Libya: technology regulation at a glance

Framework: Central Bank of Libya (CBL) 2018 circular prohibiting virtual currencies; no subsequent dedicated crypto legislation enacted

The Central Bank of Libya banned virtual currencies in 2018, citing money-laundering and terrorist-financing risks, and declared that no legal protection would be afforded to users or traders. Enforcement intensified in late 2025 when nine individuals were sentenced to three years in prison for operating Bitcoin mining equipment at a steel plant. Despite the ban, Libya hosts a significant underground mining sector driven by subsidised electricity among the world's cheapest, with an estimated 54,000+ Libyan owners of cryptocurrency and no dedicated regulatory framework for exchanges, stablecoins, token offerings, or DeFi.

Framework: National Artificial Intelligence Strategy of Libya 2025-2030 (General Information Authority / GIA), accompanied by a National AI Policy and National Charter for AI Ethics

Libya has adopted a non-binding National Artificial Intelligence Strategy 2025-2030, published by the General Information Authority (GIA) in cooperation with UN ESCWA, establishing a six-pillar roadmap for AI governance, ethics, infrastructure, and human capacity. No binding AI legislation has been enacted; the strategy's 'legislation and ethics' pillar explicitly flags the drafting of enforceable frameworks as a future objective. As of May 2026, the GIA is coordinating inter-agency meetings to launch executive initiatives and move the strategy into an implementation phase.

Framework: No dedicated data-protection law or supervisory authority; personal-data obligations derive from Law No. 6/2022 on Electronic Transactions, Law No. 5/2022 on Combating Cybercrimes, the 2011 Constitutional Declaration (Arts. 12-13), the Penal Code (1953), and NISSA (cybersecurity regulator).

Libya has no comprehensive, standalone data-protection statute and no dedicated data-protection authority as of 2026. Data-protection obligations exist only in sector-specific and functional legislation, principally the 2022 Electronic Transactions Law and the 2022 Cybercrime Law, which introduce consent, transparency, and security requirements for entities handling personal data electronically. Persistent political fragmentation has stalled the enactment of a dedicated privacy framework.

Framework: Central Bank of Libya (CBL) via Banking Law and National Payments Council regulations on electronic payment services; no comprehensive standalone Payment Services Act

The Central Bank of Libya (CBL) administers a licensing regime for electronic payment companies and operates an instant payment rail (LYPay, launched August 2024), with ~20 licensed fintech and digital payment providers active as of 2026. However, the framework is fragmented: there is no dedicated Payment Services or E-Money Act, no open banking regulatory framework, and no BNPL-specific rules, leaving Libya in a partial rather than a fully codified licensing regime.

Framework: Law No. 6 of 1987 on Organising the Entry, Residence and Exit of Foreigners in Libya (as amended by Law No. 2 of 2004), administered by the Libyan Passport, Immigration and Foreigners Affairs Authority (lpa.gov.ly)

Libya offers no dedicated digital nomad or remote-work visa, and no freelance or self-employment residency route exists. All work-related residence requires sponsorship by a Libyan-registered employer under a strict labour-ministry permit system. The country's ongoing armed conflict, US/UK/Canadian 'Do Not Travel' advisories, and suspended Western embassy services render Libya effectively inaccessible as a remote-work destination in practice.

Framework: Law No. 5 of 2022 (Anti-Cybercrime Law); National Information Security and Safety Authority (NISSA); Presidential Council Decree No. 14 of 2024 (Public Morality Protection Agency)

Libya's online environment is governed by the Anti-Cybercrime Law (Law No. 5/2022), which grants NISSA sweeping administrative powers to block websites and criminalize online speech without judicial authorization, using vague 'public order and morality' standards. A July 2024 presidential decree created an additional Public Morality Protection Agency explicitly tasked with policing social media for 'deviant' content. There is no consumer-oriented online safety framework comparable to the EU DSA or UK OSA; the existing laws function primarily as censorship and repression instruments.

Framework: Law No. 5 of 2022 on Combating Cybercrimes; Law No. 6 of 2022 on Electronic Transactions; Decision No. 150 of 2024 on Cybersecurity Services; National Information Security and Safety Authority (NISSA, est. 2013)

Libya's cybersecurity regime rests primarily on a 2022 criminal cybercrime statute (Law No. 5/2022) that defines offences and penalties for unauthorised system access and electronic misconduct, alongside Law No. 6/2022 on electronic transactions. A 2024 ministerial decision introduced a licensing requirement for cybersecurity service providers overseen by NISSA, but there is no comprehensive positive-obligation cybersecurity law, no statutory breach-notification regime, and no national cybersecurity strategy yet in force.

Framework: Law No. 9 of 2010 on Investment Promotion (primary FDI law); Ministry of Economy and Trade Decree No. 207 of 2012 (foreign branch registration); Libya's Commercial Code (LLC and general company rules); administered by the Privatisation and Investment Board (PIB) / General Authority for Investment Promotion and Privatisation Affairs (GAIPPA)

Establishing a business in Libya as a foreigner is heavily regulated and operationally difficult. Foreign ownership is capped at 49% in most joint-venture structures, with 100% ownership available only through a foreign branch (restricted to 11 approved sectors) or qualifying large-scale investments exceeding LYD 5 million under the 2010 Investment Law. Ongoing political division, weak contract enforcement, and a recent 13% currency devaluation in April 2025 compound the structural barriers.