Syria: technology regulation at a glance

Framework: No formal crypto-specific legislation enacted; Central Bank of Syria (CBS) holds general monetary oversight; post-conflict transitional government; post-sanctions environment shaped by OFAC Executive Order 14312 (June 2025)

Syria has no enacted law legalizing or banning cryptocurrency; the domain occupies a legal gray area with no VASP licensing, no stablecoin rules, and no token-offering regime. The Central Bank of Syria issued an official consumer-warning in August 2025 against dealing in digital currencies, stopping short of a formal prohibition. Following U.S. Treasury revocation of broad Syria sanctions in July 2025, major international exchanges such as Binance became accessible to Syrian residents, while the Central Bank has focused regulatory energy on integrating conventional digital payments infrastructure rather than crypto-specific rulemaking.

Framework: No AI-specific law or formal national AI strategy. AI is referenced as a pillar within the broader National Digital Transformation Strategy (to 2030) led by the Ministry of Communications and Information Technology; data is touched only indirectly via the Electronic Personal Data Protection Law (Law No. 12 of 2024).

Syria has no comprehensive AI law, sectoral AI rules, or published binding AI guidelines as of 2026. Under the transitional government, AI is treated as a strategic ambition for reconstruction and economic recovery (healthcare, education, infrastructure planning) rather than a regulated domain, and it features within an emerging digital-transformation roadmap. Governance capacity is constrained by infrastructure deficits, brain drain, and a still-forming legislative apparatus.

Framework: Electronic Personal Data Protection Law, Law No. 12 of 2024 (issued June 2024, in effect January 2025); remains in force under the post-Assad transitional government.

Syria has a dedicated, economy-wide personal-data statute, Law No. 12 of 2024 on the Protection of Electronic Personal Data, which regulates the collection, processing, use, storage and cross-border transfer of personal data and provides for a supervisory body and penalties. The law was enacted under the Assad government and took effect in January 2025; it has not been repealed by the transitional government formed in March 2025. However, it is widely criticized for broad national-security/state-access exceptions and data-retention mandates that undercut independent oversight, so its protections in practice are weaker than a GDPR-style regime.

Framework: Central Bank of Syria (CBS), Payment Systems Directorate licenses 'electronic payment and collection services companies' under CBS regulations, supported by sectoral laws (Banking Secrecy Law, AML/CFT Law, Electronic Transactions Law, Electronic Signature Law, Electronic Crime Law).

Syria operates a dedicated, in-force licensing regime for electronic payment and collection services companies, administered by the Central Bank of Syria's Payment Systems Directorate; mobile-money services (Syriatel Cash, MTN Pay) and the Syrian Electronic Payment Company (SEP) have operated under it since around 2021. After years of isolation, in 2026 the CBS substantially modernized the regime, most notably a 4 May 2026 decision permitting licensed banks and payment companies to connect to global networks (Visa/Mastercard), with first live trials on 9 May 2026. Dedicated frameworks for open banking and BNPL are not yet evident; the regime centers on payment-institution/e-money-style licensing rather than those specific verticals.

Framework: Immigration and Passports Directorate (إدارة الهجرة والجوازات) under the Ministry of Interior governs entry visas and residence permits; work authorization is separately handled by the Ministry of Social Affairs and Labor. No remote-work or digital-nomad visa category exists in Syrian law.

Syria has no digital-nomad or remote-work visa and no residency-by-investment ('golden visa') program. Foreigners enter on standard visit/business visas (often issued on arrival, paid in USD cash) and may apply for temporary residence permits tied to employment, family, or business, none of which is designed for remote workers. The country remains under a U.S./UK/Canada/Australia Level 4 'Do Not Travel' advisory amid post-Assad political transition, despite the lifting of most Western economic sanctions in 2025.

Framework: No comprehensive online-safety statute. The online environment is governed by the still-in-force Cybercrime Law No. 20 of 2022 (criminalizing online speech and mandating ISP data retention) and by Ministry of Information media-licensing rules now extended to digital platforms, administered alongside continued network-level controls (filtering, recurring shutdowns) inherited from the Assad era.

Syria has historically been one of the world's most heavily censored internet environments (DPI/Blue Coat filtering, 200+ blocked sites, the repressive 2022 Cybercrime Law). After the Assad regime fell on 8 December 2024, the transitional government under Ahmed al-Sharaa unblocked many sites and lifted some app restrictions, but the core repressive apparatus persists: the 2022 Cybercrime Law remains in force, the Ministry of Information requires licensing of digital/social-media platforms under vague 'indecent content' and 'national constants' clauses, and nationwide exam-period internet shutdowns continued in 2025. There is no DSA/OSA-style comprehensive online-safety regime and no formal age-verification framework.

Framework: A patchwork of instruments rather than a single comprehensive cybersecurity statute: Cybercrime Law No. 20 of 2022, Electronic Personal Data Protection Law No. 12 of 2024, and telecom/internet data-retention duties, overseen by the National Agency for Network Services (NANS) and its national CERT (CERT Syria).

Syria has no comprehensive NIS2-style cybersecurity law; obligations are spread across a criminal cybercrime statute (Law No. 20/2022), a 2024 electronic personal-data-protection law, and data-retention mandates on ISPs and service providers, with NANS/CERT Syria as the operational authority. The framework was built under the Assad government, which fell in December 2024; the post-Assad transitional administration is rebuilding cyber institutions and there are active calls to reform the cybercrime law, but no new comprehensive regime is yet in force. Provisions emphasize state surveillance and content control over operator security duties, and dedicated breach-notification obligations are largely absent.

Framework: Investment Law No. 18 of 2021 as amended by Presidential Decree No. 114 of 2025, administered by the Syrian Investment Agency/Authority (SIA) under the Supreme Council for Economic Development; company incorporation under Syrian commercial/companies law.

Following the fall of the Assad regime in December 2024, Syria's transitional government has liberalized its foreign-investment regime: Presidential Decree No. 114 of 2025 (issued 24 June 2025) amended Investment Law No. 18 of 2021 to guarantee 100% foreign ownership, remove the prior requirement for a local partner, protect against expropriation, and allow profit and capital repatriation. The legal framework is now welcoming and most international sanctions were lifted in mid-2025, but practical company formation remains constrained by a rebuilding post-conflict economy, a centralized/state-mediated approval system, banking and infrastructure gaps, and residual export controls.