Vanuatu: technology regulation at a glance

Framework: Virtual Asset Service Providers Act No. 3 of 2025 (VASP Act), administered by the Vanuatu Financial Services Commission (VFSC); supplemented by the Stablecoins Act passed November 2025

Vanuatu enacted the Virtual Asset Service Providers Act No. 3 of 2025 on 26 March 2025 (in force from 1 April 2025), becoming the first Pacific island nation with comprehensive virtual asset legislation. The VFSC is the licensing authority for five VASP licence classes covering exchanges, transfers, custody, token offerings, and banks, with FATF-aligned AML/CFT obligations and strict penalties. A separate Stablecoins Act was passed by Parliament in November 2025, extending dedicated regulation to stablecoin issuers.

Framework: No AI-specific law. AI is addressed only at a high level through Vanuatu's National ICT Policy (ethical principles) and broader digital-governance instruments such as the Digital Transformation Act 2025, administered by the Department of Communications and Digital Transformation.

Vanuatu has no comprehensive or sectoral AI law as of 2026. AI and machine learning are referenced only as ethical/aspirational principles within the national ICT policy and broader digital-transformation legislation, while the country has taken active international positions on the military use of AI (autonomous weapons). Regulation remains at the policy/principles stage rather than binding AI-specific rules.

Framework: Data Protection and Privacy Act No. 13 of 2024 (in force 2 January 2025), supervised by the Commissioner/Deputy Commissioner of Data Protection and Privacy under the Digital Safety Authority Act No. 15 of 2024.

Vanuatu has a comprehensive, GDPR/Convention 108+-style data protection regime under the Data Protection and Privacy Act No. 13 of 2024, which came into effect on 2 January 2025 and applies to both public and private sectors. It was developed with Council of Europe support following the 2023 National Data Protection and Privacy Policy, and is enforced by a dedicated Commissioner of Data Protection and Privacy operating within the Digital Safety Authority. The regime grants data-subject rights, imposes controller/processor obligations, and regulates cross-border transfers.

Framework: National Payment System Act No. 8 of 2021, administered by the Reserve Bank of Vanuatu (RBV), which licenses and supervises payment system operators, payment service providers, e-money issuers and mobile money service providers.

Vanuatu has a clear, in-force licensing regime for digital payments and e-money under the National Payment System Act 2021, with the Reserve Bank of Vanuatu (RBV) as the designated regulator. The RBV owns and operates the national VANKLIA system (RTGS plus an Automated Clearing House with instant retail transfers), launched in 2023, and supervises e-money/mobile money providers, including dedicated MMSP Operating Guidelines issued in July 2025. There is no PSD2-style open-banking mandate or a specific BNPL regime; those areas remain unregulated.

Framework: Immigration Act [CAP 66] / Vanuatu Department of Immigration and Passport Services, Residence Visa categories (incl. Self-Funded Resident) and Residence on Assured Income Permit

Vanuatu has no dedicated digital-nomad or remote-work visa; the 'Remote Worker Visa' marketed by relocation agencies is not an official legal category. However, location-independent earners can legally reside via the Self-Funded Resident / Residence on Assured Income route by proving a certified recurring monthly income, and Vanuatu also runs an investor-residence route and a fast citizenship-by-investment program.

Framework: Harmful Digital Communications Act No. 14 of 2024 and Digital Safety Authority Act No. 15 of 2024 (establishing the Digital Safety Authority/Commission and a Commissioner of Harmful Digital Communications), supported by the Cybercrime Act No. 22 of 2021 and Data Protection and Privacy Act No. 13 of 2024.

In late 2024 Vanuatu enacted a dedicated, NZ-modelled online-safety framework: the Harmful Digital Communications Act No. 14 of 2024 sets communication principles and criminalises online harm, while the Digital Safety Authority Act No. 15 of 2024 (commenced 2 January 2025) creates a Digital Safety Authority, a Digital Safety Commission, and a Commissioner to oversee digital content and communications. A 2025 amendment broadened offences and added platform/ISP blocking powers, and an October 2025 amendment imposed school-based internet controls for students under 16. The 2021 Cybercrime Act and 2024 Data Protection Act complete the regime.

Framework: Vanuatu has no single NIS2-style comprehensive cybersecurity statute. Obligations are spread across the Cybercrime Act No. 22 of 2021 (criminal), the Data Protection and Privacy Act No. 13 of 2024 (security and breach-notification duties for personal data), and the National Cyber Security Strategy 2030, with CERT VU (under OGCIO) as the operational incident-response hub.

Vanuatu addresses cybersecurity through a set of instruments rather than one comprehensive law: a Budapest-Convention-aligned Cybercrime Act (2021) criminalises cyber offences, while the Data Protection and Privacy Act 2024 (in force January 2025) imposes security-safeguard and data-breach-notification obligations. A non-binding National Cyber Security Strategy 2030 sets critical-infrastructure resilience goals, and CERT Vanuatu provides incident response with currently voluntary reporting. There is no enacted NIS2-equivalent imposing mandatory cyber-incident reporting on critical-infrastructure operators.

Framework: Foreign Investment Act No. 25 of 2019, administered by the Vanuatu Foreign Investment Promotion Agency (VFIPA); company incorporation under the Companies Act administered by the Vanuatu Financial Services Commission (VFSC).

A foreigner can own 100% of a Vanuatu company in most sectors, and the process is largely online and relatively fast, but a foreign investor must first obtain a Foreign Investment Registration Certificate (FIRC) from VFIPA before incorporating with the VFSC and obtaining a business licence. Foreign participation is barred entirely in 15 'reserved' activities and conditioned by thresholds in a 'restricted' list, so overall ease is moderate rather than fully open.