Mongolia: technology regulation at a glance

Framework: Law on Virtual Asset Service Providers (adopted December 17, 2021; in force March 1, 2022), enforced by the Financial Regulatory Commission (FRC); supplemented by the Law on Securities Market and Payment System Law overseen by the Bank of Mongolia

Mongolia enacted the Law on Virtual Asset Service Providers in December 2021 (effective March 1, 2022), establishing a mandatory registration and licensing regime for crypto exchanges and VASPs under the FRC. Cryptoassets are legal but not legal tender; they are classified as virtual assets subject to AML/KYC requirements aligned with FATF standards. As of mid-2023, 12 entities hold licenses and over 200 virtual assets are registered, with 912,000+ user accounts at licensed providers.

Framework: National Strategy for Big Data and Artificial Intelligence (Government Resolution, September 2025); Ministry of Digital Development, Innovation and Communications (MDDIC); Law on Personal Data Protection

Mongolia adopted a National Strategy for Big Data and Artificial Intelligence via Government Resolution in September 2025, establishing ethical principles, transparency, accountability, human rights alignment, and risk-based evaluation, for AI and data systems. No dedicated AI-specific law exists; the regulatory base relies on the Law on Personal Data Protection combined with the strategy framework. Dedicated AI legislation is planned under the strategy's 2025-2026 implementation roadmap but has not yet been formally submitted to or enacted by the State Great Khural (Parliament).

Framework: Law of Mongolia on Personal Data Protection (adopted 17 December 2021, in force 1 May 2022); oversight shared between the National Human Rights Commission and the Ministry of Digital Development, Innovation and Communications

Mongolia enacted a comprehensive personal data protection law in December 2021, effective May 2022, broadly aligned with GDPR principles and covering collection, processing, use, and security of personal data for all individuals and legal entities operating in Mongolia. The law grants data subjects rights to consent, access, rectification, erasure, objection, and portability. Enforcement remains an acknowledged weakness: there is no independent data protection authority, sanctions are lenient, and a UN Special Rapporteur who visited in April 2025 urged stronger oversight mechanisms and greater public awareness.

Framework: Law on National Payment System (enacted 31 May 2017, in force 1 January 2018); Bank of Mongolia (Mongolbank) Resolution No. A-45 on Electronic Money (2018); regulated by the Bank of Mongolia for payment services and e-money, and the Financial Regulatory Commission (FRC) for virtual asset service providers

Mongolia established a formal payment-services licensing regime under the 2017 Law on National Payment System, enabling non-bank entities to obtain Bank of Mongolia licenses to provide payment services and issue e-money; at least nine non-bank e-money issuers are currently licensed. Core interbank infrastructure (RTGS, ACH+, QR-code standards) is operational. However, dedicated open banking mandates, BNPL-specific rules, and advanced fintech supervisory capacity remain underdeveloped, with the Asian Development Bank providing active technical assistance to close these gaps.

Framework: Law of Mongolia on the Legal Status of Foreign Nationals (as amended; administered by the Immigration Agency of Mongolia, immigration.gov.mn); annual work-permit quotas set by Government Resolution

Mongolia has no dedicated digital nomad or remote-work visa. Nationals of more than 60 countries may enter visa-free for 30-90 days, during which de facto remote work is possible, but no formal long-stay pathway exists specifically for independent remote workers. Extended residence requires either an employer-sponsored Category C work permit or an investor visa (T visa, minimum USD 100,000 investment in a Mongolian entity).

Framework: Communications Regulatory Commission (CRC) under the Communications Act 2001; Law on Cyber Security 2021; Law on Personal Data Protection 2021; CRC digital content regulations

Mongolia has fragmented online content and safety rules administered by the Communications Regulatory Commission (CRC), including cybersecurity obligations and CRC-issued content restrictions, but no comprehensive online-safety or platform-liability law comparable to the EU DSA or UK OSA. A wide-reaching social media law passed in January 2023 was vetoed by the President and subsequently rejected by parliament; a Press Freedom Bill and a draft child-age-restriction law were in parliamentary process as of early 2026. The overall regime is patchwork, with significant gaps in platform accountability and formal age-verification requirements.

Framework: Law on Cyber Security of Mongolia (adopted 17 December 2021, State Great Khural); implemented by the Ministry of Digital Development, Innovation and Communications (MDDIC) and the General Intelligence Agency (GIA)

Mongolia enacted a standalone Law on Cyber Security on 17 December 2021, its first comprehensive cybersecurity statute after a decade of drafting, establishing obligations for operators of critical information infrastructure (CII), mandatory incident reporting, biennial security evaluations, and annual audits. Two national CSIRTs were operationalised in 2023: the National CSIRT under the GIA (covering state/CII sectors) and the Public CSIRT/CC under MDDIC (for the general public and private sector). An Oxford GCSCC Cybersecurity Capacity Review published in February 2025 found the legal framework functional but noted gaps in enforcement, terminology standardisation, and human-resource capacity.

Framework: Law of Mongolia on Investment (3 October 2013, as amended); Law on State Registration of Legal Entities; Law on Business Entities (Companies Act); General Authority for State Registration (GASR/LERO)

Mongolia permits up to 100% private foreign ownership in most sectors, with registration processed through the General Authority for State Registration (GASR/LERO) in approximately 5-10 business days for formal approval and around one month end-to-end. A mandatory minimum capital contribution of USD 100,000 per foreign shareholder applies to entities with 25% or more foreign ownership, creating a notable barrier; a 2025 draft Investment Law proposes eliminating this threshold but was not yet enacted as of mid-2026. Foreign state-owned enterprises face additional approval requirements in strategic sectors.