South Sudan: technology regulation at a glance

Framework: No crypto-specific law exists. The Bank of South Sudan Act, 2011 governs financial activity broadly; the Financial Act, 2024/2025 covers general taxation. No virtual-asset or VASP legislation has been enacted or formally proposed.

South Sudan has no dedicated legal or regulatory framework for cryptocurrency or digital assets as of May 2026. Crypto is neither explicitly legalised nor explicitly prohibited, placing it in a regulatory vacuum. The Bank of South Sudan has focused its digital agenda on conventional payment-system modernisation (RTGS, mobile money) rather than virtual-asset oversight, and political instability combined with very limited financial infrastructure means crypto regulation is not a legislative priority.

Framework: No AI-specific law, regulator, or national AI strategy. South Sudan has not initiated AI policy; only adjacent digital laws (Cybercrime and Computer Misuse Act 2026) exist, with a Data Protection Bill proposed for 2026.

As of mid-2026, South Sudan has no dedicated artificial intelligence regulation, no national AI strategy, and no published AI guidelines or principles. The country is consistently ranked among Africa's least AI-ready states and has not begun developing AI-specific policy. AI-relevant governance is limited to a general cybercrime statute and a still-proposed data protection bill, plus its membership in the non-binding African Union Continental AI Strategy.

Framework: No comprehensive personal-data protection law. Privacy rests on Article 22 of the Transitional Constitution (2011); related rules appear in the Right of Access to Information Act (2013) and the Cybercrime and Computer Misuse Act (signed 2026). No data-protection supervisory authority exists; a dedicated Data Protection Bill is announced for 2026.

South Sudan has no dedicated or comprehensive data-protection regime and no data-protection authority. Personal privacy is protected in general terms by the 2011 Transitional Constitution and touched on by the 2013 access-to-information law and the recently enacted cybercrime law, but none establishes GDPR-style data-subject rights or controller obligations. The government has stated it intends to introduce the country's first Data Protection Bill in 2026.

Framework: Electronic Money Regulation, 2017, issued by the Bank of South Sudan (BoSS) under the Bank of South Sudan Act, 2011; mobile-money agent/telecom side co-regulated by the National Communications Authority.

South Sudan has an in-force, dedicated e-money licensing regime, the Electronic Money Regulation, 2017, under which the Bank of South Sudan licenses electronic-money issuers and mobile-money providers, with the National Communications Authority licensing the telecom/agent layer. Several licenses have been granted (m-Gurush, MTN MoMo, Digicash), and in 2025 BoSS reaffirmed mobile money as legal tender. However, the regime is narrow: there is no broader payment-institution/PSP statute, no comprehensive fintech law, no open-banking or instant-payment-rail framework, and no BNPL-specific rules.

Framework: Passports and Immigration Act, 2011, administered by the Directorate of Nationality, Passports and Immigration (DNPI); visa issuance overseen by the Ministry of Foreign Affairs and International Cooperation (MOFAIC) via the e-Visa system

South Sudan has no dedicated digital-nomad or remote-work visa, and no freelance/self-employed visa that a remote worker could use. Its visa categories are limited to tourist, business, transit, work (employer-sponsored), student, and entry permits, with longer stays handled through employment-based residence permits. There is no residency- or citizenship-by-investment (golden visa) program.

Framework: National Communication Act, 2012 (establishing the National Communication Authority/NCA as ICT-telecom regulator) combined with the Cybercrimes and Computer Misuse Act, 2026 (signed 18 Feb 2026, replacing the 2021 Provisional Order); no comprehensive online-safety/platform-moderation statute exists.

South Sudan has no comprehensive online-safety or platform-moderation law of the DSA/OSA type. Instead, the state regulates the internet primarily through telecom-sector powers and a broad new cybercrime statute that criminalizes vaguely defined online content, backed by NCA-ordered ISP-level blocking of social media. The combination of compelled provider cooperation, broad content offenses, and repeated shutdowns reflects a restriction-oriented regime rather than a rights-protective safety framework.

Framework: Cybercrime and Computer Misuse Act, 2026 (signed by President Salva Kiir on 18 February 2026); the National Communication Authority (NCA) is the lead cybersecurity/CIRT body and the National Cybercrime Prosecution Unit sits under the Ministry of Justice and Constitutional Affairs.

South Sudan moved from a 2021 Provisional Order to a full statute in 2026: the Cybercrime and Computer Misuse Act, 2026, which entered into force on signature (18 February 2026). It is a comprehensive cybercrime/computer-misuse law that criminalizes hacking, identity theft and cyberstalking, protects critical infrastructure, and establishes national incident-response and prosecution structures. A dedicated personal-data-protection law does not yet exist; the government has said a first-ever Data Protection Bill is being prepared for 2026.

Framework: Companies Act, 2012 (administered by the Business Registry, Ministry of Justice and Constitutional Affairs) and the Investment Promotion Act, 2009 (South Sudan Investment Authority).

Incorporating a company in South Sudan is governed by the Companies Act 2012 and is procedurally heavy, slow, and complicated by instability and weak institutions, the World Bank's final Doing Business assessment ranked South Sudan 185th of 190 economies and recorded 12 procedures to start a business. There is no statutory minimum paid-in capital under the Companies Act, but foreign investors face an unevenly applied local-ownership expectation (commonly cited as ~31% South Sudanese participation for medium/large firms) and, per advisers citing the Investment Promotion Act, a substantial minimum foreign-investment threshold. The legal text on mandatory local ownership is ambiguous and applied inconsistently, so foreigners cannot reliably expect 100% control in practice.