Malawi: technology regulation at a glance

Framework: No dedicated crypto/virtual-asset statute. The Reserve Bank of Malawi (RBM) has issued cautionary advisories; general AML/CFT oversight falls under the Financial Crimes Act 2022 and Financial Services Act 2010, administered by the Financial Intelligence Authority (FIA) and RBM.

Malawi has no formal regulatory framework for crypto or digital assets. The Reserve Bank of Malawi has publicly stated that cryptocurrencies are not legal tender and has cautioned the public against crypto trading, but has stopped short of an outright ban. The government has signalled it is working on a policy position, and the RBM has initiated CBDC exploration, placing Malawi in an active but nascent 'developing' posture.

Framework: Draft National AI Strategy (under validation, 2026); Data Protection Act 2024 (MACRA as regulator); UNESCO Recommendation on Ethics of AI (implementation underway)

Malawi has no enacted AI-specific law. As of February 2026, the Ministry of Information and Communications Technology is leading a stakeholder validation process for a Draft National AI Strategy and Draft National Digital Transformation Strategy, developed with UNDP support. In parallel, Malawi enacted the Data Protection Act in June 2024 and is working with UNESCO to implement AI ethics standards via the Readiness Assessment Methodology.

Framework: Data Protection Act 2024 (in force 3 June 2024); supervised by the Data Protection Authority (DPA), established under the Act and supported by MACRA

Malawi enacted the Data Protection Act 2024, gazetted in February 2024 and commenced on 3 June 2024, replacing the data-protection provisions of the Electronic Transactions and Cyber Security Act 2016. The Act introduces a GDPR-inspired regime covering lawful-basis processing, data-subject rights, mandatory breach notification, and registration requirements for significant data controllers. An independent Data Protection Authority (dpa.mw) has been established to oversee enforcement, with MACRA playing an operational support role.

Framework: Payment Systems Act, 2016 (No. 15 of 2016) and the Payment Systems (E-money) Regulations, administered by the Reserve Bank of Malawi (RBM)

Malawi has an in-force, dedicated licensing regime for digital payments and e-money: the Payment Systems Act 2016 requires anyone operating a payment, clearing or settlement system, providing remittance/mobile-payment services or issuing payment instruments to be licensed or authorised by the Reserve Bank of Malawi. E-money is governed by gazetted Payment Systems (E-money) Regulations using an activities-based licensing approach, and interoperability is mandated through the national switch (NatSwitch), which now carries instant interbank transfers. There is, however, no dedicated open-banking or BNPL framework, these areas remain unregulated/patchwork.

Framework: Immigration Act of Malawi, administered by the Department of Immigration and Citizenship Services (immigration.gov.mw); e-Permit portal (epermit.gov.mw) for permit applications; e-Visa portal (evisa.gov.mw) for visa applications

Malawi has no dedicated digital nomad or remote-work visa as of 2026. The closest legal pathway for a self-employed remote worker is the Business Residence Permit (BRP), which explicitly covers self-employed persons and proprietors but requires a minimum USD 50,000 foreign capital investment. Short-stay visitors may remain up to 90 days on a tourist/visitor visa; longer stays require a formal permit change. No golden visa or residency-by-investment programme exists.

Framework: Electronic Transactions and Cyber Security Act 2016 (Act No. 33 of 2016); Communications Act 2016; Data Protection Act 2024, all administered by the Malawi Communications Regulatory Authority (MACRA)

Malawi's online safety regime is built on the Electronic Transactions and Cyber Security Act 2016, which criminalises cybercrime, offensive online communication, and child pornography, and includes intermediary liability and takedown provisions. The Data Protection Act 2024, in force since June 2024, adds privacy and child-data safeguards but there is no dedicated comprehensive online-safety or platform-moderation law equivalent to the EU DSA or UK Online Safety Act. Freedom House rates Malawi 'Partly Free' (61/100) in its 2025 Freedom on the Net report, noting persistent use of existing cyber laws to arrest journalists and activists alongside incremental improvements.

Framework: Electronic Transactions and Cyber Security Act 2016 (Act No. 33 of 2016), supplemented by the Data Protection Act 2024, both administered by the Malawi Communications Regulatory Authority (MACRA) and the Malawi Computer Emergency Response Team (mwCERT)

Malawi's primary cybersecurity instrument is the Electronic Transactions and Cyber Security Act 2016, which criminalises a broad range of cyber offences, gives legal effect to electronic transactions, and establishes the national CERT (mwCERT) under MACRA. The Data Protection Act 2024 (commenced May 2024) layers mandatory 72-hour breach-notification duties on top of that framework and designates MACRA as the data-protection authority. A National Cybersecurity Strategy (adopted c. 2019-2020) sets objectives for critical-information-infrastructure protection and guides institutional capacity-building.

Framework: Companies Act No. 15 of 2013 (Chapter 46:03), administered by the Department of Registrar General via the Malawi Business Registration System (MBRS); investment facilitation governed by the Investment and Export Promotion Act through the Malawi Investment and Trade Centre (MITC)

Foreign investors may hold 100% ownership in most sectors and can incorporate online through the Malawi Business Registration System (MBRS). However, setting up as a foreign investor requires a mandatory multi-step sequence, company incorporation, a MITC Investment Certificate (minimum US$50,000 capital), Reserve Bank capital-inflow registration, tax registration, and a Business Resident Permit, making the overall process moderately complex with a typical timeline of several weeks.