Togo: technology regulation at a glance

Framework: Togo AML/CFT Law (adopted 27 February 2026, transposing UEMOA Uniform AML/CFT Directive of 31 March 2023); BCEAO/WAEMU regional oversight

Togo does not ban crypto but has no comprehensive licensing or prudential framework for digital assets. In February 2026, Togo's National Assembly enacted a new AML/CFT law that explicitly brings virtual asset service providers (VASPs) under due-diligence and suspicious-transaction-reporting obligations, transposing the 2023 UEMOA regional directive and aligning with FATF Recommendation 15. Crypto is not legal tender in the WAEMU zone, and the BCEAO continues to advise caution while developing a regional harmonised framework.

Framework: National AI strategy under development (led by the Ministry of Justice & Human Rights and the Ministry of Digital Economy/MENTD); no AI-specific law in force. Existing Law No. 2019-014 on personal data protection applies to AI-related data processing.

As of mid-2026, Togo has no comprehensive or AI-specific legislation. The government is actively drafting a national AI strategy to frame AI use in public administration, define a regulatory framework, support research, and integrate AI into education, with a final framework expected in 2026. Until then, AI is governed only indirectly through the 2019 data-protection law and broader digital-transformation policy.

Framework: Loi n° 2019-014 du 29 octobre 2019 relative à la protection des données à caractère personnel, supervised by the Instance de Protection des Données à Caractère Personnel (IPDCP)

Togo has a comprehensive, GDPR-style personal data protection law (Law No. 2019-014 of 29 October 2019) regulating the collection, processing, storage, transfer and protection of personal data, making it an early adopter among Francophone African states. The law established an independent supervisory authority, the IPDCP, whose organization was set by Decree 2020-111/PR and which became operational with the appointment of its president by decree on 30 September 2024. The regime grants data subjects rights (access, rectification, objection, erasure) and imposes prior declaration/authorization, security, and cross-border transfer obligations on data controllers.

Framework: Regional BCEAO (Central Bank of West African States) framework applicable in Togo as a WAEMU/UMOA member: Instruction No. 001-01-2024 of 23 January 2024 on payment services (Payment Institution licensing) and Instruction No. 008-05-2015 on electronic money issuers (EMI licensing), supervised by the BCEAO and the WAEMU Banking Commission.

Digital payments and fintech in Togo are governed by a clear, in-force licensing regime set by the regional central bank (BCEAO) rather than by purely national law. Payment service providers must hold a BCEAO Payment Institution (PI) licence under Instruction 001-01-2024 (in force; transition period ended 31 August 2025, with only licensed entities permitted from 1 September 2025), while e-money issuers require an EMI authorisation under Instruction 008-05-2015. Togolese fintechs have been licensed under this regime (e.g., InTouch Togo received an EMI licence in June 2025 and Semoa obtained a 'full-service' payment licence), and Togo participates in the BCEAO's interoperable instant-payment system (PI-SPI).

Framework: Togolese immigration law administered by the Direction Générale de la Documentation Nationale (DGDN); visas issued via the e-visa portal and at posts abroad, residence permits issued domestically. Work permits fall under the Ministry of Employment.

Togo has no dedicated digital-nomad or remote-work visa and no golden-visa / residency-by-investment programme. Relocators and remote workers must use general long-stay routes: a long-stay 'immigration' visa obtained at a Togolese embassy/consulate that qualifies the holder for a residence permit, plus one of three residence-permit categories (temporary 1 year, ordinary 3 years, privileged 5 years). There is no remote-work-specific category, so a foreign-employed remote worker fits these routes only imperfectly and should confirm requirements directly with the DGDN.

Framework: No comprehensive online-safety/platform-liability law (no DSA/OSA equivalent). Online content is governed by speech-restrictive criminal provisions, Law No. 2018-026 (cybersecurity & cybercrime, esp. Art. 25 on 'false information'), the 2020 Press and Communication Code, and the Penal Code, enforced alongside recurrent state-ordered internet/social-media shutdowns. Institutions: ANCy (cybersecurity), ARCEP (telecoms), HAAC (media), IPDCP (data protection).

Togo has no modern comprehensive online-safety statute; instead, online expression is regulated through criminal-law tools, chiefly the 2018 cybersecurity/cybercrime law that punishes 'false information' with up to three years' prison and the 2020 Press Code, combined with direct state restriction of the internet. Authorities throttled connectivity and blocked Facebook, Telegram, Signal, YouTube and other services during the June 2025 protests, and in October 2025 the public prosecutor publicly threatened criminal prosecution of social-media users for content shared 'outside the legal framework.' Civil society and the ECOWAS Court treat these measures as unlawful censorship, making heavy state restriction the defining feature of Togo's current internet-governance posture.

Framework: Loi n°2018-026 du 7 décembre 2018 sur la cybersécurité et la lutte contre la cybercriminalité, administered by the Agence Nationale de la Cybersécurité (ANCy); complemented by Loi n°2019-014 (personal data protection) and the cybersecurity rules adopted by Arrêté n°2022-040/PMRT.

Togo operates a comprehensive, dedicated cybersecurity regime anchored in Law No. 2018-026 of 7 December 2018, which criminalizes cyber offences and created the National Cybersecurity Agency (ANCy). The framework is reinforced by binding national cybersecurity rules (Arrêté 2022-040, 2022), an operational national CERT (CERT.tg, run by state company Cyber Defense Africa), and a national cybersecurity strategy, while personal-data protection is governed by the separate Law No. 2019-014 (2019). Togo has also authorized ratification of the African Union (Malabo) Convention on Cybersecurity and Personal Data Protection.

Framework: OHADA Uniform Act on Commercial Companies (AUSCGIE) as adapted by Togolese national reforms, with company registration centralized at the Centre de Formalités des Entreprises (CFE, cfetogo.tg), which delivers RCCM, tax ID (NIF) and social-security (CNSS) numbers in one step.

Togo has aggressively reformed business entry and is now the top-ranked West African economy and 3rd in Africa on the World Bank's Business Ready (B-READY) assessment, scoring 77.26/100 on business entry. A foreigner can own 100% of a company with no local-shareholder requirement, no minimum capital for the most common form (SARL), and registration completed through a single online/one-stop CFE window, often within a few days.