Lesotho: technology regulation at a glance

Framework: Central Bank of Lesotho Act 2000; Capital Market Regulations 2014 (Sections 27-28); Money Laundering and Proceeds of Crime Act 2008; Exchange Control Regulations

Lesotho has no dedicated crypto or digital-assets regulatory framework. The Central Bank of Lesotho (CBL) expressly disclaims oversight of cryptocurrencies and crypto platforms, while warning that promotion of or participation in virtual currencies may violate existing AML/CFT, exchange-control, and tax laws. Crypto is not legal tender, no VASP licensing regime exists, and no bespoke legislation is confirmed in force as of 2025-2026.

Framework: Draft Artificial Intelligence Policy v0.1, Ministry of Information, Communications, Science, Technology and Innovation (MICSTI); National Digital Transformation Strategy 2024-2030

Lesotho has no enacted AI law as of May 2026. MICSTI developed a Draft Artificial Intelligence Policy (v0.1), which was published on the government portal and underwent a multi-stakeholder validation workshop in January 2025; formal cabinet adoption had not been confirmed. The policy sits within a broader National Digital Transformation Strategy 2024-2030 and aligns explicitly with the African Union AI Strategy.

Framework: Data Protection Act, 2012 (Act No. 5 of 2012), Data Protection Commission (established by the Act but not yet appointed)

Lesotho enacted a comprehensive Data Protection Act in 2012 (gazetted 22 February 2012), establishing data-subject rights, controller obligations, and a Data Protection Commission as supervisory authority. However, the Commission and its Commissioner have never been formally appointed, leaving the regime largely unenforced in practice. Courts retain jurisdiction to hear claims and award damages under the Act; no substantive amendment or replacement law had been enacted as of May 2026.

Framework: National Payment System Act 2014 and Payment Systems (Issuers of Electronic Payment Instruments) Regulations 2017, administered by the Central Bank of Lesotho (CBL)

Lesotho has an in-force licensing regime for payments and e-money under the National Payment System Act 2014, operationalized by the 2017 Issuers of Electronic Payment Instruments Regulations. Any payment service provider or e-money/mobile-money issuer must be licensed by the Central Bank of Lesotho before operating, and an interoperable national instant-payment switch (LeSwitch) provides cross-bank and bank-to-mobile-money settlement. There is no dedicated open-banking or BNPL framework, and crypto-assets remain outside the CBL's defined regulatory perimeter.

Framework: Immigration Act (administered by the Department of Immigration and Passport Services, Ministry of Home Affairs), no remote-work-specific visa exists; relocation runs through general work, residence, business and self-employed permits.

Lesotho has no dedicated digital-nomad or remote-work visa and no residency-by-investment/golden-visa programme. Remote workers and relocators must use general immigration channels: a two-year residence permit (issued in categories such as work, business, joining-relative/spouse, etc.), a business-people permit for those owning or opening a business, or self-employed/contractor permits. There is no pathway tailored to foreign-employed remote workers, so eligibility depends on fitting one of these existing routes.

Framework: Lesotho Communications Authority (LCA) under Communications Act No. 4 of 2012; Data Protection Act No. 5 of 2011; Computer Crime and Cyber Security Bill 2024 (tabled, not yet enacted)

Lesotho's online safety regime is fragmented across existing broadcasting, telecommunications, and data-protection legislation, with no dedicated comprehensive online safety law in force. The LCA has sought to extend broadcasting content standards to online platforms and proposed registration requirements for internet broadcasters, while the Computer Crime and Cyber Security Bill 2024, which would criminalize cyberbullying and online dissemination of false information, was tabled in Parliament in May 2024 but remained under deliberation amid significant civil-society opposition as of late 2024. No specific age-verification or platform-liability framework exists.

Framework: Computer Crime and Cyber Security Bill, 2024 (pending enactment); Data Protection Act, 2013; Lesotho Communications Authority Act, 2000

Lesotho has no comprehensive cybersecurity law in force as of May 2026. A succession of bills (2021, 2022, 2023, 2024) have been introduced but none has received royal assent and been gazetted as law. The most recent iteration, the Computer Crime and Cyber Security Bill, 2024, was tabled in the National Assembly in May 2024 and was still progressing through committee and stakeholder review as of late 2024. Existing cyber-adjacent regulation is limited to the Data Protection Act, 2013 and sector-level oversight by the Lesotho Communications Authority.

Framework: Companies Act No. 18 of 2011; Business Licensing and Registration Act 2019 and Business Licensing and Registration Regulations 2020; administered by the One-Stop Business Facilitation Centre (OBFC) under the Ministry of Trade, Industry, Cooperatives and Marketing

Lesotho provides a consolidated company registration process through the One-Stop Business Facilitation Centre (OBFC), with online procedures accessible via lesotho.eregulations.org. Foreigners may hold 100% equity in most sectors, but foreign-owned firms (defined as those with ≥30% non-citizen shareholding) must demonstrate a minimum capital investment of M2 million (≈USD 110,000-123,000) when obtaining a trader's licence, and a defined list of small-scale retail and service activities is reserved exclusively for Basotho citizens.