Iran: technology regulation at a glance

Framework: Central Bank of Iran (CBI) Policy and Regulatory Framework for Cryptocurrencies (approved December 2024); Presidential Directive designating CBI as sole regulator (January 2025); Ministry of Industry, Mine and Trade licensing for mining

Iran operates a heavily restricted and state-controlled crypto environment: mining is legal under Ministry of Industry licensing, and domestic exchanges may obtain CBI licences with mandatory government API integration for transaction surveillance, but crypto payments are banned, stablecoin ownership is capped, and advertising is prohibited. US OFAC sanctions, including an April 2026 designation of Central Bank of Iran crypto addresses and a $344 million USDT freeze, further constrain Iran's access to global digital-asset markets.

Framework: National Artificial Intelligence Document (Supreme Council of the Cultural Revolution, June 2024); National AI Plan (Majlis, May 2025); National Artificial Intelligence Organization Act (Majlis, October 2025); Supreme Council of Cyberspace as apex digital-policy body

Iran has established a layered AI governance architecture built around a 2024 national strategy document, a parliament-approved National AI Plan (May 2025), and a dedicated National Artificial Intelligence Organization (NAIO) placed under the presidency (October 2025). Governance emphasises 'AI Sovereignty', indigenous hardware, Persian-language ecosystems, and alignment with Islamic cultural values and national security, rather than consumer-rights or risk-tier regulation in the EU mould. Specific legislation targets AI-generated disinformation, but no single comprehensive AI regulation law analogous to the EU AI Act is in force.

Framework: No comprehensive data-protection statute in force. Privacy/data is governed by scattered provisions: the Electronic Commerce Law (2004, Chapter on Protection of Personal Data), the Computer Crimes Law (2009), Constitution Art. 25, and the non-binding Citizens' Rights Charter (2016). A comprehensive 'Personal Data Protection and Safeguarding Draft Act' has been pending/stalled since 2018.

Iran has no single comprehensive (GDPR-style) personal-data-protection law in force; data protection relies on a patchwork of sector-specific provisions in its E-Commerce and Computer Crimes laws plus constitutional privacy guarantees. A comprehensive Personal Data Protection and Safeguarding Draft Act was prepared in 2018 (an earlier bill was withdrawn in 2015) but remains unenacted with no clear timeline. There is no independent, operational data-protection supervisory authority today; the draft would create a Data Protection Commission chaired by the ICT Minister, whose independence has been criticized.

Framework: Central Bank of Iran (Bank Markazi) via Payment and Settlement Systems Regulations; SHAPARAK (Electronic Payment Network Company) as PSP supervisor; Law on Non-Governmental Banks and Credit Institutions

Iran operates a centralized, state-controlled domestic payments regime in which the Central Bank of Iran (CBI) licenses approximately 12 Payment Service Providers (PSPs) through SHAPARAK, requiring at least 51% bank ownership. Fintechs are restricted to payment services only with no distinct EMI licensing or open banking framework. International interoperability is effectively severed by FATF blacklisting and US/EU sanctions, confining the regime entirely to the domestic market.

Framework: Foreigners Entry and Exit Law (1931, as amended); Iranian Labor Law (1990), Article 121; Iran Ministry of Foreign Affairs eVisaTraveller portal (evisatraveller.mfa.ir); work permits issued by Ministry of Cooperatives, Labour and Social Welfare

Iran offers no dedicated digital nomad or remote-work visa, and no freelance or self-employed visa category exists. The only work-authorizing route requires a sponsoring Iranian employer and a Ministry of Labour work permit, a pathway structurally unsuitable for remote workers with foreign-sourced income. Comprehensive US and multilateral sanctions in force and intensified in 2025 additionally sever Iran from international banking and payment infrastructure, making practical relocation for digital nomads effectively impossible.

Framework: Computer Crimes Law (Law No. 71063, 2009); Supreme Council of Cyberspace; National Filtering Committee; FATA (Cyber Police, est. 2011); 'Combating the Spread of Untrue News Content' Law (2025); Supreme Council of Cyberspace 32-Article Tiered Internet Decree (December 2024)

Iran operates one of the world's most restrictive internet environments, rated 'Not Free' by Freedom House with a score of 12/100 in 2024. The state enforces pervasive platform blocking, mandatory ISP filtering, population-wide surveillance, and periodic total internet shutdowns, most recently a full blackout in January 2026 during protests. In 2024-2025, authorities formally institutionalised a two-tiered internet granting privileged unfiltered access to officials and select professionals while tightening restrictions on ordinary citizens.

Framework: Computer Crimes Law (Law No. 71063, 2009); Supreme Council of Cyberspace (est. 2012 by Supreme Leader decree); FETA (Cyber Police of the Islamic Republic of Iran)

Iran's cybersecurity regime is built around the 2009 Computer Crimes Law, which criminalises unauthorised access, data interference, and system disruption, enforced by the dedicated Cyber Police (FETA). The Supreme Council of Cyberspace, established in 2012, serves as the apex policy body coordinating all state agencies on cyberspace matters, including the development of Iran's domestic National Information Network. There is no comprehensive horizontal cybersecurity or data-breach-notification law comparable to the EU NIS2 Directive; proposals to expand internet and cyber control legislation have repeatedly stalled or been withdrawn under public pressure.

Framework: Foreign Investment Promotion and Protection Act (FIPPA, 2002) administered by the Organization for Investment, Economic and Technical Assistance of Iran (OIETAI) under the Ministry of Economic Affairs and Finance; company formation governed by the Iranian Commercial Code

Iran's domestic law permits 100% foreign ownership of locally incorporated companies under FIPPA (2002), with company formation theoretically completable in approximately 30 days via the Company Registration Office. However, comprehensive multilateral sanctions, including the US OFAC Iran Sanctions Program and the Trump administration's 'maximum pressure' campaign reimposed in February 2025, effectively sever Iranian banks from the international financial system, making it practically impossible for most foreign nationals and entities to open accounts, transfer capital, or repatriate profits, creating a near-prohibitive operational environment despite the permissive formal legal framework.