Iraq: technology regulation at a glance

Framework: Central Bank of Iraq Circular No. 125/5/9 (22 November 2021); CBI follow-up directive (26 March 2022); Anti-Money Laundering and Countering Terrorism Financing Law No. 39/2015 (Art. 36); Kurdistan Regional Government Interior Ministry Directive (2025-2026)

The Central Bank of Iraq (CBI) explicitly prohibits all supervised financial institutions, banks, non-bank intermediaries, and electronic payment providers, from engaging with virtual assets via Circular No. 125/5/9 (2021), citing AML/CFT risks and absence of a regulatory framework. No VASP licensing regime exists, and the Kurdistan Regional Government (KRG) issued active enforcement bans on crypto and forex trading in 2025-2026, including stablecoins such as USDT. Individual possession is not explicitly criminalized by national statute, leaving private holdings in a legally ambiguous gray zone with severe practical constraints.

Framework: Iraqi National Strategy for Artificial Intelligence (INSAIN) 2024-2030, overseen by the Supreme Committee for Artificial Intelligence chaired by the Prime Minister

Iraq's primary AI governance instrument is the non-binding Iraqi National Strategy for Artificial Intelligence (INSAIN) 2024-2030, formally reviewed at the first meeting of the Prime-Minister-led Supreme Committee for AI in August 2024. No comprehensive AI law is yet in force; the Ministry of Communications is drafting binding AI legislation, but it had not been enacted as of mid-2026. Iraq's current posture is strategic and aspirational rather than prescriptive.

Framework: Draft Personal Data Protection Law (2021, not enacted); Communications and Media Commission (CMC) sector directives; 2005 Constitution Articles 17 & 40; E-Commerce Regulation No. 4/2025

Iraq has no comprehensive, enacted data protection law as of May 2026. A Draft Personal Data Protection Law was submitted to the Council of Representatives in 2021 but remains unenacted, continuing a pattern that includes an earlier cabinet-approved draft from 2019 that also lapsed. In the interim, fragmented privacy protections are sourced from constitutional provisions, the 1969 Penal Code, and sector-level CMC directives.

Framework: Electronic Payment Services Regulation No. (2) of 2024, administered by the Central Bank of Iraq (CBI); supplemented by CBI mobile-wallet instructions (2025) and the 2015 Anti-Money Laundering & Counter-Terrorism Financing Law.

Iraq operates a dedicated, in-force licensing regime for digital payments under the Central Bank of Iraq (CBI). The Electronic Payment Services Regulation No. (2) of 2024, published in the Official Gazette on 29 April 2024 and replacing the 2014 framework, requires any provider of electronic payment services to obtain a CBI licence, with defined capital, governance, cybersecurity and AML requirements. The CBI is both the regulator and operator of national payment infrastructure (national switch / instant-payment rails) and has licensed roughly 16 electronic-payment companies; open banking and BNPL exist in the market but are not yet governed by dedicated standalone frameworks.

Framework: Foreigners Residence Law No. 118 of 1978 (federal Iraq); Kurdistan Region of Iraq investor visa regime administered by Kurdistan Region Ministry of Interior and Kurdistan Region Board of Investment (2025)

Iraq offers no dedicated digital nomad or remote-work visa, and its standard immigration system is built around employer-sponsored work permits requiring multi-ministry clearance. Short-stay visas (up to 3 months via tourist, normal, or multi-entry categories) do not confer work authorisation, and there is no self-employed or freelance visa route at the federal level. The Kurdistan Region has introduced an investor-residency pathway, but it is investment- or property-purchase-based rather than income-from-remote-work-based.

Framework: CMC Law No. 65 of 2004; CMC Framework Regulations for Digital Platforms and Services (issued 17 February 2025); 1969 Penal Code (Article 438) as fallback

Iraq's primary online-content regulator is the Communications and Media Commission (CMC), which in February 2025 issued binding Framework Regulations for Digital Platforms and Services imposing licensing, registration, content-moderation obligations, and Platform Liaison Officer requirements on domestic and foreign platforms serving Iraqi users. No standalone comprehensive online-safety law comparable to the EU DSA or UK OSA exists; enforcement relies on the CMC's authority under Law No. 65/2004, government-directed website blocks, periodic internet shutdowns, and cooperation requests to major platforms. A long-pending draft cybercrime law remains unenacted as of 2025, and there is no data-protection or age-verification framework in force.

Framework: No dedicated cybersecurity or cybercrime law in force; obligations derived from Iraqi Penal Code No. 111 of 1969 and Civil Code No. 40 of 1951, supplemented by sector-specific rules (Banking Law No. 94/2004; CPA Order 65/2004 for communications/CMC); National Cybersecurity Strategy 2022-2025 and Ministry of Interior Cybersecurity Directorate (established 2025) constitute the institutional framework

Iraq has no enacted cybercrime or comprehensive cybersecurity statute as of 2026. A Draft Cybercrime Law has been in circulation since 2011, was suspended by parliament in May 2021 over free-speech concerns, and remains unenacted despite repeated attempts at reintroduction. Institutional capacity has grown, the Ministry of Interior upgraded its Cybersecurity Centre to a full Cybersecurity Directorate in 2025, but mandatory breach-notification obligations and a general data-protection regime do not exist.

Framework: Companies Law No. 21 of 1997 (as amended by Amendment No. 17 of 2019); Investment Law No. 13 of 2006 administered by the National Investment Commission (NIC)

Starting a business in Iraq as a foreign investor is significantly constrained under federal law, which requires at least 51% Iraqi ownership in LLCs and JSCs following Amendment No. 17 of 2019, capping foreigners at 49%. Workarounds exist via a branch office (no local-ownership requirement), an NIC-licensed investment project, or by locating in the Kurdistan Region of Iraq (KRI) where 100% foreign ownership remains permissible. End-to-end LLC registration is bureaucratically complex and typically takes 6-8 months.