Madagascar: technology regulation at a glance

Framework: No dedicated crypto legislation. Overarching AML/CFT Law No. 2018-043 and implementing Decree No. 2024-1352 (SAMIFIN); BFM (Banky Foiben'i Madagasikara) public notices; CBDC eAriary pilot in progress.

Madagascar has no dedicated legal framework for cryptocurrencies or digital assets: they are neither authorized as legal tender nor formally banned. The BFM has issued public warnings about crypto risks while launching a CBDC pilot (eAriary) in May 2025, signalling state engagement with digital finance, but no exchange licensing, stablecoin rules, token-offering regime, custody framework, or crypto tax guidance exists.

Framework: No dedicated AI framework; Law No. 2014-038 on Personal Data Protection (2015) and the Plan Stratégique du Numérique 2023-2028 provide general digital governance context without AI-specific provisions

Madagascar has no AI-specific legislation, regulatory body, or published AI guidelines or principles as of May 2026. The primary legal touchpoint for AI-adjacent issues is the general personal data protection law (Law No. 2014-038, 2015), whose supervisory authority (CMIL) is only now becoming operational with international support. A national Digital Strategic Plan 2023-2028 targets digital infrastructure and skills but does not address AI governance.

Framework: Law No. 2014-038 of 9 January 2015 on the Protection of Personal Data, supervised by the Commission Malagasy de l'Informatique et des Libertés (CMIL), with Decree No. 2023-1541 of 6 December 2023 setting out CMIL's attributions, organisation and functioning

Madagascar has an in-force, GDPR-inspired comprehensive personal data protection law (Loi n° 2014-038, promulgated 9 January 2015) covering automated and non-automated processing carried out wholly or partly on Malagasy territory. The independent supervisory authority CMIL was structurally created by Decree 2023-1541 (December 2023); its members were appointed and sworn in before the Supreme Court in 2025, with the Commission declared operational and admitted as the 28th full member of the AFAPDP in November 2025. Enforcement is therefore now beginning, after roughly a decade in which the law existed on paper but lacked an operational regulator.

Framework: Loi n°2016-056 du 2 février 2017 sur la Monnaie Électronique et les Établissements de Monnaie Électronique; CSBF Instruction n°002/2017-CSBF (EMI licensing); supervised by Banky Foiben'i Madagasikara (BFM) and Commission de Supervision Bancaire et Financière (CSBF)

Madagascar has a dedicated e-money licensing regime under Law n°2016-056 (2017) and implementing CSBF instructions, under which mobile money operators (MVola, Orange Money, Airtel Money) are licensed and have achieved interoperability. However, the framework is incomplete: digital credit providers and BNPL lack clear licensing rules, no open banking regime exists, and broader fintech regulation remains nascent, though a CBDC pilot (eAriary) launched in 2025.

Framework: Madagascar's immigration framework is administered by the Ministry of Interior (Immigration and Emigration Service), with EDBM (Economic Development Board of Madagascar) operating as a one-stop shop to coordinate long-stay visa and residence card applications for foreign nationals.

Madagascar has no dedicated digital nomad or remote-work visa. Remote workers may legally reside and work for international clients under a long-stay visa for non-salaried professional activity ('visa long séjour, activité non salariée'), issued via a two-step process: a one-month convertible entry visa obtained abroad or at the EDBM, followed by conversion to a long-stay visa and a residence card issued by the Ministry of Interior. Tourist visas on arrival (30 or 60 days, extendable once) serve only short-term stays and do not authorise professional activity.

Framework: Law No. 2014-006 on Combating Cybercrime (as amended by Law No. 2016-031); Law No. 2014-038 on Personal Data Protection; regulated by ARTEC (telecom) and CMIL (data protection)

Madagascar's online regulatory landscape is fragmented, relying primarily on a 2014 cybercrime law (amended 2016) that criminalises certain online content, including defamation of public officials, plus a 2014 data-protection law. There is no comprehensive online-safety or platform-accountability regime comparable to the EU Digital Services Act or UK Online Safety Act, and no specific age-verification or platform-liability framework for user-generated content beyond broad ISP/operator obligations in the cybercrime law.

Framework: Law No. 2014-006 on the Fight Against Cybercrime (amended 2016 by Law No. 2016-031); Law No. 2014-038 on Personal Data Protection (enforced by CMIL); ARTEC as telecommunications regulator; national cybersecurity strategy under development (2025)

Madagascar's cybersecurity regime rests on sectoral legislation enacted in 2014: a cybercrime law criminalising illegal access, data interference, interception and fraud, and a data protection law establishing the CMIL supervisory authority. No comprehensive, NIS2-style cybersecurity statute exists; a national cybersecurity strategy was formally initiated in 2025 and the country ratified the AU Malabo Convention on Cyber Security in June 2024, though its Official Gazette publication remained pending as of early 2026.

Framework: Madagascar Investment Law 2023 (Loi sur l'Investissement); OHADA Uniform Acts for company law; Economic Development Board of Madagascar (EDBM) as statutory one-stop-shop

Madagascar permits 100% foreign ownership in most sectors and has designated EDBM as a one-stop shop capable of completing formal registration in 2-5 business days once documents are complete. However, the US State Department's 2025 Investment Climate Statement flags significant practical obstacles: large foreign investments frequently require unpredictable presidential-level approval that can remain pending for years, and foreign companies without local partners routinely face additional licensing scrutiny and unexplained delays.