eSwatini: technology regulation at a glance

Framework: No dedicated digital-asset statute. Oversight shared between the Central Bank of Eswatini (CBE) and the Financial Services Regulatory Authority (FSRA), with AML/CFT coverage extended to VASPs via the Anti-Money Laundering, Counter Financing of Terrorism and Proliferation Financing (Miscellaneous Amendments) Act, 2024. The Eswatini Financial Intelligence Unit (EFIU) handles financial-crime reporting.

eSwatini has no dedicated cryptocurrency or digital-asset legislation; crypto is not banned but is explicitly not legal tender and carries no regulatory protection for investors. The CBE and FSRA have issued consumer-risk warnings, and the 2024 AML/CFT Miscellaneous Amendments Act begins to pull VASPs into the financial-crime reporting framework, marking the first material step toward formal oversight. A retail CBDC (Digital Lilangeni) Design Paper was published in late 2024 but the CBE has decided not to proceed to issuance at this time.

Framework: No AI-specific law or strategy; general digital governance provided by the Data Protection Act, 2022 (ESCCOM/EDPA as regulators) and the eSwatini Digital Transformation Strategy 2024-2028

eSwatini has no dedicated AI legislation, national AI strategy, or published AI guidelines as of May 2026. The country's most relevant regulatory instruments are the Data Protection Act of 2022, which governs automated processing of personal data, and a broad 2024-2028 digital transformation strategy; neither addresses AI governance specifically. As an African Union member state, eSwatini is expected to domesticate the AU Continental AI Strategy (endorsed July 2024) by developing its own national AI strategy, but no such document has been proposed or published.

Framework: Data Protection Act No. 5 of 2022 (gazetted 4 March 2022); supervisory authority: Eswatini Communications Commission (ESCCOM), operating as the Eswatini Data Protection Authority (EDPA)

eSwatini enacted a comprehensive, GDPR-aligned Data Protection Act in March 2022, covering all public and private bodies that process personal data in the country, whether domiciled locally or abroad. The Eswatini Communications Commission (ESCCOM) serves as the national Data Protection Authority (EDPA), with powers to investigate complaints, issue enforcement notices, and impose administrative fines. Active enforcement began in 2024, with mandatory data-controller registration, certificate renewals, and compliance notices issued against unregistered entities.

Framework: National Payment Systems Act, 2023, administered by the Central Bank of Eswatini (CBE), which licenses payment service providers (PSPs), e-money/mobile money issuers and operators of payment systems.

Eswatini operates a central-bank-led licensing regime: the National Payment Systems Act of 2023 gives the Central Bank of Eswatini (CBE) powers to license and supervise payment service providers, system operators and participants across the value chain, and all institutions participating in the Eswatini Payment System are CBE-licensed. The CBE runs a national instant-payment rail (Eswatini Payment Switch Fast Payment Module, live since December 2024) and a fintech unit with a regulatory sandbox. Detailed e-money/PSP regulations under the 2023 Act are still being finalized, so mobile money currently operates under CBE guidelines, and open banking remains a planned future phase rather than an in-force framework.

Framework: Immigration Act No. 17 of 1982 (as amended) and Immigration Regulations, 1987, administered by the Department of Immigration under the Ministry of Home Affairs

eSwatini has no dedicated digital-nomad or remote-work visa and no announced plans to introduce one as of May 2026. Long-term legal stay for foreign workers requires either an employer-sponsored Work Permit (tied to a local Swazi employer) or a Temporary Residence Permit for Business Persons (requiring incorporation of a local entity), leaving remote workers employed by foreign companies without a clear, designated pathway. Short-stay visitor visas (up to 90 days) explicitly exclude work activities.

Framework: Computer Crime and Cybercrime Act 2022; Electronic Communications and Transactions Act 2022; Data Protection Act 2022; regulated by the Eswatini Communications Commission (ESCCOM); National Cybersecurity Strategy 2022-2027

eSwatini enacted a suite of cyber laws in 2022, the Computer Crime and Cybercrime Act, the Data Protection Act, and the Electronic Communications and Transactions Act, establishing targeted rules on cybercrime, data handling, and electronic commerce, but stopping well short of a comprehensive online-safety or platform-liability regime comparable to the EU DSA or UK Online Safety Act. ESCCOM serves as the converged regulator and national cybersecurity authority. The government has separately exercised power to direct ISPs to block social media and shut down the internet during political unrest, raising serious human-rights concerns.

Framework: Computer Crime and Cybercrime Act, 2022; Data Protection Act, 2022; Electronic Communications and Transactions Act, 2022, administered by the Eswatini Communications Commission (ESCCOM)

eSwatini enacted a coordinated package of cybersecurity and data-protection legislation gazetted on 4 March 2022, anchored by the Computer Crime and Cybercrime Act, 2022, which criminalises a broad range of cyber offences and establishes a National Cybersecurity Incident Response Team (NCSIRT) and National Cybersecurity Advisory Council. The Data Protection Act, 2022 imposes a 72-hour breach-notification duty on data controllers to report to ESCCOM and affected individuals. A five-year National Cybersecurity Strategy (2022-2027) sets strategic goals covering critical-infrastructure resilience and sectoral CIRT development.

Framework: Companies Act 2009 (Act No. 8 of 2009), administered by the Registrar of Companies under the Ministry of Commerce, Industry and Trade; supported by the Eswatini Investment Promotion Authority (EIPA) as a one-stop facilitation body

eSwatini permits 100% foreign ownership of private companies in most sectors with no statutory minimum paid-up capital for private companies. Incorporation through the Registrar of Companies typically takes 3-7 working days once documents are submitted, but full operational setup including tax registration, a trading licence, and work permits for foreign directors extends the timeline to several weeks. The process remains largely in-person and EIPA's facilitation capacity is constrained by limited institutional leverage.