Sudan: technology regulation at a glance

Framework: Electronic Transactions Act 2007; Central Bank of Sudan (CBOS) AML circulars and March 2022 public warning; no dedicated virtual-asset or VASP legislation enacted

Sudan has no crypto-specific legislation; the Central Bank of Sudan (CBOS) issued a formal public warning in March 2022 declaring digital assets are 'not classified as money or even private money and property' under Sudanese law and cautioning citizens against their use due to fraud, electronic piracy, and volatility risks. Crypto cannot legally be used for invoice payments, no exchange-licensing pathway exists, and Sudan's ongoing armed conflict since April 2023 has severely disrupted government institutions, making near-term regulatory development highly unlikely.

Framework: No AI-specific law, national AI strategy, or binding guidelines in force. A Sudanese Data and Artificial Intelligence Authority was created by prime-ministerial decree on 5 November 2025, but it has not yet issued any AI regulation; Sudan is also an African Union member expected to domesticate the AU Continental AI Strategy.

Sudan has no comprehensive AI legislation, no sectoral AI rules, and no published national AI strategy as of May 2026. The only concrete development is the November 2025 establishment of a Sudanese Data and Artificial Intelligence Authority under the Ministry of Digital Transformation and Communications, which lays institutional groundwork but has not yet produced a regulatory framework. Progress is heavily constrained by ongoing armed conflict, political instability, and limited resources.

Framework: No comprehensive personal-data protection law. Privacy is protected at a high level by Article 54 of the 2019 Constitutional Charter, with data-adjacent provisions scattered across sectoral statutes (Electronic Transactions Act 2007, Cybercrime/Information Technology Crime Act 2007, and the 2020 Cybercrime amendment). A draft Data Protection Bill (c. 2018) was never enacted, and there is no dedicated data-protection authority.

Sudan has no comprehensive, GDPR-style data-protection law and no independent data-protection supervisory authority. Personal data is governed only indirectly through a constitutional privacy guarantee and a patchwork of sectoral laws on electronic transactions and cybercrime, which lack core data-protection principles (lawful basis, data-subject rights, breach notification). A draft data-protection bill proposed around 2018 has not advanced amid prolonged political instability and the ongoing armed conflict.

Framework: Central Bank of Sudan (CBoS) under the Bank of Sudan Act and its E-Money/Mobile Payment Regulations; CBoS is the sole licensor and supervisor of e-money issuers, payment service providers and the retail payment system.

Sudan has a CBoS-administered licensing regime for e-money and mobile payments, but it remains incomplete and in transition: a 2020 reform ended the state monopoly on e-money issuance and a later directive permits MNOs and fintechs to form CBoS-licensed payment subsidiaries, yet implementing regulations are still pending and the process is described as onerous and untransparent. Infrastructure is highly centralized around the EBS national switch, and the April 2023 war severely disrupted the ecosystem, leaving Bank of Khartoum's Bankak app as the dominant rail. There is no open-banking framework or distinct BNPL regime.

Framework: Sudan's Passports and Immigration Act and visa policy administered by the General Directorate of Passports and Immigration / Ministry of Interior; entry visas issued by Sudanese diplomatic missions and the e-visa system. No remote-work or nomad-specific regime exists.

Sudan has no digital-nomad or remote-work visa and no residency-by-investment ('golden visa') programme. Standard entry is via short-stay tourist/business visas (e-visa or embassy), and longer stays require an employment- or family-based residence permit, none of which is designed for or accessible to foreign remote workers. The situation is moot in practice: Sudan has been in active civil war since April 2023, carries the highest 'Do Not Travel' advisories, and most foreign missions and consular services have ceased operating.

Framework: Law on Combating Cybercrimes 2018 (amended 2020; further repressive amendments approved by the Cabinet on 13 Oct 2025) plus telecom regulation by the Telecommunications and Post Regulatory Authority (TPRA); website blocking authority vested in the Prosecutor General. No comprehensive online-safety/platform-moderation statute (no DSA/OSA equivalent).

Sudan heavily restricts the internet rather than regulating online safety through a modern platform-liability framework. The state relies on a broad Cybercrime Law to criminalize online speech, the Prosecutor General and TPRA to block websites, and repeated nationwide/localized internet shutdowns during the SAF-RSF civil war (ongoing since April 2023). There is no DSA/OSA-style online-safety or systematic age-verification regime; instead, vague offenses such as 'false news' and threats to the 'prestige of the state' are used to suppress dissent.

Framework: Law on Combating Cybercrimes 2018 (amended 2020), administered alongside the Telecommunication and Post Regulatory Authority (TPRA) and Sudan CERT; no comprehensive NIS2-style cybersecurity law and no general data-protection statute.

Sudan has no single comprehensive cybersecurity law. Its regime rests on the criminal Law on Combating Cybercrimes 2018 (which replaced the 2007 Computer Crime Act and was amended in July 2020 to raise penalties), together with sector-specific telecom regulation and incident-response capacity provided by Sudan CERT under the TPRA. There is no general data-protection law and no statutory, economy-wide breach-notification or incident-reporting duty.

Framework: Investment (Encouragement) Act 2021 administered by the Ministry of Investment; company formation under the Companies Act 1925 and related registration statutes via the Commercial Registrar (Department of Commercial Affairs). Note: an active SAF-RSF civil war since April 2023 has rendered normal company formation largely non-functional in much of the country.

On paper Sudan's 2021 Investment Encouragement Act offers a comparatively liberal regime, equal treatment of foreign and domestic investors, up to 100% foreign ownership of limited liability companies, and a 'single window' approval service. In practice, ongoing civil war since April 2023, economic collapse, currency instability, sanctions exposure to the war economy, and a high foreign-capital deposit requirement make actually starting a business extremely difficult today. The de jure framework is moderate-to-open, but the de facto current situation is restricted.