Mozambique Cryptocurrency Regulation: VASP Registration and AML Rules
Mozambique requires eligible virtual-asset service providers to register with Banco de Moçambique. Learn the activities covered, 90-day decision period and AML requirements.
On this page
Mozambique has a formal registration process for virtual asset service providers (VASPs).
Article 25 of Law No. 14/2023, dated 28 August 2023, requires prior authorisation from Banco de Moçambique for covered virtual-asset activities. Notice No. 4/GBM/2023, published on 14 September 2023, sets out the registration process. The notice entered into force 60 days after publication, in November 2023. It is not a general cryptocurrency trading ban.
Read Law 14/2023, Articles 25–26 and the official VASP registration notice.
The main rule: covered virtual-asset services may be conducted only by entities previously registered with Banco de Moçambique. Registration is not a blanket permission to provide every type of financial service.
This guide reflects primary sources checked on 3 November 2026. It distinguishes registration rules from separate payments, investment and foreign-exchange permissions.
For wider context, see Finlazo's Africa cryptocurrency regulation directory.
Is cryptocurrency legal in Mozambique?
Mozambique does not simply treat every crypto-related service as unregulated.
The central bank's Notice No. 4/GBM/2023 creates a registration requirement for defined business activities.
Article 4 says those activities may be performed only by entities already registered with the Bank.
The notice does not declare Bitcoin legal tender. It also does not prove that every advertised exchange or stablecoin service is registered.
Which crypto services are covered?
Article 2 of the notice covers the following activities when carried out as a service:
| Activity | Registration scope |
|---|---|
| Crypto–fiat exchange | Exchange of virtual assets for traditional currency |
| Crypto–crypto exchange | Exchange of one virtual asset for another |
| Transfers | Transferring virtual assets |
| Custody | Holding or administering virtual assets and private-key instruments |
| Token-related services | Financial services related to an issuer's offer or sale |
| Other services | Other covered activities involving virtual assets |
Credit institutions seeking to conduct covered virtual-asset activities may face additional conditions. Article 2(2) also applies the registration and final provisions to institutions already supervised by the Bank.
The primary source is the official notice published by Banco de Moçambique.
How long does VASP registration take?
Article 9 sets a 90-day decision period. The Bank must decide and notify the applicant within 90 days after receiving the application. The clock can run from receipt of additional information when requested.
A missing decision does not mean the application is automatically approved.
Article 10 addresses when a registered applicant must begin its activity. It refers to 90 days after notification and allows a justified extension of up to 45 days in exceptional circumstances.
These are statutory processing rules, not a promise that every application finishes in three months. Incomplete submissions can interrupt the review clock. Article 9(5) states that silence is not approval. After approval, the Bank issues a registration certificate under Article 9(6).
When can VASP registration expire or be cancelled?
Under Article 10, registration lapses if an operator does not start activity within 90 days after notification. The Bank may grant a one-time 45-day extension for justified exceptional circumstances.
Under Article 11, the Bank may cancel a registration obtained by false declarations, following serious or repeated legal violations, or after activity ceases for more than six months. Before cancellation, the notice provides a 10-day period for the affected party to give an explanation. Article 12 requires prior Bank approval before transferring a registration.
A certificate should therefore be checked for current validity, not merely historical issuance. Source: Notice No. 4/GBM/2023, Articles 9–12.
What documents does a provider need?
Article 5 requires an application form and supporting information. The list depends on the type of applicant.
For a company, it includes: - Incorporation or constitutional documents specifying the proposed virtual-asset activities. - Founder, shareholder and beneficial-owner information. - Evidence of the source of funds. - Business, business-continuity and incident-recovery plans. - Governance and internal-control arrangements. - Relevant tax and entity identification details. - Fitness and criminal-record information.
Article 7 requires applicant-prepared documents in Portuguese and in duplicate. Foreign-language material needs an official Portuguese translation. Documents issued abroad must be properly legalised. The notice also requires criminal-record and non-insolvency evidence where applicable.
What is Mozambique's minimum VASP capital?
The registration notice asks for evidence of capital and the lawful source of funds. Article 9 also allows refusal if technical means or financial resources are inadequate for the planned activity.
The notice does not provide one universal published minimum capital amount in meticais for every VASP. We therefore do not assign an unverified figure.
A business must establish the resources appropriate to its activities. Other sector-specific authorisations may add separate conditions. Article 21 also allows the Bank to apply adapted prudential requirements where a provider's size or risk profile warrants them. This is not evidence of a universal capital threshold.
What AML rules matter?
Banco de Moçambique's official AML/CFT legislation directory lists Law 14/2023, its amendments in Law 3/2024, the implementing Decree 53/2023, and Notice 10/GBM/2024. The 2024 notice replaced earlier AML guidelines in Notice 5/GBM/2022.
A registered provider should maintain customer identification and beneficial-ownership checks, risk assessments, transaction monitoring, suspicious-transaction reporting, sanctions controls and recordkeeping. The exact duties depend on its legal classification.
Articles 15–20 of Notice 4/GBM/2023 impose additional operational controls:
| Rule | Provider responsibility |
|---|---|
| Governance, Article 15 | Appropriate management structure and internal controls |
| Custody customers, Article 16 | Provide an original custody agreement within 15 days; notify material changes and handle complaints |
| Risk framework, Article 17 | Map operational and suspicious-transaction risks; document non-core outsourcing |
| Essential functions, Article 17 | Do not delegate or subcontract essential functions without prior express Bank approval |
| Business continuity, Article 19 | Maintain recovery and continuity arrangements for disruptions |
| Transaction monitoring, Article 20 | Maintain documented systems for identifying and reviewing suspicious or fraudulent activity |
The Bank can inspect a provider's facilities and IT processing centres before operations begin (Article 13), and apply adapted prudential supervision where warranted (Article 21).
Source: Official VASP registration notice and Bank of Mozambique's 2024 AML guidelines announcement.
Cross-border payments need separate review. A blockchain transfer does not guarantee a lawful mobile-money or bank payout.
Can an overseas crypto exchange serve Mozambique residents?
An overseas licence is not a substitute for Mozambique's requirements. Article 25(2) of Law 14/2023 expressly reaches foreign virtual-asset providers whose services can be subscribed to or are available to Mozambique residents, or that have staff or management in the country.
Under Article 14 of Notice 4/GBM/2023, a VASP operating in Mozambique from another jurisdiction must appoint a representative in Mozambique who can answer supervisory and AML/CFT authorities. This representative obligation sits alongside the prior-approval framework; it does not replace registration.
Source: Law 14/2023, Article 25 and Notice 4/GBM/2023, Article 14.
Compare neighbouring requirements in Tanzania's regulation guide and Zambia's VASP overview.
How can consumers check an operator?
Ask for the operator's exact registered legal name, current Banco de Moçambique registration certificate, activities and entity holding your funds. Confirm those details directly with the Bank where possible. This review did not verify a complete public online VASP register, so an unverified company claim is not proof of authorisation.
Do not confuse registration with guaranteed solvency, investment protection or government endorsement.
Bottom line
Mozambique has a prior-authorisation and VASP registration requirement, not a legal vacuum. Law 14/2023, Article 25 expressly covers foreign providers offering services to residents. The Bank's notice specifies a 90-day decision period, documentation requirements and a local representative for offshore operators.
The rules call for sufficient financial resources, but no single fixed VASP capital amount was verified in the notice. AML rules were also updated in 2024.
Primary sources: Notice No. 4/GBM/2023, official gazette; Law 14/2023, official text; Law 3/2024, official gazette entry; Notice 10/GBM/2024, Banco de Moçambique; official AML/CFT legislation directory.
