Equatorial Guinea: technology regulation at a glance

Framework: CEMAC regional architecture: COBAC (banking supervisor) prohibition on crypto facilitation by financial institutions (May 2022); COSUMAF (financial markets regulator) Regulation on Virtual Assets and VASPs (December 2022); BEAC (Bank of Central African States) monetary oversight, no Equatorial Guinea-specific national crypto statute

Equatorial Guinea has no standalone national cryptocurrency law and operates under the CEMAC regional framework. In May 2022 COBAC prohibited all CEMAC-zone banks, microfinance institutions, and payment-service providers from facilitating cryptocurrency transactions, effectively cutting off the regulated financial sector from crypto activity. COSUMAF issued a partial counter-framework in December 2022 covering ICOs, virtual assets, and VASPs, but BEAC has repeatedly reaffirmed its opposition to crypto and the two positions remain in unresolved tension.

Framework: No dedicated national AI law, AI strategy, or AI regulatory guidelines exist at the national level. The applicable overarching data framework is Law No. 1/2016 on the Protection of Personal Data. At the continental level, Equatorial Guinea, as an African Union member state, is encompassed by the AU Continental AI Strategy (adopted July 2024).

Equatorial Guinea has no national AI legislation, no formal national AI strategy, and no sector-specific AI guidelines in force as of May 2026. The country's digital policy efforts are centred on the Digital Agenda for Equatorial Guinea (ADIGE) and a broader National Development Plan 2035, neither of which constitutes an AI governance framework. A 2024 World Bank Digital Economy Diagnostic flagged the need to strengthen the legal and regulatory framework as a priority reform area, signalling that AI-specific regulation remains nascent.

Framework: Law No. 1/2016 on the Protection of Personal Data (Ley No. 1/2016 de Protección de Datos Personales), enacted 22 July 2016; supervisory authority: Órgano Rector de Protección de Datos Personales (established by law but not yet operational as of 2026)

Equatorial Guinea enacted a standalone comprehensive personal data protection law in 2016, Law No. 1/2016, establishing GDPR-style principles (purpose limitation, data minimisation, transparency, security) and individual rights over personal data. A dedicated supervisory authority, the Órgano Rector de Protección de Datos Personales, was created by the law but had not become operational as of early 2026, leaving enforcement capacity very limited in practice. The 2016 law is supplemented by Internet Communication Law No. 1/2017, which extends data protection obligations to electronic commercial communications.

Framework: CEMAC/COBAC Regulation No. 04/18/CEMAC/UMAC/COBAC on Payment Services (2018); supervised by BEAC and COBAC at regional level

Equatorial Guinea does not have a standalone national fintech licensing regime; instead it operates under the supranational CEMAC framework administered by BEAC (central bank) and COBAC (banking supervisor). A regional payment-services regulation has been in force since 2018, but Equatorial Guinea has historically been the laggard among CEMAC members, long identified as the only member state without a fully licensed domestic e-money operator, with only nascent domestic digital-payment infrastructure beginning to emerge through bank-led partnerships.

Framework: Decree 49/2019 (four visa categories); Ministerial Order 1/2018 of the Ministry of Labour, Employment Promotion and Social Security (work permit issuance, renewal, cancellation); administered jointly by the Ministry of National Security and the Ministry of Labour, Employment Promotion and Social Security

Equatorial Guinea offers no dedicated digital-nomad or remote-work visa as of 2026. Remote workers and freelancers may qualify via the self-employed work permit (Permiso por Cuenta Propia, PCP), valid up to three years, which requires local business registration and proof of entrepreneurial activity in-country. No golden-visa or residency-by-investment scheme exists.

Framework: Penal Code and Telecommunications Law (existing); draft Cybercrime and Cybersecurity Law under parliamentary process as of April 2024; internet access controlled through executive/administrative orders

Equatorial Guinea operates one of Africa's most repressive digital environments, routinely blocking opposition and independent-media websites, banning WhatsApp multimedia content over mobile data, and imposing targeted internet shutdowns, most notably a prolonged shutdown on Annobón Island from August 2024. No comprehensive online-safety or platform-liability law analogous to the EU DSA or UK OSA is in force; a draft cybercrime bill that also governs social media use was advancing through parliament in April 2024 but its final enactment is unconfirmed in available official sources as of mid-2026.

Framework: Personal Data Protection Law No. 1/2016; draft Cybercrimes Law under parliamentary review (April 2024); supplementary provisions in the Penal Code and Telecommunications Law

Equatorial Guinea lacks a comprehensive in-force cybersecurity law. The primary enacted instrument is Personal Data Protection Law No. 1/2016, which imposes limited breach-notification duties and established a supervisory authority that has not become operational. A dedicated Cybercrimes Bill, covering unauthorised system access, illegal interception, and computer fraud, was under active parliamentary consideration as of April 2024 but has not been confirmed as enacted in available sources through May 2026.

Framework: OHADA Uniform Act on Commercial Companies and Economic Interest Groups; Equatorial Guinea Investment Law (Decree 72/2018); Ventanilla Única Empresarial (VUE) one-stop shop (Malabo 2019, Bata 2021)

Equatorial Guinea operates under the OHADA commercial law framework and has implemented a one-stop shop (VUE) that reduced average registration time to approximately five business days. Foreign ownership in non-petroleum sectors is generally unrestricted, while the petroleum sector mandates at least 35% national ownership and one-third local board representation. Practical barriers, including in-person-only registration, a non-functional VUE website, and notarization requirements, moderate the overall ease for foreign entrepreneurs.