DR Congo: technology regulation at a glance

Framework: No enacted crypto-specific law; Banque Centrale du Congo (BCC) is primary monetary regulator; Code du Numérique (Ordonnance-Loi No. 23/010, 13 March 2023) covers digital transactions broadly; draft Digital Asset Service Provider (DASP) law under inter-ministerial review as of 2025; AML/CFT overseen by CENAREF under Law No. 22/068 (December 2022)

The DRC has no enacted crypto-specific legislation; the BCC has issued public notices declaring that bitcoin and virtual currencies are not recognised as a medium of exchange and warning consumers of associated risks, but no criminal statute explicitly prohibiting mere possession has been identified. The government was actively drafting a DASP licensing framework in 2025, and a 5% withholding tax on crypto-to-fiat conversions at or above USD 5,000 was reported as a proposed fiscal measure. The DRC remained on the FATF increased-monitoring (grey) list as of October 2025, reflecting strategic AML/CFT deficiencies.

Framework: National AI Strategy 2025-2030 (launched October 2025); National Digital Plan 2026-2030 (PNN2); Digital Code Ordonnance-loi N°23-010 of 13 March 2023 (broad digital framework, no AI-specific provisions); UNESCO AI Readiness Assessment (validated April 2025)

The Democratic Republic of Congo has no binding AI-specific legislation. In October 2025, the government launched its first National AI Strategy 2025-2030 alongside the National Digital Plan 2026-2030, setting aspirational goals for AI education, infrastructure, and applied research. The Digital Code (2023) provides a general legal framework for digital activities, covering data protection, cybersecurity, and electronic commerce, but contains no dedicated AI governance provisions.

Framework: Ordonnance-loi n° 23/010 du 13 mars 2023 portant Code du Numérique (Digital Code); supervisory functions temporarily held by ARPTIC pending formal establishment of the dedicated Autorité de Protection des Données (APD)

The DRC enacted a comprehensive Digital Code (Ordonnance-loi n° 23/010) on 13 March 2023, published in the Official Journal on 11 April 2023, which dedicates Title III to personal data protection across all digital activities conducted from or within the country. The law mandates a standalone Data Protection Authority (APD), whose functions have been temporarily assigned to the telecoms regulator ARPTIC by ministerial decree of August 2024 pending the APD's formal establishment by prime-ministerial decree. The DRC additionally ratified the African Union Malabo Convention on Cybersecurity and Personal Data Protection, depositing its instrument on 27 June 2025.

Framework: BCC Instruction No. 24 (e-money issuers), Instruction No. 42 (monetique/electronic payment instruments), Instruction No. 58/2024 (payment interoperability & National Monetary Switch); primary statute: Law No. 003/2002 as amended by Law No. 22-069 of 27 December 2022 on credit institutions; regulator: Banque Centrale du Congo (BCC)

The Banque Centrale du Congo (BCC) operates a functioning licensing regime for digital payments and e-money issuance through a body of binding Instructions, with Instruction No. 24 governing e-money issuer (EMI) authorisations and Instruction No. 42 covering electronic payment instruments. In September 2024 the BCC issued Instruction No. 58 mandating full interoperability among all payment service providers and connection to the National Monetary Switch (Swift Monétique National), laying the infrastructure for the unified MOSOLO instant-payment rail. No formal open-banking standard or BNPL-specific regulation exists as of mid-2026, and the BCC has signalled that Instruction 24 and a dedicated payment-institution licensing tier are under revision.

Framework: Direction Générale de Migration (DGM), established by Decree-Law No. 002/2003 under the Ministry of the Interior, Security, Decentralization and Customary Affairs; governs all immigration, visa issuance, and foreigner settlement in the DRC

The Democratic Republic of Congo offers no dedicated digital nomad or remote-work visa, and no freelance/self-employed visa category exists. Employer-sponsored work permits (Visa d'établissement de travail, VET) are the only formal long-stay work route, tying legal residence directly to a Congolese-registered employer. Short-stay ordinary visas and the forthcoming e-visa (announced for 2025 but limited to 7-day stays) provide no viable pathway for independent remote workers.

Framework: Ordonnance-Loi No. 23/010 of 13 March 2023 (Code du Numérique / Digital Code); Law No. 20/017 of 25 November 2020 on Telecommunications and ICT; supervised by ARPTIC (replacing ARPTC per Decree No. 23/13 of 3 March 2023)

The Democratic Republic of Congo has enacted a broad Digital Code in 2023 that covers cybercrime, online content offences (including criminalising false information and press offences on social networks), platform takedown obligations, and mandatory traffic-data retention for security agencies. There is no standalone comprehensive online safety law equivalent to the EU DSA or UK Online Safety Act; platform regulation is fragmented across the Digital Code, telecom legislation, and a March 2026 ministerial order introducing licensing rules for digital services. The government has also demonstrated a willingness to impose episodic internet shutdowns and social-media blocks during political or security crises, most recently in January-February 2025 during the eastern-DRC conflict.

Framework: Ordinance-Law No. 23/010 of 13 March 2023 (Digital Code / Code du Numérique); National Cybersecurity Strategy 2022-2025; Agence Nationale de Cybersécurité (ANCS) under the Presidency; ARPTC telecom regulator

The DRC enacted a comprehensive Digital Code in March 2023 that consolidates cybersecurity obligations, cybercrime offenses, personal data protection with breach-notification duties, and electronic transactions under a single framework. The National Cybersecurity Strategy 2022-2025, validated by the President in June 2023, established a dedicated National Cybersecurity Agency (ANCS) under the Presidency to coordinate national cyber defence and protect critical infrastructure. The DRC has also ratified the AU Malabo Convention on Cyber Security and Personal Data Protection and is pursuing accession to the Budapest Convention with EU GLACY+ support.

Framework: OHADA Uniform Act on Commercial Companies (AUDSCGIE); DRC Investment Code (Loi n° 004/2002, as amended); administered via Guichet Unique de Création d'Entreprise (GUCE) and Agence Nationale pour la Promotion des Investissements (ANAPI)

Foreigners may incorporate a SARL or SAS in the DRC with a single shareholder, no statutory minimum capital, and no residency requirement for directors, using the one-stop GUCE window. In practice, bureaucratic delays mean registration often takes several weeks beyond the official 3-day target, and a 2017 subcontracting law plus sector-specific rules impose meaningful restrictions on foreign participation in small retail, agriculture, and certain licensed sectors.