March 2017 establishing the Agence Congolaise pour la Création des Entreprises (ACPCE); Law 19-2005 reserving certain activities for Congolese nationals

The Republic of Congo (Congo-Brazzaville) operates a one-stop-shop business registration system through the ACPCE under the OHADA legal framework, making formal incorporation possible within days in theory. However, practical timelines extend to several weeks, country managers face residency requirements, Law 19-2005 reserves certain commercial activities for Congolese nationals (with enforcement tightened in 2024), and sector-specific foreign-ownership rules apply in oil and mining. Corruption remains a frequently cited impediment to investment.