São Tomé and Príncipe Cryptocurrency Regulation: What the Authorised List Can Tell You
Examine GIABA’s dated VASP findings, BCSTP’s authorised-institution list and the distinction between payment permission and crypto approval.
On this page
São Tomé and Príncipe’s central bank publishes a list of authorised financial institutions. That is useful evidence, but the category shown beside a company matters.
A payment-service listing should not be presented as proof of permission to run a cryptocurrency exchange or hold customers’ crypto.
Our Africa cryptocurrency regulation directory compares the evidence behind country licensing claims.
What did GIABA find?
The 2024 mutual evaluation reflects an onsite visit from 12–26 June 2023. Under criterion 15.4, it found no VASP registration or licensing requirement. Criterion 15.6 identified no appointed VASP supervisor.
These findings describe the review period. They are not a substitute for checking subsequent legislation.
The report was adopted in November 2024. Keeping the onsite and adoption dates distinct helps readers understand how old the underlying evidence is.
What does the current authorised list show?
The BCSTP’s authorised-institution announcement, displayed on its website on 27 October 2026, links to a list organised by activity.
The published list includes banks, insurers, payment-system operators, payment-service providers, microfinance institutions and foreign-exchange houses. It does not label a separate VASP category.
That observation is narrower than saying no crypto provider exists. It also does not establish that every listed institution has the same permissions.
Does the fintech sandbox create a crypto licence?
The BCSTP’s 2025 Financial Stability Report, in its payment-infrastructure discussion, records the launch of a regulatory sandbox for fintech testing. It describes a controlled environment for experimenting with digital financial solutions.
That development does not establish a general VASP licensing route. For a sandbox claim, request the admission decision, permitted activities, testing limits and duration. Participation should not be presented as unrestricted approval for crypto exchange or custody.
Why is the permission category important?
A customer may encounter a business that processes a payment to an overseas platform. Several companies can participate in the transaction.
Identify the local payment provider, the crypto seller and the custodian. The rights and obligations of each party need their own documents.
| Part of the transaction | Evidence to examine |
|---|---|
| Local payment collection | Provider identity and relevant permission |
| Crypto sale or exchange | Contracting seller and activity approval |
| Asset custody | Key control, customer rights and withdrawal terms |
| Currency conversion | Applicable foreign-exchange arrangements |
| Complaints | Responsible company and available process |
Treat this as a transaction map. It is not a list of permissions confirmed for a named company.
Does the absence of a VASP category settle legality?
No. A directory category cannot answer every legal question about a product.
An operator should obtain a current analysis of the proposed activity, including financial-services, payment and foreign-exchange rules. The analysis should identify the serving entity and customer market.
This review did not independently confirm a complete current VASP application route or a later comprehensive crypto statute. That evidence gap is not an assertion that no law can apply.
Which questions should a business resolve first?
Write down who receives fiat and when crypto is delivered. Explain how the service handles failed payments and refunds.
Identify whether customers retain an account balance. Specify who controls the assets while the balance is held and what happens if the provider becomes insolvent.
Ask the relevant authorities for the current instruments governing the model. Preserve the response and the version of each document relied upon.
What about capital and customer protection?
A universal current VASP minimum capital amount was not independently established. A banking or payment requirement should not be copied into a crypto comparison without checking its scope.
Capital, liquidity and customer-asset protection also answer different questions. A provider should explain which funds belong to it and which are held for customers.
Users should read withdrawal limits, fees and the complaint process before depositing. Keep a copy of the legal name and terms shown at account opening.
For comparison, read Angola cryptocurrency regulation, Republic of the Congo crypto authorisation rules and Gabon’s cryptocurrency regulatory framework.
Research scope and limits
Research reviewed 6 November 2026. Sources include the 2024 GIABA evaluation, the central bank’s authorised-institution list and its 2025 Financial Stability Report. GIABA’s findings describe the June 2023 assessment period. No complete current VASP licensing route or universal VASP capital amount was independently established. This review does not certify a provider or replace activity-specific legal advice.
