Myanmar: technology regulation at a glance

Framework: Central Bank of Myanmar Directive 9/2020; CBM Law; Financial Institutions Law 2016; Anti-Money Laundering Law

Myanmar's Central Bank (CBM) has prohibited all cryptocurrency transactions since May 2019, reaffirmed by Directive 9/2020, and renewed emphatically in November 2025. No licensing framework exists for exchanges, VASPs, custody, or token offerings; enforcement is carried out under the AML Law and Financial Institutions Law with penalties including bank-account closure and imprisonment. Simultaneously, the CBM established a CBDC committee in June 2025 to develop a state digital currency, while a proposed Anti-Online Fraud Bill (May 2026) would introduce sentences of up to life imprisonment for crypto fraud.

Framework: No AI-specific law in force; National AI Strategy and National AI Policy under active drafting by the Ministry of Science and Technology (State Administration Council/military junta). Cybersecurity Law No. 1/2025 provides the only enacted digital governance framework, touching AI indirectly.

Myanmar has no enacted AI-specific legislation or adopted national AI policy as of May 2026. The military junta's Ministry of Science and Technology held its fourth drafting coordination meeting in February 2025 for a National AI Strategy and National AI Policy, both still in draft form. In parallel, the junta has deployed AI-enabled surveillance tools, including facial recognition and biometric databases, under a repressive digital legal framework rather than a rights-protective one.

Framework: Sectoral patchwork: Electronic Transactions Law 2004 (amended 2021), Law Protecting the Privacy and Security of Citizens 2017 (amended 2021), Cybersecurity Law 2025, and Telecommunications Law 2013. No independent data protection authority.

Myanmar has no comprehensive, GDPR-style data protection law. Basic personal data obligations were introduced via a 2021 amendment to the Electronic Transactions Law, while the Cybersecurity Law enacted by the military junta (State Administration Council) took effect in July 2025, mandating data retention and disclosure to authorities. Critical privacy safeguards in the 2017 Privacy and Security of Citizens Law were suspended by the junta days after the February 2021 coup, leaving wide government surveillance powers effectively unchecked.

Framework: Financial Institutions Law 2016 (Sections 132 & 184); Mobile Financial Services Regulation 2016; National Payments System Strategy 2020-2025, all administered by the Central Bank of Myanmar (CBM)

Myanmar has a functioning but limited licensing regime for mobile financial services and payment card issuers under the Central Bank of Myanmar (CBM), anchored in the Financial Institutions Law (2016) and the 2016 MFS Regulations. The CBM operates the CBM-NET payments infrastructure and officially launched the national QR interoperability standard MyanmarPay (MMQR) in February 2025. However, no dedicated comprehensive Payment Services Law, open-banking framework, or BNPL rules exist, and the post-2021 military coup has severely constrained the sector with key state banks sanctioned and the CBM operating under junta control.

Framework: Myanmar Immigration and Population Act, administered by the Ministry of Immigration and Population (MOIP) under the State Administration Council (military junta, in power since February 2021 coup); eVisa system operated at evisa.moip.gov.mm

Myanmar has no dedicated digital nomad visa and no formal legal pathway permitting remote work by foreign nationals. The only e-Visa categories are Tourist (28 days) and Business (70 days), neither of which authorises remote employment or freelance activity. The country has been under military rule since the February 2021 coup, and major Western governments, including the US (Level 4 Do Not Travel), UK, Australia, Canada, and EU members, advise against all travel to Myanmar, making the country practically inaccessible for residency planning.

Framework: Cybersecurity Law (1 Jan 2025, State Administration Council); Telecommunications Law (Art. 66d); Electronic Transactions Law (amended, S.38c); administered by the military State Administration Council (SAC)

Myanmar's military junta operates one of the most repressive internet environments in the world, scoring 9/100 on Freedom House's Freedom on the Net 2025 index. The SAC enacted a sweeping Cybersecurity Law on 1 January 2025 that bans unauthorized VPNs, mandates three-year user-data retention, and deploys advanced deep-packet inspection, moving the country from 'basic' to 'advanced' digital repression. Widespread localized and nationwide internet shutdowns, social-media blocks, and criminal prosecution of online speech complete a system of near-total state control of cyberspace.

Framework: Cybersecurity Law (State Administration Council Law No. 1/2025), enacted 1 January 2025, in force 30 July 2025; administered by a Central Cybersecurity Committee under the SAC and overseen by the Ministry of Transport and Communications

Myanmar enacted a comprehensive Cybersecurity Law on 1 January 2025 (SAC Law No. 1/2025), which came fully into force on 30 July 2025. The law, spanning 16 chapters and 88 sections, regulates cybersecurity service providers, digital platform operators, VPN services, and critical information infrastructure, and applies extraterritorially to any entity serving users in Myanmar. It imposes licensing, incident-reporting, data-retention, and content-moderation obligations, with criminal and financial penalties for non-compliance.

Framework: Myanmar Companies Law 2017 (MCL) and Myanmar Investment Law 2016, administered by the Directorate of Investment and Company Registration (DICA) and the Myanmar Investment Commission (MIC) under the Ministry of Investment and Foreign Economic Relations (MIFER)

Myanmar has a formal legal framework for foreign company formation via the online MyCO portal under the MCL 2017, permitting foreign incorporation across many sectors with no general minimum capital requirement. However, the post-February 2021 military coup has created a severely constrained practical environment: ongoing civil conflict, US/EU/UK/Australian/Canadian sanctions on junta-linked entities and key state-owned banks, and economic contraction (projected at −2.5% in FY2025/26 partly due to a devastating 2025 earthquake) make meaningful foreign business establishment highly restricted in practice, with significant sanctions-compliance legal risk for Western investors.